Item 9 Appendix 2 - Internal Audit Annual Report to 31 March 2025
West Dunbartonshire Council · 11 June 2025
Back to Audit Committee — 11 June 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
1 Assurance Statement for the year ended 31 March 2025 From the Shared Service Manager – Audit & Fraud To the Members of West Dunbartonshire Council, the Chief Executive and the Section 95 Officer (Chief Officer - Resources) As Shared Service Manager - Audit & Fraud of West Dunbartonshire Council, I am pleased to present my annual statement on the adequacy and effectiveness of the internal financial control system of the Group Accounts prepared by the Council for the year ended 31 March 2025. Respective responsibilities of management and internal auditors in relation to internal control It is the responsibility of the Council’s senior management to establish an appropriate and sound system of internal financial control and to monitor the continuing effectiveness of that system. It is the responsibility of the Shared Service Manager – Audit & Fraud to provide an annual overall assessment of the robustness of the internal financial control system. The Council’s framework of governance, risk management and internal control The Council has a responsibility to ensure that its business is conducted in accordance with legislation and proper standards. The governance framework comprises the systems and processes, culture and values by which the Council is directed and controlled and how it accounts to communities. It enables the Council to monitor the achievement of its strategic priorities and to consider whether those objectives have led to the delivery of appropriate services and value for money. The main objectives of the Council’s internal control systems are to ensure: • Adherence to management policies and directives in order to achieve the organisation’s objectives. • Economic, efficient, effective and safe use of resources and assets. • The relevance, reliability and integrity of information, so ensuring as far as possible the completeness and accuracy of records. • Compliance with statutory requirements. The system of internal control is a significant element of the governance framework. Any system of control can only ever provide reasonable and not absolute assurance that control weaknesses or irregularities do not exist or that there is no risk of material errors, losses, fraud, or breaches of laws or regulations. Accordingly, the Council is continually seeking to improve the effectiveness of its systems of internal control in order to identify and prioritise the risks that would prevent the achievement of the Council’s strategic objectives. Item 9 Appendix 2
Page 2
2 The work of internal audit Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management and internal control processes. During 2024/25 the Council’s Internal Audit Section operated in accordance with the Public Sector Internal Audit Standards (PSIAS) which were adopted from 1st April 2013 (revised in 2017) by the relevant public sector Internal Audit Standard setters. PSIAS applies the Institute of Internal Auditors International Standards to the UK Public Sector. PSIAS requires that a Quality Assurance and Improvement Programme (QAIP) is developed in order to provide assurance that internal audit activity: • Is conducted in accordance with an Internal Audit Charter. • Operates in an efficient and effective manner. • Is perceived to be adding value and improving operations. An internal self-assessment of internal audit practices has been carried out by Internal Audit every year since PSIAS became effective on 1st April 2013, with improvements identified and implemented as appropriate. PSIAS also requires, as outlined in Standard 1300 “QAIP”, that: “External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organisation. External assessments can be in the form of a full external assessment or a self-assessment with independent external validation”. The last external review was carried out in 2016. The next external review was due to be carried out by 31 March 2021 however this was deferred due to the pandemic. The external review has now been rescheduled due to the implementation of the new Global Internal Audit Standards (UK public sector). The internal review for 2024-25 confirms a high level of compliance and that the Internal Audit Section generally conforms with the requirements of PSIAS. The Internal Audit Section undertakes an annual programme of work based on a risk assessment process which is revised on an ongoing basis to reflect evolving risks and changes within the Council. All Internal Audit reports identifying control weaknesses and/or areas of non-compliance with expected controls are brought to the attention of management and the Audit Committee together with appropriate recommendations and agreed action plans. It is management’s responsibility to ensure that proper consideration is given to Internal Audit reports and that appropriate action is taken on audit recommendations. The internal auditor is required to ensure that appropriate arrangements are made to determine whether action has been taken on internal audit recommendations or that management has understood and assumed the risk of not taking action. Agreed actions arising from Internal Audit reports are followed up on a monthly basis as action dates fall due.
Page 3
3 Regular reporting on action plan implementation is provided on a monthly basis to senior management and to each meeting of the Audit Committee. Internal Audit and Corporate Fraud staff regularly attended the following external user group meetings: • SLACIAG, the purpose of which is to develop and improve the practice of internal audit activity with Scottish local authorities. It achieves this by meeting to discuss issues of common concern, commissioning work to develop ideas, sharing good practice, working in partnership with other professional / governing bodies and promoting SLACIAG as the representative body for internal audit in local authorities; and • The Scottish Local Authority Investigators Group (SLAIG): This group consists of fraud practitioners from local authorities in Scotland, with the objectives of: o Raising the profile of the counter fraud agenda; o Sharing good practice; o Raising awareness of the risk of fraud; and o Ensuring that fraud is investigated in a professional manner. Basis of Opinion My evaluation of the control environment is informed by a number of sources: • The audit work undertaken by Internal Audit during the year to 31 March 2025. • The assessment of risk completed during reviews of the annual audit plan. • The Code of Good Governance self-assessment process undertaken by the Chief Officers for the services for which they were responsible during the year to 31 March 2025. • The Council’s Annual Governance Statement for the year ended 31 March 2025. • Reports issued by the Council’s External Auditors, Audit Scotland, and other review agencies. • My knowledge of the Council’s governance, risk management and performance management and monitoring arrangements. Limitation to Resources or Scope of Internal Audit Work There were no significant threats identified to the independence of the internal audit activity such as inappropriate scope or resource limitations. Opinion The report concludes that the majority of West Dunbartonshire Council’s established internal control procedures operated as intended to meet management's control requirements for each area reviewed by Internal Audit in 2024/25. The overall audit opinion is Generally Satisfactory with some improvement needed.
Page 4
4 There was one audit review, Housing Repairs and Maintenance, which received a Requires Improvement control environment opinion. There were a number of control issues identified and work is ongoing to implement the agreed action plan in relation to the audit which will be monitored and reported to CMT and Audit Committee on a regular basis. It is also intended to carry out a follow up review of this area as part of the 2026/27 internal audit plan to provide additional assurance. Signature: Andi Priestman Title: Shared Service Manager – Audit & Fraud Date: 13 May 2025
Page 5
5 Opinion Types Satisfactory Controls evaluated are adequate, appropriate and effective to provide reasonable assurance that risks are being managed and objectives should be met. • A limited number of amber rated issues may have been identified, but generally only green issues have been found in individual audit assignments. • None of the individual assignment reports have an overall opinion of Requires Improvement or Unsatisfactory. Generally Satisfactory with some improvement needed A few specific control weaknesses were noted: generally however, controls evaluated are adequate, appropriate and effective to provide reasonable assurance that risks are being managed and objectives should be met. • A number of amber rated issues identified in individual audit assignments that collectively do not significantly impact the system of internal control. • Red rated issues that are isolated to specific systems or processes. • None of the individual assignment reports have an overall opinion of Unsatisfactory. Major improvement needed Numerous specific control weaknesses were noted. Controls evaluated are unlikely to provide reasonable assurance that risks are being managed and objectives should be met. • A high number of amber rated issues that collectively have a significant impact on some parts of the system of internal control but are not widespread. • A number of red rated issues that collectively have a significant impact on some parts of the system of internal control but are not widespread. • A small number of individual assignment reports have an overall opinion of Requires Improvement or Unsatisfactory. Unsatisfactory Controls evaluated are not adequate, appropriate or effective to provide reasonable assurance that risks are being managed and objectives should be met. • Amber and red rated issues identified in individual assignments that collectively are widespread to the system of internal control. • A high number of individual assignment reports have an overall opinion of Requires Improvement or Unsatisfactory.
Page 6
No embedded text on this page.