Agenda Document Pack - Audit and Scrutiny Committee - 08/05/2024
Moray Council · 8 May 2024
Back to Audit and Scrutiny Committee — 8 May 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Wednesday, 08 May 2024 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Wednesday, 08 May 2024 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minute of meeting of 14 February 2024 5 - 10 4. Written Questions ** 5. Internal Audit Section Update Report Report by Audit and Risk Manager 11 - 42 6. Internal Audit Section - Completed Projects Report Report by Audit and Risk Manager 43 - 76 7. Annual Audit Plan for Year Ending 31 March 2024 Report by Depute Chief Executive (Economy, Environment and Finance) 77 - 154 8. National Fraud Initiative 2022-23 Report by Audit and Risk Manager 155 - 160 Page 1
Page 2
Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. Page 3
Page 4
MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Graham Leadbitter (Chair) Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Theresa Coull (Member) Councillor John Cowe (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Marc Macrae (Member) Councillor Neil McLennan (Member) Councillor John Stuart (Member) Mr Ivan Augustus (Non-Voting Member) Ms Margaret Wilson (Non-Voting Member) Clerk Name: Caroline O'Connor Clerk Telephone: 07779 999296 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 14 February 2024 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Councillor Peter Bloomfield, Councillor John Cowe, Councillor John Divers, Councillor Amber Dunbar, Councillor Jérémie Fernandes, Councillor Donald Gatt, Councillor David Gordon, Councillor Sandy Keith, Councillor Graham Leadbitter, Councillor Marc Macrae, Councillor John Stuart, Ms Margaret Wilson APOLOGIES Mr Ivan Augustus, Councillor Theresa Coull, Councillor Neil McLennan, Councillor Shona Morrison IN ATTENDANCE The Chief Executive; Depute Chief Executive (Education, Communities and Organisational Development); Chief Officer, Health and Social Care Moray; Chief Social Work Officer/Head of Service; Head of Governance, Strategy and Performance; Head of Financial Services; Audit and Risk Manager; Social Work Service Manager; Caroline O'Connor, Committee Services Officer as Clerk to the meeting, all Moray Council and Angela Pieri and Andrew Wallace, Grant Thornton - External Auditors. Councillors Colyer, Mustard and Robertson were also present. 1. Chair Councillor Leadbitter, as Chair of the Audit and Scrutiny Committee, chaired the meeting. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Orders 21 and 23 and the Councillors' Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions take on how Member will voted on any item on the agenda or any declarations of Member's interests in respect of any item on the agenda. With regard to Item 7 "Internal Audit Plan Year Ending 31 March 2025", Councillor Gatt stated, for transparency, that he is Convener of the Grampian Valuation Joint Board and would be taking part in the debate. 3. Resolution The meeting resolved that in terms of Section 50A (4) and (5) of the Local Government (Scotland) Act 1973, as amended, the public and media representatives be excluded from the meeting for Item 11 of business on the grounds that it involves the likely disclosure of exemption information of the class. Item 3. Page 5
Page 6
Para number of the minute Para Number of Schedule 7a 13 Para 7 Information relating to the financial or business affairs of any of the particular person(s) for any matters referred to in section 27(1) of the Social Work (Scotland) Act 1968 4. Minute of meeting of 22 November 2023 The minute of the Audit and Scrutiny Committee of 22 November 2023 was submitted and approved. 5. Written Questions ** The Committee noted that no written questions had been submitted. 6. Internal Audit Section Update Report The meeting had before it a report by the Audit and Risk Manager providing Committee with an update on the work of the Internal Audit Section. In response to a question from the Chair relating to whether the revised implementation date of 31 March 2024 for the ICT Business Continuity Plan was the completion date, the Audit and Risk Manager confirmed a follow-up review would then be undertaken to update the plan and would be reported back to Committee to evidence implementation. In response to a suggestion from Councillor Gatt relating to the ICT security audit that passwords should be changed at least every six months, the Audit and Risk Manager confirmed he would include that as part of the email audit review being undertaken. The Depute Chief Executive (Education, Communities and Organisational Development) provided further assurance that corporate users are required to change passwords more frequently than once every six months with a level of complexity within passwords to ensure security. In response to a question from Councillor Macrae relating to whether potential weaknesses in cyber security should be discussed in public, the Depute Chief Executive (Education, Communities and Organisational Development) advised most weaknesses relate to phishing and that human behaviour is responsible for the majority of attacks. Action is being taken to reduce human vulnerability in the form of briefings and training to members of staff. In response to a question from Councillor Gatt relating to whether more accurate completion dates could be included in future audit reports to Committee, the Audit and Risk Manager stated that the revised dats for implementation are provided by the services when a follow-up review is undertaken. The Audit and Risk Manager confirmed he has prepared a new reporting format to come into effect during 2024 which will be a clearer and more transparent format. In response to a question from the Chair relating to whether it was likely the procurement timescales for a replacement for the CareFirst system would take the full year for which the CareFirst contract had been extended, the Head of Service / Chief Social Work Officer advised it was anticipated it could be completed within a Page 6
Page 7
year, however a scoping exercise was being undertaken to give more accurate predictions and this would be reported back to Committee. In order to provide assurance, the Chair asked for a report from the service updating on progress be brought back to Committee in 6 months' time. In response to a concern raised by Councillor Gatt relating to the extended timescale for the review of stock levels in the Building Service stores audit and a question from Councillor Stuart on what mechanisms the Committee has to propose an amendment to the timescale, the Chief Executive advised the revised reporting format will provide the Committee with context on factors as to why timescales have not been achieved and levels of assurance. Thereafter if the Committee are not assured and provide details of what they are not assured about and what action they would like taken, recommendations can then be made to address the areas not assured on. The Head of Governance, Strategy and Performance further advised if the process described by the Chief Executive was not satisfactory, it was within the remit of the Committee to make a recommendation to another Committee. Thereafter the Committee unanimously agreed:- i. to note the contents of the report; and ii. an update report by the service on procurement timescales for the CareFirst replacement system be brought back to Committee in six months time. 7. Internal Audit Section - Completed Projects Report The meeting had before it a report by the Audit and Risk Manager advising Committee on the work of the Internal Audit Section for the period from 22 November 2023 to 14 February 2024. In response to a question from Councillor Gatt relating to the variances in stocks in the Occupational Therapy Store and seeking a follow-up report to provide assurance about operation of the store and training requirements, the Audit and Risk Manager advised training was an issue for the service, systems have been reviewed and issues would be picked up as part of the review. The Chief Executive advised whilst the report had stated significant issues had been identified and the service has agreed to all the recommendation, if Committee members were not assured additional recommendations could be added. In response to concern raised by Councillor Gatt relating to the breach of Financial Regulations in respect of advance payments in the Children's Services Commissioning audit, the Audit and Risk Manager confirmed there had been a breach however the issue had now been addressed by the service. Councillor Gatt therefore moved to add an additional recommendation to note in relation to Appendix 2, Children's Services Commissioning, whilst Financial Regulations had been breached, the Audit and Risk Manager confirmed a follow up review will be undertaken to evidence implementation of the recommendation and will be reported to this Committee. This was seconded by Councillor Dunbar. There being no one otherwise minded the Committee unanimously agreed to note:- Page 7
Page 8
i. the contents of the report; and ii. in relation to Appendix 2, Children's Services Commissioning, whilst Financial Regulations had been breached, the Audit and Ris Manager will provide assurance that action had been taken to prevent a recurrence. 8. Internal Audit Plan Year Ending 31 March 2025 The meeting had before it a report by the Audit and Risk Manager providing Committee with details of the planned internal audit coverage for the year ending 31 March 2025. In response to a question from Councillor Gordon relating to the stage Members can become involved in proposed projects for the Audit Plan, the Audit and Risk Manager advised determination of what is to be included in Plan lies with him and any suggestions from Members or senior management could be considerd as part of the annual process in preparation of the annual Plan. In the past Members have not been consulted, however this year consultations has been undertaken with the Council Leader and the Chair of this Committee. The Audit and Risk Manager stated this will be expanded to include all Members of this Committee for greater consultation moving forward. To provide assurance the Chair confirmed discussions between himself, the Audit and Risk Manager and Head of Governance, Strategy and Performance are informed by discussion at Committee. He further advised it would be possible to debate projects for inclusion with advice from the Audit and Risk Manager relating to risks for other items which would then be delayed. The Chair advised a scrutiny training session entitled "How to ask the right questions" had been organised for 27 February with an invitation extended to all Members. In response to a question from Ms Wilson relating to staff resources and noting that the Audit and Risk Manager is responsible for auditing the Moray Growth Deal and whether any additional resources were provided, the Audit and Risk Manager advised that no additional resources were available. However, due to a requirement to provide additional budget savings by not replacing the Corporate Investigations Officer post, he hoped to replace this post with a full time Audit Assistant which would provide some flexibility within the services despite the reduced staff resources. Thereafter the Committee unanimously agreed to note the contents of the report. 9. Audit and Scrutiny Committee Self-Assessment and Evaluation Exercises The meeting had before it a report by the Audit and Risk Manager advising the Committee on the outcome of a self-assessment of Compliance with the Good Practice Principles Checklist and Evaluation of Effectiveness Toolkit undertaken from the Chartered Institute of Public Finance and Accountancy (CIPFA) Publication "Practical Guidance for Local Authorities and Police 2022 Edition". Following consideration the Committee unanimously agreed to note the contents of the report. Page 8
Page 9
10. The National Fraud Initiative in Scotland The meeting had before it a report providing Committee with information on the Council's approach to participation in the National Fraud Initiative (NFI). In response to a question from Councillor Keith relating to the risks of fraud or errors if not participating however the report stating local authorities are mandatory participants, the Audit and Risk Manager confirmed the data requires to be submitted however investigation of the data matches does not result in identifying fraud. Given the time take to investigate matches and the limited benefits to justify the time taken, it is planned to be more selective in terms of percentage testing moving forward. Thereafter the meeting unanimously agreed to note the contents of the report. 11. Question Time *** The Committee noted that there were no questions. 12. Thanks The Committee, in noting the Chief Executive had announced his intention to retire in the coming months, joined the Chair in thanking the Chief Executive for his support to this Committee and his extensive length of public service to the Council. 13. Update on Improvement Plan for Adult Social Care Commissioning [Para 7] The meeting had before it a report by the Head of Service / Chief Social Work Officer updating the Committee of progress regarding the Improvement Plan for Adult Social Care Commissioning in line with the external review conducted by KPMG, finalised in February 2023. In response to a question from the Chair who noted the significantly improved position however previous reports had summarised in progress in different ways and asked for details on overall values of each contract to provide more assurance, especially for those coloured red, the Head of Service / Chief Social Work Officer advised it would be possible to bring back a report with details of the average values of contracts. The Chair moved to add an additional recommendation that an update report be brought back to Committee with details of contract values. The Chief Officer, Health and Social Care Moray agreed this was appropriate in terms of good governance. The Chief Executive confirmed the update report should also include details of timelines and risks. There being no one otherwise minded the Committee unanimously agreed:- i. to note the progress since February 2023 in relation to the recommendations detailed in the Improvement Plan attached at Appendix 1; ii. to note the updated Improvement Action Plan approved by Moray Integrated Joint Board (MIJB) Audit, Performance and Risk (APR) Committee on 26 October 2023 (para 12 of minute refers) attached at Appendix 2; Page 9
Page 10
iii. that the Internal Audit will undertake a follow up review after the final date of the Improvement Plan; and iv. an update report including details of contract values, timelines and risks be brought back to Committee in six months. Page 10
Page 11
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 8 MAY 2024 SUBJECT: INTERNAL AUDIT SECTION UPDATE REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report provides Committee with an update on the work of the Internal Audit Section. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 Committee is asked to consider the contents of this report, seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards requires the Audit and Risk Manager to prepare and present reports to committee on internal audit’s activity, performance relative to its Audit Plan, and any other relevant matters. 3.2 This report provides an update on audit activity and projects progressed since the last meeting. 4. UPDATE OF PROGRESS AGAINST THE 2024/25 AUDIT PLAN Audit Plan Update 4.1 The Internal Audit Plan is a means of determining the priorities of the internal audit activity and how these fit with the wider goals of the Council. Enclosed in Appendix 1 is an update on the progress undertaken by the Internal Audit Section in completing the review projects within the Annual Audit Plan. It should be noted as this is the start of the financial year, limited progress has been made. However, additional follow up reviews to evidence the implementation of recommendations for audits previously completed for Building Services Stores, Item 5. Page 11
Page 12
Domestic Refuse Collection, Moray Integrated Community Stores and Pool Cars Scheme have now been added to the Annual Audit Plan. 4.2 Further to a Special Meeting of the Moray Council on 28 February 2024, it was agreed to reduce the Internal Audit Section staffing budget by replacing the Corporate Investigations Officer’s post with a 0.5 full-time equivalent. This is in addition to deleting an additional Assistant Auditor post in 2022/23. Current internal audit staffing resources are less than those of comparable local authorities, which senior management accepted in approving the previously detailed Assistant Auditor post. There has been no increase in staff resources of the Internal Audit Section for over 20 years, despite the statutory compliance needs with the introduction of the Public Sector Internal Audit Standards (PSIAS) and a requirement for providing additional auditing service to the Moray Integration Joint Board and Moray Growth Deal. In accordance with a core principle of PSIAS, compliance requires that the Internal Audit Service is “adequately resourced”. In addition, members, in accordance with the CIPFA Audit Committees: Practical Guidance for Local Authorities and Police 2022 Edition, have a responsibility to assess the “effectiveness of internal audit arrangements”. 4.3 As your Audit and Risk Manager, and my requirement to be “objective and free from undue influence”, I am highlighting my serious concerns about whether the existing resources of the Internal Audit Section are sufficient to meet the Council and partner organisations auditing requirements and to support effective counter fraud and corruption arrangements. However, further to the additional funding secured, which has included a commitment to meet the auditing requirements of the Levelling Up Fund Bid and the remaining budget from the reduction of the Corporate Investigations Officer post, it has provided a sufficient budget to seek the appointment of a full time Assistant Auditor. Despite the Special Meeting of the Moray Council on 28 February 2024 resulting in a reduction in internal audit resources, I hope that appointing an Assistant Auditor can mitigate the risks associated with a reduction in staff resources while still maintaining the delivery of an effective internal audit service. However, Members should be aware that my serious concerns remain regarding the available staff resources to meet the auditing requirements of the Council and partner organisations. Follow Up Reviews 4.4 Internal Audit reports are regularly presented to Members detailing not only findings but also the responses by management to the recommendations with agreed dates of implementation. Internal Audit will also undertake follow up reviews to evidence the effective implementation of these recommendations. Please see detailed the following completed follow up reviews: Transformation Programme 4.5 An audit was undertaken to review the Council’s Improvement and Modernisation Programme. The Council established an Improvement and Modernisation Programme (IMP) in 2018 to bring transformational change, deliver savings, and provide the basis for a medium to long term financial plan to support financial sustainability in the delivery of services to communities. The management and delivery of projects to provide service improvements are undertaken through a framework detailed within the Project Management Governance Policy. The audit included a review of the governance arrangements around the management, monitoring and reporting arrangements Page 12
Page 13
of the IMP, and a check that strategic projects contained within the IMP are administered in accordance with the Project Management Governance Policy. I am therefore pleased to report all recommendations have been implemented. However, I do note that the Depute Chief Executive (Education, Communities & Organisational Development) has highlighted that a more substantive review of the corporate management of transformation and change arrangements is being considered by the Corporate/Senior Management Team. The Follow Up Report to review the implementation of the agreed recommendations is given in Appendix 2. Data Protection 4.6 A review was undertaken to ensure the Council’s compliance with the Data Protection Act 2018. The audit sought evidence to check awareness throughout the Council with comprehensive training programmes and effective oversight and governance arrangements to monitor ongoing compliance with the Data Protection Act. Findings from the follow up review noted that several recommendations remain outstanding. The Information Governance Service, while implementing the recommendations, found that the volume of work required, in addition to other information management compliance requirements, was significantly greater than initially envisaged. Due to the multi-year timescale of implementing some of the recommendations, it is intended to include the review of review of Data Protection Act in a future audit plan rather than undertaking another follow up review. The Follow Up Report is given in Appendix 3. Information Management 4.7 This audit compliments the previous review undertaken regarding the Council’s compliance with the Data Protection Regulation. The scope of this Information Management audit was to ensure that an appropriate system exists in the management, security and transfer of data between the Council and care providers, including NHS Grampian. Controls in this area are particularly important due to the sensitive nature of much of the information. Findings from the follow up review noted that a number of the recommendations remain outstanding. Implementation of these recommendations is linked to the previous audit, which also highlighted a number of related information management improvements. Due to the volume of work required, there is a need for a multi- year timescale to implement some of the recommendations. It is therefore intended to include a review of Information Management within a future audit plan. The Follow Up Report is given in Appendix 4. Roads Maintenance - Planned 4.8 There has been a delay in completing this follow up review. This is a particularly technical area, and staffing issues in both the Roads Maintenance and Accountancy Sections have delayed implementing the recommendations within the previously agreed timescales. The annual Roads Maintenance Capital Plan budget is approximately £4.3 million. This includes planned projects for resurfacing, surface dressing programme, footway and drainage works. The audit undertook an overview of the capital plan and selected individual projects where more detailed audit checks were undertaken. Testing involved a review of the contract management arrangements and how individual schemes are costed, agreed and monitored. A number of recommendations were made and accepted by the Service however, implementing the recommendations requires significant staffing resources, including the support of the Accountancy Section. As the Page 13
Page 14
staffing arrangements of both the Roads Maintenance and the Accountancy Sections have now improved, the Follow Up Report detailing the revised dates for implementing the recommendations is given in Appendix 5. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications directly arising from this report. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risk associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications directly arising from this report. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Background Papers: Dafydd Lewis Internal Audit files Audit and Risk Manager Ref: SPMAN- 1042990102-224 Page 14
Page 15
APPENDIX 1 MORAY COUNCIL INTERNAL AUDIT SERVICE ANNUAL AUDIT PLAN 2024/25 CORE FINANCIAL SYSTEMS Area Type of coverage Status/ Comments Payroll Continuous auditing to confirm the adequacy of the systems and procedures for the payment of salaries. Audit programmed to start in the next quarter(s) Procurement and Creditor Payments Continuous auditing of samples of non- pay expenditure to test compliance with procurement and payment processing regulations. Audit programmed to start in the next quarter(s) ICT Hardware Asset Management review of systems and practices to record / monitor the location and use of ICT hardware. Audit programmed to start in the next quarter(s) Stocks and stores - year end valuations Attendance at stocktaking and reconciliation of stocks held to ledger balances. Work completed OTHER SYSTEMS Area Type of coverage Housing and Property Reactive Maintenance Works Audit of works undertaken within Building Services for the completion of reactive maintenance works (Council Housing). Audit programmed to start in the next quarter(s) Item 5. Page 15
Page 16
Grant Claims Certification of grant claims as required: strategic timber; network support grant, regeneration schemes as appropriate Review of Network Support Grant in progress. Housing Rent Collection & Arrears Management A review of the income collection and accounting arrangements for housing rents. Audit programmed to start in the next quarter(s) Moray Growth Deal An audit review of the governance and administrative procedures within the Council for the management of the Moray Growth Deal. The scope will include the concerning partnership working, financial management and measuring success. Audit programmed to start in the next quarter(s) Education – Secondary School Establishment visits as part of cyclical review. Audit programmed to start in the next quarter(s) Treasury Management To provide assurance that processes and controls are continuing to operate effectively for the Council's treasury management system. Audit programmed to start in the next quarter(s) Commercial Refuse Collection To consider whether adequate control is in place covering trade waste income and expenditure, that appropriate agreements and other paperwork is in place, and that accounting arrangements are robust. Fieldwork in progress Governance arrangements to prevent Fraud and Corruption Overview of the Councils governance arrangements to prevent fraud and corruption. The audit will use the Cipfa Code of practice on managing the risk of fraud and corruption as the basis in developing the audit programme for the review. Audit programmed to start in the next quarter(s) Page 16
Page 17
Education- Secondary School Premises Security Review the controls in place to mitigate the risk of unauthorised access to Secondary School Premises. Audit programmed to start in the next quarter(s) Absence Management An audit to consider the effectiveness of sickness absence monitoring and reporting. Audit programmed to start in the next quarter(s) Following the Public Pound To ensure that there is proper accountability for public funds used in delivering services, irrespective of the means of service delivery. Fieldwork in progress Moray Integration Joint Board Residential Care An audit to review the adequacy of procedures and administrative arrangements regarding the third party suppliers appointed to provide care home services The audit will also include testing to verify the accuracy of the financial assessments and the charging for residential care of both respite and permanent care residents. Audit programmed to start in the next quarter(s) Out of area placement A review of the systems and procedures regarding adult services users that are out of area but responsibility remains to meet their eligible care and support needs under the Care Act. Audit programmed to start in the next quarter(s) Fostering and Kinship payments A review to ensure that the internal controls in place for administering Fostering and Kinship Care Allowances are operating effectively. Fieldwork in progress Page 17
Page 18
Follow Up reviews to be undertaken from previous Audit Assignments * Audit Review: Original Scope Status/ Comments Business Continuity The audit reviewed the Council's Business Continuity arrangements to confirm up to date policies, procedures and plans are regularly tested and reviewed, and that an appropriate level of awareness of Business Continuity is held throughout the organisation. Fieldwork in progress Self Directed Support (SDS) – Option 1 This audit remit was to review Option 1 Direct Payments under the SDS scheme, where a payment is made by the local authority directly to a supported person for the provision of support. The scope of the audit was to ensure compliance with operating guidelines in the financial management of SDS packages, expenditure incurred is in accordance with the agreed budget and support plans, and surplus funds are recovered from service users where appropriate. Follow Up Review programmed to start in the next quarter(s) Self Directed Support (SDS) – Option 2/3 The scope of the audit was to review systems and procedures in the delivery and management of adult social care provided under Options 2 and 3 of the SDS scheme. This included examination of the processes to support individuals in determining their preferred care delivery option, contractual relationships with care providers, financial management and monitoring of individual care packages. Follow Up Review programmed to start in the next quarter(s) Building Services - Planned Maintenance Projects An overview was undertaken of how the annual planned maintenance programme is determined and the contract management arrangements of these projects by Building Services. The audit also involved a random selection of projects to verify costs can be evidenced to supporting documentation. Additional testing was also undertaken of the systems regarding the management and control of overtime paid to officers. Follow Up Review programmed to start in this quarter Page 18
Page 19
Emergency Planning The objective of this audit was to provide assurance over the adequacy and effectiveness of current controls over emergency planning. The audit scope included a check to ensure adequate training, planning and testing has been developed in the event of an emergency. Follow Up Review programmed to start in the next quarter(s) Disabled Parking Permit Scheme- Blue Badge The scope of this audit was to review systems and procedures in the administration of the Disabled Parking Permit Scheme. This included the processes for assessment, management and investigation of misuse of blue badges. The audit also reviewed the procedures for the issue, control and income collection arrangements. Follow Up Review programmed to start in this quarter Refugee Integration Scheme The scope of this audit involved a review systems and procedures to account for the relatively new and increasing source of funding for national humanitarian protection schemes. This audit has specifically covered the financial and administrative processes involved in the operation of the Ukrainian Refugee Scheme. Follow Up Review programmed to start in the next quarter(s) Building Services - Stores This audit scope reviewed the systems and controls in managing stock held within Building Services Stores. Testing involved a review of the stores software application called Servitor used for the recording and valuation of materials and equipment. Testing also included a check of the security arrangements to safeguard against unauthorised access to the storage areas. Follow Up Review programmed to start in the next quarter(s) Environmental & Commercial Services- Stores This audit scope reviewed the systems and controls in managing stock held within Environmental & Commercial Services Stores. The audit used the Chartered Institute of Public Finance Accountants audit programme to review the systems and controls in managing stock held within stores. Testing also included a review of the security arrangements to safeguard against unauthorised access to the storage areas. Follow Up Review programmed to start in the next quarter(s) Page 19
Page 20
Debtors The audit scope was to review the key operational controls within the Council's Debtors System. The audit checked the systems for raising invoices, collecting income, recording income and debt recovery arrangements. The audit review did not include the arrangements for recovering debts concerning council tax, non domestic rates, and housing rents. Follow Up Review programmed to start in this quarter Domestic Refuse Collection The scope of this audit was to review systems and procedures to ensure the most effective and efficient use is made of resources for the collection of domestic waste. The audit also checked the arrangements for disposing of recyclable waste. This included disposal of plastic, glass and biodegradable waste, in addition to paper / card, aluminium and steel cans for which the Council received regular payments from recycling contractors. Follow Up Review programmed to start in the next quarter(s) Pool Cars Scheme The scope of this audit was to review systems and procedures in the management and use of pool cars. Policies and procedures were checked to ensure they provide appropriate operating guidance to officers in the booking and use of pool cars. The audit included a review of arrangements for internal recharging to services and also exploration if further use of pool cars could provide additional value for money opportunities to the Council Follow Up Review programmed to start in the next quarter(s) Cyber Security The audit reviewed systems, practices and an assessment of the controls in place to protect the Council from a cyber-attack. The audit also reviewed Information, Communication and Technology (ICT) security policies and procedures to ensure they are regularly reviewed and promote best practices. The audit programme has been developed from the Scottish Government Cyber Resilience Framework and other good practice guidelines Follow Up Review programmed to start in the next quarter(s) Page 20
Page 21
Moray Integrated Community Stores The audit reviewed the management of the Moray Integrated Community Stores. This included reviewing the procedures for ordering and issuing occupational therapy equipment to service users. In addition, a check was made to compare stock records to the actual equipment held within the Stores. Follow Up Review programmed to start in the next quarter(s) * Additional follow up reviews may be reported depending on the implementation dates detailed by Services for recommendation Page 21
Page 22
Page 22
Page 23
Appendix 2 Moray Council Internal Audit Section 1 DEPARTMENT: Education, Communities & Organisational Development SUBJECT: Transformation Programme (Improvement and Modernisation Programme) REPORT REF: 24'009 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Review key controls to ensure effective project management of the Improvement and Modernisation Programme 5.01 The Project Management Governance Policy should be reviewed and updated to reflect any proposed changes to project management arrangements. High Yes 30/11/2023 Implemented. The Project Management Governance Policy has been updated and reported to the Corporate Committee on 07 November 2023. This has highlighted a need for a more substantive review of the corporate Item 5. Page 23
Page 24
Appendix 2 Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation management of transformation and change which is being considered by Corporate/Senior Management Team. 5.02 The standardised “Highlight Report” format should be used to monitor progress for all Improvement and Modernisation Programme strategic projects. In addition, consideration should be given to further developing the “Highlight Report” to provide more effective analysis of key deliverables during project implementation. Medium Yes 30/11/2023 Implemented. A Highlight Report has been updated and is now used to monitor the progress for all Improvement and Modernisation Programme strategic projects. Future project management arrangements are being discussed by Corporate/Senior Management as detailed in 5.01 above. 5.03 Consideration should be given to reviewing the format of future committee reporting arrangements to allow greater transparency in monitoring financial savings derived Medium Yes 30/11/2023 Implemented. Reporting format has been revised by the Chief Financial Officer to provide greater clarity. This revision to the reporting format should assist in providing Page 24
Page 25
Appendix 2 Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation from implementing Improvement and Modernisation Programme projects. greater transparency to monitor savings and achieve the future financial sustainability of the Council. Page 25
Page 26
Page 26
Page 27
APPENDIX 3 Moray Council Internal Audit Section DEPARTMENT: Education, Communities and Organisational Development SUBJECT: Data Protection REPORT REF: 23'015 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: The Council has the appropriate procedures and controls in place to protect information, fulfilling the requirements of the Data Protection Act. 5.01 The Data Protection Policy and guidance should be reviewed to ensure the detailed information remains current and appropriate. Thereafter, a timetable for continued review should be set. Medium Yes 31/01/2023 (Revised Implementation Date 31/03/2025) Outstanding. Due to the limited staff resources and the requirement to prioritise activity towards data breach investigations, completion of Data Protection Impact Assessments and Data Sharing Agreements, the updating of the Policy and guidance has been delayed. It is accepted that the Policy and guidance are in need of a review and if Item 5. Page 27
Page 28
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation required updating, but this needs to be balanced with current operational demands. A revised implementation date of 31/03/2025 has been agreed. 5.02 In compliance with UK GDPR, a Record of Processing Activities (ROPA) should be compiled by the Authority based on a data mapping exercise. High Yes 31/12/2023 Part Implemented. The follow up review noted evidence of work in progress to complete a Record of Processing Activities (ROPA). However, on implementing the recommendation, it was found that the volume of work required to complete a ROPA for multi- service activities, in addition to other information management compliance requirements noted within this audit review was significantly greater than initially envisaged. The Service has advised that the implementation of the recommendation will be undertaken over the next few years. It is intended that another audit review will be included in a future Audit Plan to evidence Page 28
Page 29
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation implementation. 5.03 In compliance with UK GDPR, an Information Asset Register should also be compiled and maintained on an ongoing basis. High Yes 31/08/2023 Part Implemented. An Information Asset Register is being compiled as part of more comprehensive information management compliance requirements referred to in the Status/ Explanation at 5.02. It is intended that another audit review will be included in a future Audit Plan to evidence implementation. 5.04 A review of Privacy Notices held within Council services should be progressed and the documents made available on the Council website for public inspection. Medium Yes 31/08/2023 Part Implemented. Evidence noted of completion of Privacy Notices. However, as referred to previously, full implementation of this recommendation is part of wider information management compliance requirements. It is intended that another audit review will be included in a future Audit Plan to evidence implementation. 5.05 Consideration should be given to undertaking reviews within High Yes 31/08/2023 Part Implemented. It was found that data protection compliance recommendations are Page 29
Page 30
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Services to audit compliance with the Data Protection Policy and Guidance. This should provide assurance that the Authority is effectively handling personal data in line with regulations. made to services when asked to review systems or practices or where improvements are identified due to data breaches. However, a programme of rolling reviews within services to evidence continued compliance with data protection regulations is intended after completing the audit recommendations previously detailed. It is intended that another audit review will be included in a future Audit Plan to evidence implementation. 5.06 A review of the guidance documents and forms held within the Information Management section of the Interchange should be undertaken and updated accordingly. Low Yes 30/09/2023 (Revised Implementation Date 31/03/2025) Outstanding. Interchange content relating to information management has yet to be reviewed due to ongoing operational demands and workload capacity. Implementation of this recommendation will be undertaken after the review and if required updating of the Data Protection Policy and guidance, referred to within recommendation 5.01. A revised implementation date of 31/03/2025 has been Page 30
Page 31
Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation agreed. A wholescale review of Interchange content relating to Information Management has not been undertaken due to workload capacity. A comprehensive housekeeping exercise will be undertaken when the Data Protection Policy and guidance, referred to at 5.01, is updated and new documentation and templates are required to be made available. A revised implementation date of 31/03/2025 has been set. 5.07 A review should be undertaken of the officers that have not undertaken the data protection training on the LearnPro training system. Any officer identified should be reminded to undertake their data protection training requirement. High Yes 30/04/2023 Outstanding. Data Protection training is required for newly appointed officers. In addition, officers are required to complete annual data protection refresher training. However, performance information is not readily available to highlight officers who have not undertaken this training. A new Learning Management Software Application System is currently in the process of being procured, with installation planned for 24/25. It is intended Page 31
Page 32
Moray Council Internal Audit Section 6 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation that this new Learning Management Software Application System will provide additional reporting functions detailing officers' participation in training modules. It is intended that another audit review will be included in a future Audit Plan to evidence implementation. 5.08 Consideration should be given to providing elected members with an update of actions undertaken to ensure the Council's compliance with data protection requirements. High Yes 31/12/2023 Implemented. An Annual Information Governance Report was provided to the Corporate Committee on 7th November 2023. It is intended to continue with reporting an Annual Information Governance Report to committee. Page 32
Page 33
APPENDIX 4 Moray Council Internal Audit Section DEPARTMENT: Health and Social Care Moray SUBJECT: Information Management REPORT REF: 23'009 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Appropriate arrangements are in place for secure handling and sharing of personal data. 5.01 Data Protection Impact Assessments (DPIAs) should be undertaken to determine whether additional safeguards need to be implemented where information concerning service users is shared with care providers. High Yes 31/12/2023 Part Implemented. This follow up review within Health and Social Care Moray found that Data Protection Impact Assessments (DPIAs) have been completed for care providers within Children Services. However, in Adult Services, work is still ongoing, and due to the number of care providers, significant work is still required before all of the necessary Item 5. Page 33
Page 34
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation DPIAs are completed. This recommendation is linked to the KPMG review of Adult Social Care Commissioning, which highlighted the need for agreement of new contracts with care providers. Due to the multi-year timescale, it is intended that another audit review will be included in a future Audit Plan to evidence implementation. 5.02 Assurances should be obtained that appropriate data protection training has been undertaken by NHS Grampian employed officers requiring access to Council administered databases. Medium Yes 31/03/2023 Implemented. The application process for NHS employed officers to gain access to Council Systems has been amended to include the requirement to disclose the date that Data Protection training was last completed. NHS Grampian has also provided assurances that officers are required to complete annual refresher training on Data Protection. 5.03 Access to the Staffplan Software Application used to schedule visits Medium Yes 31/03/2023 Outstanding. Further investigations found that establishing individual log in access would Page 34
Page 35
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation by Care Workers to service users should require individual user login and password controls. require significant development and resources to implement. As the system has no link to other software applications, e.g., payroll, this recommendation is not considered a priority at the moment but will be reviewed again in the future. However, all officers using StaffPlan are to be reminded of good ICT security practices, e.g., locking the screen to prevent unauthorised access. 5.04 Regular reviews should be undertaken to confirm the access requirement to the Occupational Therapy Stores Management System by NHS Grampian employed officers. Medium Yes 31/03/2023 Implemented. A process of regularly reviewing officer access requirements to the Occupational Therapy Stores Management System is now in place. Page 35
Page 36
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.05 The Council and NHS Grampian should agree on an updated Data Sharing Agreement (DSA) for operational information concerning service users that includes the requirements of the current data protection regulations. Medium Yes 31/06/2023 (Revised date 31/03/27) Part Implemented. The follow up review noted that the Council and NHS Grampian have now agreed on an Information Sharing Protocol. This is an overarching agreement that allows for the development of DSAs for individual service areas. Work is now ongoing to develop DSAs where information is shared. However, this has been a significantly greater workload commitment than initially envisaged, and a multi-year timescale is needed to implement this recommendation. As a result, it is intended that another audit review will be included in a future Audit Plan to evidence implementation. Page 36
Page 37
Moray Council Internal Audit Section 5 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.06 Contract compliance visits to care providers should include a review that appropriate systems are being followed to manage and ensure the security of service user information. Medium Yes Implemented Implemented. The contract monitoring checklist for external care providers was updated to include checking information management arrangements. Page 37
Page 38
Page 38
Page 39
APPENDIX 5 Moray Council Internal Audit Section DEPARTMENT: Economy, Environment & Finance SUBJECT: Roads Maintenance - Planned REPORT REF: 22'014 Follow Up Audit Review Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Key Control: Works met by the capital budget provision follow proper procurement procedures, are monitored effectively and accurately costed. 5.01 A review of the in-house contractor Schedule of Rates should be undertaken to ensure individual costings provide value for money. As works are also awarded directly to the in house contractor based on a Bill of Medium Yes 31/03/2023 (Revised Implementation Date 31/03/2025) Part Implemented. Evidence was noted that the Service has been reviewing individual costings within the Schedule of Rates and the Bill of Quantities. However, due to staffing issues within Roads Maintenance and the Accountancy Sections, there was a need to suspend this process. It is now planned for a working group to be established with officers Item 5. Page 39
Page 40
Moray Council Internal Audit Section 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation Quantities, the same requirement should be undertaken. Yearly changes to individual rates should also be reviewed to ensure best value is achieved for the costs charged. from both Roads Maintenance and the Accountancy Sections to review the costings of all individual rates. This should ensure transparency in the calculation of all the rates used for costing and recharging of jobs. An officer from the Internal Audit Section has also been asked to overview this arrangement. Due to the volume of the work required, a revised Implementation date of 31/3/2025 has been agreed. 5.02 Oncost percentages charged on works completed by the in house contractor should be reviewed to ensure the rates used reflect the expenditure incurred. Medium Yes 31/03/2023 (Revised Implementation Date 31/03/2025) Outstanding. As detailed in 5.01, a working group has been established with officers from the Roads Maintenance and Accountancy Sections to review all rates used for the recharging of works. This will also include the recalculation of the oncost rates used to ensure they reflect the actual expenditure incurred. A revised Implementation date of 31/3/2025 has been agreed. Page 40
Page 41
Moray Council Internal Audit Section 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation 5.03 Consideration should be undertaken to develop a range of performance indicators to monitor the works undertaken by private and in-house contractors. Medium Yes 31/03/2023 (Revised Implementation Date 31/12/2024) Part Implemented. Evidence has been noted of benchmarking to compare in-house contractor pricing to external contractor costs. In addition, the Association for Public Service Excellence (APSE) Roads, Highways, and Winter Maintenance performance comparison indicators with other local authorities are used in the management of the Service. However, the Roads Maintenance Manager has accepted that further benchmarking needs to be developed to reflect the whole Service to demonstrate best value. A revised Implementation date of 31/12/2024 has been agreed. 5.04 Operating procedures should be documented to assist officers in managing projects and ensuring working practices follow Medium Yes 31/07/2022 (Revised Implementation Date 31/12/2024) Part Implemented. An individual scheme file pack for all internal works over £10,000 has been developed. However, there is a need to ensure that operating practices are supported with documented procedures. A revised date Page 41
Page 42
Moray Council Internal Audit Section 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Date of Completion Status / Explanation recommended civil engineering conditions. of 31/12/2024 has been agreed to fully implement this recommendation. Page 42
Page 43
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 8 MAY 2024 SUBJECT: INTERNAL AUDIT SECTION – COMPLETED PROJECTS REPORT BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 14 February 2024 to 8 May 2024. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (8) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service through receipt of quarterly reports on work carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the following internal audit work concluded during the period 14 February 2024 to 8 May 2024: Pool Cars Scheme 3.2 A review of the Pool Cars Scheme has been undertaken. A pool car is a vehicle owned by the Council and made available for employees on a shared basis. At the time of the audit, the Council’s fleet of pool cars consisted of 118 vehicles, with 84 classified as general and 34 designated as service dedicated vehicles. The audit scope checked systems and procedures in the management and use of pool cars. It is pleasing to note that policies and procedures have been developed detailing guidance and procedures for officers to follow in the booking and use of pool cars, although some are in need of review and possibly updating. Audit testing included checking that officers' actual usage of pool cars was in accordance with these policies and procedures. Enquiries were also undertaken to assess if the further expansion of the number of available pool cars could provide additional value for money opportunities to the Council. The executive summary and recommendations for this project are given in Appendix 1. Item 6. Page 43
Page 44
Creditor Payments - Regularity Review 3.3 Part of the annual audit plan is devoted to main financial systems, including creditor payments that cover non-payroll expenditure, i.e. payment for works, goods and services to suppliers or contractors. The purpose of the audit was to confirm ongoing compliance with procurement and payment processing regulations. 3.4 Testing was undertaken using a data analysis software application to extract a random sample of transactions for review. A check for duplicate payments was also carried out by extracting listings where more than one invoice from a single supplier had been paid for the same amount. Findings from the testing undertaken did note issues concerning the authorisation, processing and use of suppliers, but overall it is considered they do not indicate a systematic failure in operating arrangements. The executive summary for this project is given in Appendix 2. Payroll - Regularity Review 3.5 A review of the payroll system has been undertaken. The payroll system is one of the core financial systems of the Council, administering approximately £178 million of annual expenditure. The audit reviewed the effectiveness of key controls in the management of the payroll service. This involved audit testing a random selection of salary payments and deductions to ensure the correct calculation of remuneration and statutory/voluntary deductions are processed timeously and accurately. The Chartered Institute of Public Finance and Accountancy Control Matrices were used to develop the audit programme. 3.6 The findings from the audit undertaken noted that within the scope of this review, effective arrangements are in place in the management of the Council’s payroll system. However, improvements were identified, including the need to develop a policy for managers and officers detailing the procedures in the authorisation and use of Time Off In Lieu. The executive summary and recommendations for this project are given in Appendix 3. Early Learning and Childcare Premises Security 3.7 The annual audit plan provided for a review of controls in place to mitigate the risk of unauthorised access to Early Learning and Childcare Nurseries. This audit complements the audit review undertaken last year regarding primary school security and the review of secondary school security included within the Audit Plan for 2024/25. 3.8 The scope of this audit involved a review of the controls to prevent children from leaving nursery buildings and play areas unnoticed. The audit involved a review of policies and procedures and visiting nurseries, where the actual security controls operating in practice were observed and tested. It was found that the age and type of premises vary considerably, which presents challenges to ensure the implementation of consistent physical security arrangements. The audit has confirmed that the nurseries visited did have effective supervision arrangements for the children. However, findings from the review highlighted a need for every nursery to undertake a risk assessment of its security risks and the mitigating controls that should be considered. The executive summary and recommendations for this project are given in Appendix 4. Page 44
Page 45
Purchasing Cards 3.9 An audit has been undertaken to review the systems and procedures for the management, use and control of purchasing cards. Cards are available to officers on approval of their budget manager. They provide flexibility and a cost effective alternative to the Council's standard requisition ordering process. Purchasing cards are managed by a payment card software application administered by the Bank. At the time of the audit, purchase cards were issued to 424 officers. The audit selected a time period for testing from April to October 2023, with an expenditure of £1.7 million. Findings from the review undertaken found areas where improvements are required in administrative and monitoring arrangements, especially concerning the accounting arrangements for Value Added Tax (VAT) accounting arrangements. The executive summary and recommendations for this project are given in Appendix 5. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Page 45
Page 46
Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal Audit files Ref: SPMAN-1042990102-220 Page 46
Page 47
APPENDIX 1 AUDIT REPORT 24’014 POOL CARS SCHEME Executive Summary The Internal Audit Plan for 2023/24 provides for a review of the Pool Cars Scheme. A pool car is a vehicle owned by the Council and made available for employees on a shared basis. At the time of the audit the Council’s fleet of pool cars consisted of 118 vehicles, with 84 classified as general and 34 designated as service dedicated vehicles. The pool car system is administered by a software application managed by Fleet Services. Policies and procedures have been developed and are included within the Council website, detailing guidance and procedures for booking and using the vehicles. The scope of this audit was to review systems and procedures in the management and use of pool cars. Policies and procedures were checked to ensure they provide appropriate operating guidance to officers in the booking and use of pool cars. The audit involved interrogation of the software application to randomly select a sample of previously recorded journeys undertaken by officers to ensure usage is in accordance with the Pool Car Employee Guide. Enquiries were also undertaken to assess if a further expansion of the Pool Car Service could provide additional value for money opportunities to the Council. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The areas identified for management attention include:-; • Policies and procedures have been developed to detail the arrangements for the booking and use of pool cars. However, it was noted that most of these documents had not been reviewed for several years. Policies and procedures should be regularly reviewed and if required, updated to reflect best practices. Thereafter, they should be promoted and included within the Council Intranet to ensure officers are aware of their requirements and conditions. • Detailed guidance in the use of pool cars is included in an Employee Guide. The audit included a review of pool car usage by randomly selecting pool car journeys from the tracking information contained within a software application detailing the locations visited, including the speed travelled. Findings highlighted concerns, where journeys undertaken, require further explanation from the officer concerned regarding the use of the pool car. Senior management has been informed to allow for further investigation. • Recovery of costs for fuel, vehicle maintenance and depreciation against capital expenditure on general pool cars is based on an hourly rechargeable rate. However, it was noted that this rechargeable rate has not been reviewed for a number of years. A costing exercise should be undertaken by Fleet Service in consultation with the Accountancy Service to ensure the current rechargeable Item 6. Page 47
Page 48
rate remains appropriate to recover the costs for delivering a pool car service. The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 2 2 3 Page 48
Page 49
Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Policies and procedures for the administration of pool cars are in place, up to date and adequate. 5.01 All policies and procedures should be reviewed and updated on a regular schedule to ensure content remains current and valid. Thereafter, they should be promoted and included within the Council Intranet to ensure officers are aware of their requirements and conditions. Medium Yes A review and if required an update will be undertaken of all policies and procedures and annually thereafter. This will be done by the Compliance & Training Officer. This post is currently vacant, but it is hoped that it will be filled shortly. The implementation timescale is reflective of current staffing arrangements. Fleet Manager / Compliance & Training Officer 31/12/2024 Key Control: Effective controls in place in the management, booking and use of pool cars. 5.02 Services should be reminded that if an officer books a Low Yes Pool car webpage on the Fleet Manager 30/09/2024 Page 49
Page 50
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation vehicle and is later not required, the booking must be cancelled immediately. interchange will be updated to make this clear. 5.03 Senior Management should be informed to remind all officers that the use of pool car vehicles must be in accordance with the Employee Guide. Service Managers should receive monthly reports from Fleet Services of any identified instances where the use of a pool car is not in accordance with the Employee Guide. High High Yes Yes Three minute brief will be issued to all Heads of Services to remind officers of the Employee Guide detailing acceptable use of pool cars. To be implemented once the Compliance and Training Officer has been recruited. Fleet Manager. Compliance & Training Officer 31/04/2024 31/12/2024 5.04 Fleet Service in consultation with the Accountancy Service should review the Medium Yes Rechargeable hourly rates will be reviewed in Fleet Manager 30/06/2024 Page 50
Page 51
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation rechargeable hourly rate used for funding the pool car service. Consideration should also be given to recharging these costs to Services every month. consultation with the Accountancy Section after year end. Monthly recharging is to be introduced. 5.05 A review of the current pool car fleet should be undertaken to determine whether there are any further value for money opportunities to increase the efficiency of the Service. Low Yes A review of the current pool car fleet will be undertaken on appointment of the vacant Compliance and Training Officer role. Compliance & Training Officer 31/12/2024 5.06 Regular physical inspections of pool car vehicles should be introduced to ensure essential documentation and equipment are maintained in all pool car vehicles. Low Yes Inspection of items already undertaken & process in place to review on a 13wk rota. Vehicle Service & Compliance Manager Implemented Page 51
Page 52
Page 52
Page 53
APPENDIX 2 AUDIT REPORT 24'020 CREDITOR PAYMENTS- REGULARITY REVIEW Executive Summary The Annual Audit Plan for the year 2023/24 provides for coverage of the Council’s core financial systems. A review of payments made to suppliers of goods and services has been undertaken. The purpose of the audit was to confirm compliance with Financial, Procurement and Creditor Payment Processing Regulations from the sample checked. This review is part of the annual continuous auditing activity of non- salary expenditure and will be used to support the Audit and Risk Manager’s annual opinion of the Council’s internal control system. Approximately £74 million was paid in the six months, April to September 2023, to suppliers of goods and services. Through the use of a data analysis software application, a random sample of individual payments with a collective total of £11.3 million was selected. The testing included a check to ensure invoices have been correctly authorised, coded and in compliance with regulations. The audit programme was developed from the Chartered Institute of Public Finance and Accountancy Systems Based Auditing Control Matrices and consultation with the External Auditor. In addition, the data analysis software application was also used to select a sample of high-value invoices to test and a check made of identical payment amounts made to the same supplier, which may indicate a potential duplicate payment. Findings from the review found two examples where invoices had not been correctly authorised and an advance payment without the required authorisation of the Chief Financial Officer. In addition, off contract expenditure was also noted in the testing undertaken. Although audit testing noted errors, it is pleasing to report that explanations have been obtained for the discrepancies found, and it is considered that the findings do not indicate a systematic failure in operating arrangements. The Services have also taken the appropriate corrective action. It is considered from the sample checked and from the scope of this review that generally appropriate controls are operating effectively and the integrity of systems has been maintained. The audit was carried out in accordance with the Public Sector Internal Audit Standards (PSIAS). Item 6. Page 53
Page 54
Page 54
Page 55
APPENDIX 3 AUDIT REPORT 24'023 PAYROLL- REGULARITY REVIEW Executive Summary The annual audit plan for the 2023/24 year provided for a review to be undertaken of the Council's payroll system and specifically the controls in place to ensure the adequacy of the systems in place for the payment of salaries. This was undertaken by testing a random sample of starters, leavers, and continuing employees to verify the accuracy of payments and to provide assurance that supporting documentation was in place to support the payments. The sample period for the audit testing was 1 April 2023 to 31 October 2023. The Payroll system is a core financial system of the Council and is key to supporting the processing of staffing costs, which in 2022/23 were in the region of £178 million. The main objectives of the audit were to review the controls in place to ensure the correct calculation of remuneration and that statutory and voluntary deductions are processed timeously and accurately. Since 2017, the Council has operated its Payroll function using a software application called I-Trent. It was noted that approximately 5,400 officer payslips are processed every month. The iTrent system has a dual function of meeting the requirements of two main service areas, i.e., payroll and human resources. This allows segregation of duties control to ensure a separation between the management process concerning officer appointments, terminations, grading and the processing of salary payments. The audit was carried out in accordance with the Public Sector Internal Audit Standards (PSIAS). It is pleasing to report that from the testing undertaken and within the scope of this review, effective arrangements are in place in the management of the Council’s payroll system. However, the following areas were identified for management attention: • From an audit check undertaken to ensure the correct last date of employment was used for the salary paid to a sample of officers recorded as leaving the employment of the Council; an example was noted where an officer had continued to be paid for 2 months after the date the officer had left the Council. This issue had already been raised separately, and action has been taken to recover the overpayment. The salary overpayment occurred due to an administrative error within the employing Service. A reminder should be issued to all budget managers of the need to ensure prompt notification to the Payroll Section as soon as it is known that an officer is leaving the employment of the Council. • Audit testing noted an officer who had been paid a significant amount of Time Off In Lieu (TOIL). The TOIL payment had been correctly authorised. However, enquiries noted that no policy is in place to assist managers and officers in detailing agreed and consistent guidelines for the use, authorisation and if required payment of TOIL. Item 6. Page 55
Page 56
Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 1 2 0 Page 56
Page 57
Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Key controls and processes are operating effectively in ensuring accurate salary payments to Council employees that are accounted for correctly. 5.01 Notification of Appointment Forms should be completed for appointments of Newly Qualified Teachers. Medium Yes Will be completed as part of the induction day for NQT’s held in August each year and prior to commencement of employment. Payroll process will be updated accordingly. Business Support Team Manager 31/08/2024 5.02 All budget managers should be reminded of the importance of timely completion and submission of a “Termination of Employment” Form" as soon it is known that an officer is leaving the employment of the Council. High Yes Regular reminders to be included within the HR Bulletin, Payroll newsletter and Connect. Head of HR, ICT & Organisational Development 30/06/2024 Page 57
Page 58
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.03 A policy relating to Time Off In Lieu (TOIL) arrangements should be agreed. Medium Yes A policy will be developed and progressed through due process. Head of HR, ICT & Organisational Development 31/10/2024 Page 58
Page 59
APPENDIX 4 AUDIT REPORT 24’017 EARLY LEARNING AND CHILDCARE PREMISES SECURITY Executive Summary The annual audit plan for 2023/24 provides for a review of controls in place to mitigate the risk of unauthorised access to Early Learning and Childcare Nurseries. The audit also included a review of the controls to prevent children from leaving nursery buildings and play areas unnoticed. It was found that the age and type of premises do vary considerably, which does present challenges to ensure the implementation of consistent physical security arrangements. In Moray, there are 63 funded nurseries, with the majority delivered by private and third sector providers. The Council’s Early Learning and Childcare Service has an overall responsibility to ensure the delivery of Scottish Government funded childcare in Moray. The scope of the audit included a check to review the policies and procedures used to maintain the security controls within nursery buildings and play areas. Audit testing involved selecting a sample of both Council and privately run nurseries to visit, where the actual security controls operating in practice were observed and tested. The audit was carried out in accordance with the Public Sector Internal Audit Standards (PSIAS). The review found that the security of children was of high priority to the Early Learning and Childcare Service, with examples of good practices noted during the audit visits to nurseries. However, the audit has highlighted where further improvements should be considered: • The audit visits to nurseries found effective supervision arrangements for the children. However, the physical controls to manage access and exit to nursery grounds and play areas varied, with some nurseries having low fencing and concerns noted regarding locks for the gates. It is appreciated the challenges facing some nurseries regarding physical security arrangements. Consideration should be given to every nursery to undertake a risk assessment of their security risks and the mitigating controls that should be considered. • It was pleasing to note that induction training on the security arrangements to be followed is provided to officers working at nurseries. However, from a review of a sample of officers appointed, examples were noted where individual training records had not been updated to record the training provided. In addition, it was also found there was no requirement for nurseries to deliver ongoing refresher training for officers to maintain an up to date awareness of security requirements. • The Early Learning and Childcare Service administers Scottish Government childcare funding to the private and third sector nurseries. This arrangement is documented within a contractual agreement. A review of this agreement noted reference to a requirement to ensure the safety of children and officers, but no reference is made regarding the security of the premises and play areas. Item 6. Page 59
Page 60
The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 2 6 0 Page 60
Page 61
Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: The controls around Early Learning and Childcare Nurseries are sufficient to prevent unauthorised access and to prevent children from leaving premises unnoticed. 5.01 Council operated nurseries should be reminded to update the Early Learning and Childcare Policies, Procedures and Guidance Document with their site- specific security arrangements. Medium Yes Each Local Authority nursery to complete the site-specific arrangements of the Early Learning and Childcare Policies, Procedures and Guidance Document. Early Years Service Manager/ Nursery Managers 31/08/2024 5.02 All security training provided to nursery officers should be recorded within their personal training records. Regular security procedures awareness training should Medium Yes Managers will be reminded to record induction security Early Years Service Manager / Nursery Managers 31/08/2024 Page 61
Page 62
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation also be provided on an ongoing basis. training and refresher security training will be carried out annually for all nursery practitioners. The same training will be offered as induction training when new staff start. 5.03 All nurseries should agree on site specific operating guidelines to follow in the event of unauthorised access to the nursery by an individual. Medium Yes Nursery Managers will develop and document site- specific procedures to be followed in the event of a range of Early Years Service Manager / Nursery Managers 31/08/2024 Page 62
Page 63
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation security scenarios. 5.04 Consideration should be given to including a requirement for ensuring premises and play area security arrangements within the contractual agreements with private and third sector early learning and childcare nurseries. Medium Yes Requirement to maintain secure indoor and outdoor spaces to be included in upcoming review of contract terms and conditions. Early Years Service Manager 31/08/2024 5.05 Consideration should be given for all nurseries to install individual alarms on external doors accessible to the children. High Yes To be included as part of individual risk assessments to be carried out at each nursery regarding security arrangements. Early Years Service Manager / Nursery Managers 31/08/2024 Page 63
Page 64
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.06 Consideration should be given to all nurseries to undertake a documented assessment of the premises and play areas to assess current security risks and the controls implemented or required to mitigate these risks. Medium Yes To be included as part of individual risk assessments to be carried out at each nursery regarding security arrangements. Early Years Service Manager / Nursery Managers 31/08/24 5.07 Consideration should be given to service delivery inspections at nurseries to include an assessment of the physical controls operating within the nursery's premises and play areas. Medium Yes To be included in contract monitoring carried out by Continuous Improvement Officers. Early Years Service Manager / Continuous Improvement Officers 31/08/2024 5.08 A premises key holder list should be maintained for all nurseries. High Yes Key holder lists to be established and maintained at all Local Early Years Service Manager / Nursery Managers 31/08/2024 Page 64
Page 65
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Authority Nurseries. Page 65
Page 66
Page 66
Page 67
APPENDIX 5 AUDIT REPORT 24'023 PURCHASING CARDS Executive Summary The Internal Audit Plan for the 2023/24 year provides for a review of the systems and procedures for the management, use and control of purchasing cards. A purchasing card is similar to a personal credit card issued by the Council's Bank used by the Moray Council to enable purchases of supplies and services to be made quickly and efficiently. Cards are available to officers on approval of their budget manager. It provides flexibility and a cost effective alternative to the Council's standard requisition ordering process. Purchasing cards are managed by a payment card software application administered by the Bank. The audit scope for this review was to assess the key controls and systems in place in the management and use of purchasing cards. This involved testing a sample of transactions to evidence operating arrangements compliance with the Purchasing Card Manual. In addition, the audit checked the use of purchasing cards to Financial Regulations, Authorisation Policy and VAT accounting requirements. The audit also undertook a reconciliation of purchasing card transactions within the payment card system to the Council's Financial Management System. In terms of scale, at the time of the audit, purchasing cards were in issue to 424 officers. The audit selected a time period for testing of April to October 2023, which amounted to a total expenditure of £1.7 million. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Areas identified for management attention include:- • The audit has noted a number of findings where improvements have been identified as required in Value Added Tax (VAT) accounting arrangements. Testing has found examples where the maximum recovery of input VAT is not being achieved. Services should be reminded of VAT accounting arrangements detailed within the Purchasing Card Manual to ensure increased costs are not being incurred unnecessarily. • All officers issued a purchasing card are required to sign and return to the Payments Service a Payment Card Terms of Use Form. This form details the officer's acceptance of the conditions of use, card security and the requirement for purchases to comply with the Council's Financial Regulations. Audit testing found from a random sample that the majority of officers using a purchasing card had not signed this Payment Card Terms of Use Form. • All payment card transactions over £10 must be authorised by the appropriate budget manager within the payment card software application. Operating arrangements involve a weekly email notification from the Bank to a budget manager to highlight any unauthorised transactions. Additionally, there are periodic notifications by the Payments Service to remind budget managers to Item 6. Page 67
Page 68
authorise all transactions. Testing noted within the time period reviewed that approximately 6% of all transactions had not been authorised. This amounted to 394 individual transactions. In accordance with the Authorisation Policy, a Budget Manager is required to authorise all transactions over the value of £10. The authorisation of transactions is a key control as a payment is made in full on receipt of the monthly purchasing card statement from the Bank. The Internal Audit Section provides Management with an opinion on the internal control environment and also categories risk ratings for recommendations as high, medium or low. The audit recommendations for this review have been classified as follows: Risk Ratings for Recommendations High Medium Low Key controls absent, not being operated as designed or could be improved. Urgent attention required. Less critically important controls absent, not being operated as designed or could be improved. Lower level controls absent, not being operated as designed or could be improved. 3 6 3 Page 68
Page 69
Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Procedures are in place and frequently reviewed to govern use of the corporate purchasing cards system. 5.01 In accordance with agreed timescales, Purchasing Card Procedures should be reviewed annually and made available on the Interchange for user reference. Medium Yes Procedures will be reviewed annually, every March, and uploaded to the interchange for reference. Assistant Manager FMS & Banking 30/04/2024 Key Control: A robust purchase card application process is in place accompanied by a controlled process for issue of cards on acceptance of terms of operation. 5.02 All officers must sign and return a Payment Card Terms of Use Form to the Payments Service before being issued a purchasing card and access granted to the Payment Card System. Medium Yes As an addition, it will be included as part of the terms and conditions that the card will not be issued until the signed form is returned. Payments Officer 30/04/2024 Page 69
Page 70
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Usage of purchase cards is controlled by imposed limits, is for purchases not suitable for standard procurement routes, is appropriately detailed for authorisation and scrutiny purposes and supports the continued appropriateness of card retention. 5.03 Consideration should be given to aligning all purchasing cardholders who hold a standard single transaction limit to the current transaction limit of £1,000 to ensure consistency. Low Yes An exercise to review limits will be undertaken. Payments Officer 31/07/2024 5.04 The Bank should be informed to correct the errors found in Cardholders spending limits noted during the audit review. Low Yes As above, this will be addressed by the exercise to review all cardholder limits. Payments Officer 31/07/2024 Key Control: Purchase Card transactions are appropriately authorised by the relevant budget manager. 5.05 Full transaction listings of purchase card transactions should be issued for information to all budget managers every quarter, in Medium Yes Full transaction listings for 23/24 will be issued to budget Assistant Manager FMS & Banking 30/04/2024 Page 70
Page 71
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation compliance with purchasing card procedures. managers as a catch-up exercise and quarterly reports will be issued going forward. 5.06 Agreed timescales should be established where payment card transactions not authorised by a budget manager are referred to the appropriate Head of Service to resolve and if required, authorise the outstanding expenditure. Medium Yes Budget Managers will be chased monthly and non compliance will be reported to Heads of Service on a quarterly basis. Payments Officer 30/04/2024 Key Control: VAT on purchasing card transactions is accurately documented and accounted for with full recovery of applicable input tax elements. 5.07 A reminder should be issued to all services to remind officers of VAT accounting requirements for payment card transactions. High Yes A reminder will be added to the annual email template used for confirming Payments Officer 30/04/2024 Page 71
Page 72
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation terms of use and cardholder details with every cardholder. 5.08 Consideration should be given for the Payments Service to undertake further monitoring of payment card transactions with the aim of maximising VAT recovery where documentary evidence is required of valid VAT receipts / invoices from services. High Yes This will be considered in terms of available resources and workload prioritisation. However, the process should be assisted by the electronic developments for receipt recording currently being progressed. Assistant Manager FMS & Banking 31/07/2024 5.09 The agreed procedure for the Payments Service of issuing routine escalation reports on High Yes Process has been reinstated with Assistant Manager FMS & Banking 30/04/2024 Page 72
Page 73
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation purchase card transactions with potential VAT implications to Heads of Service should be reinstated to promote VAT recovery arrangements. catch-up reports for 23/24 now issued to Heads of Service. The standard process of issuing timely quarterly reports will be followed going forward. 5.10 Investigation of an electronic document imaging facility to record VAT receipts / invoices on transaction logging should continue with the aim of implementing more effective VAT accounting and documentation retention arrangements. Medium Yes System development is currently being undertaken to progress the required electronic upload of spend evidence. Assistant Manager FMS & Banking 31/07/2024 Page 73
Page 74
Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Processes are in place to ensure purchase card permissions are fully withdrawn from cardholders on termination of employment. 5.11 In accordance with operating arrangements, the payment card system should be updated promptly to reflect current budget management responsibilities when notified of officers leaving the employment of the Council. Medium Yes Leaver information will continue to be addressed monthly. Process will be strengthened to ensure budget managers who cannot be immediately removed from the system are flagged for review in the following month. Payments Officer 30/04/2024 5.12 Greater care should be taken on inputting payroll reference numbers when setting up employees on the purchasing card system. Low Yes An email reminder will be issued to the Team. Assistant Manager FMS & Banking 30/04/2024 Page 74
Page 75
Page 75
Page 76
Page 76
Page 77
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 8 MAY 2024 SUBJECT: ANNUAL AUDIT PLAN FOR YEAR ENDING 31 MARCH 2024 BY: DEPUTE CHIEF EXECUTIVE (ECONOMY, ENVIRONMENT & FINANCE) 1. REASON FOR REPORT 1.1 To inform the Committee of the Auditor’s Annual Audit Plan for 2023/24. 2. RECOMMENDATION 2.1 It is recommended that the Committee: (i) scrutinises the Audit Risk Assessment; and (ii) considers and notes the contents of the External Auditor’s Annual Plan for 2023/24. 3. BACKGROUND 3.1 In September 2022, the Accounts Commission confirmed the appointment of Grant Thornton as the external auditor for the Council for financial years 2022/23 to 2026/27 inclusive. 3.2 In delivering the public audit for Moray, Grant Thornton will provide independent assurance that public money has been spent appropriately and provides value. Audit work is carried out in accordance with International Standards on Auditing, the Code of Audit Practice and any other relevant guidance. 3.3 The audit includes consideration of Best Value as part of the Wider Scope audit. 4. ANNUAL AUDIT PLAN 2023/24 4.1 Grant Thornton’s Annual Audit Plan (AAP) for 2023/24 is attached as Appendix 1 to this report. The Plan sets out the scope of the audit work and the auditor’s approach to the audit. The AAP is risk based and details the initial risks identified at the planning stage by Grant Thornton on page 11. These will direct the focus of audit testing and the AAP sets out the planned Item 7. Page 77
Page 78
work to be undertaken for the audit of the financial statements for the year ending 2023/24. 4.2 In order to assist with the assessment of risk, an Informing the Audit Risk Assessment was completed by senior managers and this is attached as Appendix 2. This Committee is asked by the Auditor to scrutinise the Audit Risk Assessment. 4.3 Page 6 of the AAP shows the external audit fee for 2023/24 as £312,720, which is an increase of 10.6% on the previous year. In the main this fee is set by Audit Scotland. 4.4 The annual accounts timetable, including key deadlines are shown on page 7 of the AAP and includes the statutory requirement for the Council to submit the Unaudited Annual Accounts along with supporting working papers to Grant Thornton by 30 June 2024, following consideration by those charged with governance at the meeting of Moray Council on 26 June 2024. The Council will be asked to consider the Annual Audit Report and approve the Audited Annual Accounts at its meeting on 25 September 2024. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) This report aligns with the strategic delivery framework which sits around the Corporate Plan including the financial strategies and performance framework including plans to ensure the delivery of Best value. (b) Policy and Legal The external audit is conducted in terms of statutory powers afforded to the appointed External Auditor and in accordance with Grant Thornton’s Code of Practice. (c) Financial implications The annual audit fee for 2023/24 is £312,720. (d) Risk Implications The risks associated with the Annual Audit Plan have been identified and categorised within the Annual Audit Plan on page 11. (e) Staffing Implications Preparation of the Council’s financial statements will be co-ordinated by the Chief Financial Officer and will require input from all sections of Financial Services along with other departments across the Council. (f) Property None arising directly from this report. (g) Equalities/Socio Economic Impact None arising directly from this report. (h) Climate Change and Biodiversity Impacts Page 78
Page 79
None arising directly from this report. (i) Consultations The content of the Annual Audit Plan has been discussed with CMT, the Chief Financial Officer and the Audit and Risk Manager prior to production and their comments have been incorporated where appropriate. 6. CONCLUSION 6.1 The Annual Audit Plan informs the Council, its Committees and officers of the work to be undertaken by the external Auditor, Grant Thornton, in the year ahead. Author of Report: Lorraine, Paisey, Chief Financial Officer Background Papers: Ref: LP/LJC/SPMAN-1293228629-1073 Page 79
Page 80
Page 80
Page 81
APPENDIX 1 Item 7. Page 81
Page 82
Page 82
Page 83
• • Page 83
Page 84
• • • • • • • • Page 84
Page 85
• • • • • • • • Page 85
Page 86
• • • • Page 86
Page 87
Page 87
Page 88
8 • • • • • Page 88
Page 89
Page 89
Page 90
• • • • • • Page 90
Page 91
• • • • • • Page 91
Page 92
Page 92
Page 93
Page 93
Page 94
• • • • • • • • Page 94
Page 95
Page 95
Page 96
• • • • • • • Page 96
Page 97
• • • • – – – – – – • • Page 97
Page 98
• • • • • • • • Page 98
Page 99
Page 99
Page 100
Page 100
Page 101
• • • • • Page 101
Page 102
• • • Page 102
Page 103
• • • Page 103
Page 104
• Page 104
Page 105
• • • • • • Page 105
Page 106
• • • • • • Page 106
Page 107
• • • • • • • • Page 107
Page 108
• • • • • • Page 108
Page 109
Page 109
Page 110
Service Fees £ • • • • • Page 110
Page 111
31 Adding value through the audit • • • Inflo • • • • • •Page 111
Page 112
Page 112
Page 113
Page 113
Page 114
Page 114
Page 115
Page 115
Page 116
36 • • • • • Page 116
Page 117
37 • • • • • • Page 117
Page 118
Page 118
Page 119
39 • • • • Page 119
Page 120
40 • • • • • • • Page 120
Page 121
• • • • • • • • Page 121
Page 122
Page 122
Page 123
Informing the audit risk assessment for Moray Council 2023/24 Prepared by management Angela Pieri Director T 0161 214 6337 E Angela.L.Pieri@uk.gt.com Andrew Wallace Manager T 0141 223 0671 E andrew.d.wallace@uk.gt.com APPENDIX 2 Item 7. Page 123
Page 124
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence The contents of this report relate only to the matters which have come to our attention, which we believe need to be reported to you as part of our audit process. It is not a comprehensive record of all the relevant matters, which may be subject to change, and in particular we cannot be held responsible to you for reporting all of the risks which may affect your business or any weaknesses in your internal controls. This report has been prepared solely for your benefit and should not be quoted in whole or in part without our prior written consent. We do not accept any responsibility for any loss occasioned to any third party acting, or refraining from acting on the basis of the content of this report, as this report was not prepared for, nor intended for, any other purpose. 2 Page 124
Page 125
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Table of Contents Section Page Purpose 4 General Enquiries of Management 6 Fraud 9 Fraud Risk Assessment 10 Laws and Regulations 16 Impact of Laws and Regulations 17 Related Parties 19 Going Concern 21 Accounting Estimates 23 Accounting Estimates - General Enquiries of Management 24 Appendix A – Accounting Estimates 27 3 Page 125
Page 126
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Purpose The purpose of this report is to contribute towards the effective two-way communication between Moray Council’s external auditors and Moray Council’s Audit & Scrutiny Committee, as 'those charged with governance'. The report covers some important areas of the auditor risk assessment where we are required to make inquiries of the Audit & Scrutiny Committee under auditing standards. Background Under International Standards on Auditing (UK), (ISA(UK)) auditors have specific responsibilities to communicate with the Audit & Scrutiny Committee. ISA(UK) emphasise the importance of two-way communication between the auditor and the Audit & Scrutiny Committee and also specify matters that should be communicated. This two-way communication assists both the auditor and the Audit & Scrutiny Committee in understanding matters relating to the audit and developing a constructive working relationship. It also enables the auditor to obtain information relevant to the audit from the Audit & Scrutiny Committee and supports the Audit & Scrutiny Committee in fulfilling its responsibilities in relation to the financial reporting process. Communication As part of our risk assessment procedures we are required to obtain an understanding of management processes and the Authority’s oversight of the following areas: • General Enquiries of Management • Fraud, • Laws and Regulations, • Related Parties, • Going Concern, and • Accounting Estimates. 4 Page 126
Page 127
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Purpose This report includes a series of questions on each of these areas and the response we have received from Moray Council’s management. The Audit & Scrutiny Committee should consider whether these responses are consistent with its understanding and whether there are any further comments it wishes to make. 5 Page 127
Page 128
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence General Enquiries of Management Question Management response 1. What do you regard as the key events or issues that will have a significant impact on the financial statements for 2023/24? Impact of inflation on construction costs (not as the same scale as previous year) 2. Have you considered the appropriateness of the accounting policies adopted by Moray Council ? Have there been any events or transactions that may cause you to change or adopt new accounting policies? If so, what are they? Accounting Policies are reviewed each year as the Accounts are prepared and changes incorporated where deemed necessary. No changes to Accounting Policies are anticipated for the 2023/24 Accounts 3. Is there any use of financial instruments, including derivatives? If so, please explain No derivatives. Financial Liabilities – measured at amortised cost and include: Long Term Loans from PWLB and commercial lenders, Short Term Loans from other Local Authorities, Lease Payables, PPP Contracts, Trade Payables. Financial Assets – measured at amortised cost and include: Cash in Hand, Bank Current and Deposit Accounts, Trade Receivables for Goods and Services Provided. 4. Are you aware of any significant transaction outside the normal course of business? If so, what are they? Not aware of any 6 Page 128
Page 129
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence General Enquiries of Management Question Management response 5. Are you aware of any changes in circumstances that would lead to impairment of non-current assets? If so, what are they? Not aware of any 6. Are you aware of any guarantee contracts? If so, please provide further details N/A 7. Are you aware of the existence of loss contingencies and/or un-asserted claims that may affect the financial statements? If so, please provide further details N/A 8. Other than in house solicitors, can you provide details of those solicitors utilised by Moray Council during the year. Please indicate where they are working on open litigation or contingencies from prior years? Will be a separate email from legal for this 7 Page 129
Page 130
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence General Enquiries of Management Question Management response 9. Have any of the Moray Council's service providers reported any items of fraud, non-compliance with laws and regulations or uncorrected misstatements which would affect the financial statements? If so, please provide further details Not aware of any 10. Can you provide details of other advisors consulted during the year and the issue on which they were consulted? Mercer for Actuarial Services in relation to IAS 19 Employee Benefits. Arlingclose – Treasury Management Advisers and also engaged specifically on the changes to Service Concession Arrangements in Scotland. 11. Have you considered and identified assets for which expected credit loss provisions may be required under IFRS 9, such as debtors (including loans) and investments? If so, please provide further details Bad Debt Provision for Trade Debtors, Council Tax and Housing Rents will be processed as normal. No further allowance anticipated in 2023/24 8 Page 130
Page 131
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Fraud Matters in relation to fraud ISA (UK) 240 covers auditors responsibilities relating to fraud in an audit of financial statements. The primary responsibility to prevent and detect fraud rests with both the Audit & Scrutiny Committee and management. Management, with the oversight of the Audit & Scrutiny Committee, needs to ensure a strong emphasis on fraud prevention and deterrence and encourage a culture of honest and ethical behaviour. As part of its oversight, the Audit & Scrutiny Committee should consider the potential for override of controls and inappropriate influence over the financial reporting process. As Moray Council's external auditor, we are responsible for obtaining reasonable assurance that the financial statements are free from material misstatement due to fraud or error. We are required to maintain professional scepticism throughout the audit, considering the potential for management override of controls. As part of our audit risk assessment procedures we are required to consider risks of fraud. This includes considering the arrangements management has put in place with regard to fraud risks including: • assessment that the financial statements could be materially misstated due to fraud, • process for identifying and responding to risks of fraud, including any identified specific risks, • communication with the Audit & Scrutiny Committee regarding its processes for identifying and responding to risks of fraud, and • communication to employees regarding business practices and ethical behaviour. We need to understand how the Audit & Scrutiny Committee oversees the above processes. We are also required to make inquiries of both management and the Audit & Scrutiny Committee as to their knowledge of any actual, suspected or alleged fraud. These areas have been set out in the fraud risk assessment questions below together with responses from Moray Council's management. 9 Page 131
Page 132
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Fraud risk assessment Question Management response 1. Has Moray Council assessed the risk of material misstatement in the financial statements due to fraud? How has the process of identifying and responding to the risk of fraud been undertaken and what are the results of this process? How do the Authority's risk management processes link to financial reporting? The Council has established risk management, governance and operating procedures to mitigate the risk of material misstatement in the financial statements. The Corporate Risk Register detailing the Council’s principal risks is reviewed by CMT/SMT on a 3 monthly basis with an annual report provided to elected members. Services are also required to maintain risk registers detailing identifiable risks and mitigating controls. In addition, the Audit and Risk Manager prepares a risk-based audit plan which considers the Council’s strategic objectives, associated risks and the views of senior management. 2. What have you determined to be the classes of accounts, transactions and disclosures most at risk to fraud? A risk register is maintained by Accountancy recording risks, controls, etc. In addition, Internal Audit will also review and test transactions to ensure compliance with Council Regulations and Procedures. The use of IDEA, a computer assisted software system is used to analyse and select a sample for testing 3. Are you aware of any instances of actual, suspected or alleged fraud, errors or other irregularities either within Moray Council as a whole, or within specific departments since 1 April 2023? If so, please provide details No irregularity noted below the £5000 reporting threshold 10 Page 132
Page 133
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Fraud risk assessment Question Management response 4. As a management team, how do you communicate risk issues (including fraud) to those charged with governance? The Council’s Financial Regulations require all irregularities to be reported to the Audit and Risk Manager. Principal risks facing the Council are reviewed on a 3 monthly basis by CMT/SMT and the Corporate Risk Register is then updated accordingly. 5. Have you identified any specific fraud risks? If so, please provide details Do you have any concerns there are areas that are at risk of fraud? Are there particular locations within Moray Council where fraud is more likely to occur? Not aware of any 6. What processes do Moray Council have in place to identify and respond to risks of fraud? Financial Regulations detail that all staff irregularities should be reported to the Audit and Risk Manager. This is supported by the Policy to Combat Fraud, Theft, Bribery and Corruption and the Whistleblowing Policy. In addition, the Council participates in the National Fraud Initiative data matching exercise, and also publicises a point of contact to report fraud or irregularities involving the misuse of council resources. 11 Page 133
Page 134
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Fraud risk assessment Question Management response 7. How do you assess the overall control environment for Moray Council, including: • the existence of internal controls, including segregation of duties; and • the process for reviewing the effectiveness the system of internal control? If internal controls are not in place or not effective where are the risk areas and what mitigating actions have been taken? What other controls are in place to help prevent, deter or detect fraud? Are there any areas where there is a potential for override of controls or inappropriate influence over the financial reporting process (for example because of undue pressure to achieve financial targets)? If so, please provide details The responsibility for developing and maintaining sound control environment rests with management. However, the Audit and Risk Manager prepares a risk-based audit plan which considers the Council’s strategic objectives and associated risks. While the prevention of fraud and error rests with management through the design and operation of suitable systems of control, reviews undertaken by Internal Audit will make recommendations to improve the control environment. Internal Audit also coordinates the Council’s participation in the National Fraud Initiative, a data matching exercise involving a range of public sector bodies. This activity is viewed as complementary to other audit activities, and participation assists Internal Audit in assessing the potential for the occurrence of fraud and related fraud risk. Testing will primarily be undertaken by the Services, with Internal Audit undertaking an overview of the process. In accordance with an Audit and Scrutiny Committee Report, the Internal Audit Section reviewed the key fraud risks identified within an Audit Scotland Report – Fraud & Irregularity. Findings detailing risks, mitigating controls and responsible officer(s) were reported to the Information Assurance Group. 8. Are there any areas where there is potential for misreporting? If so, please provide details None known 12 Page 134
Page 135
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Fraud risk assessment Question Management response 9. How does Moray Council communicate and encourage ethical behaviours and business processes of it’s staff and contractors? How do you encourage staff to report their concerns about fraud? What concerns are staff expected to report about fraud? Have any significant issues been reported? If so, please provide details The Council has a Policy to Combat Fraud, Theft, Bribery and Corruption. This policy is built around a counter fraud culture supported by practices to deter and detect fraudulent and corrupt activities. It takes account of the Council’s statutory obligations, including, and in particular, the provisions of the Bribery Act 2010. The Council has a statutory responsibility to make arrangements for the administration of its financial affairs under the direction of a proper officer - the Chief Financial Officer. The Council has incorporated within its standing orders and procurement procedures, arrangements in respect of contracts for the supply of services, goods or materials and the execution of works. These ensure that established and consistent contracting procedures are available for use by the Council, and all procuring officers are either fully trained or are given support by Procurement Officers as part of the Supported Tender Process. The Audit and Scrutiny Committee has a remit which includes ensuring that the highest standards of probity and public accountability are demonstrated. This involves oversight of internal control processes as a contribution to good governance and generally supporting an anti-fraud, theft, corruption, and bribery culture. This Committee considers reports produced by Internal and External Audit on the Council’s systems; reports which include recommendations to strengthen internal controls and in turn reduce the risk of fraud and related behaviours going undetected. .As detailed previously, Managers have an ongoing responsibility for implementing effective systems of control which secure the legitimacy of expenditure, the safeguarding of assets and income, the reliability of management information, the accuracy of record keeping and compliance with statutory guidance. They also have a responsibility to communicate this policy to their staff and ensure established systems are followed. Financial Regulations detail that all irregularities should be reported to the Audit and Risk Manager. In addition, a Confidential ‘whistle blowing’ policy and procedure is in place, enabling employees to raise any concerns about any aspect of the Council’s work without fear of victimisation, subsequent discrimination or disadvantage, and in the knowledge that such concerns will be properly investigated 13 Page 135
Page 136
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Fraud risk assessment Question Management response 10. From a fraud and corruption perspective, what are considered to be high-risk posts? How are the risks relating to these posts identified, assessed and managed? There is an expectation that all staff and elected members will act within the law and with honesty and integrity at all times. In particular, all staff and elected members are expected to refrain from engaging in fraudulent or corrupt activity of any kind and shall refrain from the offering, making or accepting bribes, whether financial or otherwise. Governance standards promote values and behaviours for the Council that demonstrate how it will uphold good practice and high standards of conduct. These include codes of conduct for both elected members and employees and reflect the principles of public life identified by the Nolan Committee, including selflessness, honesty and integrity. This also takes in the Duty (Public Service) and Respect principles added by the Scottish Government. 11. Are you aware of any related party relationships or transactions that could give rise to instances of fraud? If so, please provide details How do you mitigate the risks associated with fraud related to related party relationships and transactions? None noted. The Council participates in the National Fraud Initiative. This requires the submission of various data sets at prescribed intervals to the Cabinet Office. The information supplied is matched to similar data provided by other public bodies and then made available to the Council for use in data matching exercises designed to detect fraud and error. Page 136
Page 137
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Fraud risk assessment Question Management response 12. What arrangements are in place to report fraud issues and risks to the Audit & Scrutiny Committee? How does the Audit & Scrutiny Committee exercise oversight over management's processes for identifying and responding to risks of fraud and breaches of internal control? What has been the outcome of these arrangements so far this year? The Public Sector Internal Audit Standards (PSIAS) applicable to Local Government in Scotland requires the Audit and Risk Manager to report functionally to the Audit and Scrutiny Committee on various issues relative to the work of the Internal Audit Service, including special investigations. The Audit and Scrutiny Committee has a remit which includes ensuring that the highest standards of probity and public accountability are demonstrated. This involves oversight of internal control processes as a contribution to good governance and generally supporting an anti-fraud, theft, corruption, and bribery culture. This Committee considers reports produced by Internal and External Audit on the Council’s systems; reports which include recommendations to strengthen internal controls and in turn reduce the risk of fraud and related behaviours going undetected. Functions and makeup of the Audit and Scrutiny Committee have also been recently reviewed and updated to reflect the requirements of the Chartered Institute of Public Finance and Accountancy (CIPFA) Position Statement: Audit Committees in Local Authorities and Police 2022 13. Are you aware of any whistle blowing potential or complaints by potential whistle blowers? If so, what has been your response? None noted 14. Have any reports been made under the Bribery Act? If so, please provide details None noted 15 Page 137
Page 138
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Law and regulations Matters in relation to laws and regulations ISA (UK) 250 requires us to consider the impact of laws and regulations in an audit of the financial statements. Management, with the oversight of the Audit & Scrutiny Committee, is responsible for ensuring that Moray Council's operations are conducted in accordance with laws and regulations, including those that determine amounts in the financial statements. As auditor, we are responsible for obtaining reasonable assurance that the financial statements are free from material misstatement due to fraud or error, taking into account the appropriate legal and regulatory framework. As part of our risk assessment procedures we are required to make inquiries of management and the Audit & Scrutiny Committee as to whether the body is in compliance with laws and regulations. Where we become aware of non-compliance or suspected non-compliance we need to gain an understanding of the non-compliance and the possible effect on the financial statements. Risk assessment questions have been set out below together with responses from management. 16 Page 138
Page 139
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Impact of laws and regulations Question Management response 1. How does management gain assurance that all relevant laws and regulations have been complied with? What arrangements does Moray Council have in place to prevent and detect non-compliance with laws and regulations? Are you aware of any changes to the Authority's regulatory environment that may have a significant impact on the Authority's financial statements? Generally speaking each service area (for example planning, procurement, social work) are familiar with the statutory regime in which they operate and will keep up to speed with developments through their professional associations such as CIPFA or SOLAR. Changes to legislation, consultations and guidance are notified to the Council by the Scottish Government and are distributed to the relevant departmental area. The legal section has teams which specialise in different areas of Council activity and will be involved (at the request of client departments) in the implementation of more complex changes (such as formation of the IJB) and in any areas where legislation is unclear. Legal compliance will often be subject to external regulation (for example data protection). The Councils Scheme of Delegation (detailing the powers given to officers to implement services under specified legislation) is reviewed annually in line with revised legislative powers, in consultation with client departments 2. How is the Audit & Scrutiny Committee provided with assurance that all relevant laws and regulations have been complied with? The Councils Scheme of Delegation (detailing the powers given to officers to implement services under specified legislation) is reviewed annually in line with revised legislative powers, in consultation with client departments 3. Have there been any instances of non-compliance or suspected non-compliance with laws and regulation since 1 April 2023 with an on-going impact on the 2023/24 financial statements? If so, please provide details The on going issue regarding records management plan from 2022/23 17 Page 139
Page 140
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Impact of laws and regulations Question Management response 4. Are there any actual or potential litigation or claims that would affect the financial statements? If so, please provide details On going asbestos claims Employment tribunal cases Industrial estate debt 5. What arrangements does Moray Council have in place to identify, evaluate and account for litigation or claims? The legal section has teams which specialise in different areas of Council activity and will be involved (at the request of client departments) in the implementation of more complex changes (such as formation of the IJB) and in any areas where legislation is unclear. Where necessary external advise will be sought 6. Have there been any reports from other regulatory bodies, such as HM Revenues and Customs, which indicate non-compliance? If so, please provide details The on going records management plan from 2022/23 18 Page 140
Page 141
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Related Parties Matters in relation to Related Parties Moray Council are required to disclose transactions with bodies/individuals that would be classed as related parties. These may include: ■ bodies that directly, or indirectly through one or more intermediaries, control, or are controlled by Moray Council ; ■ associates; ■ joint ventures; ■ a body that has an interest in the authority that gives it significant influence over the Authority; ■ key management personnel, and close members of the family of key management personnel, and ■ post-employment benefit plans (pension fund) for the benefit of employees of the Authority, or of any body that is a related party of the Authority A disclosure is required if a transaction (or series of transactions) is material on either side, i.e. if a transaction is immaterial from the Authority's perspective but material from a related party viewpoint then the Authority must disclose it. ISA (UK) 550 requires us to review your procedures for identifying related party transactions and obtain an understanding of the controls that you have established to identify such transactions. We will also carry out testing to ensure the related party transaction disclosures you make in the financial statements are complete and accurate. 19 Page 141
Page 142
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Related Parties Question Management response 1. Have there been any changes in the related parties including those disclosed in Moray Council's 2023/24 financial statements? If so please summarise: • the nature of the relationship between these related parties and Moray Council • whether Moray Council has entered into or plans to enter into any transactions with these related parties • the type and purpose of these transactions No changes 2. What controls does Moray Council have in place to identify, account for and disclose related party transactions and relationships? Senior Officers and Elected Members make annual returns and any significant factors that arise as part of this process would be factored into the Related Parties Note in the Annual Accounts 3. What controls are in place to authorise and approve significant transactions and arrangements with related parties? Normal procedures following the Authorisation policy would apply – transactions over £25,000 are checked by the Chief Financial Officer 4. What controls are in place to authorise and approve significant transactions outside of the normal course of business? For significant transactions that are new and outside the normal course of business Committee approval is required 20 Page 142
Page 143
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Going Concern Matters in relation to Going Concern The audit approach for going concern is based on the requirements of ISA (UK) 570, as interpreted by Practice Note 10: Audit of financial statements and regularity of public sector bodies in the United Kingdom (Revised 2020). It also takes into account the National Audit Office's Supplementary Guidance Note (SGN) 01: Going Concern – Auditors’ responsibilities for local public bodies. Practice Note 10 confirms that in many (but not all) public sector bodies, the use of the going concern basis of accounting is not a matter of significant focus of the auditor’s time and resources because the applicable financial reporting frameworks envisage that the going concern basis for accounting will apply where the body’s services will continue to be delivered by the public sector. In such cases, a material uncertainty related to going concern is unlikely to exist. For this reason, a straightforward and standardised approach to compliance with ISA (UK) 570 will often be appropriate for public sector bodies. This will be a proportionate approach to going concern based on the body’s circumstances and the applicable financial reporting framework. In line with Practice Note 10, the auditor’s assessment of going concern should take account of the statutory nature of the body and the fact that the financial reporting framework for local government bodies presume going concern in the event of anticipated continuation of provision of the services provided by the body. Therefore, the public sector auditor applies a ‘continued provision of service approach’, unless there is clear evidence to the contrary. This would also apply even where those services are planned to transfer to another body, as in such circumstances, the underlying services will continue. For many public sector bodies, the financial sustainability of the body and the services it provides are more likely to be of significant public interest than the application of the going concern basis of accounting. Financial sustainability is a key component of value for money work and it is through such work that it will be considered. Page 143
Page 144
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Going Concern Question Management response 1. What processes and controls does management have in place to identify events and / or conditions which may indicate that the statutory services being provided by Moray Council will no longer continue? Regular reporting on the Council’s finances would highlight any conditions which may meant he Council is no longer to deliver statutory duties. Regular performance reports to Service Committees would highlight this as well 2. Are management aware of any factors which may mean for Moray Council that either statutory services will no longer be provided or that funding for statutory services will be discontinued? If so, what are they? Not aware of any 3. With regard to the statutory services currently provided by Moray Council, does Moray Council expect to continue to deliver them for the foreseeable future, or will they be delivered by related public authorities if there are any plans for Moray Council to cease to exist? Moray Council expects to continue to deliver statutory services 4. Are management satisfied that the financial reporting framework permits Moray Council to prepare its financial statements on a going concern basis? Are management satisfied that preparing financial statements on a going concern basis will provide a faithful representation of the items in the financial statements? The annual accounts will be prepared on a going concern basis and this will provide a faithful representation of the items included in the financial statements Page 144
Page 145
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Accounting estimates Matters in relation to accounting estimates ISA (UK) 540 (Revised December 2018) requires auditors to understand and assess a body’s internal controls over accounting estimates, including: • The nature and extent of oversight and governance over management’s financial reporting process relevant to accounting estimates; • How management identifies the need for and applies specialised skills or knowledge related to accounting estimates; • How the body’s risk management process identifies and addresses risks relating to accounting estimates; • The body’s information system as it relates to accounting estimates; • The body’s control activities in relation to accounting estimates; and • How management reviews the outcomes of previous accounting estimates. As part of this process auditors also need to obtain an understanding of the role of those charged with governance, which is particularly important where the estimates have high estimation uncertainty, or require significant judgement. Specifically do Audit & Scrutiny Committee members: • Understand the characteristics of the methods and models used to make the accounting estimates and the risks related to them; • Oversee management’s process for making accounting estimates, including the use of models, and the monitoring activities undertaken by management; and • Evaluate how management made the accounting estimates? We would ask the Audit & Scrutiny Committee to satisfy itself that the arrangements for accounting estimates are adequate. 23 Page 145
Page 146
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Accounting Estimates - General Enquiries of Management Question Management response 1. What are the classes of transactions, events and conditions, that are significant to the financial statements that give rise to the need for, or changes in, accounting estimate and related disclosures? Valuation of Property, Plant & Equipment Valuation of Pension Liability 2. How does the Authority's risk management process identify and address risks relating to accounting estimates? By engaging with experts in each of the areas identified the risk of material misstatement is reduced 3. How does management identify the methods, assumptions or source data, and the need for changes in them, in relation to key accounting estimates? The results of prior year audits are looked at and whether there was any material concerns raised or amendments made – in those instances accounting estimates would be reviewed 4. How do management review the outcomes of previous accounting estimates? The results of prior year audits are looked at and whether there was any material concerns raised or amendments made – in those instances accounting estimates would be reviewed 5. Were any changes made to the estimation processes in 2023/24 and, if so, what was the reason for these? No Page 146
Page 147
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Accounting Estimates - General Enquiries of Management Question Management response 6. How does management identify the need for and apply specialised skills or knowledge related to accounting estimates? Each area is looked at in isolation and the skills/knowledge/capacity of relevant Services considered 7. How does the Authority determine what control activities are needed for significant accounting estimates, including the controls at any service providers or management experts? Ensuring that relevant information is provided on time and accurately to ensure that the information received can be relied upon. 8. How does management monitor the operation of control activities related to accounting estimates, including the key controls at any service providers or management experts? Regular updates provided by preparers of the Accounts on any issues that arise. 9. What is the nature and extent of oversight and governance over management’s financial reporting process relevant to accounting estimates, including: - Management’s process for making significant accounting estimates - The methods and models used - The resultant accounting estimates included in the financial statements. The unaudited accounts are reported to Committee and then again upon completion of the audit. External Audit reporting also helps to inform on estimates Page 147
Page 148
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Accounting Estimates - General Enquiries of Management Question Management response 10. Are management aware of any transactions, events, conditions (or changes in these) that may give rise to recognition or disclosure of significant accounting estimates that require significant judgement (other than those in Appendix A)? If so, what are they? Not aware of any additional areas where new estimates would be required to be disclosed. 11. Why are management satisfied that their arrangements for the accounting estimates, as detailed in Appendix A, are reasonable? No major changes required to annual accounts in previous years. 12. How is the Audit & Scrutiny Committee provided with assurance that the arrangements for accounting estimates are adequate ? Annual accounts are reported to Full Council 26 Page 148
Page 149
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Appendix A Accounting Estimates Estimates Method / model used to make the estimate Controls used to identify estimates Whether management have used an expert Underlying assumptions: - Assessment of degree of uncertainty - Consideration of alternative estimates Has there been a change in accounting method in year? Land and buildings valuations Infrastructure/Community Assets/AUC – DHC Schools – DRC Surplus Assets – Fair Value Council Dwellings - EUV Information used is industry standard information from entities such us BCIS. Internal valuers No Investment property valuations Fair Value Per the Code – Investment Property reviewed annually Internal valuers Follow the Code No Depreciation Straight line method over the useful life of the asset Estates provide useful life estimates Internal valuers No Heritage Assets Insurance valuations/Historic cost Yes No 27 Page 149
Page 150
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Appendix A Accounting Estimates Estimate Method / model used to make the estimate Controls used to identify estimates Whether management have used an expert Underlying assumptions: - Assessment of degree of uncertainty - Consideration of alternative estimates Has there been a change in accounting method in year? Provisions Only one provision – amounts based on actual amounts Liaise with HR No Based on information from HR , which is confirmed annually that it is still at the right level No Accruals Based on actual entries in the general ledger or from information from departments No, but in some cases estimates are made by quantity surveyors Most cases are based on general ledger and no estimates. Were estimates are provided it will be based on professional judgement and we would query if it was materially different from estimates provided No Credit loss and impairment allowances Bad Debt Provision – debtors, council tax, housing rents Debtors/Housing Rents: >12 months – provided in full 6-12 months – 50% <6 months – 0% Council Tax: <12 months – 0% >12 months – 100% No Looked at and reviewed each year to see if the percentages are still appropriate No 28 Page 150
Page 151
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Appendix A Accounting Estimates (Continued) Estimate Method / model used to make the estimate Controls used to identify estimates Whether management have used an expert Underlying assumptions: - Assessment of degree of uncertainty - Consideration of alternative estimates Has there been a change in accounting method in year? Valuation of defined benefit net pension fund liabilities Based on information from actuaries Information provided to actuaries based on year end position reducing the need for estimates Yes Disclosure in accounts regarding the changes that could happen and the impact it would have on the figures included in the accounts No Accrued Income Based on actual entries in the general ledger, or from information from departments No In most cases based on actual general ledger entries, so no estimates. Where estimates are provided it is based on professional judgement ad we would query if it was materially different from estimates provided No PFI Liabilities Financial models are used each year Financial models are well established and were set up in conjunction with experts and have been audited in detail since then Models used were set up in conjunction with experts – annual use is by council staff No changes considered – process well established No 29 Page 151
Page 152
© 2024 Grant Thornton UK LLP | Moray Council 2023/24 Commercial in confidence Appendix A Accounting Estimates (Continued) Estimate Method / model used to make the estimate Controls used to identify estimates Whether management have used an expert Underlying assumptions: - Assessment of degree of uncertainty - Consideration of alternative estimates Has there been a change in accounting method in year? Fair Value of Assets and Liabilities (Financial Instruments) In most cases the fair value is calculated using models provided by the Councils treasury management advisers Use of external expert information Yes No 30 Page 152
Page 153
© 2024 Grant Thornton UK LLP ‘Grant Thornton’ refers to the brand under which the Grant Thornton member firms provide assurance, tax and advisory services to their clients and/or refers to one or more member firms, as the context requires. Grant Thornton UK LLP is a member firm of Grant Thornton International Ltd (GTIL). GTIL and the member firms are not a worldwide partnership. GTIL and each member firm is a separate legal entity. Services are delivered by the member firms. GTIL does not provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions. grantthornton.co.uk Page 153
Page 154
Page 154
Page 155
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 8 MAY 2024 SUBJECT: NATIONAL FRAUD INITIATIVE 2022/23 BY: AUDIT AND RISK MANAGER 1. REASON FOR REPORT 1.1 To advise the Committee of outcomes from the Council’s participation in the National Fraud Initiative for 2022/23. 1.2 This report is submitted to Committee in terms of Section III (I) (2) of the Council’s Scheme of Administration relating to considering reports from the Council’s Internal Auditor. 2. RECOMMENDATIONS 2.1 Committee is asked to consider the contents of this report; seek clarification on any points noted and otherwise note the report. 3. BACKGROUND 3.1 The National Fraud Initiative (NFI) is a data matching project conducted by the Cabinet Office on behalf of Audit Scotland. Public bodies, including Local Authorities, are mandatory participants in this process. Each body is required to submit data it holds on individuals and businesses that receive public funds either as paid employees or suppliers of goods, works or services, or in the form of benefits. Information is also provided on individuals with housing tenancies, housing waiting lists and recipients of blue badges. 3.2 The matching process takes place and extracts data ‘matches’ for each participant that are considered worthy of investigation. There is no presumption of fraud, simply a match comprises two or more records where there appears to be some anomaly that would merit further review. For example, if an individual is on Moray’s council house waiting list from an address in Dundee but is in receipt of council tax reduction at an address in Aberdeen, this is recorded as a match. Most likely, the ‘error’ is that the information is out of date, as the individual has relocated to Aberdeen and our waiting list has not been updated. Similarly, an individual employed as a teacher may be identified on two payroll records with different authorities. This will appear as a match but is not irregular if the individual is employed part time at each council. Item 8. Page 155
Page 156
3.3 A further and common reason for matches occurring is simply timing differences i.e. if an individual changes jobs or address around the time the data for matching is submitted, the old and new information can appear as a match but on checking can be quickly discounted. This timing difference was also noted due to HM Revenue & Customs (HMRC) submitting their information after the deadline for other public bodies. 3.4 The 2022/23 matching process for Moray Council at the time of drafting this report disclosed 2,976 matches across eight data themes. The total breakdown of the data matches set is as follows: • Creditors (Payments to Suppliers) 1496 • Council Tax Reduction Scheme 325 • Council Housing Waiting List 206 • Blue Badges 254 • Housing Tenancies 544 • Procurement 51 • Housing Benefits 28 • Payroll 72 2976 3.5 While this volume of matches is significant, experience from prior exercises has shown that the incidence of fraud is not. The review of findings from an investigation of matches for the 2022/23 NFI data matching exercise again proved this to be the case, with no instances of fraud. A proportionate approach was taken to testing, which involved a high level ‘scanning’ of all matched data and more in-depth testing of a sample of items to confirm the outcomes were as expected. Investigation of matches is time consuming requiring significant staff resources from Services and within the Internal Audit Section. Moving forward, it is intended to continue and refine the sampling process of future data matching exercises to ensure the most effective use of staff resources is based on the findings from the investigations undertaken. Further detail is provided below, which concludes that the principal benefits of participating in the exercise are two-fold: • it provides confirmation that control systems within the scope of the exercise to prevent fraud are working effectively; • there is an opportunity to undertake data cleansing to improve the currency and accuracy of data held in council systems. Outcomes 3.6 Creditor Payments matches consider payee names, addresses, bank account details and VAT calculations, looking mainly for duplicate or erroneous payments. While a high volume of matches was generated, it should be noted that the Council routinely makes legitimate payments of the same amount to a single supplier. Typical examples are monthly school transport invoices where a contracted daily rate applies, purchases by fleet services of more than one vehicle with identical specifications, and payments for monthly care packages for an individual. Page 156
Page 157
3.7 Testing of the matches found the majority related to legitimate payments, e.g., regular contracted purchases for the same amount. However, duplicate payments of £15,803 were found, of which £13,070 was related to an administrative error of paying an incorrect supplier with a similar name to the intended payee. This duplicate payment has now been recovered. 3.8 Council Tax Reduction Scheme (CTRS) entitles qualifying households to a reduction in the amount of council tax they pay. The level of reduction depends on individual circumstances. CTRS awards are referenced to other CTRS claims, public sector payroll and pension records, taxi licensing, housing tenancies, Department for Work and Pensions (DWP) and HMRC records. The matches are designed to ensure claim forms have been accurately completed and disclose information e.g. on income, that can influence the amount of the CTRS award. In most cases the correct disclosures had been made and related to timing issues of when information was uploaded to the NFI from participating organisations. However, for a small number, further investigations are being undertaken. Regarding these investigations, it should be noted that where an individual is also receiving other benefits, the NFI system requires onward referral of the match to the DWP. The DWP determines any investigation work needed and the Council receives no feedback on the outcomes of these referrals. 3.9 Council Housing Waiting List applicants are referenced to other councils waiting lists, housing tenancy records, housing benefit claimants, DWP and HMRC records. The number of matches within this category has fallen compared to the previous NFI exercise. This has been due to the implementation of a new housing waiting list system that has contributed to improved accuracy of the information held by the Council. However, an annual review of applicants included in the Council’s Housing Waiting List was being undertaken while uploading the data to the NFI. This resulted in timing differences and explained the reasons for the majority of the data matches. . 3.10 Blue Badge parking permits are compared with permits issued by other councils and DWP records of deceased persons. The relatively high number of matches from these datasets has occurred because of the need to cancel badges on the system. The NFI has calculated this as a potential financial saving of £150,150. However, this is an estimated calculated figure as the risk, in theory, if not in practice, that a badge no longer required by its recipient may be misused by others to avoid parking charges or to park in designated spaces to the detriment of those entitled to use them. A recent internal audit review highlighted improvements to current operating practices. The Service has agreed to all the recommendations that should assist in improved administrative arrangements. 3.11 Housing Tenancy records are referenced to other Councils tenancy records, housing benefit claims, housing waiting lists, information held by the HMRC and DWP records, all with the purpose of validating the accuracy of information the Council has on the occupancy of its Council housing. Findings from sample testing of the data matches found legitimate reasons for the matches, e.g. a recent move or family change of circumstances, with detailed information available to evidence why matches had been generated. As information was provided by HMRC later in 2023, this resulted in matches due Page 157
Page 158
to the timing differences of when all other public bodies provided information for the NFI data matching exercise. . 3.12 Procurement matches compare the Council’s Payroll records with supplier records, including company director information held by Companies House. Matches are looking at potential conflicts of interest in the award of Council contracts, but none was disclosed; those highlighted being known (e.g. Councillors who are paid and also Directors of Moray Leisure) and not considered irregular. 3.13 Housing Benefit matches are referenced to recipients of student loans, housing tenancy records, taxi licensing information, housing waiting lists, recipients of council tax reduction and DWP records. The matches are designed to ensure claim forms have been accurately completed and have disclosed information e.g. on income, that can influence the amount of the Housing Benefit award. The number of matches in this category is reducing as more claimants move to Universal Credit. Testing found matches were due to timing issues in changes in circumstances of individual claimants. However, one claimant has been referred to the DWP for further investigation. 3.14 Payroll matches are compared with other payroll, public sector, pension and creditor payment records. The matches were mostly related to valid reasons why the information was held within other databases, individuals with two part- time jobs and timing issues. No fraud or irregularity resulting in financial loss was found from the testing undertaken. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) Fraud and irregularity has the potential to impact on the council’s ability to deliver on its key strategic outcomes, although the results of this exercise suggest that the council’s control systems are working well and mitigating this risk. (b) Policy and Legal Participation in the NFI is mandatory for all Scottish councils, however this has advantages in that national protocols have been developed and agreed for data management and security. (c) Financial implications There are costs for staff time associated with organising and submitting the data and reviewing the returned matches. These can be set against ‘notional’ savings e.g. a cancelled blue badge is valued by NFI at £650, but these savings are indirect at best and more likely the benefits from participation are in improving the accuracy of the systems from which data is derived. (d) Risk Implications The risk of not adequately checking returned matches is that a significant fraud may go undetected resulting in substantial financial loss. However with no such fraud being detected in this council since NFI has operated in Scotland, a proportionate approach to checking the matches is judged to be the most prudent approach. Page 158
Page 159
(e) Staffing Implications Work linked to the NFI is covered in the day to day duties of data owners in Services and within ICT and time is made available in the audit plan for Internal Audit to co-ordinate and overview the exercise. (f) Property No implications directly arising from this report. (g) Equalities/Socio Economic Impact No implications directly arising from this report. (h) Climate Change and Biodiversity Impacts No implications directly arising from this report. (i) Consultations The Chief Financial Officer as the NFI Senior Responsible Officer has been consulted with the content of this report. 5. CONCLUSION 5.1 Participation in the NFI exercise for 2022/23 has highlighted no issues in the way of fraud or irregularity. It is a time consuming exercise to manage and investigate data matches by Services and the Internal Audit Section. Based on the findings, the main benefits from participation arise from the assurances provided that the Council’s main systems are accurate and up to date and that system Controls are working well. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: NFI Database Ref: SPMAN-1042990102-214 Page 159
Page 160
Page 160