Agenda Document Pack - Audit and Scrutiny Committee - 13/09/2023
Moray Council · 13 September 2023
Back to Audit and Scrutiny Committee — 13 September 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 13 September 2023 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 13 September 2023 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of the meeting held 27 June 2023 5 - 8 4. Written Questions ** 5. Internal Audit Section Update Report Report by Audit and Risk Manager 9 - 26 6. Internal Audit Section Completed Projects Report Report by Audit and Risk Manager 27 - 56 7. Question Time *** Consider any oral question on matters delegated to the Committee in terms of the Council's Scheme of Administration. Page 1
Page 2
Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. *** Question Time - At each ordinary meeting of the Committee ten minutes will be allowed for Members questions when any Member of the Committee can put a question to the Chair on any business within the remit of that Section of the Committee. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than ten minutes after the Committee has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he/she can submit it in writing to the proper officer who will arrange for a written answer to be provided within seven working days. Page 3
Page 4
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Graham Leadbitter (Chair) Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Theresa Coull (Member) Councillor John Cowe (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Lindsey Robinson Clerk Telephone: 07966 120593 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Tuesday, 27 June 2023 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Theresa Coull, Councillor John Cowe, Councillor John Divers, Councillor Amber Dunbar, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Graham Leadbitter, Councillor Marc Macrae, Councillor Neil McLennan, Councillor Shona Morrison, Councillor John Stuart, Ms Margaret Wilson IN ATTENDANCE The Chief Executive, Head of Governance, Strategy and Performance, Head of Environmental and Commercial Services, Audit and Risk Manager, Atholl Scott, Business Continuity and Risk Management Officer, Lindsey Robinson, Committee Services Officer as clerk to the meeting, all Moray Council and Andrew Wallace, Grant Thornton - External Auditor. 1. Chair Councillor Graham Leadbitter, as Chair of the Audit and Scrutiny Committee, chaired the meeting. 2. Welcome The Committee joined the Chair in welcoming Ivan Augustus to his first meeting since joining the Committee as an external member. 3. Declaration of Group Decisions and Members Interests * In terms of Standing Order 21 and 23 and the Councillors’ Code of Conduct, the Committee noted the following declarations: Councillors Morrison, Divers, Gatt, Keith and Bloomfield all declared that they were either members or substitute members of the Moray Integration Joint Board. Councillor Gatt declared that he was the Convenor of the Grampian Valuation Joint Board. There were no further declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member’s interests in respect of any item on the agenda. 4. Minute of the meeting held 10 May 2023 The minute of the meeting of the Audit and Scrutiny Committee dated 10 May 2023 was submitted and approved. Item 3. Page 5
Page 6
Councillor McLennan raised a point of accuracy with regards to the wording of item 6 “Internal Audit Section Completed Projects” He was of the opinion that the comments made by the Chair for members to be mindful of their language should have been added. The clerk agreed to look back at the webcast and add in the information. 5. Written Questions ** The Committee noted that no written questions had been submitted. 6. Annual Governance Statement The meeting had before it a report by the Chief Executive providing the Committee with a copy of the Council's Annual Governance Statement for 2022/23 for information and review. During consideration Councillor Gordon sought clarification on item 5 on page 16 of the appendix to the statement asking whether it would be relevant to add in the interaction between CMT and the administration in terms of capability of leadership and the individuals. In response the Business Continuity and Risk Management Officer agreed to add it in to the report. Thereafter, the Committee agreed unanimously to note the content of the Annual Governance Statement provided at Appendix 1. 7. Internal Audit Annual Report- 2022-23 The meeting had before it a report by the Audit and Risk Manager providing the Committee with a copy of the Internal Audit Annual Report for the year ended 31 March 2023, together with the Audit and Risk Manager's opinion on the adequacy and effectiveness of the Council's system of internal control. Following consideration the Committee agreed unanimously to note the contents of the annual report provided at Appendix 1. 8. Internal Audit Section Completed Projects Report The meeting had before it a report by the Audit and Risk Manager advising the Committee on the work of the Internal Audit Section for the period form 11 May 2023 to 27 June 2023. During consideration of the report, Ms Wilson sought clarification on Appendix 1 "Emergency Planning", and whether, in section 5.03, Chief Executive or CMT could be added in to the sentence "However this process requires commitment from the heads of services.." In response the Chief Executive agreed that this could be added. Councillor Gordon enquired as the whether the Members could get sight of the current emergency planning flood action plan. The Head of Environmental and Commercial Services agreed to circulate this. Page 6
Page 7
Councillor Macrae sought clarification on the weekly Moray Emergency response Co-ordinator (MERC) rota which had previously been available to Members and whether this could be reinstated. In response the Head of Environmental and Commercial Services advised that it was not a decision that could be made immediately as there were options to consider and agreed to come back to the Committee with a report into options for this or something similar. The Chief Executive offered to provide a briefing to all Members of the Council on Emergency Planning and the role of elected members. The Chair agreed that a briefing would be useful. Councillor Stuart sought clarification on the timescales mentioned in Appendix 2 "Self Directed Support", and he was of the opinion that there was a “back to basics” approach. In response the Audit and Risk Manager advised that the approach would be a question for the service and the timescales were provided by the service. The Chair agreed to raise this with the MIJB Chief Officer and for IJB members to take it back to the next meeting. Thereafter, the Committee agreed unanimously to note the contents of the report and to a briefing on Emergency Planning. 9. Question Time *** Role of the Audit and Scrutiny Committee Ms Wilson sought clarification on the possible extension of the role of the Committee and what areas would it cover. In response the Chair advised that there had been discussions and that there were various areas under consideration after the committee description was agreed earlier in the year. The Chair further advised that he plans to have regular meetings with the Chairs of the service committees regarding the role of scrutiny and he is looking for these to start after recess. The Audit and Risk Manager advised that he would be holding a briefing for members on the CIPFA Publication – Audit Committees: Practical Guidance for Local Authorities 2022 Edition, which will also require an annual evaluation and assessment by the committee. He has also been working with the Organisational Development team to design a questionnaire for members to look at additional training requirements. The Head of Governance, Strategy and Performance advised that there had recently been a briefing session on scrutiny but that there may be room for further training, but he was unsure as to whether the external members could attend. Councillor Divers sought clarification on the attendance of Heads of Service at the Committee, and mentioned that in the past it was the committee Chairs who were Page 7
Page 8
present but most were members of this committee so he was of the opinion that the Heads of Service should attend to answer any questions Members of this committee may have. The Chair advised that he would raise it off the table with the MIJB Chief Officer. The Chief Executive confirmed that it should be the committee Chairs who were present and the requirement for the Heads of Service to attend would need further discussion. The Chair further advised that the Chair of the MIJB rotates so it not always Moray Council so attendance could be a problem. Page 8
Page 9
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 13 SEPTEMBER 2023 SUBJECT: INTERNAL AUDIT SECTION UPDATE REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III I (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE 2023/24 AUDIT PLAN Audit Plan Update 4.1 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Enclosed as Appendix 1 is an update on the progress undertaken by the Internal Audit Service regarding the completion of audit review projects against the Annual Item 5. Page 9
Page 10
Audit Plan. CIPFA Publication – Audit Committees: Practical Guidance for Local Authorities and Police (2022 edition) 4.2 The CIPFA Publication – Practical Guidance for Local Authorities and Police 2022 Edition sets out its guidance on the function and operation of audit committees in local authorities and police bodies and represents CIPFA’s view of best practice for audit committees in local authorities throughout the UK. 4.3 Audit Committees are a key component of an authority’s governance framework and provide an independent and high-level resource to support governance and strong public financial management. The guidance states the purpose of an audit committee is, “to provide an independent and high-level focus on the adequacy of governance, risk and control arrangements. The committee’s role in ensuring that there is sufficient assurance over governance risk and control gives greater confidence to all those charged with governance that those arrangements are effective.” 4.4 CIPFA promotes that a good standard of performance against recommended practice together with a knowledgeable and experienced membership are essential requirements for delivering effectiveness. To this effect, CIPFA has provided a high-level review checklist that incorporates the key principles set out in CIPFA’s Position Statement: Audit Committees in Local Authorities and Police (2022 edition). In addition, the Public Sector Internal Audit Standards also call for the committee to assess their remit and effectiveness in relation to purpose, authority and responsibility. The Audit and Risk Manager is planning to facilitate a workshop with elected members to complete a Self-Assessment of Compliance with the Good Practice Principles Checklist and an Evaluation of Effectiveness from the CIPFA Audit Committees Guidance. A copy of the full CIPFA Publication – Practical Guidance for Local Authorities and Police 2022 will be shared with members of the Committee in advance of the meeting. The outcome of the self-assessment and evaluation exercises, together with an action plan detailing any identified improvements, will thereafter be reported to a future Audit and Scrutiny Committee. Follow Up Reviews 4.5 Internal Audit reports are regularly presented to elected members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: Business Continuity 4.6 An audit review was undertaken of the Council's management arrangements for Business Continuity. Business Continuity Management concerns how the Council identifies and prepares for potential incidents and how the risk is managed to ensure it can continue delivering essential services in an emergency or during a disruption of normal day-to-day activities. The follow up review found that several recommendations had not been fully implemented. However, with the appointment last year of a part time Business Continuity and Risk Page 10
Page 11
Management Officer, this has facilitated progress to further develop business continuity arrangements within services. Revised implementation dates for the recommendations have been agreed. The follow up report to review the implementation of the agreed recommendations is given in Appendix 2. Primary School Estate Security 4.7 This audit reviewed the controls to restrict unauthorised access to primary school buildings and grounds. It was found that the age, type of school buildings and locations of play areas do vary considerably across the Authority. This does present challenges in ensuring the implementation of consistent security arrangements. The audit reviewed policies, procedures and an appraisal of the security controls operating within a sample of primary schools. The audit found examples of good practices and improvements that have been made to the physical security of the primary school estates. However, the follow up review found that not all recommendations have been implemented. The follow up report to review the implementation of the agreed recommendations is given in Appendix 3. Council Tax 4.8 An audit was undertaken of the Council Tax System. The Council Tax Service administers and collects council tax for residential properties in Moray. The Service also administers and collects domestic water and sewerage charges on behalf of Scottish Water. The Council maintains a database of residential properties and updates it for changes of owners and residents, and also processes applications for exemptions and discounts. The audit noted some improvements required in administrative arrangements. The follow up report to review the implementation of the agreed recommendations is given in Appendix 4. 5 SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report.. . Page 11
Page 12
(f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: SPMAN-1042990102-175 Page 12
Page 13
Appendix 1 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2023/24 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Housing Benefits - Rent Rebates and Rent Allowances Substantive testing of selected benefit claims to confirm the accuracy of the Council’s benefit subsidy claim External Audit now undertaking review as part of core audit fee Payroll Continuous auditing to confirm the adequacy of the systems and procedures for the payment of salaries Audit programmed to start in the next quarter(s) Procurement and Creditor Payments Continuous auditing of samples of non- pay expenditure to test compliance with procurement and payment processing regulations Audit programmed to start in the next quarter(s) Debtors A review of the system for income collection through invoicing and debt recovery arrangements Fieldwork completed Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances Work Completed OTHER SYSTEMS Area Type of coverage Transformation Programme Review of the Transformation Programme to assess progress and planned outcomes are on course to be achieved Final report issued Item 5. Page 13
Page 14
Appendix 1 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Housing and Property- Reactive Maintenance Works Audit of works undertaken within Building Services for the completion of reactive maintenance works (Council Housing) Audit programmed to start in the next quarter(s) Environmental Services – Grant Claims Certification of grant claims as required: strategic timber; bus operators, regeneration schemes as appropriate Awaiting request from Services Pool Cars Review of operating arrangements for the administration and use of Pool Cars Fieldwork in progress E-Mail Security A review of procedures and system controls used to administer the email system. Audit programmed to start in the next quarter(s) Moray Growth Deal A follow up review to evidence implementation of the recommendations agreed within a recent audit undertaken of the governance and administrative arrangements within the management of the Moray Growth Deal Draft Report Completed Education – Secondary School Establishment visits as part of cyclical review Audit programmed to start in the next quarter(s) Purchasing Cards Review the systems and procedures for the management, use and control of Purchasing Cards Audit programmed to start in the next quarter(s) ICT Disaster Recovery Review to evaluate the effectiveness of the processes and controls surrounding Information Technology Disaster Recovery Management Audit programmed to start in the next quarter(s) Page 14
Page 15
Appendix 1 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Food Standards Scotland Guidelines A review of systems and practices used to evidence compliance with the new Food Standards Scotland Guidelines Fieldwork in progress Leisure Services – Sports and Community Centre A review of the arrangements for the accounting of income and expenditure at Keith Sports and Community Centre. The audit will also check procedures comply with the Payment Card Industry Data Security Standard Audit programmed to start in the next quarter(s) Burial Services Review of the arrangements for the management of the burial service including a check of the income collection procedures for the collection of interment fees and sale of lairs Final report issued Refugee Integration Scheme Review of systems and procedures to account for grants received and costs relating to Refugee Integration Final report issued Education- Early Learning and Childcare Premises Security Review the controls in place to mitigate the risk of unauthorised access or egress to Early Learning and Childcare Establishments Audit programmed to start in the next quarter(s) Moray Integration Joint Board Commissioning Services Review of the arrangements for the commissioning of services for children to ensure these are designed and delivered to meet the specified needs and demonstrate best value Fieldwork in progress Page 15
Page 16
Appendix 1 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Disabled Parking System Review of the system for administering the disabled parking permits are also known as Blue Badges Final report issued Occupational Therapy Services – Stores A review of the Occupational Therapy Stores Systems to ensure appropriate accounting systems are followed Fieldwork in progress Page 16
Page 17
Appendix 2 Moray Council Internal Audit Section DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Business Continuity REPORT REF: 22'008 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: The Council's Business Continuity Policy has been formally approved, is reviewed at regular intervals and is supported by procedures and guidelines for consistent application across the organisation. 5.01 The Council's Business Continuity Policy should be reviewed and updated as required. Policies and procedures once implemented should be reviewed at regular, stated, Medium Yes 28/02/2022 Part implemented. The policy has been acknowledged as requiring updating. This needs to be done having regard to statutory obligations, critical functions of the Council, the response to the pandemic, and identified links with risk management and emergency planning. These matters are under consideration with CMT/SMT and the timescale for finalising the policy has been Item 5. Page 17
Page 18
Appendix 2 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation intervals. extended to 31st October 2023. This will ensure the final approved version reflects up-to-date strategic priorities and makes best use of resources available to support this area of work. Key Control: Business Continuity Plans are in place for all critical service areas and these plans are fully tested and regularly reviewed. 5.02 Current and finalised Business Continuity Plans, should be held covering all critical services identified by the organisation. Medium Yes 31/10/2022 Part implemented. Critical functions of the Council were affirmed during the pandemic. These have been reviewed in the context of impacts from potential power outages that threatened disruption over the winter period. This identified the specific plans that need to be updated as a priority and work on these is ongoing. Plans for other critical service areas will be updated dependent on assessed risk as work continues to align business continuity requirements with risk management practice. A programme of work will be developed for the 23/24 year with a revised implementation date for business plans covering all critical activities to be in place by 31st March 2024. Page 18
Page 19
Appendix 2 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.03 All Business Continuity Plans should be reviewed and tested on at least an annual basis, with outcomes analysed and documented, to ensure plans are capable of supporting an effective recovery position. Medium Yes 28/02/2023 Not implemented. The focus currently is on bringing the business continuity plans up-to-date; part of this process will involve discussions with relevant managers to ensure proposals are achievable in practice. Updating of plans will continue with a revised completion date of 31st March 2024 and formal testing of plans thereafter will be on an 'as and when' required basis. Key Control: Business Continuity is embedded into the culture of the organisation with all relevant officers appropriately trained and sound central governance arrangements in place. 5.04 A training programme should be developed to assist officers in the preparation and implementation of the business continuity management process. Medium Yes 30/06/2022 Implemented. Service Managers are being supported in the development of service risk registers and business continuity plans through briefing sessions held by the Business Continuity & Risk Management Officer appointed in June 2022. 5.05 The roles and responsibilities of the Business Continuity Officer as detailed within the Business Medium Yes 28/02/2022 Implemented. A Business Continuity and Risk Management Officer was appointed on a part-time basis in June 2022. The Officer is currently progressing the business continuity agenda and Page 19
Page 20
Appendix 2 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Continuity Policy should be undertaken. implementing the recommendations within this audit report. Page 20
Page 21
Appendix 3 Moray Council Internal Audit Section DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Primary School Estate Security REPORT REF: 22'017 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: The controls around school access are sufficient to prevent unauthorised entry to primary schools. 5.01 Guidance should be prepared and issued to all schools detailing good security practices. Medium Yes 31/08/2022 Not implemented. Revised guidance has been drafted, but consultation with head teachers and unions is still required before finalisation. Revised implementation date of 30/09/2023. Item 5. Page 21
Page 22
Appendix 3 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Due to the different nature of individual schools with regard to buildings, play areas, etc.; consideration should be given for each school to develop its own documented security procedures. 31/08/2022 Not implemented. Individual action plans for each school are being drafted based on risk assessments carried out. These alongside centrally agreed security guidance will form the security guidance documentation for each school. Revised implementation date of 30/09/2023. 5.02 Remedial action should be undertaken to resolve the security concerns found during the audit regarding a door entry security system. Medium Yes Implemented Implemented. Work completed prior to the issuing of the original audit report. 5.03 A review of the CCTV arrangements including coverage requirements for all primary school estates should be undertaken. High Yes 31/08/2022 Implemented - A review of CCTV requirements for each primary school has been completed and a rolling program of installing or upgrading is underway. Page 22
Page 23
Appendix 3 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.04 A standardised recording system should be introduced within all primary schools to ensure a consistent approach is followed in the recording of incidents or concerns. In addition, notices/ posters should be displayed within Schools to remind staff and pupils to follow good security practices. Low Yes 31/08/2022 Not implemented. The revised school security guidance details the requirement to record security concerns. As noted in recommendation 5.01, this guidance requires further consultation with head teachers and unions before finalisation. Revised implementation date of 30/09/2023. 5.05 Regular training to promote good security practices should be provided to all staff within schools. Medium Yes Ongoing from 31/08/2022 Not implemented. Once the revised school security guidance has been agreed, training will be provided to schools. Revised implementation date agreed- ongoing from 30/09/2023. Page 23
Page 24
Appendix 3 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.06 Each primary school should undertake a documented assessment of the buildings and grounds including play areas to assess current security risks and the controls implemented or required to mitigate these risks. Low Yes 31 August 2022 for risk assessment guidance. 31 December 2022 for risk assessments to be completed. Implemented. Senior Health and Safety Advisor has carried out a health and safety assessment in relation to security at each primary school. A risk assessment report has been prepared for each school, together with an action plan pertaining to each site. Page 24
Page 25
Appendix 4 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Council Tax REPORT REF: 22'009 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Billing is carried out in accordance with regulations and on an accurate and prompt basis. 5.01 Procedures to be followed in administering the Council Tax system should be formally documented to provide a comprehensive point of reference for staff. Medium Yes Ongoing Part- Implemented. The follow-up review found that a number of written procedures have now been developed within the Council Tax Service. However, the documentation of all systems and practices will be an ongoing requirement, but progress is constrained by limited staff resources. Item 5. Page 25
Page 26
Appendix 4 Moray Council Internal Audit Section Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Collection of Council Tax is carried out in accordance with statutory and Authority regulations, is fully evidenced in terms of documentation of all payment sources and transactions and refunds are appropriately controlled. 5.02 A regular Review of credit balances should be undertaken to identify any processing errors or irregular account activity. The review will ensure monies collected are applied correctly and promptly returned to tax payers where appropriate. Low Yes 31/01/2023 Implemented. A process of regularly reviewing credit balances, with a view to reducing returning these balances to taxpayers, has been implemented. A procedure document has been developed to provide staff with guidance. Page 26
Page 27
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 13 SEPTEMBER 2023 SUBJECT: INTERNAL AUDIT SECTION – COMPLETED PROJECTS REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 28 June 2023 to 13 September 2023. 1.2 This report is submitted to Committee in terms of Section III (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the following internal audit work concluded during the period 28 June 2023 to 13 September 2023: 4. COMPLETED AUDIT REVIEWS Burial Service 4.1 An audit review of the Burial service has been undertaken. The Council has responsibility for 63 burial grounds. The Service is administered in accordance with a locally developed Burial Grounds Standards of Service, which reflects the obligations and rights of the Burial and Cremation (Scotland) Act 2016. The scope of this audit was to review systems and procedures in the administration of the Burial Service. This included checking operational processes to ensure compliance with the Burial Grounds Standards of Service. In addition, a check was also made to verify the costs of delivering the Service and a review of Item 6. Page 27
Page 28
systems and procedures for the collection of income. The executive summary and recommendations for this project are given in Appendix 1. Disabled Parking Permit Scheme 4.2 An audit review of the Disabled Parking Permit Scheme has been completed. Disabled parking permits, also known as blue badges, help people with disabilities or health conditions park closer to their destination. Local authorities are responsible for the day-to-day administration and enforcement of the scheme. However, the framework for the scheme is set by Transport Scotland. The audit reviewed the systems and procedures in the administration of the Disabled Parking Permit Scheme. This has also included the processes for investigating blue badge misuse. The executive summary and recommendations for this project are given in Appendix 2. Transformation Programme 4.3 An audit has been undertaken to review the Council’s Improvement and Modernisation Programme. The Council established an Improvement and Modernisation Programme in 2018 to bring transformational change, deliver savings, and provide the basis for a medium to long term financial plan to support financial sustainability in the delivery of services to communities. The Improvement and Modernisation Programme currently consists of nine separate work streams. 4.4 Detailed within each of these workstreams are individual projects from across a range of services. The management and delivery of projects to deliver service improvements are undertaken through a framework detailed within the Project Management Governance Policy. The scope of the audit has reviewed the governance arrangements around the management, monitoring and reporting arrangements of the Improvement and Modernisation Programme. The audit has also checked that strategic projects included within the Improvement and Modernisation Programme are managed in accordance with the Project Management Governance Policy. The executive summary and recommendations for this project are given in Appendix 3. Refugee Integration Scheme 4.5 An audit has been undertaken to review the Refugee Integration Scheme. The scope of this audit examined the financial and administrative processes involved in delivering the Ukrainian Refugee Scheme. The emerging Asylum Dispersal, Afghan Citizens Resettlement Scheme and Afghan Relocation & Assistance Policy Scheme did not form part of the audit testing due to limited activity at the time of the review. The Council has supported approximately 140 Ukrainian displaced persons, with allocated funding from the Central Government in 2022/23 of over £1.9 million spread across the Warm Scottish Welcome Fund, Tariff per Displaced Person funding, Host Thank You Payment Funding and Educational Tariff Funding. All these funds have specific requirements and the audit has reviewed the accounting arrangements for administering these schemes and the claiming of expenditure. The executive summary and recommendations for this project are given in Appendix 4. Page 28
Page 29
5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-177 Page 29
Page 30
Page 30
Page 31
Appendix 1 AUDIT REPORT 24'007 BURIAL SERVICE Executive Summary The annual audit plan for 2023/24 provides for an audit review to be undertaken of the arrangements for the management of the Council's Burial Service, including a check of the income received from the collection of interment fees and sale of lairs. The Council has responsibility for 63 burial grounds. The service is administered in accordance with a locally developed Burial Grounds Standards of Service, which reflects the responsibilities and rights of the Burial and Cremation (Scotland) Act 2016. The scope of this audit was to review systems and procedures in the administration of the Burial Service. The included checking operational processes to ensure compliance with the Burial Grounds Standard of Service. In addition, a check was also made to verify the costs of delivering the Service and a review of systems and procedures for the collection of income. Expenditure relates mainly to burial grounds routine maintenance and the costs of carrying out interments. It was noted that £724,000 is budgeted to be raised per annum from interment fees, the sale of lairs and headstone preparations. This was a cross-service audit as the delivery of the Burials Service involves officers from Environmental and Commercial Services and the Registrars. It was noted that work is currently ongoing to automate current administrative systems and practices with the intention of developing improved communication processes. Audit testing was limited in certain areas to ensure no duplication of effort nor detailed analysis on processes already identified by the Service as in need of review. A more complete audit review of the Burials Service will therefore be included in a future Audit Plan. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The main areas identified for management attention are as follows:- • A Schedule of Rates is used internally to monitor costs and performance in the works undertaken for interments, headstone preparations and routine grounds maintenance. It was noted that elements of the Schedule of Rates has not been updated to account for all current cost components. A review of the Schedule of Rates should be undertaken to ensure recharges reflect current expenditure and the work undertaken. • A review of recording arrangements of lair purchases and interments for burial grounds noted for some locations manual registers are maintained whilst for others both manual and electronic recording systems are kept. It was found that the Head of Service is aware of this issue and a commitment was noted to review current arrangements with the aim of developing a singular recording system. Item 6. Page 31
Page 32
Appendix 1 The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. - 2 2 . Page 32
Page 33
Appendix 1 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Key costs of service provision are appropriately controlled and accounted for. 5.01 The Schedule of Rates should be reviewed to ensure full and current costs of service provision are reflected and recharged to the Burials service. Medium Yes The service is aware that all schedule of rates within the Confirm asset management system need to updated and work is underway via Finance to move all burials related costs to the burials service. Service Manager (Waste, Open Spaces, Catering & Facilities) 31/03/2024 5.02 Consideration should be given to the development of recharge rates for interments within the Schedule of Rates which reflect the varying costs of service provision incurred by weekday and Low Yes As above the service is aware that recharge rates require to be reviewed. Arrangements Open Space Manager 31/12/2023 Page 33
Page 34
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation weekend interments. will be made to review and update rates for burials on Saturdays, Sundays and Public Holidays in Confirm via the Admin Team. 5.03 Checks should be undertaken to ensure all jobs carried out in the month are identified for recharge in the Confirm system and the Confirm content is reflected accurately in the recharge processed in the Financial Management System. Low Yes Burials team to be reminded that job tickets are returned timeously to the Admin team to allow processing within the Financial Management System in the relevant month. This will be Administration Officer 30/09/2023 Page 34
Page 35
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation communicated via Teams meetings. Key Control: Processes are in place to control all income due to the service with fees formally approved and regularly reviewed and income amounts fully and appropriately accounted for. 5.04 A review of current arrangements for the recording of lair purchases and interments should be undertaken with the aim of developing a singular recording system. Medium Yes Cross service review required. Head of Service aware and has initiated process mapping exercise to guide future decision making on processes and singular software / recording system. Service Manager (Waste, Open Spaces, Catering & Facilities) 31/03/2025 Page 35
Page 36
Page 36
Page 37
Appendix 2 AUDIT REPORT 24'010 DISABLED PARKING PERMIT SCHEME Executive Summary The annual audit plan for 2023/24 provides for an audit review of the arrangements for managing the Disabled Parking Permit Scheme. Disabled parking permits, also known as blue badges, allow eligible people to park close to amenities they would otherwise have difficulty accessing. Local authorities are responsible for the day-to- day administration and enforcement of the scheme. However, the framework for the scheme is set by Transport Scotland, in addition to providing support to assist in consistent operating practices across all local authorities. A blue badge is subject to a charge of £20 and can be valid for up to three years. The scope of this audit was to review systems and procedures in the administration of the Disabled Parking Permit Scheme. This included the processes for assessment, management and investigation of blue badge misuse. The expenditure for providing the service relates mainly to staffing and the cost of producing badges from approved suppliers. The Council issues approximately 1700 blue badges annually with an income of £29,000 collected in 2022/23. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The key areas identified for management attention include the following:- • The Moray Council Financial Regulations detail that invoices must be raised within one month of providing goods or services. Once a blue badge is issued, an invoice of £20 should be issued to the applicant. Audit testing found that the Service did not raise invoices until several months after issuing the blue badge. It was noted that over recent years there have been significant increases in the number of applications received for blue badges, but staffing levels have remained unchanged. However, to ensure effective income collection arrangements and compliance with the Council’s Financial Regulations, invoices should be raised promptly once the blue badge has been issued. • Analysis of the Financial Management System noted a shortfall of approximately £24,000 in the income received compared to the blue badges issued. Further investigation noted that there were approximately 1200 blue badges provided to applicants in 2020 and 2021, where no invoices had been issued. Explanation sought as to why no invoices had been raised revealed this was due to workload issues and the extraordinary challenges faced by the Service during the pandemic. Invoices should be raised for these blue badges issued in 2020 and 2021 as a matter of urgency. Item 6. Page 37
Page 38
Appendix 2 • Audit testing noted that the Service is following Transport Scotland Guidelines in assessing eligibility and managing the Disabled Parking Permits Scheme. However, it was found that the Blue Badge Scheme Policy was last updated in 2013. Policies and procedures should be updated to reflect current operating practices and legislation. The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 2 2 1 . Page 38
Page 39
Appendix 2 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective management controls operate to ensure the delivery of the Disabled Parking Permit System is in accordance with Transport Scotland Guidelines. 5.01 The Blue Badge Scheme Policy should be reviewed and updated. This should include reference to responsibility for investigating misuse and arrangements if required to cancel a service users blue badge. Medium Yes The Blue Badge Scheme Policy will be updated to ensure all aspects of the service and its processes are incorporated, including badge misuse arrangements. Interim Community Care Finance Officer/Supp ort Manager 31/03/2024 5.02 All service users identified that have received a blue badge in 2020 a 2021 but not billed should be invoiced as a matter of priority. High Yes Work is underway to review un- invoiced applications from 2020 and 2021 to establish the current position. On completion of this review, invoices will be raised for all Commissioni ng Manager 31/01/2024 Page 39
Page 40
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation outstanding approved blue badges issued from this period. 5.03 In accordance with Financial Regulations, service users should be invoiced within one month of receiving a blue badge. An action plan should also be agreed to resolve any backlog of blue badges issued to applicants who have yet to be invoiced. The audit review noted that the fee for a blue badge is payable on application in some Local Authorities. Consideration should be given to investigating the option for an individual to pay the charge for a blue badge Medium Low Yes Yes An action plan is now in place to clear the current year invoice backlog, staff time has been ring fenced to facilitate this. All new applications are being invoiced within one month. Discussions are currently underway between the Community Care Finance team, the Payments team and Senior Management to develop the option Interim Community Care Finance Officer/Supp ort Manager Interim Community Care Finance Officer/Supp ort Manager 31/08/2023 31/12/2023 Page 40
Page 41
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation on completion of the application form. of up-front payment for blue badges. 5.04 All sensitive personal data held within the Community Care Finance Office should be stored securely with access restricted to only authorised officers. High Yes There will be a purchase of lockable filing cabinets to replace those which are non-lockable and all staff will attend data protection training and be reminded of the clear desk policy with immediate effect. The lock on the door will be used without delay and without exception. Interim Community Care Finance Officer/Supp ort Manager 31/08/2023 Page 41
Page 42
Page 42
Page 43
Appendix 3 AUDIT REPORT 24’009 TRANSFORMATION PROGRAMME (Improvement and Modernisation Programme) Executive Summary The annual audit plan for 2023/24 provides for a review of the transformation projects included within the Improvement and Modernisation Programme, which is designed to contribute to a financially stable Council for the future. The Council established an Improvement and Modernisation Programme in 2018 with the purpose of bringing transformational change across the Council, delivering savings and providing the basis for a medium to long term financial plan to support the financial sustainability in the delivery of services to communities. The Improvement and Modernisation Programme currently consists of nine separate work streams. Detailed within each of these work streams are 15 strategic projects from across a range of services. The management and delivery of these projects is undertaken through a framework detailed within the Project Management Governance Policy. The Council has identified a need to make savings of approximately £20 million across 2023/24 and 2024/25 to deliver a balanced budget and ensure the sustainability of Council services. The Improvement and Modernisation Programme is an integral part of the delivery of this objective. Significant progress has been made by senior management to advance the transformation of services and build on the approved Improvement and Modernisation Programme. The scope of the audit has reviewed the governance arrangements around the management, monitoring and reporting arrangements of the Improvement and Modernisation Programme. The audit has also checked that strategic projects included within the Improvement and Modernisation Programme are managed in accordance with the Project Management Governance Policy. The review found variances in the administration of projects when compared to the procedures detailed within the Project Management Governance Policy. This does not indicate that the key deliverables of the projects are not being achieved. However, consistent administration of projects in accordance with the Project Management Governance Policy would provide greater confidence to senior management in their objective to ensure that projects included within the Improvement and Modernisation Programme secure savings the Council requires to achieve. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The audit has noted the following areas for senior management to consider in regard to governance arrangements of the Improvement and Modernisation Programme: • The Council has an established Project Management Governance Policy that was agreed in 2016 with additional project management assurances concerning governance and leadership noted at the Corporate Committee on Item 6. Page 43
Page 44
Appendix 3 30 August 2022. This Policy provides a framework for accountability and responsibilities, ensuring that project decision making is robust, logical and that projects provide value to the Council. It offers a mechanism for ensuring that accurate and appropriate project status reports are presented regardless of the service running the project or the type of project. Detailed within the Policy is a governance framework for managing projects from approval of a mandate by a Project Initiation Board to agreeing on business plans and monitoring progress at a High Level Governance Board through to a Benefit Realisation Board to evidence a project has delivered the key deliverables and benefits. However, the audit review of individual projects noted variances in the practices undertaken in approving project mandates and outline/ full business cases compared to the requirements detailed within the Project Management Governance Policy. In addition, a need for more consistency was found in project monitoring and reporting progress to the Programme Boards. Reference was also noted within the Project Management Governance Policy to a Gateway Initiation Board as the first step in agreeing on a mandate for approval of a project. However, this Board's function is undertaken by the Corporate Management Team. It is understood that senior management has already recognised the need to update the current Policy and are developing a “Single Project Gateway Process” to ensure more effective project management arrangements. • As part of the audit, a review was undertaken of the administration of projects from approval of a mandate to progress monitoring and end of project reporting to the Benefit Realisation Board. Project management arrangements were noted to be based on the Prince2 project management methodology, aligned with the Scottish Government Construction Procurement Manual and the Office of Government Commerce Gateway Framework. It was pleasing to find that in accordance with good practice, a standardised “Highlight Report” is used to monitor progress, major risks/ issues/ change requests and targets for the next period. However, the “Highlight Report” template is not used to monitor the progress of all projects. It is considered that the format of the “Highlight Report” is fit for purpose, however consideration should also be given to including an additional requirement for monitoring the key deliverables from implementing the project. The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 1 2 - Page 44
Page 45
Appendix 3 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Review key controls operate to ensure effective project management of the Improvement and Modernisation Programme. 5.01 The Project Management Governance Policy should be reviewed and updated to reflect any proposed changes to project management arrangements. High Yes Review has been undertaken and will be considered by CMT/SMT before being reported to Committee Depute Chief Executive (Education, Communities & Organisational Development) 30/11/2023 5.02 The standardised “Highlight Report” format should be used to monitor progress for all Improvement and Modernisation Programme strategic projects. In addition, consideration should be given to further developing the “Highlight Report” to provide more effective analysis of key deliverables during project implementation. Medium Yes Report format to be reviewed and Senior Responsible Officers will be reminded to use the highlight report for projects following agreement of the business case and to ensure its Depute Chief Executive (Education, Communities & Organisational Development) 30/11/2023 Page 45
Page 46
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation content enables tracking the progress towards key deliverables. Reporting will also be put in place for more structured oversight of progress from project mandate approval to business case to ensure progress or re- prioritisation. 5.03 Consideration should be given to reviewing the format of future committee reporting arrangements to allow greater transparency in monitoring Medium The format for reporting financial performance to Committee will Chief Financial Officer 30/11/2023 Page 46
Page 47
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation financial savings derived from implementing Improvement and Modernisation Programme projects. be updated to ensure greater transparency. Page 47
Page 48
Page 48
Page 49
Appendix 4 AUDIT REPORT 24’008 REFUGEE INTEGRATION SCHEME Executive Summary The Annual Audit Plan for 2023/24 provides for a review to be undertaken of systems and procedures to account for grants received and costs relating to Refugee Integration. Asylum is a matter reserved to the UK Government, however local authorities are required to deliver access to essential services like housing, healthcare and education that enable the integration of refugees and asylum seekers in the community. This is undertaken through various humanitarian protection schemes. The scope of this audit was to review the financial and administrative processes involved in delivering the Ukrainian Refugee Scheme. The emerging Asylum Dispersal, Afghan Citizens Resettlement Scheme and Afghan Relocation & Assistance Policy Scheme did not form part of the audit testing due to limited activity at the time of the review. The Council has supported approximately 140 Ukrainian displaced persons, with allocated funding from the Central Government in 2022/23 of over £1.9 million spread across the Warm Scottish Welcome Fund, Tariff per Displaced Person funding, Host Thank You Payment Funding and Educational Tariff Funding. All these funds have specific requirements and the audit has reviewed the accounting arrangements for administering these schemes and the claiming of expenditure. The Asylum, Refugee and Resettlement Section within Health & Social Care Moray is operationally responsible for service delivery. However, a cross-service delivery function including Education, Housing and Environmental Health Services is required to ensure an effective integration of refugees and asylum seekers in the community. It is understood that alternative management arrangements for the Asylum, Refugee and Resettlement Section are currently being considered within the Council and Health and Social Care Moray. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The main areas identified for management attention are as follows:- • Further improvements are required in budgetary management arrangements. It is appreciated that the delivery of Refugee Schemes requires services to be provided by various sections of the Council and Health and Social Care Moray. However, the Asylum, Refugee and Resettlement Section do not regularly monitor the full costs of delivering these services compared to the available funding. Improved financial recording arrangements should be implemented to allow more accurate financial forecasting and aid the maximisation of the impact of available funding. Item 6. Page 49
Page 50
Appendix 4 • Audit testing was undertaken of the administration of the imprest account. It was found that while an audit trail of cash usage was maintained providing evidence of the distributions to Ukrainian Displaced Persons, the limit of cash authorised to be held by the service was exceeded on multiple occasions. In addition, significant expenditure items were noted to have been paid from the imprest account, which should have been met by alternative procurement methods in accordance with Financial Regulations and Petty Cash Procedures. Usage of the imprest should be monitored to ensure compliance with Council regulations and procedures. The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 2 2 4 Page 50
Page 51
Appendix 4 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Grant funding is effectively managed, monitored and applied for the intended purpose 5.01 A consolidation exercise should be undertaken to identify all expenditure and designate as costs being met from the available funding. A standard financial monitoring process should thereafter be put in place to ensure funding and its usage is reported and effectively monitored by the service on a monthly basis. High Yes Meeting with Finance on 17 August 2023 arranged to consolidate current spend position across departments. Thereafter forecasting can be agreed to aid a standard financial monitoring statement. Interim Strategy & Planning Lead 01/12/2023 5.02 Ongoing financial forecasting should be undertaken to allow more informed management decisions to be taken and ensure the full potential of the available funding is utilised. High Yes Through the business case being developed for the service, a financial forecast will Interim Strategy & Planning Lead 01/12/2023 Page 51
Page 52
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation identify funding potential. Monthly forecasting will be undertaken going forward. 5.03 Improved consolidation of documentation regarding funding awards and related submissions requires to be undertaken to ensure the service holds the full complement of final version documents for clarity and completeness. Low Yes A review of all funding award documentation will be undertaken, cross- referencing with the Scottish Government Policy Team. Interim Strategy & Planning Lead 01/11/2023 5.04 In establishing the new Asylum, Refugee and Resettlement Section, the temporary employment contracts currently in place for team members should be reviewed and aligned consistently to funding terms. Low Yes A full business case will be developed to address the team structure and long-term sustainability of the team. Interim Strategy & Planning Lead 31/03/2024 Page 52
Page 53
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.05 Petty cash reimbursement claims submitted must be based on actual expenditure incurred and always reconcile to the authorised petty cash imprest for the section. Medium Yes Reconciliation to the imprest amount to be actioned. Project Manager (Resettlement & Refugees) 30/09/2023 5.06 Expenditure incurred through the petty cash fund, other than the cash Welcome Payments, should comply with Council procedure of no single item exceeding £10. Alternative standard procurement routes should be used for any higher value purchases. Receipts for all expenditure incurred should be submitted with petty cash reimbursement claims to account for purchases and ensure input VAT is recovered where applicable. Medium Yes Purchase card now issued and procedures in place for gaining authorisation to spend. Training needs identified for all team members and to be recorded and annually reviewed. Interim Strategy & Planning Lead 01/12/2023 Page 53
Page 54
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.07 To improve the audit trail, the master record of hosts and guests should be amended to ensure the date of arrival which is relevant to the initial host payment calculation is clearly recorded. Additionally, all payment calculations which relate to less than a full month of hosting should be checked to confirm accuracy prior to payment processing. Low Yes This has been addressed within the master spreadsheet. Process is now in place for partial payment calculations to be double- checked prior to host payments being made. Interim Strategy & Planning Lead Implemented 5.08 Welcome Hub costs sought for reimbursement by central government should be calculated based on actual expenditure incurred and require to be appropriately Low Yes Meeting to be held with Finance to close off welcome hub payments Project Manager (Resettlement & Refugees) 31/10/2023 Page 54
Page 55
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation evidenced. appropriately as Welcome Hub no longer exists. Page 55
Page 56
Page 56