Agenda Document Pack - Audit and Scrutiny Committee - 22/11/2023
Moray Council · 22 November 2023
Back to Audit and Scrutiny Committee — 22 November 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 22 November 2023 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 22 November 2023 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of the meeting held 13 September 2023 5 - 8 4. Written Questions ** 5. Internal Audit Section Update Report Report by Audit and Risk Manager 9 - 37 6. Internal Audit Section - Completed Projects Report by Audit and Risk Manager 38 - 48 7. Scottish Public Services Ombudsman Recommendations Report Report by Chief Executive 49 - 60 8. Question Time *** Consider any oral question on matters delegated to the Committee in terms of the Council's Scheme of Administration. Page 1
Page 2
Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. *** Question Time - At each ordinary meeting of the Committee ten minutes will be allowed for Members questions when any Member of the Committee can put a question to the Chair on any business within the remit of that Section of the Committee. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than ten minutes after the Committee has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he/she can submit it in writing to the proper officer who will arrange for a written answer to be provided within seven working days. Page 3
Page 4
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Graham Leadbitter (Chair) Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Theresa Coull (Member) Councillor John Cowe (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 13 September 2023 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Theresa Coull, Councillor John Divers, Councillor Amber Dunbar, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor Sandy Keith, Councillor Graham Leadbitter, Councillor Marc Macrae, Councillor Neil McLennan, Councillor Shona Morrison, Councillor John Stuart, Ms Margaret Wilson APOLOGIES Councillor John Cowe, Councillor David Gordon IN ATTENDANCE The Depute Chief Executive (Education, Communities and Organisational Development), Head of Governance, Strategy and Performance, Audit and Risk Manager, Interim Strategy and Planning Lead, Lindsey Robinson, Committee Services Officer and Angela Pieri, Grant Thornton - Extenal Auditor. 1. Chair Councillor Graham Leadbitter, as Chair of the Audit and Scrutiny Committee, chaired the meeting. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Order 21 and 23 and the Councillors’ Code of Conduct, the Committee noted the following declarations: Councillors Morrison, Divers, Gatt, Keith and Bloomfield all declared that they were either members or substitute members of the Moray Integration Joint Board (MIJB). Mr Augustus declared that he was a member of the MIJB and Skills Development Scotland. Councillor Stuart declared an interest in the Refugee Integration Scheme as he was a host family. There were no further declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member’s interests in respect of any item on the agenda. 3. Minute of the meeting held 27 June 2023 The minute of the meeting of the Audit and Scrutiny Committee dated 27 June 2023 was submitted and approved. Item 3. Page 5
Page 6
4. Written Questions ** The Committee noted that no written questions had been submitted. 5. Internal Audit Section Update Report The meeting had before it a report by the Audit and Risk Manager providing Committee with an update on the work of the Internal Audit Section. During consideration Councillor Gatt sought clarification as to why critical functions were classified as a medium risk on pages 17 and 18. In response the Audit and Risk Manager advised that work was ongoing in this area but this would be amended. Thereafter the Committee agreed to note the contents of the report. 6. Internal Audit Section Completed Projects Report The meeting had before it a report by the Audit and Risk Manager advising Committee on the work of the Internal Audit Section for the period from 28 June 2023 to 13 September 2023. During consideration Councillor Bloomfield sought clarification as to why there is no online application or online payment system for the disabled parking scheme. In response the Audit and Risk Manager advised that this has been highlighted with the service as it needs to be looked at. Adjournment The Chair agreed to an adjournment to correct a technical issue. Resumption of Meeting Following a short adjournment, Councillor Gatt sought clarification on whether money owed could be recovered after this amount of time. In response the Audit and Risk Manager advised yes the money could still be recovered and that a review if invoicing across the board is coming to a future meeting as income recovery is a concern. Councillor Gatt raised concern that the Blue Badge Scheme policy was last updated in 2013. In response the Audit and Risk Manager advised that the policies and procedures would be looked at as some do need to be updated as soon as possible. They will be further updated by any changes going forward. Councillor Leadbitter sought clarification as to whether this report was going to the IJB Audit Performance and Risk Committee. The Audit and Risk Manager confirmed that it would be. Page 6
Page 7
Councillor Divers sought clarification on how the information gets out to the public as the paper went to IJB 2 weeks ago and just provided a website and a phone number. Mr Augustus added that this would be a good opportunity to streamline the process. In response the Head of Governance, Strategy and Performance advised that he would take the points back to the department concerned and that the information hubs would help the public to complete the forms if necessary. Councillor Divers raised concern about upfront, online payments and how people would do that if they had no access to IT. The Audit and Risk Manager advised that this would need to be referred back to the service. Councillor Leadbitter sought clarification on the Refugee Integration Scheme as it was an unplanned body of work, completed at pace by a small team and whether there was an audit plan in place for this. In response the Audit and Risk Manager advised that additional work items could be added but they may have a knock on to items already planned. Thereafter the Committee agreed to note the contents of the report. 7. Question Time *** Committee Attendance Under reference to item 9 of the minute of the meeting of this committee held 27 June 2023, Councillor Diver sought an update on committee Chairs or Heads of Service attending this committee to answer questions raised. The Chair advised that he was due to have discussions with the committee chairs and he would bring this up. Councillor Divers added that the numbers were difficult due to the administration only having 9 members, meaning that committee chairs were also members of this committee. The Head of Governance, Strategy and Performance advised that it was always good to keep the remit of the committee under review. The last decision of the full Council was that there were 15 members with a political balance. He added that further discussion was needed offline around this. The Depute Chief Executive (Education, Communities and Organisational Development) acknowledged the cross part questions raised around the operation and role of the Committee and added that she would refer this to the Chief Executive to speak to members. Councillor McLennan added that he was of the opinion that all of the committees were large and that the governance should be looked at for best value. He was also of the opinion that it should be the committee chairs who attend not the head of service as they have other commitments. Page 7
Page 8
Timescales Councillor Stuart sought clarification on whether the timescales provided by the services could be questioned. In response the Chair advised that the timescales were decided by the services. The role of the Committee is to seek assurance on any risks. He added that some department timescales were longer than the audit recommendations and it is up to them to justify that. Training Councillor McLennan asked that any training, including CIPFA, be provided online and recorded to allow members to access it as and when they need to. In response the Audit and Risk manager advised that Organisational Development are looking at the training and the CIPFA guidance will be reported back to a future committee. The Depute Chief Executive (Education, Communities and Organisational Development) advised that the method of training would depend on the subject. Early Years Childcare Portacabins Councillor Macrae sought clarification on when the audit report on the Aberlour nursery portacabins would be available. In response the Audit and Risk Manager advised that he would be going back to the service in October and then report back to members at either the November or February meeting. Freedom of Information Councillor McLennan stated that the Council policy on the Public Interest Disclosure Act 1985 was due to be reviewed in 2017. He sought clarification as to whether a report would come to this committee or another. In response the Head of Governance, Strategy and Performance advised that the Information Governance report covering Freedom of Information and Data Protection will go before the corporate committee and then come before this committee if subject to audit Page 8
Page 9
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 22 NOVEMBER 2023 SUBJECT: INTERNAL AUDIT SECTION UPDATE REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III I (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE 2023/24 AUDIT PLAN Audit Plan Update 4.1 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Enclosed in Appendix 1 is an update on the progress undertaken by the Internal Audit Service regarding the completion of audit review projects against the Annual Audit Plan. Officers from the Section have also been assisting Health and Social Care Moray with the development of recommendations from a review undertaken by KPMG Governance, Risk & Compliance Services of adult social care commissioning. Item 5. Page 9
Page 10
4.2 The section is currently operating with a vacancy in the post of Corporate Investigations Officer, which investigated housing benefits fraud and supported the work of the audit team on the National Fraud Initiative and other routine audit work. Due to staffing issues, the section has been covering these tasks with reduced resources for some months. Due to budgetary constraints facing the Council, there is no longer funding to fill the vacant post . In accordance with the Public Sector Internal Audit Standards, the Audit and Risk Manager is required to consider whether or not staffing resources are sufficient to meet the audit needs of the Council and where it is believed that the level of resources may adversely impact the provision of the annual internal audit opinion, and draw this to the attention of the Committee. I am therefore informing the Committee again of my concerns about whether available resources will be sufficient to meet the auditing needs of the Council, Moray Integration Joint Board and the Grampian Valuation Joint Board. The current staffing issues will impact on the completion of the audit plan. 4.3 In addition to the requirement for completing projects detailed within the Annual Audit Plan, a review has also been undertaken of the Grampian Valuation Joint Board. Internal Audit is required to provide annual assurances on the main financial systems operated for payroll, payments and income from funding requisitions from the constituent authorities and other sources. The Joint Board’s systems align with those of the Council but require annual review and testing in order to provide assurances for the separate annual financial statements the Board is required to prepare and publish. It is pleasing to report that based on the audit work completed, reasonable assurance can be placed on the adequacy and effectiveness of the system of internal financial control established within the Assessor’s Service. Audit Plan 2024/25 4.4 Preparation has begun to agree on the Audit Plan for 2024/25. Internal Audit’s approach to annual audit planning is risk-based with all areas which may be subject to audit review contained within an ‘audit universe.’ The audit universe is reviewed and updated on an ongoing basis to include all significant activities and systems. 4.5 The consultation process will also provide the opportunity to remind officers of established timescales for responding to requests for information during an audit review and to the recommendations within the audit report. However, as the Audit and Risk Manager, I appreciate the significant workload demands on officers and will always try to accommodate any requests for changes in reporting arrangements. Follow Up Reviews 4.6 Internal Audit reports are regularly presented to elected members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: Page 10
Page 11
Payroll System 4.7 An audit has previously been undertaken of the payroll system. The payroll system is one of the core financial systems of the Council in administering approximately £80 million of annual expenditure. A payroll software application called iTrent is used to administer the Payroll Service. It was noted that approximately 5,000 officer payslips are processed every month. The iTrent system has a dual function of meeting the requirements of two main service areas, i.e., Payroll and Human Resources. The audit reviewed the key controls in the management of the Payroll Service. This involved an assessment of the operational effectiveness of these controls. Audit testing included the random selection of a sample of salary payments and deductions to ensure the correct calculation of remuneration and statutory/voluntary deductions are processed timeously and accurately. All recommendations have been implemented. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 2. Self Directed Support (SDS) 4.8 An audit has previously been undertaken into the financial monitoring arrangements within the SDS Team for direct payments made to service users. The audit has checked for effective procedures in monitoring funds issued to service users. This involved the random selection of a sample of care packages and a check made to ensure compliance with operating procedures, expenditure incurred by the service user is in accordance with the agreed budget and support plans, and surplus funds are recovered from service users where appropriate. A follow up review to evidence implementation of the recommendations found a number remain outstanding. However, it was pleasing to note that the Service is committed to implementing all the recommendations with the progress of the work being undertaken reported to members of the Audit, Performance and Risk Committee of the Moray Integration Joint Board Audit, Performance and Risk Committee on 31 August 2023. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 3. Client Monies 4.9 An audit was undertaken of how Health and Social Care officers manage income held for individuals under Corporate Appointeeship Arrangements. Where no alternative exists, the Council can make an application to the Department for Work and Pensions (DWP) for a named officer to become the "Corporate Appointee" and have the legal authority to manage an individual's personal finances. The audit involved a review of the procedures undertaken by the Community Care Finance Team into how they manage client funds held within the corporate bank account. In addition, a sample of individuals was also selected, and a check was made on how the Health and Social Care Officer appointed as the named 'Corporate Appointee' manages and supports individuals to access and use their funds appropriately. The follow up review to evidence implementation of the recommendations found all apart from 5.04 had been implemented. Recommendation 5.04 concerns the requirement to undertake a full review of current cash handling procedures for monies withdrawn for distribution to meet the needs of service users. The Service has accepted the need for this recommendation, but implementation is not possible as a reorganisation of the Service is currently being considered. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 4. Page 11
Page 12
Aberlour Early Years Learning & Childcare Scheme 4.10 A follow up review has been undertaken to evidence implementation of the recommendations from the audit undertaken of the Aberlour Early Years Learning & Childcare Scheme. The audit concerned a review of the contract management arrangements for refurbishing Aberlour's early years and childcare nurseries. The audit was requested after concerns were raised by elected members regarding the management of this scheme. The agreed scope for the audit was to review the reporting arrangements and compliance with Financial Regulations, Procurement Guidelines and the Conditions of the Contract for the refurbishment of the Aberlour early years learning and childcare premises. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 5. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Dafydd Lewis Background Papers: Internal Audit files Audit and Risk Manager Ref: SPMAN-1042990102-185 Page 12
Page 13
Appendix 1 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2023/24 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Housing Benefits - Rent Rebates and Rent Allowances Substantive testing of selected benefit claims to confirm the accuracy of the Council’s benefit subsidy claim External Audit now undertaking review as part of core audit fee Payroll Continuous auditing to confirm the adequacy of the systems and procedures for the payment of salaries Audit programmed to start in the next quarter(s) Procurement and Creditor Payments Continuous auditing of samples of non- pay expenditure to test compliance with procurement and payment processing regulations Fieldwork in progress Debtors A review of the system for income collection through invoicing and debt recovery arrangements Final report issued Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances Work Completed OTHER SYSTEMS Area Type of coverage Transformation Programme Review of the Transformation Programme to assess progress and planned outcomes are on course to be achieved Final report issued Item 5. Page 13
Page 14
Appendix 1 Housing and Property- Reactive Maintenance Works Audit of works undertaken within Building Services for the completion of reactive maintenance works (Council Housing) Audit programmed to start in the next quarter(s) Environmental Services – Grant Claims Certification of grant claims as required: strategic timber; bus operators, regeneration schemes as appropriate Awaiting request from Services Pool Cars Review of operating arrangements for the administration and use of Pool Cars Fieldwork in progress E-Mail Security A review of procedures and system controls used to administer the email system. Fieldwork in progress Moray Growth Deal A follow up review to evidence implementation of the recommendations agreed within a recent audit undertaken of the governance and administrative arrangements within the management of the Moray Growth Deal Final report issued Education – Secondary School Establishment visits as part of cyclical review Audit programmed to start in the next quarter(s) Purchasing Cards Review the systems and procedures for the management, use and control of Purchasing Cards Fieldwork in progress ICT Disaster Recovery Review to evaluate the effectiveness of the processes and controls surrounding Information Technology Disaster Recovery Management Audit programmed to start in the next quarter(s) Food Standards Scotland Guidelines A review of systems and practices used to evidence compliance with the new Food Standards Scotland Guidelines Fieldwork in progress Leisure Services – Sports and Community Centre A review of the arrangements for the accounting of income and expenditure at Keith Sports and Community Centre. Audit programmed to start in the next quarter(s) Page 14
Page 15
Appendix 1 The audit will also check procedures comply with the Payment Card Industry Data Security Standard Burial Services Review of the arrangements for the management of the burial service including a check of the income collection procedures for the collection of interment fees and sale of lairs Final report issued Refugee Integration Scheme Review of systems and procedures to account for grants received and costs relating to Refugee Integration Final report issued Education- Early Learning and Childcare Premises Security Review the controls in place to mitigate the risk of unauthorised access or egress to Early Learning and Childcare Establishments Fieldwork in progress Moray Integration Joint Board Commissioning Services Review of the arrangements for the commissioning of services for children to ensure these are designed and delivered to meet the specified needs and demonstrate best value Draft report issued Disabled Parking System Review of the system for administering the disabled parking permits are also known as Blue Badges Final report issued Occupational Therapy Services – Stores A review of the Occupational Therapy Stores Systems to ensure appropriate accounting systems are followed Final report issued Page 15
Page 16
Appendix 2 Moray Council Internal Audit Section 1 DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Payroll System REPORT REF: 23'018 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Review internal controls as detailed within the CIPFA control matrices to ensure effective delivery of a payroll service. 5.01 Email requests to the Payroll Section to reset an officer’s access to their Employee Self Service Account should only be accepted from a Moray Council email address or a prior registered personal email High Yes 28/02/2023 Implemented. Instruction has been added to procedures and discussed with staff. Item 5. Page 16
Page 17
Appendix 2 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation account. 5.02 Officers should be reminded to record memorable information within their Employee Self Service accounts. This will allow an additional level of system security to confirm identity before an officer can reset their password. High Yes 30/06/2023 Implemented – Officers reminded of this requirement through a newsletter in the June 2023 payslip emails. 5.03 The Human Resources Section should undertake an annual exercise with budget managers to confirm the names, grades, locations and salary details of officers within their Service. High Yes 30/04/2023 Implemented – An establishment listing was generated and emailed to budget managers. A deadline for return was provided and reminders were issued. 5.04 All budget managers should be reminded of the importance of High Yes 30/09/2023 Implemented - A follow up email was sent to the non responders and an instruction issued Page 17
Page 18
Appendix 2 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation confirming or advising Human Resources of any changes required to the establishment list reports of officers recorded within their services. If the budget manager does not respond, the issue should be referred to the appropriate Head of Service. that should the new deadline not be met then escalation is required to the appropriate Head of Service. Subsequently, emails have been sent to Heads of Service for responses as part of the escalation process 5.05 Occupancy end date reports issued to budget managers of employees due to end their employment with the Council the following month should be expanded to include all officers whose records indicate their employment contract has ended. The budget manager should advise the Human Resources Section of any High Yes 31/07/2023 Implemented – employees with end dates that have not been addressed by managers, remain on the occupancy reports in subsequent months until action has been taken. Page 18
Page 19
Appendix 2 Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation changes required to the employment status of officers within their services. Page 19
Page 20
Appendix 3 Moray Council Internal Audit Section 1 BODY: Health & Social Care Moray SUBJECT: Self-Directed Support REPORT REF: 22'013 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Clear and current policy documents and operational guidelines have been developed for the financial administration of SDS packages. 5.01 The SDS Direct Payment guidance and financial monitoring procedures should be reviewed and updated on a regular basis. Low Yes 30/04/2022 Implemented. Financial Monitoring Procedures were updated in October 2021 and SDS Direct Payments Guidance was revised in April 2022. Item 5. Page 20
Page 21
Appendix 3 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Financial reviews are being carried out to monitor the usage of SDS funding in accordance with operational guidelines. 5.02 Annual financial reviews should be undertaken in line with the direct payment financial monitoring procedures. High Yes 31/01/2022 (Revised Implementation Date 31/08/2023) Outstanding. 4 temporary positions have been approved and recruitment is currently in progress. Additional resources will allow the backlog of financial reviews to be worked through and an annual review routine to be established going forward. Dependent on temporary positions being extended beyond March 2024, a revised date for recommendation implementation is set at 30/09/2024. 5.03 Consideration should be given to the routine production of reports from the Care First System which can be used to detail financial reviews falling due and allow Medium Yes 31/12/2021 Implemented. Reports are being produced by the CareFirst system to detail financial reviews due and their priority. Page 21
Page 22
Appendix 3 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation management to prioritise workloads accordingly. The requirement of manual spreadsheets should be minimised wherever possible to ensure information reference points come direct from the Care First system. 5.04 A risk based approach should be initiated by management to prioritise outstanding financial reviews and work through the backlog in an order which makes best use of limited resources. High Yes 31/12/2021 (Revised Implementation Date 31/08/2023) Implemented. Targeted prioritisation is now in place with a policy of prioritisation of reviews of unmanaged accounts, early reviews 3 months after package commencements, closing reviews and where service has been made aware of discrepancies. Page 22
Page 23
Appendix 3 Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.05 A reminder should be issued to service users, and approved payroll providers where applicable, to inform the Authority when funds in excess of the contingency amount are held. This may assist in the prioritisation of early financial reviews and highlight issues for further investigation. High Yes 30/04/2022 Implemented. Initial reminders were issued and are now scheduled annually each January, incorporated into an annual data check. 5.06 A review should be undertaken of all Service Users in regard to the current balances held within their SDS bank account. Action should then be taken to recover excess funds. High Yes 30/04/2022 (Revised Implementation Date 31/08/2023) Part Implemented. The majority of account balances have now been obtained and 4 temporary posts have been approved to complete the backlog and move forward with routine financial reviews in line with timescales set for the service. As in 5.02, a revised date Page 23
Page 24
Appendix 3 Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation for recommendation implementation of 30/09/2024 has been agreed. 5.07 In compliance with established procedures, one-off direct payments should be subject to a financial monitoring review 3 months (or in limited circumstances at another interval) after the funding has been distributed to confirm its appropriate usage. Medium Yes 30/04/2022 (Revised Implementation Date 31/08/2023) Part Implemented. Work on the backlog of one-off direct payment reviews is in progress and is being addressed. A revised implementation date of 31/03/2024 has been agreed for full implementation. 5.08 The Service should comply with the monitoring requirements detailed within an agreement between the Council and Service Medium Yes 31/12/2021 (Revised Implementation Date 31/03/2023) Part Implemented. Partial checks on contract requirements have been undertaken to date. The first MOT of the vehicle is now falling due and evidence of this is to be collated. On an ongoing annual basis, insurance, MOT and Page 24
Page 25
Appendix 3 Moray Council Internal Audit Section 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation User for the purchase and adaptation of a mini van. service detail will be obtained. A revised implementation date of 31/12/2023 has been agreed for full implementation. 5.09 Closing financial reviews of SDS care packages should be undertaken in accordance with agreed procedures. Evidence should be retained of any expenditure outwith the agreed support plan and of the full discussions held and decisions made by Social Workers regarding retrospective authorisation. Medium Yes 31/12/2021 (Revised Implementation Date 31/08/2023) Outstanding. Aligned to 5.02 and 5.04. Closing reviews are being prioritised within the work programme but the backlog requires to be cleared by additional resources. A revised implementation date of 30/09/2024 has been agreed. Page 25
Page 26
Appendix 3 Moray Council Internal Audit Section 7 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: SDS Funding is only used to support the service user's support plan outcomes and compliance is monitored to ensure public funds are spend appropriately. 5.10 Care and Support Plans should be reviewed annually to ensure the agreed care is being provided and continues to meet the service user's needs. High Yes 01/05/2022 (Revised Implementation Date 31/08/2023) Outstanding. Work is being undertaken with Social Work to develop a strategy to ensure all reviews are completed in time. This recommendation has also been made in the recent SDS Option 2/3 internal audit report in which an implementation date of 30/09/2024 has been agreed. 5.11 All Social Workers should be reminded of the requirement to inform the SDS Team of any amendment to a Support Plan that will have a financial change to a service user's care package. High Yes 01/12/2022 Implemented. The SDS Team have reminded Social Work Teams regarding the requirement to refer support package changes where there is a financial implication. Page 26
Page 27
Appendix 3 Moray Council Internal Audit Section 8 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: SDS service has effective arrangements in place to monitor support packages and report on performance. 5.12 Consideration should be given to the development of appropriate performance monitoring measures to be reported to service management on a regular basis. Given the current backlog of reviews and consequences of direct payment accounts not being scrutinised on a timely schedule, it may be beneficial for performance information to be made available for management to identify any resourcing issues arising and assess risks involved. Low Yes 30/09/2022 (Revised Implementation Date 31/03/2023) Implemented. Revised arrangements have been implemented for monitoring performance of the SDS Team. Regular meetings are utilised to discuss performance, monitor progress and escalate any concerns to the Service Manager. Resourcing issues have been considered by the Senior Management Team and additional support posts approved to increase service capacity. Page 27
Page 28
Appendix 3 Moray Council Internal Audit Section 9 Page 28
Page 29
Appendix 4 Moray Council Internal Audit Section 1 DEPARTMENT: Health & Social Care Moray SUBJECT: Client Monies REPORT REF: 22'011 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Clear and current policy documents and operational guidelines have been developed for the financial management of client monies. 5.01 The Procedures for Managing Service User's Money and Corporate Appointeeship should be reviewed and updated and a subsequent regular cycle of review maintained. Medium Yes 31/10/2022 (Revised Implementation Date 30/06/2023) Implemented. Procedures have been reviewed and updated and have been approved by the Senior Management Team at the end of September 2023. Review of the procedures has been scheduled for October 2024. Item 5. Page 29
Page 30
Appendix 4 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 Procedures for the management of client monies should be promoted to ensure there is an awareness of their requirements by all officers involved in client finance administration. Medium Yes 31/10/2022 (Revised Implementation Date 30/06/2023) Implemented. The new procedures have been distributed to all relevant officers immediately following their approval and are available electronically for ease of reference on the Adult Social Care Policies and Procedures page of the Council Interchange. Page 30
Page 31
Appendix 4 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Correct formal powers to administer client monies have been obtained. 5.03 Clarification should be obtained from Legal Services regarding the length of time funds must be retained on behalf of deceased clients and potential action which can be taken should the funds not be claimed within the timeframe. Consideration should also be given to holding these funds separate to the corporate bank account for increased visibility. Medium Yes 31/10/2022 Implemented. A process is now in place for active pursual of estate settlement and referral to National Ultimus Haeres Unit to aid fund dispersement where applicable. A separate balance record is being maintained for increased visibility of deceased client funds and to record actions taken. Page 31
Page 32
Appendix 4 Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: All transactions should be for benefit of the client with justifiable supplier selection, verified to source documentation and in line with the client's Financial Management Plan. Any cash held is done so securely and with full accounting arrangements. 5.04 Due to changes in operating practices a full review of current cash handling procedures should be undertaken. The review should include a risk assessment to ensure best practices are followed regarding the safety and security of both officers and client funds. Documented procedures should thereafter be updated to reflect any agreed changes. High Yes 31/07/2022 (Revised Implementation Date 31/07/2023) Part Implemented. Elements of the cash handling procedures have been reviewed and practices revised to increase safety and security of client funds. A full review is not deemed practical at this point due to an impending service review and potential office relocations but will be undertaken once the future administration arrangements for client funds are determined. The Service has accepted the risk of current practices in the interim period. Page 32
Page 33
Appendix 4 Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Robust records of fund administration per client are maintained. 5.05 Confirmation of the monthly reconciliation of the Corporate bank account to manual records should be undertaken by Community Care Finance management. This should also include the verification of a sample of transactions to source documentation. High Yes 31/05/2022 Implemented. There is now a monthly management check of the corporate bank account reconciliation and a sample of transactions are independently checked for validity. The follow-up exercise has resulted in further enhancements to the management check being advised such as types of transactions for increased focus, which will increase the strength of the scrutiny process. Page 33
Page 34
Appendix 5 Moray Council Internal Audit Section 1 DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Aberlour Early Years Learning & Childcare Scheme REPORT REF: 23'014 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective management controls operate to ensure the delivery for the refurbishment Aberlour Early Learning and Childcare Premises in accordance with Council Regulations and Conditions of Contract 5.01 Consideration should be given to updating job titles and other points of reference recorded within the Project Management Governance Policy. Low Yes 30/09/2023 Implemented– The Project Management Governance Policy has been updated to reflect changes to job titles and other points of reference. Item 5. Page 34
Page 35
Appendix 5 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 All officers responsible for purchasing goods, services or works should be reminded of the Council’s Financial Regulations and Procurement Guidelines. High Yes 30/06/2023 Implemented – It was noted that officers within Education Services have been reminded through staff briefings. Housing and Property Services officers have participated in a training workshop operated jointly by the Payments Manager and the Design and Construction Manager. 5.03 Consideration should be given to any improvements that may be required in the current arrangements for consultation and communication with stakeholders for future projects. Medium Yes Implemented at the time of review Implemented – The Depute Chief Executives have reminded all Heads of Services of a project checklist detailing best practices to follow in project management arrangements. 5.04 All officers involved in procuring goods, services and works should be reminded that in accordance High Yes 30/06/2023 Implemented – As detailed previously, officers within Education Services have been reminded of this requirement through staff Page 35
Page 36
Appendix 5 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation with Financial Regulations, advance payments must be authorised by the Chief Financial Officer. As a matter of urgency, a decision is required regarding the future intention of the temporary cabins stored with the supplier. Consideration should be given for the temporary cabins to be used by another establishment or be sold. High Yes 30/06/2023 briefings. Housing and Property Services officers have participated in a training workshop operated jointly by the Payments Manager and the Design and Construction Manager. Implemented- The Council has investigated alternative uses for the cabins, but none were found. A report to the Moray Council Committee on 28 June 2023 agreed for the cabins to be declared as surplus to requirements and should be disposed of at best value to the Council. The cabins are currently advertised for sale, with offers invited for purchase. The cabins remain stored at the haulage company’s premises. Page 36
Page 37
Appendix 5 Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.05 The refurbishment contract for the Aberlour early years learning and childcare premises should be reviewed to ensure documents are easily retrievable to evidence compliance with the Conditions of Contract and Council Policies and Regulations. Medium Yes 30/06/2023 Implemented – A review has been undertaken to ensure all key documents are now held in accordance with contract management requirements. 5.06 The contractor should be contacted for an updated cost estimate for the completion of the works and if required the budget should be reviewed and updated. Medium Yes 30/06/2023 Implemented – Revised tender report, including cost estimates received May 2023. The cost estimate for completing the works remains within the existing budget. Page 37
Page 38
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 22 NOVEMBER 2023 SUBJECT: INTERNAL AUDIT SECTION – COMPLETED PROJECTS REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 13 September 2023 to 22 November 2023. 1.2 This report is submitted to Committee in terms of Section III (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the following internal audit work concluded during the period 13 September 2023 to 22 November 2023: Moray Growth Deal 3.2 The Moray Growth Deal is a transformational investment of over £100 million for eight strategic projects intended to maximise regional economic competitiveness and boost economic growth across the Moray area. The annual audit plan provided for a follow up review of an audit undertaken in 2022/23 regarding the governance and administrative arrangements established by the Council to support the delivery of the Moray Growth Deal. Due to the importance of the Moray Growth Deal, this follow up review has been separately identified within the annual audit plan. I am pleased to report that all recommendations have been implemented from the review undertaken. It is intended that further auditing of the Moray Growth Deal activities will be included within future audit plans for reporting to this Committee. The follow up report to review the implementation of the agreed recommendations is given in Appendix 1. Item 6. Page 38
Page 39
Debtors 3.3 The annual audit plan for 2023/24 provided for an audit review to be undertaken of the Debtors System. Invoices are raised for various types of services, e.g., financial contribution for care, trade waste, special uplifts, hire of facilities and rechargeable repairs. For the financial year 2022/23, approximately 70,000 invoices were raised to a value of £15.4 million. Testing involved a check to ensure invoices can be evidenced with enough backing documentation to be able to support debt recovery should the need arise; confirm payments had been auto matched to debtor accounts; receipts without a valid reference have been posted to and cleared from a suspense account on a regular basis; effective monitoring of unpaid invoices are monitored and chased in accordance with debt recovery procedures; collection performance is monitored and reported. The audit review did not include the arrangements for recovering debts concerning council tax, non- domestic rates and housing rents. The review forms part of the yearly audit coverage of the Council’s core financial systems. The executive summary and recommendations for this project are given in Appendix 2. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. Page 39
Page 40
5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-182 Page 40
Page 41
Appendix 1 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment and Finance SUBJECT: Moray Growth Deal REPORT REF: 23'013 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Ensuring the governance arrangements supporting the delivery of the Growth Deal are adequate and proportionate 5.01 A formalised monitoring framework should be agreed to measure and record the benefits achieved for each High Yes 28/02/2023 Implemented. A Benefits Realisation Plan and Monitoring Plan have been developed and were presented to the Moray Growth Deal Item 6. Page 41
Page 42
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation project against their respective business plans. (MGD) Board in February 2023. They will be used to monitor projects when they enter the delivery phase. This will enable any variances in the delivery of the respective plans to be highlighted. The MGD Board has committed to giving a bi-annual focus to the status of benefits realisation. 5.02 In accordance with the Stakeholder Engagement Plan, ongoing communication should be undertaken to highlight the actions undertaken within the Moray Growth Deal. This should also include the updating of the Communications Plan to reflect planned activity beyond September 2022. Medium Yes 31/03/2023 Implemented. Evidence was noted in relation to the Annual Conversation held with UK and Scottish Governments on 29 March 2023. The Communications Plan has been updated. Progress updates are provided through social media and the My Moray website. 5.03 Guidelines should be developed to ensure consistent practices can be followed in the saving of documents and naming conventions within the SharePoint document management system. Medium Yes 28/02/2023 Implemented. The need for a well-structured site has been recognised and acted upon. A new Sharepoint site has been developed and became operational from February 2023. 5.04 Consideration should be given to providing elected members with a briefing session regarding the High Yes 28/02/2023 Implemented. A briefing for Elected Members took place on 21 February 2023 to present the Annual Report. The briefing included a Page 42
Page 43
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Scrutiny Checklist detailed within the Audit Scotland published report on Scotland’s City Region and Growth Deals of January 2020. presentation of the Audit Scotland Scrutiny Checklist. The checklist was subsequently circulated to members. 5.05 Each Partner Organisation should provide their Annual Audit Plan to the Moray Council of planned internal audit activity regarding Moray Growth Deal Activities. These Plans should then be forwarded to the Audit and Risk Manager for review. Medium Yes 30/09/2023 Implemented. Agreement has been reached with partner organisations surrounding their commitment to carry out internal audit reviews. As at September 2023, one partner organisation project is in the delivery stage (Digital Health). The Digital Health project has engaged the Internal Audit Services of the University of Strathclyde to undertake the review, scheduled for December 2023. A statement has been provided by the MGD Programme Manager and will be provided annually thereafter on the audit activity to be undertaken. Page 43
Page 44
Appendix 2 AUDIT REPORT 24’011 DEBTORS Executive Summary The annual audit plan for 2023/24 provided for an audit review to be undertaken of the Debtors System. The objective of this audit was to provide assurance over system controls, documentation to support the invoices raised and the debt recovery process. The review forms part of the yearly audit coverage of the Council’s core financial systems. The audit review does not include the arrangements for recovering debts concerning council tax, non domestic rates and housing rents. Invoices are raised for various types of services, e.g, financial contribution for care, trade waste, special uplifts, hire of facilities and rechargeable repairs. Customers may be individuals or commercial businesses. For the financial year 2022/23, approximately 70,000 invoices were raised to a value of £15.4 million. The Debtors System is administered by the Payments Section through the Financial Management System software application to provide automation in the raising of invoices and overdue notices up to the point where final reminders are issued and referral is made to an external debt collection agency. The overall audit objective of this review is to provide an independent opinion on the adequacy and effectiveness of controls and processes. This involved a check to ensure invoices are raised with enough supporting documentation to be able to support debt recovery should the need arise; confirm payments had been auto matched to debtor accounts; receipts without a valid reference have been posted to and cleared from a suspense account on a regular basis; effective monitoring of unpaid invoices are monitored and chased in accordance with debt recovery procedures; collection performance is monitored and reported. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The main issues raised for management consideration are: • The use of performance management information can be an essential aid in ensuring the objectives of an organisation are achieved. Consideration should be given to further developing key performance management information regarding debt recovery. This would allow for further benchmarking of performance with other Local Authorities and assist in providing an overview of the internal management of invoices raised by individual services. • During the audit, an issue arose concerning the Council’s inability to collect income from direct debits for a period of 10 days. This issue impacted several service users, including council tax payers, resulting in a cost to the Council Item 6. Page 44
Page 45
and the need to agree on revised debt recovery arrangements. The reason for this issue was due to a software certificate, as part of the authentication process to allow the Council to recover debts through Direct Debits not being renewed. The audit has noted that the Payments Section has undertaken a review and highlighted several recommendations regarding current operating arrangements that have now been implemented. The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 1 4 0 Page 45
Page 46
Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: The audit reviewed the key operational controls in the management of the Council's Debtors System 5.01 Further to a review undertaken by the Payments Section, additional controls have been implemented to ensure more effective monitoring of software licensing requirements. This will include establishing a register of software certificates requiring future renewal. High Yes Further monitoring of when future software licences are due for renewal has been introduced. In addition, contact has been made with the Bank and Software Supplier to agree on additional notification messaging Assistant Manager – FMS & Banking 31/12/2023 Page 46
Page 47
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation regarding the ongoing status of software licences. 5.02 To ensure the Council is maximising income recovering arrangements, services should be reminded to resolve any disputed invoices as quickly as possible. Medium Yes This will be highlighted to Services when the updated Sundry Debt Management Policy is issued. Assistant Manager – FMS & Banking 31/01/2024 5.03 In accordance with Financial Regulations, services should be reminded of the requirement that invoices are issued promptly, either in advance or within a maximum of 30 days of the service or goods being provided. Medium Yes This will be highlighted to Services when the updated Sundry Debt Management Policy is issued. Assistant Manager – FMS & Banking 31/01/2024 Page 47
Page 48
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.04 Consideration should be given for additional guidance to be included within the Sundry Debt Management Procedures to ensure a uniform approach is taken where the use of legal action should be considered by services for the recovery of unpaid invoices. Medium Yes The requirement for consideration of legal action to recover outstanding debts will be included as part of the current review to update the Sundry Debt Management Policy. Assistant Manager – FMS & Banking 31/12/2023 5.05 Consideration should be given to further developing performance management information to allow benchmarking with other local authorities and for the internal management of debt recovery action undertaken by individual services. Medium Yes Agreed. Further development of performance indicators will be undertaken to ensure more effective monitoring of debt recovery arrangements. Assistant Manager – FMS & Banking 31/03/2024 Page 48
Page 49
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 22 NOVEMBER 2023 SUBJECT: SCOTTISH PUBLIC SERVICES OMBUDSMAN RECOMMENDATIONS REPORT BY: CHIEF EXECUTIVE 1. REASON FOR REPORT 1.1 The Committee is asked to consider the Scottish Public Services Ombudsman (SPSO) Recommendations Report. 1.2 This report is submitted to Committee in terms of Section III (A) (4) of the Council's Scheme of Administration relating to monitoring performance of the services in accordance with the Council’s performance management framework. 2. RECOMMENDATION 2.1 The Committee is invited to consider the content of the SPSO Recommendations Report in Appendix 1, seek clarification on any points arising and otherwise approve the report. 3. BACKGROUND 3.1 Complaints handling is part of the Council’s Performance Management Framework. Members receive updates on complaints performance through routine reports to service committees. 3.2 All complaints operate through a two stage complaints process. 3.3 Once a complaint has passed through the complaints process, a complainant has the option of having their complaint considered by the SPSO. Following SPSO investigation, they can make recommendations to help councils learn from mistakes and implement service improvements. 3.4 The SPSO has asked authorities to confirm that SPSO complaint recommendations are reviewed at a senior level by returning an annual ‘learning and improvement statement’ confirming this. This builds on the model complaints handling procedures that set out the importance of the Council being able to demonstrate how they ‘systematically review complaints performance reports to improve service delivery’. The Council’s statement includes a commitment to report on SPSO recommendations annually to this Committee. Item 7. Page 49
Page 50
3.5 The SPSO introduced a ‘learning and improvement unit’ (LIU) to ensure public authorities take the necessary responsibility and actions to handle complaints well and reduce the occurrence of repeat mistakes. The aim of the LIU is to enhance the impact of their work by helping authorities improve public services through learning from complaints. 3.6 One of the main areas the LIU focus on is SPSO recommendations. A key part of this work includes providing authorities with additional support and advice on how to meet their recommendations with a view to preventing repeat service failings and complaints. In addition to this extra support, they are looking to adopt a tighter escalation process for the very few cases where their recommendations are not being implemented, with the potential to lead to a Special Report. 4. SPSO RECOMMENDATIONS FOR REPORTING PERIOD 2022-23 4.1 Table 1 (APPENDIX A) shows all Council complaints in the reporting period 2022/23 where the Council received notification of referral by complainants to the SPSO. No significant recommendations were made. The Council were provided with SPSO feedback as detailed at cases 9 and 12. Case 9 4.2 Case 9, SPSO reference 202204802 relates to a complaint that the council had failed to provide suitable playpark resources for a child’s disability needs and further regarding not addressing all complaint points and showing a lack of understanding in the language used in the Council’s response to this complaint. 4.3 SPSO were satisfied that the Council had upheld this complaint however they identified issues that the council should have addressed and requested that a revised final response be issued. This was done to the satisfaction of SPSO and the complainant. 4.4 SPSO provided one feedback issue: • Care should be taken to ensure that all points of the original complaint are properly addressed. Case 12 4.5 Case 12, SPSO reference 202209451 relates to a complaint containing four issues associated with an annual gas safety check and the contract relating to this. SPSO were satisfied that the Council had properly investigated and upheld three of the complaint issues. 4.6 The fourth complaint issue related to a staff member, known to the complainant, allegedly sharing information with a third party without the complainant’s consent. This was denied by the staff member and the complaint was not upheld. 4.7 SPSO provided one feedback issue: • On the fourth complaint point: the third party was not spoken to to ascertain their account. This was subsequently done and the complaint remained not upheld. SPSO were satisfied that this complaint aspect had now been fully investigated. Page 50
Page 51
5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Effective handling of complaints is used to ensure the efficient and sustainable delivery of services to meet the Council’s priorities in ‘Moray 2026: A Plan for the Future.’ Within the Moray Council Corporate Plan, it has been identified that “we will talk to our customers and see how they would like services improved” that is a core part of the process of learning from complaints. SPSO recommendations often necessitate further communication with customers. (b) Policy and Legal The SPSO requested a ‘Learning and Improvement statement’ in support of our statutory requirement to report to the SPSO annually on their performance indicators. (c) Financial implications There are no financial implications in this report. The two complaint recommendations referred to in this report are not linked in any way to financial claims. (d) Risk Implications Failure to report may result in SPSO making a declaration of non- compliance against the Council. Non-compliance with the statutory duty relating to national standards being adopted would present risk in terms of reputational damage and a loss of public confidence in our ability to deliver quality improvements based on complaints analysis, and ultimately to maintaining and improving service standards. (e) Staffing Implications There are no staffing implications related to this report. (f) Property There are no property implications related to this report. (g) Equalities/Socio Economic Impact The Equal Opportunities Officer has recommended that where services are experiencing high volumes of complaints, the management of respective services should arrange to identify common complaint issues and any learning arising. This will help to ensure that complaints are not arising from situations where customer diversity needs have not been considered or addressed, e.g. disability or cultural issues. The Officer further recommends that where there is evidence or a possibility that a complaint is related to characteristics protected under the Equality Act 2010 (race, disability, sex, religion/belief, sexual orientation, age, gender reassignment, pregnancy/maternity), services make contact the Council’s Equal Opportunity Officer. Page 51
Page 52
(h) Climate Change and Biodiversity Impacts There are no climate change and biodiversity impacts related to this report. (i) Consultations The Corporate Management Team has been consulted on the contents of SPSO Recommendations report. 6. CONCLUSION 6.1 The SPSO Recommendations Report presents Council action taken to address SPSO recommendations. Author of Report: John Black, Complaints Officer Background Papers: SPSO PIs Ref: SPMAN-2045703626-316 Page 52
Page 53
APPENDIX 1 Case Ref/No LOG Ombudsman Referrals 01-04-2022 to 31-03-2023 Submission Req’d/Sub Details Decision/Date Action Plan Y/N Comp Ref No Department 1. SPSO 202105445 14/10/2021 10100206646 Chief Executive Complained that: Staff had unfairly blocked him from Moray Council’s social media pages. This complaint was not upheld by the council. 27/07/2022 – SPSO issued a decision letter. They were satisfied with council action taken and made the decision not to investigate the complaint further. N 2. SPSO 202106454 09/06/2022 Not Applicable Planning Complained that: Planning consent had been given to erect properties on a woodland area despite community opposition. . 09/06/2022 – SPSO issued a decision letter. They were satisfied that this couldn’t be handled as a complaint in accordance with the CHP. They noted that the complainant intended to challenge the decision of the Local Review Body in the Court of Session. As legal proceeding were being considered, they made the decision not to investigate the complaint further. N Item 7. Page 53
Page 54
APPENDIX 1 3. SPSO 202110296 18/11/2021 101002928193 Direct Services Complained that: Staff failed to respond to correspondence in a timely manner concerning parking issues. This complaint was partially upheld by the council. 21/04/2022 – SPSO issued a decision letter. They were satisfied that the council dealt with the complaint appropriately by not upholding the parking aspect; upholding staff not responding in a timely manner. They concluded that they would not be investigating this complaint. N 4. SPSO 202110971 18/01/2022 101002966768 Direct Services Complained that: the council had suspended assisted recycling collection on the grounds that the complainant had able teenager children living at home to assist. The Council did not uphold this complaint at front line however following receipt and 12/04/2022 – SPSO issued a decision letter. They asked the council to escalate the complaint to stage two investigation. The council informed SPSO that they had carried out an investigation and having considered the additional correspondence, they were reinstating the assisted collection. N Page 54
Page 55
APPENDIX 1 consideration of further complainant correspondence from SPSO, the complaint was upheld. 10/05/2022 - SPSO issued an email. They were satisfied with the actions of the council and would not be investigating this complaint. 5. SPSO 202111002 31/01/2022 101002982133 Education Complained that: Staff had treated his family unfairly and refused to provide information held about their child. The council did not uphold this complaint. 07/04/2022 – SPSO issued a decision letter. They were satisfied with the investigation carried out by the council and that the complainant has been correctly signposted regarding the request for information. They would not be investigating further. N 6. SPSO 202111827 12/04/2022 101003038338 Legal and Democratic Services Complained that: The council refused a grant for loss of taxi driver earnings and did not uphold the subsequent appeal. The council did not uphold this complaint. 16/06/2022 - SPSO issued a decision letter. They were satisfied with the investigation carried out and how the appeal was handled by the council. They agreed with the council’s view that the complainant did not provide satisfactory documentation to support his claim. N Page 55
Page 56
APPENDIX 1 They would not be investigating this complaint. 7. SPSO 202202452 09/12/2021 101002931994 Direct Services Complained that: A harbour access ramp had been erected in close proximity to his property without any prior planning notification having been given. He perceived that this would lower the value of his property. The council did not uphold this complaint. 02/08/22 SPSO issued a decision letter. They were satisfied with the investigation carried out by the council and advised the complainant that this was a legal matter. They would not be investigating this complaint. N 8. SPSO 202202548 25/05/2022 101003057311 Roads Maintenance Complained that: There had been an excessive delay in replacing a dropside kerb leading to their driveway following road maintenance. 26/10/2022 - SPSO issued a decision letter. They noted that the council had apologised for wrongly advising the complainant that they would be replacing the old kerb with a dropside kerb as the placing of a standard kerb N Page 56
Page 57
APPENDIX 1 This complaint was partially upheld by the council. was sufficient; for excessive delay in responding to the complainant. They would not be investigating this complaint further. 9. SPSO 202204802 22/08/2022 101003112134 Education Complained that: There was a lack of playpark resources for their disabled child. Further complained about the language used in our response. This complaint was upheld by the council. 23/03/2023 - SPSO issued a decision letter. In February 2023, SPSO advised the council of additional points that the complainant had raised in their complaint to SPSO and requested that the council consider these and issue a revised final response This was done and SPSO advised that they were now satisfied with how the council had subsequently handled this complaint. They raised one feedback issue: Y Page 57
Page 58
APPENDIX 1 Care should be taken to ensure that all points of the original complaint are properly considered and addressed. 10. SPSO 202204948 16/08/2022 101003124509 Education - Sport and Culture Complained that: Staff had given misleading information concerning membership cancellation and a fitLife charge should not have been made when the membership was cancelled. This was not upheld by the council. 12/10/2022 - SPSO issued a decision letter. They advised that they were happy that the council had correctly applied the terms and conditions and agreed that the charge should stand. They highlighted that the council, having dealt with the complaint at front line apologised for omitting to sign post the complainant to stage 2 investigation. As the council had identified this error and corrected it prior to SPSO involvement, they decided that they would be taking no further action. N Page 58
Page 59
APPENDIX 1 11. SPSO 202207153 02/11/2022 101003175446 Children and Families and Criminal Justice Complained that: Staff were not listening to her concerns for her child regarding the poor home conditions the child was subjected to when living with their father. This complaint was not upheld by the council. 09/01/2023 - SPSO issued a decision letter. SPSO advised that they were happy with the council’s investigation and handling of this complaint and that they would be taking no further action. N 12. SPSO 202209451 02/02/2023 101003204296 Housing and Property Services Complained that: 1) Annual Gas Safety Check cancelled and non access procedure was applied incorrectly (upheld) 2) Added to heating contract without consent or valid reason (upheld) 3) Staff member provided information to a third party (not upheld) On 07/03/2023, SPSO issued a decision letter. They were satisfied with the majority of the council’s investigation and findings. SPSO provided one feedback aspect for complaint issue 3 – the staff member had allegedly spoke to a third party and this person wasn’t spoken to to ascertain their account. The council addressed the feedback issue and the Y Page 59
Page 60
APPENDIX 1 4) Excessive staff contact to book a gas servicing appt (upheld) This complaint was partially upheld by the council. complaint issue remained not upheld. SPSO decided that they would not investigate this complaint further. Page 60