Agenda Document Pack - Audit and Scrutiny Committee - 14/02/2024
Moray Council · 14 February 2024
Back to Audit and Scrutiny Committee — 14 February 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 14 February 2024 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 14 February 2024 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of meeting of 22 November 2023 5 - 8 4. Written Questions ** 5. Internal Audit Section Update Report Report by Audit and Risk Manager 9 - 38 6. Internal Audit Section - Completed Projects Report Report by Audit and Risk Manager 39 - 66 7. Internal Audit Plan Year Ending 31 March 2025 Report by Audit and Risk Manager 67 - 80 8. Audit and Scrutiny Committee Self-Assessment and Evaluation Exercises Report by Audit and Risk Manager 81 - 104 9. The National Fraud Initiative in Scotland Report by Audit and Risk Manager 105 - 114 10. Question Time *** Consider any oral question on matters delegated to the Committee in terms of the Council's Scheme of Administration. Page 1
Page 2
Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. *** Question Time - At each ordinary meeting of the Committee ten minutes will be allowed for Members questions when any Member of the Committee can put a question to the Chair on any business within the remit of that Section of the Committee. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than ten minutes after the Committee has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he/she can submit it in writing to the proper officer who will arrange for a written answer to be provided within seven working days. Page 3
Page 4
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Graham Leadbitter (Chair) Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Theresa Coull (Member) Councillor John Cowe (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 22 November 2023 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Ivan Augustus, Councillor Peter Bloomfield, Councillor Theresa Coull, Councillor John Cowe, Councillor John Divers, Councillor Amber Dunbar, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Graham Leadbitter, Councillor Marc Macrae, Councillor Neil McLennan, Councillor Shona Morrison, Councillor John Stuart, Ms Margaret Wilson ALSO PRESENT Councillor Kathleen Robertson, Councillor Derek Ross IN ATTENDANCE The Chief Executive; Depute Chief Executive (Economy, Environment and Finance); Depute Chief Executive (Education, Communities and Organisational Development); Head of Governance, Strategy and Performance; Head of Financial Services; Head of Housing and Property Services; Audit and Risk Manager; Property Asset Manager; Caroline O'Connor, Committee Services Officer as Clerk to the meeting, all Moray Council and Hannah McKellar, Grant Thornton - External Auditor. 1. Chair Councillor Leadbitter, as Chair of the Audit and Scrutiny Committee, chaired the meeting. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Order 21 and 23 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. Councillor Gatt did however state that in relation to Item 5 "Internal Audit Section Update Report" he is Convener of the Grampian Valuation Joint Board and for transparency in relation to Item 6 "Internal Audit Section Completed Projects", a recent personal transaction had flagged up issues for the Audit Officer. This was noted. Mr Augustus stated that he was a member of the Moray Integration Joint Board and Skills Development Scotland. This was noted. Item 3. Page 5
Page 6
3. Minute of the meeting held 13 September 2023 The minute of the meeting of the Audit and Scrutiny Committee dated 13 September 2023 was submitted for approval. The Chair advised a number of amendments to the minute had been submitted by Councillor McLennan shortly before the meeting and reminded Members the agreed minute style is a summary of discussion held whilst decisions are minuted in detail. Following discussion the Chair advised he was not prepared to accept the amendments given the late notice of receipt of the amendments, the detail contained therein and that members of the Committee had not been given reasonable opportunity to consider the amendments. Councillor McLennan noted the decision of the Chair. Thereafter the Committee unanimously approved the minute. 4. Written Questions ** The Committee noted that no written questions had been submitted. 5. Internal Audit Section Update Report The meeting had before it a report by the Audit and Risk Manager providing Committee with an update on the work of the Internal Audit Section. The Chair advised Councillor Ross was in attendance as he wished to speak on Appendix 5. In response to a question from Councillor Gatt relating to there no longer being funding for the Corporate Investigations Officer vacancy, the Head of Governance, Strategy and Performance advised no decision had yet been taken and this would need to be considered by Moray Council. In response to a question from Councillor Gatt relating to the Audit and Risk Manager's concerns about insufficient internal audit staffing resources to meet the needs of the Council, Moray Integration Joint Board (MIJB) and the Grampian Valuation Joint Board (GVJB), the Chief Executive advised shortages in staffing resources across the Council are being considered by the senior management team and the Accounts Commission direction next year will focus on workforce planning in terms of Best Value. In response to a question from Ms Wilson relating to whether a review could be progressed into internal audit requirements of the MIJB and GVJB which may result in producing funding for additional resources, the Chief Executive agreed to undertake a review. In response to a question from Councillor Stuart relating to slippages in timescale and delays in respect of the Self-Directed Support audit and whether audits can be paused to focus on new work, the Audit and Risk Manager advised there is a requirement for annual audit coverage, and it is intended for next year’s Audit Plan to be reported to Committee in February 2024. This will include MIJB projects and include details of follow-up reviews to be undertaken next year. Page 6
Page 7
In response to a question from Mr Augustus relating to the duration of temporary staff employed to deal with the backlog and the risk of reoccurrence when the resources are removed, the Audit and Risk Manager advised that would be a matter for the MIJB. The Chief Executive advised that the Audit and Risk Manager is preparing an revised report format for Committee to balance the robustness of the audit process while taking into account the flexibility of resources to respond to the audit requirements. The Audit and Risk Manager confirmed consultation would be undertaken with Committee on the revised reporting format. In response to a question from Councillor Ross relating to costs incurred for storage of the surplus portacabins in respect of the Aberlour Early Years Learning and Childcare Scheme audit, the Head of Housing and Property advised a number of notes of interest had been received which would be taken forward and the expected yield would exceed the cost of the interim storage. Thereafter the Committee unanimously agreed to note the contents of the report. 6. Internal Audit Section - Completed Projects The meeting had before it a report by the Audit and Risk Manager advising the Committee on the work of the Internal Audit Section for the period from 13 September 2023 to 22 November 2023. In response to a question from Councillor Gordon relating to collection of non- domestic rates, the Audit and Risk Manager advised it was not part of the Debtors System review but a review would be included as part of the 2025/26 Audit Plan. In response to a question from Councillor Gatt relating to a personal invoicing issue which had raised matters not contained in the audit, the Audit and Risk Manager advised it highlighted further scrutiny was required in relation to reallocation of income received via bank transfer. Thereafter the Committee unanimously agreed to note the contents of the report. 7. Scottish Public Services Ombudsman Recommendations Report The meeting had before it a report by the Chief Executive asking the Committee to consider the Scottish Public Service Ombudsman (SPSO) Recommendations Report. In response to a question from Councillor McLennan asking what the figures were in relation to comparator authorities, the Chief Executive advised he would follow this up with the Council's Complaints Officer. Thereafter the Committee unanimously agreed to note the contents of the report. 8. Question Time *** External Funds The Chair noted numerous external funding streams are due to be received by the Council and asked what the audit process would be in terms of audit and review. Page 7
Page 8
The Audit and Risk Manager advised Heads of Services have been asked to highlight any reviews they would like to be included in the Audit Plan for next year. One response has been received for a review of a funding stream which given timescales is proposed will be included in the 2025/26 Audit Plan. The Audit and Risk Manager confirmed he plans to discuss 2024/25 Audit Plan with the Chair and Council Leader. Committee Attendance Under reference to paragraph 7 of the minute of the meeting of this Committee held on 13 September 2023, Councillor Divers sought an update on the outcome of discussions held between the Chair and Committee Chairs relating to committee attendance. In response the Chair advised that discussions had not yet been held but he planned to progress with the Council Leader and Depute Leader. Councillor McLennan sought clarification on whether the proposed discussion with Committee Chairs was relating to Chairs attendance at this Committee following the issues raised at the last meeting of this Committee or if the discussions were relating regular catch up meetings with Committee Chairs or both. In response the Chair advised the proposed discussions were relating to regular catch up meetings, six monthly or annual as deemed most appropriate, to explore a range of issues with the Chairs including what was being scrutinised by their own Committees and what should be scrutinised by this Committee. Councillor Divers confirmed his question related to Committee Chairs attendance at this Committee to answer questions relating to their Committees rather than Officers, as agreed previously by Council. In response the Chair advised this would be covered in his discussions with Committee Chairs whilst noting the context of the Committee role has changed since previously agreed by Council. Councillor McLennan agreed with the comments made by Councillor Divers and suggested in terms of Best Value and effective scrutiny requirements, a smaller Committee would be useful going forward. Page 8
Page 9
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 14 FEBRUARY 2024 SUBJECT: INTERNAL AUDIT SECTION UPDATE REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE 2023/24 AUDIT PLAN Audit Plan Update 4.1 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Enclosed as Appendix 1 is an update on the progress undertaken by the Internal Audit Section regarding the completion of audit review projects against the Annual Audit Plan. As was reported to Audit and Scrutiny Committee on 22 November 2023 (para 5 of minute refers), the Internal Audit Section has been operating with a vacancy in the post of Corporate Investigations Officer. Officers within the section have been covering the duties of this post. Unfortunately, this has Item 5. Page 9
Page 10
impacted the available staff resources to complete this year’s Audit Plan. There will therefore, be a requirement to carry forward the reviews of Building Services Reactive Maintenance and the Information Technology Disaster Recovery Management arrangements to a future Audit Plan. Follow Up Reviews 4.2 Internal Audit reports are regularly presented to Elected Members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: Cyber Security 4.3 This follow up review checked the implementation of recommendations detailed from an audit undertaken into the Council's control arrangements regarding cyber security. Cyber security concerns the protection of computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. Cyber security controls are designed to combat threats against networked systems and applications, whether those threats originate from inside or outside an organisation. The Scottish Government in 2020 issued a Cyber Resilience Framework to all Local Authorities. The Framework includes a self-assessment tool to assist Local Authorities in improving their cyber resilience and compliance with a range of legislative, regulatory, policy and audit requirements. The audit programme was developed from this Cyber Resilience Framework and other good practice guidelines. The impact of a successful cyber attack would immediately affect how the Council would be able to continue providing day to day services. 4.4 The follow up review found that significant work has been undertaken by the Information, Communication and Technology (ICT) Service to ensure effective cyber security controls. However, some audit report recommendations remain outstanding or need to be fully implemented. The significant workload demands within the ICT Service are appreciated. It is important to highlight that maintaining an effective cyber security control environment is the responsibility of not only the ICT Service but also every Officer and Elected Member of the Council. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 2. Social Care & CareFirst System Information Governance 4.5 An audit was undertaken into how information relating to social care service users is recorded, accessed and kept up to date. The Council uses a system known as CareFirst to record and manage social care cases for both adult and children’s services. CareFirst is a long standing widely used application within the public sector for recording social care data. Due to the limitations of CareFirst, information regarding social care users is retained on a Council server or in paper files. The audit also checked the management arrangements for reviewing case files and access controls of who can view, add, amend or delete information, recognising that restricted access has to be balanced with a need for prompt availability of information for Officers who require it to deliver services effectively. The follow up review found that a number of recommendations remain outstanding. Workload and staffing issues are appreciated in delaying the implementation of the recommendations. However, as the Audit and Risk Manager, I am concerned about whether the CareFirst System remains fit for Page 10
Page 11
purpose as the primary recording database for the management of social care service users. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 3. Buckie High School 4.6 A follow up review to evidence implementation of the recommendations contained within an audit report regarding the administrative arrangements within Buckie High School has been completed. The audit reviewed the Devolved School Management Scheme in terms of the allocation of funding and the management of these funds at school level. In addition to undertaking an overview of how the School develops, monitors and controls its £4.8 million budget, the audit checked the management of the staffing costs involved in delivering the curriculum. A review was also undertaken to ensure appropriate accounting arrangements are followed in managing school fund monies. It is pleasing to report that all recommendations have been implemented. The Follow Up Report is given in Appendix 4. Building Services Stores 4.7 This follow up review checked the implementation of recommendations within the Building Services Stores audit report. The scope of the audit reviewed the systems and controls in managing materials and equipment (stock) stored to meet the repairs and maintenance requirements of Council housing. It was noted that individual stock items varied in value from a few pounds to upwards of £1,000. Materials and equipment with a cumulative value of approximately £700,000 are issued annually from Stores. Good progress has been made in the implementation of the recommendations; however, some actions remain outstanding. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 5. Early Learning and Childcare 4.8 An audit was undertaken to review the systems and controls in the financial management of the Early Learning and Childcare Service (ELC). The Education, Children’s and Leisure Services Committee of 26 January 2022 (para 17 of the minute refers) requested that Internal Audit provide greater clarity on the final financial position of the Early Learning and Childcare Service for 2022/23. Discussions with Senior Officers requested that the scope be expanded to include a review of the 2021/22 financial year to determine the reasons for the reported variance between budgeted and actual expenditure. A follow up audit has been undertaken to evidence implementation of the recommendations detailed within the review reported to the Audit and Scrutiny Committee on 30 March 2022 (para 5 of the minute refers). It is pleasing to confirm that the majority of recommendations have been implemented. A recommendation concerning a service review of Additional Support Needs remains ongoing, but changes to budgetary responsibilities have been implemented. The Follow Up Report is given in Appendix 6. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. Page 11
Page 12
(b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: SPMAN-1042990102-200 Page 12
Page 13
APPENDIX 1 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2023/24 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Housing Benefits - Rent Rebates and Rent Allowances Substantive testing of selected benefit claims to confirm the accuracy of the Council’s benefit subsidy claim External Audit now undertaking review as part of core audit fee Payroll Continuous auditing to confirm the adequacy of the systems and procedures for the payment of salaries Fieldwork in progress Procurement and Creditor Payments Continuous auditing of samples of non- pay expenditure to test compliance with procurement and payment processing regulations Draft report completed Debtors A review of the system for income collection through invoicing and debt recovery arrangements Final report issued Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances Work completed OTHER SYSTEMS Area Type of coverage Transformation Programme Review of the Transformation Programme to assess progress and planned outcomes are on course to be achieved Final report issued Housing and Property- Reactive Maintenance Works Audit of works undertaken within Building Services for the completion of reactive maintenance works (Council Housing) Audit Review to be carried forward to a future Audit Plan Item 5. Page 13
Page 14
Environmental Services – Grant Claims Certification of grant claims as required: strategic timber; bus operators, regeneration schemes as appropriate Audit testing of the Network Support Grant completed Pool Cars Review of operating arrangements for the administration and use of Pool Cars Draft report issued E-Mail Security A review of procedures and system controls used to administer the email system. Fieldwork in progress Moray Growth Deal A follow up review to evidence implementation of the recommendations agreed within a recent audit undertaken of the governance and administrative arrangements within the management of the Moray Growth Deal Final report issued Education – Secondary School Establishment visits as part of cyclical review Audit programmed to start in this quarter Purchasing Cards Review the systems and procedures for the management, use and control of Purchasing Cards ICT Disaster Recovery Review to evaluate the effectiveness of the processes and controls surrounding Information Technology Disaster Recovery Management Audit Review to be carried forward to a future Audit Plan Food Standards Scotland Guidelines A review of systems and practices used to evidence compliance with the new Food Standards Scotland Guidelines Audit programmed to start in this quarter Leisure Services – Sports and Community Centre A review of the arrangements for the accounting of income and expenditure at Keith Sports and Community Centre. The audit will also check procedures comply with the Payment Card Industry Data Security Standard Fieldwork in progress Burial Services Review of the arrangements for the management of the burial service including a check of the income Final report issued Page 14
Page 15
collection procedures for the collection of interment fees and sale of lairs Refugee Integration Scheme Review of systems and procedures to account for grants received and costs relating to Refugee Integration Final report issued Education- Early Learning and Childcare Premises Security Review the controls in place to mitigate the risk of unauthorised access or egress to Early Learning and Childcare Establishments Draft report completed Moray Integration Joint Board Commissioning Services Review of the arrangements for the commissioning of services for children to ensure these are designed and delivered to meet the specified needs and demonstrate best value Final report issued Disabled Parking System Review of the system for administering the disabled parking permits are also known as Blue Badges Final report issued Occupational Therapy Services – Stores A review of the Occupational Therapy Stores Systems to ensure appropriate accounting systems are followed Final report issued Page 15
Page 16
Page 16
Page 17
APPENDIX 2 Moray Council Internal Audit Section DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Cyber Security REPORT REF: 23'011 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective Cyber Security Controls to combat threats against networked systems and applications. 5.01 The ICT Service should progress with completing the Scottish Government Cyber Resilience Framework self- assessment tool. Any improvement actions required to Council systems and procedures should be agreed with an action plan detailing recommendations for implementation. High Yes 31/03/23 Implemented - The self-assessment tool was completed in November 2022. An action plan to address identified areas of improvement has been developed. Item 5. Page 17
Page 18
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 ICT policies and guidelines should be reviewed and if required updated to include best practices in information management, computer use and cyber security practices. Medium Yes 31/12/22 Part Implemented – At the time of the follow- up review, both policies have been reviewed and remain at the draft stage. A revised implementation date has been agreed as 31/03/2024. 5.03 The ICT Business Continuity Plan should be reviewed and if required updated to reflect current cyber resilience arrangements. High Yes 31/12/22 Outstanding - This remains in progress with a revised implementation date agreed as 31/03/2024. 5.04 Cyber security awareness training should be provided to officers of all levels within the Council. Medium Yes 31/03/23 Implemented - An initial phishing exercise has been completed which will support a targeted approach to training. ICT has worked with the provider to agree topics to include within the training plan, now developed. 5.05 An Incident Response Plan should be developed and thereafter regularly tested through simulation exercises. High Yes 31/12/22 Part Implemented – An Incident Response Plan has been developed and discussed with the Corporate Management Team. Sessions Page 18
Page 19
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation operated by Scottish Government and are due to be held in November 2023, thereafter the intention is to carry out simulation exercises locally. A revised implementation date has been agreed as 31/03/2024. 5.06 A review of existing insurance cover should be carried out to ensure the level of cover is appropriate and adequate in relation to the threat level from cyber-attack. Medium Yes 30/09/22 Implemented – ICT and Council Officers responsible for insurance have met with existing and wider insurers to discuss the level of cover available for cyber security. There are currently national issues relating to the level of cover available. This specific issue will continue to be discussed at annual review to ensure the Council can minimise the risks in this area. Page 19
Page 20
Page 20
Page 21
APPENDIX 3 Moray Council Internal Audit Section DEPARTMENT: Health and Social Care Moray SUBJECT: Social Care & CareFirst System Information Governance Review REPORT REF: 23'012 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Effective information control systems in operation to protect and secure access to social care data. 5.01 Investigation should be undertaken to explore the possibilities of developing a single case recording system. Medium Yes 30/11/2022 Revised implementation date 25/01/2024 Part Implemented- The Service has investigated the possibility of developing a single case recording system. A committee report seeking approval for the replacement of the CareFirst System is planned to be reported to the Moray Integration Joint Board on 25 January 2024. 5.02 Additional access controls to the CareFirst System should be introduced to include time limited Medium Yes 31/10/2022 Implemented- Password parameters for CareFirst have been adjusted to require users to change their password every 90 days. Item 5. Page 21
Page 22
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation access and more complex password combination requirements. 5.03 A review of access rights to CareFirst, Shared Drive and Paper Files should be undertaken with the purpose that officers should only be authorised to view case file information required to undertake their duties. Medium Yes 31/10/2022 Revised Implementation date 25/01/2024 to provide update on status Outstanding- The implementation of this recommendation is dependent on a planned replacement of the CareFirst System. The Service is seeking approval for the replacement of the CareFirst System with a report to the Moray Integration Joint Board on 25 January 2024. 5.04 An officer should record a clear description within the CareFirst System to explain why access is required to a Restricted Case File. Medium Yes 31/12/2022 Implemented- Reminders were disseminated to officers highlighting the need to provide a clear explanation of reasons for access to restricted files within CareFirst. Audit testing found explanations detailing the reasons for access to restricted files. Page 22
Page 23
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Where restricted service user records are also held within the shared drive and paper records, a clear description should also be maintained detailing reasons for access. Revised Implementation date 25/01/2024 to provide update on status Outstanding– This recommendation remains outstanding as there will be a need to introduce systems and controls to ensure implementation. If a replacement to the CareFirst System is agreed upon, the need for a single case recording system will reduce the requirement for saving service user information on a shared drive or paper file. 5.05 CareFirst Case Files should be deleted in accordance with the Council Document Retention Policy. Deletion of case files should only be actioned after the authority of a senior manager is obtained. Medium Yes 31/12/2022 Revised Implementation Date 31/12/2023 Part Implemented- An officer was appointed in May 2023 with responsibility for deleting case files. Audit testing confirmed the deletion of service user information but has highlighted a requirement for maintaining additional records to evidence compliance with the Council’s Document Retention Policy. 5.06 The deletion of CareFirst System files should also include Medium Yes 31/12/2022 Outstanding– Implementation of this recommendation has been delayed due to Page 23
Page 24
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation information held regarding a service user within the shared drive and paper files. Revised Implementation date 30/04/2024 long term staff absence within the Service. Revised Implementation date agreed with Service as 30/04/2024. 5.07 The re-introduction of regular reviews of case files should be undertaken by Managers within Adult, Children and Families Services Medium Yes 31/10/2022 Implemented– Service has re-introduced the requirement for case file reviews by managers. 5.08 Case recording procedures should be updated for Adult, Children and Families Services Medium Yes 31/12/2022 Revised implementation date 30/04/2024 Part Implemented– A revised case recording procedure has been drafted but still requires approval by the Service. Revised implementation date agreed with Service as 30/04/2024. 5.09 A review should be undertaken of the security of paper records held within the Community Care Medium Yes Completed Implemented– The Community Care Finance Service are now based within the Headquarters. In addition officers have been Page 24
Page 25
Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Finance Offices to ensure service user information can only be viewed by authorised officers reminded of the clear desk policy. Page 25
Page 26
Page 26
Page 27
APPENDIX 4 Moray Council Internal Audit Section DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Buckie High School REPORT REF: 23'024 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Listings of equipment held by the School are kept up-to-date and secure with physical items appropriately identified. 5.01 An inventory record should be developed of all moveable items with a value over £500. Thereafter a copy of this record should be saved off site. Medium Yes 30/06/2023 Implemented – Follow up review has confirmed that inventory record now includes all moveable items with a value over £500 and a copy kept at the Council Headquarters. Key Control: School Funds are administered in compliance with the School Fund Regulations Item 5. Page 27
Page 28
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 Monthly School Fund Reconciliation records should include a requirement for the “writing back” of uncashed cheques over 6 months old. In addition, correcting adjustments noted within the School Fund Cashbook should also be amended. Low Yes 30/08/2023 Implemented– Audit testing has confirmed uncashed cheques over 6 months old are written back as part of the bank reconciliation process, and adjustments to School Fund Cashbook have been corrected. 5.03 Supporting documentation to evidence income and expenditure transactions should be held with the central School Fund records. Low Yes Implemented Implemented- Supporting documentation relating to School Fund income and expenditure transactions now held with the central School Fund records. Page 28
Page 29
APPENDIX 5 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Building Services - Stores REPORT REF: 22'019 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Review of the Building Services Stores to ensure effective controls are operating in the management and control of materials and equipment. 5.01 Building Services equipment and materials purchased as a direct order for specific schemes and stored at the Depot should be recorded within Servitor. Medium Yes 31/03/2023 Implemented - Audit testing undertaken confirms that items purchased by direct order for contracts and stored within the Depot are now recorded within Servitor. Item 5. Page 29
Page 30
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.02 Higher value items should be stored whether possible in alarmed storage areas. Medium Yes 31/05/2022 Implemented– An audit visit noted that high value items are now stored within the alarmed areas. 5.03 Officers should be reminded that greater care should be taken to record items received and issued within Servitor. Medium Yes 30/06/2022 Implemented– Introducing a new barcoding system has reduced the need to manually enter stock reference numbers when receiving and issuing items. 5.04 All materials and equipment recorded within Servitor should be updated with minimum and maximum stock levels. This should assist in the effective management of stock levels at the appropriate levels. Low Yes 31/03/2022 Revised Implementation date 30/06/2024 Outstanding– The Service is planning to undertake a review of the stock levels maintained for all items; this will include the introduction of minimum and maximum stock level parameters within the stores management software system. Page 30
Page 31
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.05 Contracts should be agreed with companies used regularly for the supply of goods and materials where annual expenditure exceeds the Quick Quote threshold of £5000. Medium Yes 31/03/2023 Revised Implementation date 30/06/2024 Outstanding– The Service has undertaken an analysis to identify suppliers used for all off contract expenditure. Investigation is now planned to explore the availability of national framework contracts or identify the need to develop local agreements. Page 31
Page 32
Page 32
Page 33
APPENDIX 6 Moray Council Internal Audit Section DEPARTMENT: Education, Communities and Organisational Development SUBJECT: Early Learning and Childcare Service REPORT REF: 22’201 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Appropriate controls operating to ensure effective budgetary arrangements. 6.1 Anticipated demand should be the cost driver in deciding budgets for Partner Provider Payments and Council Owned Nurseries. Registration forms and other available databases should be used for this purpose. High Yes 31/01/2023 Implemented. NHS Community Health Index information on numbers of children in age bands from birth and catchment area is being used to forecast future early learning demand. Nursery registration forms are also being used as a further indicator of demand along with increased data capture of actual hours of nursery care being provided. Increased information availability is allowing financial Item 5. Page 33
Page 34
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation forecasts to be produced on an ongoing basis and any potential issues highlighted at an early date. 6.2 The current catering arrangements need to be assessed to ensure the correct balance is achieved between costs and quality both within and outwith term time. High Yes 31/08/2022 Implemented. Catering costs and service delivery have been reviewed and operational changes made which have allowed a reduced cost per meal to be borne by Early Years whilst still covering catering service costs. No budgetary pressures are existing regarding the provision of nursery meals. Service needs will continue to be reviewed on an ongoing basis. 6.3 Benchmarking of costs in the delivery of an ELC Service with other Local Authorities should be undertaken to highlight any significant variances for further investigation. Medium Yes 31/12/2022 Implemented. Benchmarking has been undertaken in terms of costs incurred and service delivery models, in the course of the external consultant’s review of Early Learning and Childcare reported to ECLS Committee on 19th April 2023. A significant amount of Page 34
Page 35
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation benchmarking work has also been undertaken by the service in considering sustainable rate methodologies for payments to partner providers using information from both Northern Alliance local authorities and comparator authorities across Scotland. Exchange of information between Northern Alliance participants will continue as financial sustainability remains a key priority within service planning and delivery. 6.4 The ongoing ASN service review should inform the appropriate support cost to be met by the ELC sector, in line with support for other educational sectors. High Yes 31/12/2022 Outstanding. The ASN review remains ongoing with an anticipated completion date of end of academic session 2025/26. Whilst Early Years ASN costs are an integral part of this review, budgetary responsibility now sits within the ASN service and this recommendation no longer forms part of this audit review. Page 35
Page 36
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 6.5 A review of current staffing and recruitment arrangements of Council owned nurseries should be undertaken to ensure the appropriate balance between costs and quality of service is achieved. High Yes 31/08/2022 Part Implemented. The review of staffing arrangements for Council owned term-time nursery settings is complete and savings are being recognised from August 2023. A review of arrangements for year-round nursery settings is ongoing with an intended completion date of August 2024. 6.6 Further financial management training should be provided to the Early Learning and Childcare Manager. High Yes 31/07/2022 Implemented. The Early Learning and Childcare Manager has received full budget manager training and is meeting monthly with Accountancy for budget monitoring purposes. All Nursery Managers have been fully trained in budget responsibilities and have tailored personal training packs. Accountancy have also provided all requested training to the Head of Education. Training needs will be kept under review in the event of service changes. Page 36
Page 37
Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 6.7 Financial management arrangements of the ELC Budget should be reviewed to ensure future variances can be easily highlighted. High Yes 30/09/2022 Implemented. Nursery Managers receive monthly budget monitoring reports for their individual nurseries. New balance reports have been created which summarise spend in each nursery for management review. The Continuous Improvement Officers scrutinise the reports and raise any over / under spend issues arising with the Early Years Service Manager. The Early Years Service Manager receives a suite of monthly reports from Accountancy relating to central costs and partnership nurseries. Monthly budget monitoring meetings are also held between the Early Years Service Manager and Accountancy to ensure any variances are identified and considered for forecasting to Page 37
Page 38
Moray Council Internal Audit Section 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation ensure more effective budget management arrangements. Page 38
Page 39
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 14 FEBRUARY 2024 SUBJECT: INTERNAL AUDIT SECTION – COMPLETED PROJECTS REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 22 November 2023 to 14 February 2024. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the following internal audit work concluded during the period 22 November 2023 to 14 February 2024: Moray Integrated Community Equipment Store 3.2 A review of the Occupational Therapy Store, now known as the Moray Integrated Community Equipment Store, has been undertaken. Occupational Therapy stock comprises aids and equipment issued to service users to help with various daily tasks, including cooking, dressing and bathing. The individual items of equipment held can vary in value from a few pounds to upwards of £1,000 for certain types of hoists and specialised seating. The total stock turnover for 2022/23 amounted to approximately £500,000. A particular feature of this store is that it also deals with returns of equipment that is no longer required, and where possible, this equipment is decontaminated and made available for reuse. The audit reviewed the systems and controls in managing the store, covering purchases, issues and storage of stock items. Significant findings were found where improvements are required to current operating arrangements. However, it is pleasing to report that the Service has agreed to all the recommendations. The executive summary and recommendations for this project are given in Appendix 1. Item 6. Page 39
Page 40
Children's Services Commissioning 3.3 An audit of the arrangements for commissioning children's social care services has been undertaken. The audit reviewed the key controls in operation within Children's Services with regard to the external commissioning of social care services. Services delivered included contracts for preventative, support and restorative services and residential care, and the commissioning of out of area residential placements required due to the limited capacity of specialised care within the Moray locality. The annual budget for commissioning children's social care services covered by the audit utilising national framework and local contract arrangements totals £7.4 million, of which £4.3 million relates to out of area placements. The audit found within the parameters of the audit scope that the delivery and management of children's social care commissioning services to be well managed. The executive summary and recommendations for this project are given in Appendix 2. Food Standards Scotland Guidelines 3.4 A review has been undertaken of systems and procedures used by the Council's Environmental Health Service to evidence compliance with the Food Law Code of Practice (Scotland) developed by Food Standards Scotland. Local Authorities are required to monitor compliance with food hygiene and standards on behalf of Food Standards Scotland. In 2019, the Food Law Code of Practice (Scotland) introduced a new Food Law Rating System whereby local authorities classify all food business operators within their locality into defined category ratings that determine the requirements and frequency of inspections to assess compliance with the food safety standards. At the time of this audit, it was noted that over 1,300 food business operators were registered with the Council. The audit tested the key controls and operational practices within the Environmental Health Service to evidence the Council's compliance with the requirements of the Code. The audit reviewed service delivery planning arrangements and checked the processes and procedures developed for registering and monitoring food business operators’ compliance with food safety standards and regulations. Audit testing found no significant issues of concern. However, as with other Local Authorities, full implementation of the Code has taken longer than anticipated, but the Service is working on an agreed programme to ensure full compliance with the Food Law Rating System. The executive summary and recommendations for this project are given in Appendix 3. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. Page 40
Page 41
(e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-192 Page 41
Page 42
Page 42
Page 43
APPENDIX 1 AUDIT REPORT 24’013 MORAY INTEGRATED COMMUNITY EQUIPMENT STORE (OCCUPATIONAL THERAPY STORE) Executive Summary The annual Internal Audit plan for 2023/24 provided for a review to be undertaken of the Occupational Therapy Store, now known as the Moray Integrated Community Equipment Store. Occupational therapy stocks comprise aids and equipment issued to service users to help with various daily tasks, including cooking, dressing and bathing. The individual items of equipment held can vary in value from a few pounds to several thousand for certain types of hoists, specialised seating, etc. The total stock turnover for 2022/23 amounted to approximately £500,000, with nearly 500 separate lines of stock items. A particular feature of this store is that it also deals with returns of equipment that is no longer required, and where possible, this equipment is decontaminated and made available for reuse. The audit used the Chartered Institute of Public Finance (CIPFA) System Based Control Matrices as the basis for developing the audit programme. This included looking at overall management arrangements for the store covering purchases, issues and security access arrangements. It also considered the controls around the use of the store management software system (Equipment Loans Management System (ELMS)). The audit noted the challenges facing the service in terms of providing timely support to individuals with a diverse range of needs. However, from the review undertaken, improvements are needed in the store's operation and a requirement to make further use of ELMS. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Areas highlighted as requiring particular attention were as follows: • Audit testing found a higher than expected number of variances between the stocks recorded in ELMS and the actual physical stock held in the store. Further development is required of ELMS to assist in more effective stock management arrangements. In addition, from a visit made to the store, difficulty was experienced locating items as they had not always been clearly labelled within the building and the same type of equipment was not always kept in the same place. • It was found that stock orders and invoices are not processed through ELMS but through another store's software application within the Council. Further review should be undertaken to investigate the possibility that ELMS could be used for all stock related processes. However, as there is a requirement for Item 6. Page 43
Page 44
compliance with accounting standards, the software application used for purchasing equipment and payment of invoices should be regularly updated with stock issues to ensure an accurate valuation is maintained of the stock held. • A review of the management arrangements of stock items issued to service users found a need for further improvements to current operating arrangements. Procedures should be developed to strengthen controls to ensure that equipment no longer required by service users is returned or action is undertaken to recover the cost of the items. The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 2 13 2 Page 44
Page 45
Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective systems and procedures operating to ensure accurate records are maintained to account for all occupational therapy equipment held within Stores and issued to service users. 5.01 A full stock check should be undertaken to ensure records correspond to the actual number of items held within Stores. Items of equipment should be kept wherever possible in asset number order within the stores building. Asset numbers should be clearly recorded where possible on shelving. High Medium Yes Yes Full stock check to be undertaken. Review of stores layout to be carried out. Item codes to be clearly marked on all shelving. All areas of store to be given location numbers and recorded in ELMS. Service Co- ordinator Service Co- ordinator 31/03/2024 31/032024 Page 45
Page 46
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.02 The software application used for purchasing equipment should be regularly updated with the stock issued to ensure an accurate unit price is maintained. Further exploration should be undertaken of ELMS with the purpose of enabling the direct purchase of equipment. Medium Medium Yes Yes Procedures to be put in place to ensure purchasing system is updated regularly. Further exploration of ELMS to be carried out. Purchasing function to be tested. Service Co- ordinator Information Systems Officer 31/03/2024 31/10/2024 5.03 A review should be undertaken of the current policy of revaluing re-used items of equipment at 50% of the original unit price. Medium Yes Report to be taken to MIJB (through Operational Management Team) to look at change of policy. Service Manager 31/01/2024 Page 46
Page 47
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.04 Service users should be advised that any equipment received should be included within their personal property content insurance. Medium Yes Report to be taken to the MIJB to change current arrangements. Service Manager 31/01/2024 5.05 Maximum and minimum stock levels should be implemented in ELMS to assist officers in ensuring the effective management of stock levels. Medium Yes Maximum and minimum levels to be implemented within ELMS. Service Co- Ordinator 31/03/2024 5.06 A record should be maintained of the stock checks undertaken, and any adjustments to stock figures for equipment recorded within ELMS should require the authorisation of the supervisor. Medium Yes Record to be created and maintained of all stock checks. Procedures to be put in place to ensure all stock adjustments are authorised. Service Co- Ordinator 31/01/2024 Page 47
Page 48
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.07 In regard to the stock of returned specialised chairs noted during the audit review, a decision should be undertaken regarding their future use. Medium Yes Report to be taken to MIJB to provide guidance on this issue. Service Manager 31/01/2024 5.08 Further development should be undertaken of ELMS to enable greater use of the software application in the management of stock items. Medium Yes Further investigation will be undertaken of the functions and reporting facility within ELMS. Information Systems Officer 31/03/2024 5.09 Officers should be instructed to utilise the facility within ELMS to mark stock as out for delivery. Low Yes Amendments will be made to the system and staff briefed in its use. Information Systems Officer 30/06/2024 Page 48
Page 49
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.10 A review of off contract expenditure should be carried out and where necessary contracts developed. Medium Yes A review of off- contract expenditure will be undertaken, and contracts developed where required. Service Manager 31/03/2024 5.11 A formal procedure should be established for maintaining a list of NHS officers requiring access to ELMS. Low Yes A record will be maintained of all individuals including NHS employed officers with access to ELMS. Procedures will developed to ensure the regular review Information Systems Officer 29/02/2024 Page 49
Page 50
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation of officer access needs. All accounts not accessed within a six month period to be deleted. 5.12 Current operating practices should be recorded within a Service Operating Manual. Medium Yes Internal Service Operating manual (“How to” guides) to be created and distributed to all relevant staff. Service Co- ordinator 31/03/2024 5.13 A review of service procedures should be undertaken to ensure the store is informed of a change in circumstance in a service user’s condition where an Medium Yes Service procedures to be discussed and reviewed with OT Managers. Information system Officer 29/02/2024 Page 50
Page 51
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation item of equipment may no longer be required. Arrangements should then be undertaken for collection at the earliest opportunity. If no agreement can be made for an item of equipment to be returned to the store, consideration should be given to invoicing the service user. Medium Yes Stores to look at staffing resources and be more proactive regarding collections. Report to be taken to MIJB for guidance on future procedures. Service Co- ordinator Service Manager 31/01/2024 31/01/2024 5.14 Improvements identified to the Service during the audit review regarding the physical security of the Moray Integrated Community Equipment Store building should be implemented as a matter of urgency. High Yes Improvements have been advised and will be implemented to the physical security. The service will work with Estates to ensure compliance. Service Manager 31/01/2024 Page 51
Page 52
Page 52
Page 53
APPENDIX 2 AUDIT REPORT 24’012 CHILDREN'S SERVICES COMMISSIONING Executive Summary The Internal Audit Plan for 2023/24 provided for a review of the arrangements for commissioning children's social care services to ensure they are designed and delivered to meet the specified needs and demonstrate best value principles. With the recent transition of Children's Services to become part of the Moray Integrated Joint Board Scheme of Integration, this work complements the audit review undertaken by KPMG Governance, Risk & Compliance Services of adult social care commissioning. The audit scope was to review and assess the commissioning of social care services for children. Services delivered included contracts for preventative, support and restorative services, residential care, and out of area residential placements required due to the limited provision of specialised care and capacity within Moray. Testing involved a review of the strategy and procedures relating to children's services commissioning, checking financial monitoring arrangements and an assessment of the effectiveness of contract management and monitoring practices. It was noted that the annual budget for commissioning these children's social care services utilising national framework and local contract arrangements totals £7.4 million, of which £4.3 million relates to out of area placements. The review covered systems and practices for 2023/24, but reference is made to prior years if required as part of the audit review. Overall, the audit found within the parameters of the audit scope that the delivery and management of children's social care commissioning services is well managed. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The areas identified for management attention are:- • The Scottish Government Commissioning Plans Guidance requires each local authority to produce a Strategic Commissioning Plan. The Service has recognised this requirement, and a Commissioning and Procurement Plan is currently under development as part of the Strategic Delivery Plan to support the Moray Partners in Care Strategy. The implementation of a Commissioning and Procurement Plan should be progressed and agreed in accordance with the timescale detailed by the Service. • It is pleasing to report that revised commissioning procedures were agreed in May 2023. These procedures included a requirement for contracts with providers to detail a condition for the supply of regular performance information on the care delivered. This allows the service to effectively monitor the delivery of care is in accordance with the contract's objectives. However, before these procedures were agreed, contracts with care providers did not include a requisite to provide comprehensive performance information. For these contracts, the Service encourages the provision of performance information Item 6. Page 53
Page 54
from care providers; this proactive approach should continue. Once contracts become due for renewal, the requirement for providing comprehensive performance information should be included within the conditions of the contract. • The review found that payments had been made by Children's Services to care providers before the commissioned services were fully delivered. Audit testing noted from the sample checked, advance payments of up to 31 days. Advance payments are not in accordance with the contracted terms agreed with care providers, as monthly payments for a service should be made in arrears. In addition, the Council’s Financial Regulations do not allow advance payment for the delivery of goods or services unless authorised by the Head of Financial Services. The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 0 3 0 Page 54
Page 55
Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: A clear Strategy and Procedures have been developed for Children's Services Commissioning and are regularly reviewed. 5.01 The development and agreement of a Commissioning and Procurement Plan should be progressed and agreed in accordance with the timescale detailed within the Health & Social Care Moray Strategic Delivery Plan. Medium Yes The Commissioning and Procurement Plan is being developed but requires significant analysis of future care commissioning requirements. The Children's and Families Commissioning team will support the process. Chief Social Work Officer / Head of Service 31/12/2025 Key Control: Commissioned services are identifiable, subject to appropriate contractual arrangements and managed and monitored to ensure service delivery meets the intended outcomes. 5.02 All contractual arrangements should be aligned with the new Commissioning Procedures at the earliest Medium Yes All new contracts will comply with the new Senior Commissioning Officer 31/10/2024 Page 55
Page 56
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation opportunity to ensure consistency in the management and monitoring of performance information. Procedures. Ongoing discussions with care providers regarding inherited contracts to provide similar performance information. 5.03 In accordance with established contractual arrangements, payments should not be made in advance of service delivery. Medium Yes Reiteration of the Terms & Conditions of the contracts & financial regulations to wider Social Work teams and the providers through email communication and discussion at Policy Procedure & Commissioning Senior Commissioning Officer 31/12/2023 Page 56
Page 57
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Meeting on 20/11/2023. Page 57
Page 58
Page 58
Page 59
APPENDIX 3 AUDIT REPORT 24’016 FOOD STANDARDS SCOTLAND GUIDELINES Executive Summary The Internal Audit Plan for 2023/24 provides for a review of systems and procedures used by the Council's Environmental Health Service to evidence compliance with the Food Law Code of Practice (Scotland) developed by Food Standards Scotland. The Food Law Code of Practice (Scotland) details requirements for local authorities to follow on behalf of Food Standards Scotland to ensure an effective, consistent and proportionate approach to the delivery of Food Law and Official Controls in order to protect food safety and the wider interests of consumers. The Code came into effect in 2019 and introduced a Food Law Rating System requiring local authorities to classify all food business operators within their locality into defined category ratings that determine the requirements and frequency of inspections to assess compliance with the food safety standards. The audit scope has been to assess the key controls and review operational practices within the Environmental Health Service to evidence the Council's compliance with the requirements of the Code. The audit involved an examination of service delivery planning arrangements and detailed testing of the processes and procedures developed for the registration and monitoring of food businesses operators compliance with food safety standards and regulations. Performance monitoring arrangements to ensure compliance with the Code have also been reviewed. At the time of the audit, it was noted that over 1,300 food business operators were registered with the Council. The review has covered the processes within the current 2023/24 financial year, with reference made to prior years where relevant. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). It is pleasing to note that no significant issues of concern have been identified in the course of the audit. The areas identified for management attention include:- • Policies and procedures for Food Safety Enforcement, Food Sampling and Food Complaints have not been reviewed for a number of years. It is appreciated that officers are aware of legislative requirements, however policies and procedures should be regularly reviewed and if required updated. The review of documentation should also include information made available by the Service on the Council's website. • The Food Law Code of Practice was introduced in 2019, but full implementation has taken longer than initially envisaged due to the pandemic and available staff resources. The Code requires that all food business operators be physically inspected and classified under the new Food Law Rating System. The Service is working on an agreed programme to ensure compliance with the Food Law Rating System. Delay in the full implementation of the Food Law Code of Practice has been recognised nationally, and implementation Item 6. Page 59
Page 60
timescales within the Moray Council are consistent with other Local Authorities in Scotland. The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 0 3 6 Page 60
Page 61
Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Current service plan defines service delivery and aligns to the requirements set by Food Standards Scotland. Service delivery is assisted by current and comprehensive policies and procedures. 5.01 All policies and procedures should be reviewed and updated on a regular schedule to ensure content remains current and valid. Medium Yes Current and proposed budget reductions will require a review of all policies and procedures, including food law enforcement, to reflect what tasks can be carried out. The review will commence when the budgetary position is confirmed. Principal Environmental Health Officer 31/03/2025 5.02 The Environmental Health content on the Council website should be reviewed Medium Yes Website content will be updated to reflect the Principal Environmental Health Officer 31/03/2025 Page 61
Page 62
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation and where required updated. service offered following budget reductions. As in 5.01 above, update will commence when budgetary position is confirmed. 5.03 The Food Law Enforcement Service Delivery Plan should be reported for approval to the appropriate Council Committee. Low Yes The Service Plan has been approved by the Planning and Regulatory Services Committee on 19th December 2023. Principal Environmental Health Officer Implemented Page 62
Page 63
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Food Business Operator ratings have been assigned and monitoring is being undertaken, as required by the stipulations of the Food Law Rating System. 5.04 The Food Programmed Inspections Procedures should be updated to reflect the current officers within Services who receive reports on inspections undertaken. Low Yes As detailed in 5.01 above, a full review of all policies and procedures is to be undertaken. Principal Environmental Health Officer 31/03/2025 5.05 Consideration should be given to the amendment of the Aide Memoire Form to include the details of the Officer completing the inspection document. Low Yes The Aide Memoire template document has been accordingly amended on 1st December 2023. Principal Environmental Health Officer 01/12/2023 5.06 Consideration should be given to the Service implementing a periodic housekeeping check on the register of food business Low Yes A report for premises with no rating will now be produced monthly for Principal Environmental Health Officer 31/01/2024 Page 63
Page 64
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation operators content to ensure all valid entries have a food law rating assigned to inform the inspection programme. attention of the Principal Environmental Health Officer. 5.07 Enquiries should be undertaken with the software application supplier used to inform future intervention for food businesses classified as 3A, 3B and 3C rating groups, with a view to having these aligned to the Food Law Code of Practice frequencies. Low Yes Software has been installed to address the issue on 1st December 2023. Principal Environmental Health Officer 01/12/2023 5.08 In accordance with established procedures, any reductions in Food Law Rating for a food business should be countersigned by the Principal Environmental Health Officer to evidence management agreement to Low Yes Procedure now in place as of January 2024. Principal Environmental Health Officer 03/01/2024 Page 64
Page 65
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation the change in future inspection schedule. Key Control: Effective performance measures are in place to assess achievement of key service activities. 5.09 Performance management information should be evidenced by suitable documentation which supports the calculation of the reported figures. Medium Yes Evidenced reports now being produced on a monthly basis as of January 2024. Principal Environmental Health Officer 03/01/2024 Page 65
Page 66
Page 66
Page 67
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 14 FEBRUARY 2024 SUBJECT: INTERNAL AUDIT PLAN YEAR ENDING 31 MARCH 2025 BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 This report provides the Committee with details of the planned internal audit coverage for the year ending 31 March 2025. 1.2 This report is submitted to Committee in terms of Section III (I) (7) of the Council’s Scheme of Administration relating to having responsibility for focusing audit resources through a process of agreeing on an annual audit plan. 2. RECOMMENDATIONS 2.1 The Committee is asked to consider and: i) note the proposed internal audit coverage for the 2024/25 financial year; and ii) seek clarification on any matters arising from the report or the attached appendices. 3. BACKGROUND 3.1 The Public Sector Internal Audit Standards (PSIAS) applicable to Local Government in Scotland requires the Audit and Risk Manager to report functionally to the Audit and Scrutiny Committee on various issues concerning audit planning. This requirement includes preparing a risk based internal audit plan for submission to Committee and providing the Committee with details of internal audit resourcing or other issues that may impact on the scope of audit work. Definition of Internal Audit 3.2 Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. Item 7. Page 67
Page 68
Public Sector Internal Audit Standards (PSIAS) Requirements 3.3 PSIAS sets out the requirement for the: • Audit and Risk Manager to prepare a risk-based audit plan which considers the Council’s strategic objectives, associated risks and the views of senior management and the Committee. • Audit and Risk Manager to review and adjust the plan as necessary in response to changes in the Council’s business, risks, operations and priorities. • Audit Plan to incorporate or be linked to a strategic or high-level statement of how Internal Audit will be delivered and developed in accordance with the Internal Audit Charter approved by this Committee at its meeting on 23 November 2022 (para. 8 of the minute refers) and how it links to the organisational objectives and priorities. Internal Audit Plan 3.4 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Internal Audit’s approach to annual audit planning is risk-based, with all areas which may be subject to audit review contained within an ‘audit universe’. The audit universe is reviewed and updated on an ongoing basis to include all significant activities and systems that contribute to the achievement of the Council’s priorities and objectives. 3.5 The audit universe is risk assessed each year to help determine the annual audit plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Consideration is also taken to the demands within services to ensure a proportionate audit coverage is taken across the functions of the Council. Note that the audit universe, whilst a key factor, is not the only consideration when determining the audit plan. Senior management has been consulted on priority areas for review, and cognisance is taken of external audit plans and other statutory agencies to avoid duplication and increase the potential for cross-reliance. In addition to senior management, consultation has also been undertaken this year with the Leader of the Council and the Chair of the Audit and Scrutiny Committee; the Audit and Risk Manager has considered their views in the preparation of the Annual Audit Plan for 2024/25. 3.6 The audit universe risk assessment is based upon a number of factors including: • materiality (based on expenditure or income) • sensitivity (based on whether a service is a statutory duty, statutory power or non-statutory, is customer facing and whether it features as a specific challenge in the Council’s Service Plans) • time elapsed since an area was last subject to review • Corporate Risk Register - assessment of any movement in the assessment of principal risks facing the Council • overall audit assessment of the control environment Page 68
Page 69
3.7 These various sources are designed to enable the Audit and Risk Manager to meet a requirement to provide an annual internal audit opinion on the adequacy and effectiveness of the systems of internal control for inclusion in the annual governance statement published with the Council’s annual financial statements. A review is also undertaken of the internal audit plans for other local authorities as per their committee reporting available online. This provides an opportunity to gain an understanding of issues being faced by other local authorities and identify any auditable areas for the Moray Council. 3.8 PSIAS encourage internal audit to consider if there are other bodies whose work internal audit could place reliance on for assurance purposes. While internal and external audit roles are separate and distinct, internal audit maintains a close working relationship with the external auditor as required to secure an optimum combined benefit from the audit resource and avoid duplication. 3.9 The Annual Audit Plan details what Internal Audit anticipates being able to review in the year, assuming stability in resources available to the Section. The time allocation for all audits assumes that systems to be reviewed are adequately documented, detailing the controls put in place by management and that testing identifies that these controls are being complied with. If this is not the case, there will be an impact on the time taken to review planned areas and on the plan’s achievability. 3.10 The Plan also includes time to assist services in developing their controls and approach to improving compliance. This reflects the continuing development of a more proactive value-added approach by Internal Audit to supplement the more traditional core compliance-oriented audit work. However, this needs to be balanced with the requirement for Internal Audit to complete sufficient work to provide an evidence based annual opinion on the adequacy and effectiveness of the Council’s internal control system. Internal Audit will continue to review the Council’s risk registers and update its own risk assessments based on audit findings throughout the Plan’s term. 3.11 Whilst undertaking planned work, it is possible that Internal Audit may identify governance issues that are not within the stated scope of the review being undertaken. PSIAS require that Internal Audit report such instances to those charged with governance. In this respect, Internal Audit reports may contain issues that appear to be “outwith scope”. Where at one time five year audit plans were commonplace, the PSIAS standards now advocate annual planning, noting that ‘the plan should be sufficiently flexible and kept up to date with the organisation and its changing risks and priorities’. 3.12 Sufficiently flexible is not defined; however, it suggests that ‘contingency days’ should be held to deal with emerging issues. Thus a proportion of the available audit days are being retained as contingency days, which if not used, can accommodate additional audit projects that may be brought into the audit plan later in the year. These projects may be identified by the Audit and Risk Manager as an emerging issue or come from a recommendation by Committee. Details of the available audit days are provided in Appendix 1. Page 69
Page 70
3.13 An additional element of the planning process takes place for the Moray Integration Joint Board (MIJB); the Council’s Audit and Risk Manager is also the Board’s Chief Internal Auditor. A separate Internal Audit Plan is prepared for the MIJB and is reported to their Audit, Performance and Risk Committee. The established working protocol is for audit reviews of interest to the MIJB to be reported to the Council’s Audit and Scrutiny Committee before the Audit, Performance and Risk Committee. However, depending on the proposed dates of future committees, the Audit and Risk Manager will consider some flexibility in this reporting arrangement to ensure that the requirement of meeting the functions of both Committees can be achieved. 3.14 The audit role for the MIJB involves providing assurances that governance and financial arrangements have been developed and are operating in line with policies and that selected systems and processes are suitably controlled. Previous years audit testing have noted significant findings in the administration and management of adult social care. These audits and the follow up reviews to evidence implementation of the recommendations have been a particularly time consuming commitment on the Internal Audit Section. It is anticipated this requirement will continue in 2024/25. 3.15 Links have been established in previous years with the internal audit providers and finance managers in NHS Grampian, Aberdeen City and Aberdeenshire Councils IJBs. The aim was to develop joint working arrangements for undertaking reviews that could provide more effective use of internal audit resources and allow a holistic view of the control environment across all the Organisations. The Internal Audit Plan includes a review of the governance arrangements to prevent fraud and corruption. The audit will review systems and procedures for both the Council and the MIJB. It has been agreed, subject to the approval of each Organisations Audit Plans for this review to be part of a joint working arrangement with the Internal Audit Services of Aberdeen City Council, Aberdeenshire Council and the Internal Audit Provider of NHS Grampian. 3.16 In addition, the Council’s Internal Audit Service undertakes the internal audit work for the Grampian Valuation Joint Board, which requires the provision of annual assurances on the main financial systems operated for payroll, payments and income from funding requisitions from the constituent authorities and other sources. The Joint Board’s systems align with those of the Council but require annual review and testing in order to provide assurances for the separate annual financial statements the Board is required to prepare and publish. 3.17 While the prevention of fraud and error rests with management through the design and operation of suitable systems of control, the audit plan continues to provide time for Internal Audit to coordinate the Council’s participation in the National Fraud Initiative, a data matching exercise involving a range of public sector bodies. This activity is viewed as complementary to other audit activities, and participation assists Internal Audit in assessing the potential for the occurrence of fraud and related fraud risk. Testing will primarily be undertaken by Services, with Internal Audit undertaking an overview of the process. However, any irregularity or potential fraud will still be referred to Internal Audit for investigation. Due to the budgetary constraints facing the Council, there is no longer funding to fill a vacant Corporate Investigations Officer post within the Internal Audit Section. This reduction in resources will impact the Section’s Page 70
Page 71
ability to support good governance and review systems and practices to ensure the Council has effective standards for countering fraud and corruption. In order to fully assess the impact of this vacancy, a review of the Council’s compliance with the Chartered Institute of Public Finance and Accountancy’s (CIPFA’s) Code of Practice on Managing the Risk of Fraud and Corruption is included within the Audit Plan for 2024/25. 3.18 As the new smarter working arrangements have become embedded across the Council, the Internal Audit Section has adapted, and greater use has been made of electronic methods of communication. However, sometimes this has proved challenging and has slowed the pace of audits. Committee should therefore be aware of potential delays in progressing and completing audit reviews. Internal Audit Resourcing 3.19 The staff complement of the team is currently 3.8 FTE, including the Audit and Risk Manager, who has a range of responsibilities, including the management and supervision of the team, planning work, development of the service, servicing Committees, overseeing the development of business continuity and risk management arrangements. On the basis that all posts are filled and allowing for overheads for holidays, training, administration and the like, some 790 working days are available to be allocated for the 2024/25 year. This time is spread over a number of headings, principally audit projects but also work related to governance, business continuity and risk management. In addition, the Audit and Risk Manager has been appointed as the Chief Internal Auditor for the Moray Growth Deal. This requires an overview of the internal audit activity undertaken by partner Organisations, in addition to a commitment to reviewing systems and practices on a regular basis. 3.20 Priority areas have been determined by internal audit and are listed in Appendices 2 and 3. 3.21 The PSIAS require the Audit and Risk Manager to consider whether or not the audit staffing resources are sufficient to meet the audit needs of the organisation and where it is believed that the level of resources may adversely impact the provision of the annual internal audit opinion, to draw that to the attention of the Committee. Demands on the Internal Audit Service have increased over the years, and this is expected to continue. After a review of the staffing establishment, the Council agreed that the Internal Audit Service required additional staff resources in the form of an Assistant Auditor. Unfortunately, due to the current financial climate, it has been decided not to fill this post and the budget has been taken as a financial saving. This is also in addition to providing additional budgetary savings by not replacing the Corporate Investigations Officer. As the Audit and Risk Manager, I am required, in accordance with the PSIAS to inform the Committee of my concerns about whether available resources will be sufficient to meet the auditing needs of the Council, Moray Integration Joint Board and the Grampian Valuation Joint Board. 3.22 The current financial climate is appreciated, and there is a need for all managers to consider alternative methods of service delivery where budget savings can be achieved. A Budget Savings / Transformation Template has been submitted to management with a proposal to replace the Corporate Investigations Officer with an Assistant Auditor on a lower grade and reallocate service responsibilities within the Section. This would result in reduced staff resources to meet the Council and partner Organisations requirements for Page 71
Page 72
counter fraud and corruption controls. However, it is hoped more effective use of resources could be implemented to maintain service delivery while also providing additional budgetary savings to the Council. 3.23 In considering the sufficiency of the audit coverage, Committee is reminded that the responsibility for developing and maintaining a sound control environment rests with management and not with Internal Audit. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) No direct implications. (b) Policy and Legal The activities of Internal Audit assist the organisation to demonstrate the control environment and risk management arrangements are consistent with good practice. (c) Financial Implications No direct implications. (d) Risk Implications The work of internal audit mitigates the risk of dilution of controls established within systems to ensure best value is secured in the use of public resources. (e) Staffing Implications No direct implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations Planned audit work is informed throughout the year from various sources, including Heads of Services. 5. CONCLUSION 5.1 This report invites the Committee to consider and note the planned internal audit coverage for 2024/25. Authors of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-194 Page 72
Page 73
APPENDIX 1 MORAY COUNCIL INTERNAL AUDIT ANNUAL AUDIT PLAN – 2024/25 Staff Resources Available Days 3.8 FTE staff x 52 weeks x 5 days 988 Less: Overheads: Annual Leave (including public holidays) 152 Training 20 Sick Leave (Estimate) 18 Administration 8 198 Available Days 790 Allocation of Days Core Financial Systems (Appendices 2 & 3) 110 Departmental Audit Projects (Appendices 2 & 3) 275 Moray Integration Joint Board 80 Service Developments and Supervision 40 Risk Management & Business Continuity 40 Governance Statement / Corporate Initiatives/ Committee Attendance and Reporting 50 Public Sector Internal Audit Standards- Internal Review 15 Public Sector Internal Audit Standards- Review of Highlands Council 20 National Fraud Initiative (oversight and reporting) 20 Grampian Valuation Joint Board 10 Follow-up Work 50 Contingency 80 790 Item 7. Page 73
Page 74
Page 74
Page 75
APPENDIX 2 MORAY COUNCIL – INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2024/25 LIST OF PROPOSED PROJECTS CORE FINANCIAL SYSTEMS Audit Area Total Days Procurement and Creditor Payments 40 Payroll 35 ICT Hardware Assets 25 Year-end Stock Taking 10 110 OTHER SYSTEMS Departmental Projects per Appendix 3 275 Risk Management & Business Continuity 40 Governance Statement / Corporate Initiatives/ Committee Attendance and Reporting 50 PSIAS- Internal and External Review of Highlands Council 35 Service Development and Supervision 40 Moray Integration Joint Board 80 Grampian Valuation Joint Board 10 National Fraud Initiative 20 Follow up work 50 Contingency/ Consultancy 80 Total – Other Systems 680 GRAND TOTAL 790 Item 7. Page 75
Page 76
Page 76
Page 77
APPENDIX 3 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2024/25 CORE FINANCIAL SYSTEMS Area Type of coverage Corporate Risk Register (Control Assurance) Payroll Continuous auditing to confirm the adequacy of the systems and procedures for the payment of salaries. Financial & Regulatory Procurement and Creditor Payments Continuous auditing of samples of non-pay expenditure to test compliance with procurement and payment processing regulations. Financial ICT Hardware Assets Management Review of systems and practices to record / monitor the location and use of ICT hardware. Operational & IT (Technological) Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances. Regulatory OTHER SYSTEMS Area Type of coverage Housing and Property Reactive Maintenance Works Audit of works undertaken within Building Services for the completion of reactive maintenance works (Council Housing). Operational Continuity and Performance Grant Claims Certification of grant claims as required: strategic timber; bus operators, regeneration schemes as appropriate. Regulatory Housing Rent Collection & Arrears Management A review of the income collection and accounting arrangements for housing rents. Operational Continuity and Performance Moray Growth Deal An audit of the governance and administrative procedures within the Council for the management of the Moray Growth Deal. The scope will include a review of partnership working arrangements, financial management and measuring success criteria. Economic Recovery/ Sustainability Item 7. Page 77
Page 78
Education – Secondary School Establishment visits as part of cyclical review. Operational Continuity and Performance Treasury Management To provide assurance that processes and controls are continuing to operate effectively for the Council's treasury management system. Regulatory & Financial Commercial Refuse Collection To consider whether adequate control is in place covering trade waste income and expenditure, that appropriate agreements and other paperwork are in place, and that accounting arrangements are robust. Operational Continuity and Performance Governance arrangements to prevent Fraud and Corruption Overview of the Council and the MIJB’s governance arrangements to prevent fraud and corruption. The audit will use the Cipfa Code of Practice on Managing the Risk of Fraud and Corruption as the basis for developing the audit programme for the review. Regulatory/ Operational Continuity and Performance/ Reputational Education- Secondary School Premises Security Review the controls in place to mitigate the risk of unauthorised access or egress to Early Learning and Childcare Establishments. Operational Absence Management An audit to consider the effectiveness of sickness absence monitoring and reporting. HR (Staffing) & Operational Following the Public Pound To ensure proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Regulatory Moray Integration Joint Board Residential Care An audit to review the adequacy of procedures and administrative arrangements regarding the third party suppliers appointed to provide care home services. The audit will also include testing to verify the accuracy of the financial assessments and the charging for residential care of both respite and permanent care residents. Financial & Regulatory Out of area placement A review of the systems and procedures regarding adult services users who are out of the area but whose responsibility remains to meet their eligible care and support needs under the Care Act. Regulatory & Operational Page 78
Page 79
Fostering and Kinship payments A review to ensure that the internal controls in place for administering Fostering and Kinship Care Allowances are operating effectively. Financial & Operational Follow Up reviews to be undertaken from previous Audit Assignments * Audit Review: Original Scope Business Continuity The audit reviewed the Council's Business Continuity arrangements to confirm up to date policies, procedures and plans are regularly tested and reviewed, and an appropriate level of awareness of Business Continuity is held throughout the organisation. Self Directed Support (SDS) – Option 1 This audit remit was to review Option 1 Direct Payments under the SDS scheme, where a payment is made by the local authority directly to a supported person for the provision of support. The scope of the audit was to ensure compliance with operating guidelines in the financial management of SDS packages, expenditure incurred is in accordance with the agreed budget and support plans, and surplus funds are recovered from service users where appropriate. Self Directed Support (SDS) – Option 2/3 The scope of the audit was to review systems and procedures in the delivery and management of adult social care provided under Options 2 and 3 of the SDS scheme. This included examination of the processes to support individuals in determining their preferred care delivery option, contractual relationships with care providers, financial management and monitoring of individual care packages. Social Care & CareFirst System Information Governance Review The audit reviewed how information is recorded and managed within the various information databases for Adult, Children and Families Services. The audit reviewed access controls around the management of case files. This included consideration of who can view, add, amend or delete information. Building Services - Planned Maintenance Projects An overview was undertaken of how the annual planned maintenance programme is determined and the contract management arrangements of these projects by Building Services. The audit also involved a random selection of projects to verify costs can be evidenced to supporting documentation. Additional testing was also undertaken of the systems regarding the management and control of overtime paid to officers. Emergency Planning The objective of this audit was to provide assurance over the adequacy and effectiveness of current controls over emergency planning. The audit scope included a check to ensure adequate training, planning and testing has been developed in the event of an emergency. Disabled Parking Scheme- blue badge The audit reviewed the adequacy and effectiveness of current controls over emergency planning. The audit scope included a check to ensure adequate training, planning and testing has been developed in the event of an emergency. Refugee Integration Scheme This audit's scope involved reviewing systems and procedures to account for the relatively new and increasing source of funding for national humanitarian protection schemes. This audit has specifically covered the financial and administrative processes involved in the operation of the Ukrainian Refugee Scheme. Cyber Security The scope of this audit was to provide a review of systems, practices and an assessment of the controls in place to protect the Council from a cyber-attack. The audit also reviewed Information, Communication and Technology (ICT) security policies and procedures to ensure they are regularly reviewed and promote best practices. * Additional follow up reviews may be reported depending on the implementation dates detailed by Services for recommendations Page 79
Page 80
Page 80
Page 81
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 14 FEBRUARY 2024 SUBJECT: AUDIT & SCRUTINY COMMITTEE SELF-ASSESSMENT & EVALUATION EXERCISES BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The purpose of this report is to advise Committee on the outcome of a self- assessment of Compliance with the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit undertaken from the Chartered Institute of Public Finance and Accountancy (CIPFA) Publication “Practical Guidance for Local Authorities and Police 2022 Edition”. 1.2 This report is submitted to Committee in terms of Section III I (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the council’s Internal Auditor. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 The CIPFA Publication “Practical Guidance for Local Authorities and Police 2022 Edition” sets out its guidance on the function and operation of audit committees in local authorities and police bodies and represents CIPFA’s view of best practices for audit committees in local authorities throughout the UK. 4. AUDIT & SCRUTINY COMMITTEE SELF-ASSESSMENT & EVALUATION EXERCISES 4.1 Audit Committees are a key component of an authority’s governance framework and provide an independent and high-level resource to support governance and strong public financial management. The guidance states the purpose of an audit committee is “to provide an independent and high-level focus on the adequacy of governance, risk and control arrangements. The committee’s role in ensuring that there is sufficient assurance over governance risk and control gives greater confidence to all those charged with governance that those arrangements are effective.” Item 8. Page 81
Page 82
4.2 CIPFA promotes that a good standard of performance against recommended practices, together with a knowledgeable and experienced membership, are essential requirements for delivering effectiveness. To this effect, CIPFA has provided a high-level review checklist that incorporates the key principles set out in CIPFA’s Position Statement: Audit Committees in Local Authorities and Police 2022 Edition. In addition, the Public Sector Internal Audit Standards also call for the committee to assess their remit and effectiveness in relation to Purpose, Authority and Responsibility to facilitate the work of this committee. 4.3 Members from the Audit and Scrutiny Committee carried out self-assessments of Compliance with the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit from the CIPFA Audit Committees Guidance during a workshop session on 30 October 2023 facilitated by the Audit and Risk Manager. The self-assessments are appended to this report as Appendix 1 (Good Practice Principles) and Appendix 2 (Effectiveness) for consideration. 4.4 The outcome of the self-assessment and evaluation noted significant compliance with good practice principles and a high degree of effectiveness. However, areas have been identified for further improvements. An Action Plan has been produced as Appendix 3 to strengthen and improve the overall effectiveness of the Audit and Scrutiny Committee. 5 SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations The Chief Executive and the Head of Governance, Strategy & Performance have been consulted on the contents of this report. Page 82
Page 83
6. CONCLUSION 6.1 This report provides the Committee with details of the self-assessment of Compliance with the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit undertaken from the CIPFA Publication “Practical Guidance for Local Authorities and Police 2022 Edition”. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: SPMAN- 1042990102-207 Page 83
Page 84
Page 84
Page 85
APPENDIX 1 CIPFA Audit Committees Practical Guidance for Local Authorities and Police 2022 Edition Self-Assessment of Effectiveness of the Audit & Scrutiny Committee Ref. Good practice questions Yes Partly No Audit Review Audit committee purpose and governance 1 Does the authority have a dedicated audit committee that is not combined with other functions (eg standards, ethics, scrutiny)? P The Council has an Audit and Scrutiny Committee. Responsibility for scrutiny lies with the Service Committees, but the Audit and Scrutiny Committee has the authority to seek further service review. 2 Does the audit committee report directly to full council? Y Yes- The Council has delegated functions to the Audit and Scrutiny Committee. 3 Has the committee maintained its advisory role by not taking on any decision-making powers? Y Audit and Scrutiny Committee has no decision making powers 4 Do the terms of reference clearly set out the purpose of the committee in accordance with CIPFA’s 2022 Position Statement? Y Audit and Scrutiny functions are detailed within the Scheme of Administration. Functions of the Committee updated (Moray Council Committee – 7/12/2022- Item 15) to reflect the current Cipfa Position Statement. Item 8. Page 85
Page 86
APPENDIX 1 5 Do all those charged with governance and in leadership roles have a good understanding of the role and purpose of the committee? Y Yes- Scheme of Administration details the purpose of the Audit and Scrutiny Committee to ensure that the highest standards of probity and public accountability. Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. 6 Does the audit committee escalate issues and concerns promptly to those in governance and leadership roles? Y The Audit and Scrutiny Committee is a key part of the Council’s governance framework. This Committee is a critical component in the overall corporate governance arrangements of the Council, where good corporate governance requires independent and effective assurance about the adequacy of financial management and reporting. These functions are delivered independently from the scrutiny functions of the Corporate Management Team. The Committee can scrutinise areas of policy, service delivery or performance identified for improvement where sufficient evidence of progress from the appropriate committee is not available. Any issues of concern can be raised with the Senior Management of the Council 7 Does the governing body hold the audit committee to account P Moray Council has 26 councillors. Membership of the Audit and Scrutiny Committee has 15 councillors and 2 independent (non- voting) members. As the majority of councillors are already Page 86
Page 87
APPENDIX 1 for its performance at least annually? members of the Audit and Scrutiny Committee, performance is monitored on an ongoing basis. 8 Does the committee publish an annual report in accordance with the 2022 guidance, including: N An annual review has yet to be undertaken. This assessment should provide the basis for future annual reviews and reporting. There is no requirement for an annual report as most councillors are already members of the Audit Scrutiny Committee. • compliance with the CIPFA Position Statement 2022 N • results of the annual evaluation, development work undertaken and planned improvements N • how it has fulfilled its terms of reference and the key issues escalated in the year? N Functions of the committee 9 Do the committee’s terms of reference explicitly address all the core areas identified in CIPFA’s Position Statement? • good governance Y Standards of the committee are to ensure that the highest standards of probity and public accountability are demonstrated. Reference was made to supporting the Council’s governance, risk and control arrangements by providing a review of the Annual Governance Statement and the assurances underpinning it. (I5) In addition, functions also include considering the annual assurance statement provided by Internal Audit on the Council’s control environment (I10 Page 87
Page 88
APPENDIX 1 • Risk management arrangements Y Supporting the Council’s governance, risk and control arrangements by considering the effectiveness of the Council’s risk management arrangements. (I5) • Internal control arrangements, including: • financial management • value for money • ethics and standards • counter fraud and corruption P Standards of the committee detail a requirement to ensure that the highest standards of probity and public accountability are demonstrated. (Audit Standards (1)) Supporting the Council’s governance, risk and control arrangements by promoting internal controls and assurances, supporting an anti- fraud culture, review of revisions to financial procedures. (I5) No clear reference is made to value for money but implied with functions of the committee. Annual governance statement Y Functions detail supporting the Council’s governance, risk and control arrangements by providing a review of the Annual Council Statement and the assurances underpinning it. (I5) Financial reporting Y Enhancing corporate governance arrangements by promoting internal control and risk management, by supporting an anti-fraud culture, and by the review of revisions to financial procedures (I5), Reference also noted to reviewing revisions to financial procedures within functions. (I5) Assurance framework Y Implicit in all aspects of Audit functions. However, reference is made to considering the annual assurance statement provided by Internal Audit on the Council’s control environment. (I10) • internal audit Y Considering reports from the Council’s Internal Auditor (I2) • external audit Y Considering reports from the External Auditor concerning Council functions. (I9) 10 Over the last year, has adequate consideration been given to all core areas? Y Per CIPFA ‘audit committees’ Practical Guidance for Local Authorities and Police 2022: Page 88
Page 89
APPENDIX 1 “The Position Statement sets out the core functions of the audit committee. Essentially, the responsibilities of the committee fall into three broad areas: 1 Supporting the establishment and maintenance of good governance, risk management and control arrangements. 2 Supporting accountability and public reporting, in particular the financial statements and the annual governance statement, and other statements that accompany the financial statements. 3 Supporting the establishment and maintenance of good arrangements for internal audit and external audit.” Governance review undertaken last year included proposals regarding committee structure and changes to the Scheme of Administration (Moray Council Committee – 30/6/21 Item 23). Functions of the Committee updated (Moray Council Committee – 7/12/2022- Item 15). Corporate risk register reported to Corporate Committee on 30 August 2023. Financial reporting – No draft accounts were reported to Moray Council Committee. AGS reported to Audit and Scrutiny Committee on 27 June 2023. External and Internal Audit Reports reported to Audit and Scrutiny Committee. 11 Over the last year, has the committee only considered agenda items that align with its core functions or selected wider functions, as set out in the 2022 guidance? Y Yes core areas considered include: • Governance – Yes. Governance forms part of some audits. Risk management – Not to Audit and Audit and Scrutiny Committee but to the Corporate Committee • Accountability and public reporting- Yes Annual Governance Statement reporting to Audit and Scrutiny Committee Page 89
Page 90
APPENDIX 1 • Internal audit – Yes, reports received and representatives from Internal Audit attend meetings to allow challenge. • External audit - Yes, reports received and representatives from External Audit attend meetings to allow challenge. 12 Has the committee met privately with the external auditors and head of internal audit in the last year? N Members will contact the Audit and Risk Manager to discuss specific issues. Membership and support 13 Has the committee been established in accordance with the 2022 guidance as follows? • Separation from executive Y • A size that is not unwieldy and avoids use of substitutes P Membership –15 from 26 Full Council Elected Members. This may be considered to be more than required. Non Administration Members are appointed to the positions of Chair and Vice Chair. • Inclusion of lay/co-opted independent members in accordance with legislation or CIPFA’s recommendation Y 2 X Independent Members to the Audit and Scrutiny Committee have been appointed. 14 Have all committee members been appointed or selected to ensure a committee membership that is knowledgeable and skilled? Y Standards of the Audit and Scrutiny detail a requirement that all must demonstrate the highest standards of probity and public accountability. Briefings have also been delivered as part of the Informal Sessions to coincide with the Audit Cycle to help committee members to extend their knowledge. 15 Has an evaluation of knowledge, skills and the P There is a comprehensive Induction Programme. Ongoing training and briefings are also provided to elected members. However, a self Page 90
Page 91
APPENDIX 1 training needs of the chair and committee members been carried out within the last two years? evaluation questionnaire has now been developed to identify additional training needs. . 16 Have regular training and support arrangements been put in place covering the areas set out in the 2022 guidance? P Organisational Development provides training to support elected members in discharging their duties effectively. However, the self- evaluation questionnaire will also help in identifying any skills gap where further training can be provided by Organisational Development. 17 Across the committee membership, is there a satisfactory level of knowledge, as set out in the 2022 guidance? P The appointment of 2 X Independent Members with specialised financial and governance skills has assisted in meeting this requirement. Self-evaluation questionnaire may assist in identifying any additional requirements. 18 Is adequate secretariat and administrative support provided to the committee? Y Support is provided by Democratic Services who send out agendas and compile minutes. 19 Does the committee have good working relations with key people and organisations, including external audit, internal audit and the CFO? Y Yes. External/ Internal Audit and CFO representatives attend meetings where elected members can discuss and challenge items on the agenda. Regular pre-meetings held with Chair. Effectiveness of the committee 20 Has the committee obtained feedback on its performance from those interacting with the committee or relying on its work? Y The Council has a designated Corporate Management Team member, i.e., Chief Executive as the lead officer. The Monitoring Officer is also a member of the Committee. While there is no formal mechanism for feedback on the Committee’s performance, there are opportunities for views to be relayed. Page 91
Page 92
APPENDIX 1 21 Are meetings well chaired, ensuring key agenda items are addressed with a focus on improvement? Y As reflected in the Minutes of the Committee 22 Are meetings effective with a good level of discussion and engagement from all the members? Y As reflected in the Minutes of the Committee 23 Has the committee maintained a non-political approach to discussions throughout? P Concerns have been raised by Audit Scotland in the past regarding cross party working arrangements and relationships. 24 Does the committee engage with a wide range of leaders and managers, including discussion of audit findings, risks and action plans with the responsible officers? Y Members challenge officers and approve recommendations. Audit and Scrutiny Committee may request Senior Management to attend Committee and provide an update on their actions to address the risks and associated recommendations identified by Internal Audit. 25 Does the committee make recommendations for the improvement of governance, risk and control arrangements? P The Audit and Scrutiny Committee does not make recommendations; however it does agree to the Annual Internal Audit Plan and the implementation of the plan is monitored accordingly. The audits reported to this Committee include recommendations concerning governance, risk and control arrangements. The Audit and Risk Manager meets with the Chair of the Audit and Scrutiny Committee independently of senior management. 26 Do audit committee recommendations have traction with those in leadership roles? P Audit recommendations with managements response included within reports and follow up reviews undertaken to evidence implementation. Page 92
Page 93
APPENDIX 1 27 Has the committee evaluated whether and how it is adding value to the organisation? P A self-assessment and evaluation have recently been undertaken to review how effectively it had fulfilled its Audit functions (CIPFA guidance 2022 ‘audit committees’) 28 Does the committee have an action plan to improve any areas of weakness? Y As part of this self-evaluation review an action plan has been prepared. 29 Has this assessment been undertaken collaboratively with the audit committee members? Y Meeting held with members to discuss and agree CIPFA self assessment and evaluation of the Audit and Scrutiny Committee. Page 93
Page 94
Page 94
Page 95
APPENDIX 2 CIPFA Audit Committees: Practical Guidance for Local Authorities and Police 2022 Edition Evaluating the Impact and Effectiveness of the Audit & Scrutiny Committee AREAS WHERE THE AUDIT COMMITTEE CAN ADD VALUE BY SUPPORTING IMPROVEMENT EXAMPLES OF HOW THE AUDIT COMMITTEE CAN ADD VALUE AND PROVIDE EVIDENCE OF EFFECTIVENESS SELF-EVALUATION, EXAMPLES, AREAS OF STRENGTH AND WEAKNESS OVERALL ASSESSMENT 5-1 SEE KEY BELOW 1. Promoting the principles of good governance and their application to decision making Supporting the development of a local code of governance. Providing robust review of the Annual Governance Statement (AGS) and the assurances underpinning it. Supporting reviews/audits of governance arrangements Participating in self assessments and evaluation of governance arrangements Working with partner audit committees to review governance arrangements in partnerships. Chair meets with Chief Executive / Heads of Services on a regular basis. The committee supports the role of audit in improving internal control and governance. Chair meets Committee Chairs of MIJB and GVJB. The committee scrutinises AGS. Audit and Risk Manager provides annual opinion on the adequacy and effectiveness of the Council’s internal control system. 3 Item 8. Page 95
Page 96
2. Contributing to the development of an effective control environment. Actively monitoring the implementation of recommendations from auditors. Encouraging ownership of the internal control framework by appropriate managers. Raising significant concerns over controls with appropriate senior managers. Committee receives regular progress reports from Auditors. Heads of Services attend committee meetings on request to discuss progress with audit recommendations to manage risks. Audit and Risk Manager provides annual opinion over internal control is that arrangements are satisfactory. Control frameworks are in place and operating effectively for key control areas – for example, information security or procurement. 3 3. Supporting the establishment of arrangements for the governance of risk and for effective arrangements to manage risks. Reviewing risk management arrangements and their effectiveness, e.g. risk management benchmarking. Monitoring improvements. Holding risk owners to account for major/strategic risks. Corporate Committee receives an annual report on the corporate risks and mitigations. Business Continuity and Risk Management Officer supports services to deliver effective arrangements. 4 4. Advising on the adequacy of the assurance framework and considering whether assurance is deployed efficiently and effectively. Specifying its assurance needs, identifying gaps or overlaps in assurance. Seeking to streamline assurance gathering and reporting. Reviewing the effectiveness of assurance providers, e.g. internal audit, risk management, external audit. Induction programme outlines Governance/ Assurance Framework and Audit Cycle. Committee Audit and Scrutiny Committee considers Annual Strategies, Plans and Reports from Auditors. The authority’s leadership team has defined an appropriate framework of assurance, including core 5 Page 96
Page 97
arrangements, major service areas and collaborations and external bodies. 5. Supporting the quality of the internal audit activity, particularly by underpinning its organisational independence. Reviewing the audit charter and functional reporting arrangements. Assessing the effectiveness of internal audit arrangements, providing constructive challenge and supporting improvements. Actively supporting the quality assurance and improvement programme (QAIP) of internal audit. Committee has considered and approved the Internal Audit Charter. Committee considers and approves the Annual Internal Audit Strategy and Plan and considers regular Reports raising queries and endorsing Internal Audit recommendations. Committee receives Internal Audit QAIP and PSIAS conformance reports. The auditors deliver in accordance with their audit plan and any amendments are well explained. 5 6. Aiding the achievement of the authority’s goals and objectives through helping to ensure appropriate governance, risk, control and assurance arrangements Reviewing how the governance arrangements support the achievement of sustainable outcomes. Reviewing major projects and programmes to ensure that governance and assurance arrangements are in place. Reviewing the effectiveness of performance management arrangements. Auditors provide assurance reports on governance arrangements for transformation, sustainability, and performance management. Annual Governance Statement sets out the Governance Framework. Inspection reports indicate that arrangements are appropriate to support the achievement of service objectives. The authority’s arrangements to 3 Page 97
Page 98
review and assess performance are undertaken by Service Committees. 7. Supporting the development of robust arrangements for ensuring value for money. Ensuring that assurance on value for money arrangements is included in the assurances received by the audit committee. Considering how performance in value for money is evaluated as part of the AGS. Following up issues raised by external audit in their value-for- money work. Value for money is assessed by both Internal and External Audit. Auditors. Annual Governance Statement sets out the Governance Framework including arrangements for best value. External audit’s assessments of arrangements to support best value are satisfactory. 5 8. Helping the authority to implement the values of good governance, including effective arrangements for countering fraud and corruption risks. Reviewing arrangements against the standards set out in the Code of Practice on Managing the Risk of Fraud and Corruption (CIPFA, 2014). Reviewing fraud risks and the effectiveness of the organisation’s strategy to address those risks. Assessing the effectiveness of ethical governance arrangements for both staff and governors. Committee has scrutinised the Policy to Combat Fraud, Theft, Bribery and Corruption (which are underpinned by relevant standards, codes of conduct, policies and procedures) The Policy to Combat Fraud, Theft, Bribery and Corruption has recently been updated and is going through a review process. Auditors have issued assurance reports on fraud risks and counter fraud controls. . 4 9. Promoting effective public reporting to the authority’s stakeholders and local community and measures to improve Improving how the authority discharges its responsibilities for public reporting; for example, better targeting at the audience, plain English. Reviewing whether decision making The committee meets in public with only reports exempt from the public discussion that are presented in private. Plain English is used 5 Page 98
Page 99
transparency and accountability. through partnership organisations remains transparent and publicly accessible and encourages greater transparency. Publishing an annual report from the committee. throughout reports with jargon kept to a minimum. Chair meets with other Committee Chairs on a regular basis to understand assurance arrangements to avoid duplication. Evidence noted that the Council meets statutory deadlines for financial reporting. The Audit and Scrutiny Committee reviews the Annual Governance Statement to ensure it accurately assesses the adequacy of governance arrangements. No Annual Report is prepared as the Audit and Scrutiny Committee membership is 15 elected members and 2 independent members. Assessment key 5 Clear evidence is available from a number of sources that the committee is actively supporting improvements across all aspects of this area. The improvements made are clearly identifiable. 4 Clear evidence from some sources that the committee is actively and effectively supporting improvement across some aspects of this area. 3 The committee has had mixed experience in supporting improvement in this area. There is some evidence that demonstrates their impact but there are also significant gaps. 2 There is some evidence that the committee has supported improvements, but the impact of this support is limited. 1 No evidence can be found that the audit committee has supported improvements in this area. Page 99
Page 100
Page 100
Page 101
APPENDIX 3 Moray Council Internal Audit Section CIPFA Audit Committees Practical Guidance for Local Authorities and Police 2022 Edition Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Objective: Effective governance arrangements to ensure compliance with best practices detailed within the Cipfa Audit Committees Practical Guidance for Local Authorities and Police 2022 Edition 5.01 The Audit and Scrutiny Committee should undertake an annual self-assessment against best practice checklists. (CIPFA ‘Audit Committees’ Practical Guidance for Local Authorities and Police 2022 Edition).(SA8/E1) Medium Yes Annual self- assessment and evaluation will be undertaken with members of the Audit and Scrutiny Committee. Audit and Risk Manager Immediate Item 8. Page 101
Page 102
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.02 The External Auditor and the Audit and Risk Manager should at least annually meet in private with members of the Audit and Scrutiny Committee. (SA12,27) Medium Yes Members can contact the Audit and Risk Manager directly at any time. However, a meeting will be arranged at least annually. Audit and Risk Manager 29/02/2024 5.03 A self-evaluation questionnaire should be issued to elected members to identify additional skills or training needs. (SA16) Medium Yes A self assessment questionnaire has been developed to identify any skills gap where further training can be provided by Organisational Development. Audit and Risk Manager 31/10/2023 Page 102
Page 103
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.04 Members should be reminded of the need for effective non- political cross-party working arrangements in their approach to discussions. (SA23) Medium Yes Council Leader\ Chief Executive will recommend to A&S Committee members that all members are encouraged to engage in cross party working/ discussion. Council Leader\ Chief Executive 31/05/2024 Page 103
Page 104
Page 104
Page 105
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 14 FEBRUARY 2024 SUBJECT: THE NATIONAL FRAUD INITIATIVE IN SCOTLAND BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 To provide Committee with information on the Council’s approach to participation in the National Fraud Initiative (NFI). 1.2 This report is submitted to Committee in terms of Section III (I) (2) of the Council’s Scheme of Administration relating to considering reports from the Council’s Internal Auditor. 2. RECOMMENDATION 2.1 Committee is asked to consider the Audit Scotland self-appraisal checklists that participating bodies are invited to complete and present to their local audit committees; seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 The NFI is a data matching project conducted by the Cabinet Office on behalf of Audit Scotland every 2 years. Public bodies, including local authorities, are mandatory participants in this process. A matching exercise was undertaken in 2023, and the Council was provided with the results in the form of “data sets” detailing the matches for investigation. The review of these matches is nearing completion. The approach taken within the Council has been for Services to review and document the reasons for the data matches and for the Internal Audit Section to investigate any potential fraud, monitor progress and report on the outcome. 3.2 The NFI involves a data matching exercise from a range of systems both within the Council and from data provided by other councils and organisations. Data is submitted on individuals and businesses that receive public funds either as paid employees or suppliers of goods, works or services, or in the form of benefits and rates relief. Data is also provided on individuals with housing tenancies and waiting lists, taxi licence holders, and recipients of blue badges. There is no presumption of fraud, simply a match comprises two or more records where there appears to be some anomaly that would merit further review. Item 9. Page 105
Page 106
3.3 In August 2022, Audit Scotland published a report titled ‘The National Fraud Initiative in Scotland 2022’. This report detailed the success of the NFI exercise within the public sector to mitigate fraud and error. Over 130 Scottish public sector bodies participated in the 2020/2021 NFI exercise, with £14.9 million of fraud, overpayment and error identified in Scotland. However, previous data matching exercises in Moray have not found fraud, rather timing differences or information that is out of date, i.e. if an individual changes jobs or address around the time the data for matching is submitted, the old and new information can appear as a match but on checking can be quickly discounted. 3.4 Detailed within the Audit Scotland report is a recommendation for Audit Committees or equivalent, and officers leading the NFI should review Audit Scotland’s National Fraud Initiative self-appraisal checklists. These self-appraisal checklists have now been reviewed and completed by the Audit and Risk Manager and are provided as Appendix 1. It is pleasing to report from the overview undertaken that the Council is essentially meeting Audit Scotland requirements with no immediate actions required. 3.5 The completion of the self-appraisal checklists has been a helpful aid-memoire as the Council has progressed through the investigation of matches provided in 2023. At the conclusion of the data matching exercise, the findings will be reported to this Committee by the Audit and Risk Manager. 4 SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications There is a cost of participation in NFI; however, there are also benefits where correction of errors results in additional funding for the council, and additionally, assurances are obtained on the robustness of our systems. (d) Risk Implications The risk of not participating is that fraud or error occurs and is allowed to continue unchecked. (e) Staffing Implications No implications directly arising from this report. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. Page 106
Page 107
(i) Consultations The Chief Financial Officer as the NFI Senior Responsible Officer has been consulted with the content of this report. 5. CONCLUSION 5.1 The Council is complying with the Audit Scotland requirements for participants in the National Fraud Initiative, as evidenced in the completed self-assessment checklist provided with this report. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: SPMAN- 1042990102-198 Page 107
Page 108
Page 108
Page 109
APPENDIX 1 Audit Scotland National Fraud Initiative- Self-appraisal checklists Part A: For those charged with governance Yes/No/Partly Is action required? Who by and when? Leadership, commitment and communication 1. Are we aware of emerging fraud risks and taken appropriate preventative and detective action? Yes Irregularities reported by Audit Scotland and the Scottish Local Authority Investigators' Group are reviewed by the Internal Audit Section. This is used to identify projects for review within the Audit Plan. Services also informed of issues of concerns. No N/A 2. Are we committed to NFI? Has the council/board, audit committee and senior management expressed support for the exercise and has this been communicated to relevant staff? Yes The Chief Financial Officer is the delegated NFI Senior Responsible Officer, and the Audit and Risk Manager is the Key Contact Officer. Individual officers within Services are responsible for progressing and investigating matches that fall under their remit (for example, Payroll, Creditors). Internal Audit will investigate any fraud and monitor progress. The outcome of the data matching exercise will be reported to the Audit and Scrutiny Committee by the Audit and Risk Manager. No N/A Item 9. Page 109
Page 110
3. Is the NFI an integral part of our corporate policies and strategies for preventing and detecting fraud and error? Yes NFI is referred to and forms part of the Council’s Policy to Combat Fraud, Theft, Bribery and Corruption. Yes Policy to Combat Fraud, Theft, Bribery and Corruption has recently been updated. Policy was reported to the Corporate Committee in Jan 2024. 4. Have we considered using the point of application data matching service offered by the NFI team (AppCheck), to enhance assurances over internal controls and improve our approach to risk management? Yes There is a cost for using these services, which would not be justified based on the outcomes from checking matches thus far. This position will continue to be monitored. Yes Keep under review 5. Are NFI progress and outcomes reported regularly to senior management and elected/board members (e.g., the audit committee or equivalent)? Yes The most recent outcomes were reported to the Audit and Scrutiny Committee on 16 February 2022. No N/A 6. Where we have not submitted data or used the matches returned to us (e.g. council tax single person discounts), are we satisfied that alternative fraud detection arrangements are in place and that we know how successful they are? Yes All data submission requests have been met. However, a decision was made by the Service to use Datatank to validate single-person discount claims. (Datatank is a private company specialising in the provision of data analytic solutions and managed services to support Local Authority revenues and benefits fraud detection. The Service will monitor results from the use of Datatank.) No N/A 7. Does internal audit, or equivalent, monitor our approach to NFI and our main outcomes, ensuring that any weaknesses are addressed in relevant cases? Yes The Audit and Risk Manager is the Key Contact Officer with oversight of the matching process. No N/A 8. Do we review how frauds and errors arose and use this information to improve our internal controls? Yes When an investigation identifies control weaknesses, recommendations are made to management to reduce the risk of recurrence of the error in the future. No N/A Page 110
Page 111
9. Do we publish, as a deterrent, internally and externally the achievements of our fraud investigators (eg, successful prosecutions)? No Investigation of data matches has related to errors or issues that require corrective actions as opposed to fraud that would merit formal prosecution. No N/A Part B: For NFI Key Contacts and users Yes/No/Partly Is action required? Who by and when? Planning and preparation 1. Are we aware of emerging fraud risks and taken appropriate preventative and detective action? Yes Irregularities reported by Audit Scotland and the Scottish Local Authority Investigators' Group are reviewed by the Internal Audit Section. This is used to identify projects for review within the Audit Plan. Services also informed of issues of concerns. No N/A 2. Are we investing sufficient resources in the NFI exercise? Yes Services undertake the investigation of matches. Internal Audit will overview the process and report on the outcomes. No N/A 3. Do we plan properly for NFI exercises, both before submitting data and prior to matches becoming available? This includes considering the quality of data. Yes The Internal Audit Section coordinates the NFI data matching exercise. Services and the ICT Section are provided with guidance on the information and deadlines for uploading the information. The quality of data is continually assessed during the processing of each dataset. No N/A Page 111
Page 112
4. Is our NFI Key Contact the appropriate officer for that role and do they oversee the exercise properly? Are our Key Contact’s details up to date on the NFI system? Yes The Audit and Risk Manager is the Key Contact Officer. Internal Audit officers are in regular contact with service representatives to monitor progress. No N/A 5. Does our Key Contact have the time to devote to the exercise and sufficient authority to seek action across the organisation? Yes However, a reduction in staff resources within the Internal Audit Section has resulted in reduced opportunities to support Services. No N/A 6. Where NFI outcomes have been low in the past, do we recognise that this may not be the case the next time, that NFI can deter fraud and that there is value in the assurances that we can take from low outcomes? Yes This has been communicated to the Audit and Scrutiny Committee with the emphasis for each dataset involving taking a proportionate approach to checking returned matches No N/A 7. Do we confirm promptly (using the online facility on the secure website) that we have met the fair processing notice requirements? Yes No N/A 8. Do we plan to provide all NFI data on time using the secure data file upload facility properly? Yes No N/A 9. Have we considered using the point of application data matching service offered by the NFI team (AppCheck) to enhance assurances over internal controls and improve our approach to risk management? Yes There is a cost for using these services which, based on the outcomes from the checking of matches thus far, would not be justified. This position will continue to be monitored. No Keep under review. Effective follow-up of matches 10. Do all departments involved in NFI start the follow-up of matches promptly after they become available? Yes The requirement of investigating matches promptly must be balanced with the operational demands of the Service. No N/A 11. Do we give priority to following up high-risk matches, those that become quickly out-of-date and those that could cause reputational damage if a fraud is not stopped quickly? Yes No N/A Page 112
Page 113
12. Are we investigating the circumstances of matches adequately before reaching a ‘no issue’ outcome, in particular? Yes No N/A 13. (In health bodies) Are we drawing appropriately on the help and expertise available from NHS Scotland Counter Fraud Services? N/A 14. Are we taking appropriate action in cases where fraud is alleged (whether disciplinary action, penalties/cautions or reporting to the Procurator Fiscal)? Are we recovering funds effectively? Yes Where errors are disclosed which call for funds to be recovered by the Council, the steps necessary to do this are put in place. No Future actions will depend on results from future matching processes 15. Do we avoid deploying excessive resources on match reports where early work (e.g., on high-risk matches) has not found any fraud or error? Yes The process of checking has been refined over successive exercises to reflect the risk apparent from sampled matches, with testing sufficient to draw conclusions No A proportionate approach to checking will continue to ensure resource inputs are optimised. 16. Where the number of high-risk matches is very low, are we adequately considering the medium and low-risk matches before we cease our follow-up work? Yes The all matches report is used for information only with the focus being on the specific matches involving the individual datasets. No No change to current practice proposed 17. Do we follow up matches which indicate a customer may be eligible for a benefit or service which they currently do not receive? Yes A review of eligibility for additional services is restricted to individuals identified within a dataset allocated to officers within a Service to investigate. No N/A 18. Overall, are we deploying appropriate resources on managing the NFI exercise? Yes In the current financial climate and with the increased demands on Services, available staff resources to complete and manage the NFI data matching exercises have proved challenging. No N/A Recording and reporting 19. Are we recording outcomes properly in the secure website and keeping it up to date? Yes No N/A Page 113
Page 114
20. Do staff use the online training modules and guidance on the secure website, and do they consult the Cabinet Office NFI team if they are unsure about how to record outcomes (to be encouraged)? Yes No N/A 21. If, out of preference, we record some or all outcomes outside the secure website, have we made arrangements to inform the Cabinet Office NFI team about these outcomes? Yes To minimise data breaches all results are recorded on the secure website. No N/A Page 114