Item 5 Appendix 1 - Internal Audit Annual Report 2025-2026

West Dunbartonshire Council · 10 June 2026
Back to Audit Committee — 10 June 2026 and its agenda

Text extracted from the council's PDF. Layout and reading order may differ from the original.

Original council PDF · Download plain text

Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.

Page 1

West Dunbartonshire Council 
Internal Audit
Annual Report 
2025/26 
Gillian McConnachie
Chief Internal Auditor  
ITEM 5
APPENDIX 1

Page 2

Annual Internal Audit Report 2025/26
This Annual Internal Audit Report is a summary of the activities of West Dunbartonshire
Council’s (the Council) Internal Audit Team for the financial year 2025/26 and includes the
internal audit opinion at Appendix 1.1. The opinion concludes on the adequacy and
effectiveness of the Council’s framework of governance, risk management and control. It
supports the annual governance statement which will be included in the annual accounts and
financial statements. It considers the expectations of senior management, the Audit
Committee and other stakeholders. It is supported by sufficient, reliable, relevant and useful
information, as referenced in the body of this report. Through utilising such information,
Internal Audit demonstrates compliance with relevant Internal Audit Standards - Global
Internal Audit Standards in the UK Public Sector (GIAS-UKPS).
Internal Audit Opinion
The full statement and opinion provided at Appendix 1.1, confirms my opinion that the
adequacy and effectiveness of the Council’s internal control systems, governance and risk
management systems in the year to 31 March 2026 are concluded as being Generally
Satisfactory with some improvement needed.
This means members can be assured proper processes are in place to enable the
achievement of the Council’s strategic priorities.
Key Areas for Improvement
In reaching this conclusion, I note risks raised by Internal Audit in the current year relating to
Housing Repairs and Maintenance. Individually, these risks do not significantly impair the
Council’s systems of internal control. Furthermore, management have reported progress and
detailed plans to mitigating these risks. The remaining risks will continue to be kept under
review, with auditors monitoring compliance with the agreed actions as part of regular follow-
up updates which will be reported to the Audit Committee.
The opinion at Appendix 1.1 represents a consolidated view, informed by several sources
and, in bringing these together, considers whether there is evidence key controls are absent,
inadequate or ineffective. The work includes an assessment of any weaknesses identified
and whether these, taken independently or with other findings, significantly impair the
Council’s system of internal control. Wider considerations relating to the Council’s corporate
governance framework and risk management arrangements have also been reflected on in
providing the opinion.
The level of assurance provided by the Internal Audit Team can never be absolute. This
reflects the sample nature of the work carried out, the relative scope and objectives of audit
assignments and those explanations offered, and evidence provided by officers. In addition,
factors external to the audit process including human error, collusion or management
overriding controls as a potential for systems, historically highlighted as being satisfactory, to
become exposed to risk or loss.

Page 3

Summary of Work Supporting the Opinion
The opinion is informed by several sources, including the internal audit work completed in the
year. Each audit assignment addresses a specific area of risk. The risk of fraud is also
considered in each assignment, together with any governance or risk management
implications. This allows the Council’s Chief Internal Auditor, to draw sustainable
conclusions based on a range of activities that reflect the diversity of work carried out by the
Council.
The team has had a challenging year, with vacancies impacting on completion of the Audit
Plan (the Plan). Whilst sufficient resources have been allocated by the Council to Internal
Audit in its budget, resource limitations as a result of vacancies have impacted on the timely
completion of the Plan. There have been vacancies at the Shared Service Manager, Lead
Internal Auditor, Internal Auditor, and Audit Assistant levels. Whilst progress has now been
made towards filling these vacancies there has been a material impact on the results of the
team for 2025/26.
Nonetheless, the following has been completed by the team in the year:
• Follow up work on previously raised issues, including on the Housing Repairs and
Maintenance Report which included two red and eleven amber findings.
• Payroll high earners – quarterly review (quarters 1 to 2 completed)
The team has completed the following in the year, in support of the annual audit opinion:
• Void Management Audit
• Housing Repairs and Maintenance Audit
• Procurement Compliance Audit (nearing completion)
• Payroll High Earners – Review – Quarters 1 and 2
• Internal Audit Follow up reports
• Review of governance arrangements
• Corporate Fraud Activity
Whilst the audit work has fallen short of expectations for 2025/26, the team completes audit
work on an ongoing basis and the Chief Internal Auditor includes other sources of assurance
in reaching her opinion including the work completed in previous years by Internal Audit.
A detailed comparison of the work carried out against the Plan is provided at Appendix 1.3.
The opinion is also informed by follow up work, which involves reviewing the extent to which
those risks previously identified have been subsequently managed or mitigated. Updates are
a standard agenda item at Audit Committee and are also reported to the Council’s Senior
Management Team. An update on outstanding audit actions is included in the Internal Audit
Progress Report. The consolidated follow up work has identified that five actions to address
a Red risk relating to the Adequacy of Housing Client Function from the Housing Repairs and
Maintenance audit remain outstanding, with a revised target date of 30 June 2026. These

Page 4

actions will be followed up on during 2026/27. Whilst acknowledging the significant and
ongoing work and the continued pressures on services, auditors ask for prioritised focus in
closing off the remaining outstanding Red issues relating to the Housing Repairs and
Maintenance audit.
Additionally, the Council’s Chief Internal Auditor provides representation to the Glasgow City
Deal Audit Support Group. The Group is a key requirement of the City Deal assurance
framework and is an important consideration in the overall governance arrangements.
Representatives of the group are required to provide an Assurance Statement on behalf of
their councils, highlighting any concerns or weaknesses that may need to be taken into
consideration by the Glasgow City Region Cabinet. Having reviewed City Deal activities
within West Dunbartonshire Council, the wider governance arrangements within the Council,
there were no material issues that needed to be brought to the attention of the Glasgow City
Region Cabinet; the statement was therefore prepared on this basis.
Internal Audit Output Summary
The 2025/26 annual audit plan included provision for a direct allocation of 285 audit days and
planned completion of three risk based audits, in addition to regularity audits and other work.
The plan to deliver the programme represents the commitment of the team to deliver an
opinion based on the widest possible range of audit work.
Full details on these audits have been provided in the internal audit updates to Committee.
This work supports both this Annual Audit Report and opinion and the Annual Governance
Statement in the accounts. Where internal audit has identified risks in the areas reviewed,
action plans have been agreed. The agreed actions are logged on the Ideagen Pentana
performance management system and will be followed up on and progress reported back to
the Audit Committee.
Consideration of the Council’s management of risk forms part of the overall internal opinion
for the year. When reviewing arrangements in place, auditors have noted that the Strategic
Risks are regularly reviewed and updates presented to the Audit Committee, with this
occurring in the year on 24 September 2025 and 18 February 2026. Standard Committee
templates also include a section for the consideration of risk and control measures for all
reports, under the heading of ‘Risk Analysis’. This promotes a risk aware culture. A Risk
Management Strategy is in place, with risks being considered in the preparation of service
Delivery Plans.
The team has a suite of KPIs in place and these will be reported on at the next committee.
It is expected that these results will reflect the vacancies in the team during the year and will
act as a benchmark for improvements in 2026/27 and beyond. Full detail of the audits
completed and in progress is provided at Appendix 1.3. Such cut-off and completion
challenges can be managed in support of the annual audit opinion, provided that there is
sufficient evidence to support the annual audit opinion each year. When taken together with
the audit history over the last three financial years, as outlined at Appendix 1.4, it is the
opinion of the Chief Internal Auditor that sufficient evidence has been obtained to enable the
provision of the year end audit opinion.

Page 5

Annual Assurance - Several documents that collate the work of the Internal Audit team have
been produced or are in progress as part of the team’s responsibility for annual assurance.
These are: follow up reviews, the Annual Internal Audit Report (this document), the drafting
of the Annual Governance Statements for inclusion in the Council, and, additionally, an
Annual Audit Report on the Council’s audit work for the Integrated Joint Board and an
assurance statement for City Deal.
Audit Development
Allocations of time to Audit Development represent resources dedicated to the development
of quality processes, benchmarking and adherence to good practice requirements.
An Internal Audit Satisfaction Survey has been developed for services to complete following
the conclusion of each audit. The results of these surveys are monitored to identify
opportunities for improvement within the service.
Co-ordination with External Audit
During the year under review, liaison has taken place with the Council’s External Auditors
Forvis Mazars through joint attendance at the Audit Committee, meetings, ad hoc
discussions and the sharing of audit plans and reports.
Progress against improvement plans
The Internal Audit service takes a ‘continuous improvement’ approach to our internal audit
work. This is reflected in our reports and recommendations made to services and also in the
approach to the internal audit work itself, with a focus in making incremental improvements to
our work through efficiencies, and/or improved quality. This helps us to improve our quality
and adherence to relevant Internal Audit Standards (GIAS-UKPS), and to focus on the areas
of greatest risk and where we are able to add the most value.
Impairments or Restriction of Scope
There have been no impairments or restrictions of scope during the course of the year.
Reliance on Other Assurance Providers
The internal audit opinion also includes consideration of the work of other assurance
providers. This includes those reports, where appropriate, issued by the Council’s external
auditors, Forvis Mazars, and other scrutiny partners.
Global Internal Audit Standards in the UK Public Sector – GIAS-UKPS
The Internal Audit Team is required to work to a set of rules – GIAS-UKPIAS. These rules
apply to all public sector internal auditor teams. It is a requirement of these standards that
periodic self-assessments are conducted to evaluate conformance with the GIAS-UK.
Under Section 7 (1) of the Local Authority Accounts (Scotland) Regulations 2014, the Council
must operate a professional and objective internal auditing service in accordance with
recognised standards and practices in relation to internal auditing. The Council defines such
standards as those set out within the GIAS-UKPS.

Page 6

The Public Sector Internal Audit Standards (PSIAS) were the previous applicable standards
that the Internal Audit team conformed with. From 1 April 2025 GIAS-UKPS became the
applicable standards.
To ensure compliance with prevailing standards the service works to quality methodology, as
set out in the audit manual. The audit manual has been previously specified to comply with
Public Sector Internal Audit Standards which were the previous applicable standards. The
GIAS-UKPS are the new applicable standards and there has been an initial consideration of
processes against the GIAS-UKPS. This assessment has identified the following areas as
requiring further improvements to ensure full conformance:
• Root cause analysis
• Documentation of the evaluation of controls in working papers
The above actions will be progressed in 2026/27.
The transition plan to achieve full conformance with GIAS-UKPS has been extended into the
year 2026/27 and will be carried out by the Chief Internal Auditor and the results reported to
the Audit Committee.
In addition, an external quality review will be required to be carried out against GIAS-UKPS.
This will be arranged as a peer review via the Scottish Local Authority Chief Internal Auditors
Group.
Questionnaires have been made available to services to complete for each audit assignment
and provide an opportunity for the auditee to provide feedback on the planning process,
communication and the quality of the internal audit report. All audit files are reviewed by the
Lead Auditor or the Chief Internal Auditor to ensure high standards are maintained and to
encourage a continuous improvement approach by the team.
Other Issues
I am aware of no other material issues that require to be reported at this time.

Page 7

Appendix 1.1 
STATEMENT ON THE ADEQUACY AND EFFECTIVENESS OF THE INTERNAL
CONTROL ENVIRONMENT OF WEST DUNBRTONSHIRE COUNCIL FOR 2025/26. 
To the Elected Members of West Dunbartonshire Council, the Chief Executive, the Chief
Officer – Resources (Section 95 Officer), and the Corporate Management Team  
As the Chief Internal Auditor of West Dunbartonshire Council, I am pleased to present my
annual statement on the adequacy and effectiveness of the internal control system of the
Council for the year ended 31 March 2026. 
Respective Responsibilities of Management and the Internal Audit Team in Relation to
Governance, Risk Management and Internal Control 
It is the responsibility of the Council’s senior management to establish appropriate and sound
systems of governance, risk management and internal control to monitor the continuing
effectiveness of those systems.  It is the responsibility of the Council’s Chief Internal Auditor
to provide an annual overall assessment of the robustness of governance, risk management
and internal control. 
The Council’s Framework of Governance, Risk Management and Internal Controls 
The main objectives of the Council's framework of governance, risk management and internal
controls are to ensure that resources are directed in accordance with agreed plans, policies
and priorities and to ensure that there is sound decision−making and clear accountability for
the use of those resources in order to achieve the desired outcomes for service users and
communities. 
This includes ensuring appropriate internal controls and risk management arrangements are
in place in order to effectively manage issues which might impact on the delivery of Council
services, the achievement of corporate and service priorities and public confidence in the
Council.  The Council also requires effective internal controls and risk management
arrangements to safeguard its employees, protect its assets, maintain effective stewardship
of public funds, ensure good corporate governance, ensure compliance with statutory
requirements and ensure it continues to deliver best value. 
A system of control can only ever provide reasonable and so not absolute assurance that
control weaknesses or irregularities do not exist.  It cannot guarantee there is no risk of
material errors, losses, fraud, or breaches of laws or regulations.  Nonetheless, the Council is
continually seeking to improve the effectiveness of its systems of governance, risk
management and internal controls in order to minimise these risks. 
The Work of the Internal Audit Team 
Internal audit is an independent appraisal function, established by the Council in line with
statutory requirements to review the internal control system.  This function is provided as a
service to the organisation as a whole.  The Internal Audit Team objectively examines,

Page 8

evaluates and reports on the adequacy of internal controls in place to mitigate risks to
achievement of the Council’s strategic priorities.
The Internal Audit Team has undertaken a programme of work in the year, in line with the
Audit Plan which was produced in consultation with Senior Management and key
stakeholders, to understand the key risks facing the Council.
All Internal Audit reports identifying system weaknesses, risks and/or non-compliance with
expected controls are brought to the attention of senior management and significant findings
presented to the Audit Committee. Audit reports and action plans provide insight into the
risks identified and include an agreed narrative highlighting the Service’s intended course of
action, including the timescales involved to mitigate and manage the risk. It is management’s
responsibility to ensure proper consideration is given to internal audit reports and appropriate
action is taken on those risks identified.
The Internal Audit team is required to ensure appropriate arrangements are made to
determine whether action has been taken on agreed reports or, where appropriate, that
management has understood and assumed the risk of not taking action. Significant matters
(including non-compliance with audit recommendations) arising from internal audit work are
reported to the Audit Committee and Senior Officers.
Auditors have noted that some risks previously highlighted by auditors remain ‘in progress’.
Management have reported progress towards mitigation of these issues and Auditors will
monitor compliance with the agreed actions as part of a regular follow-up cycle, and updates
being reported to the Audit Committee.
Impairments or Restriction of Scope
There have been no impairments or restrictions of scope during the course of the year.
Basis of Opinion
My evaluation of the control environment is informed by a number of sources:
• The audit work undertaken by Internal Audit during the year to 31 March 2026.
• Internal audit work undertaken in previous years and the follow up work undertaken in
2025/26.
• The assessment of risk completed during reviews of the annual audit plan.
• The Code of Good Governance self-assessment process undertaken by the Chief
Officers for the services for which they were responsible during the year to 31 March
2026.
• The Council’s Annual Governance Statement for the year ended 31 March 2026.
• Reports issued by the Council’s External Auditors, Forvis Mazars, and other review
agencies.
• My knowledge of the Council’s governance, risk management and performance
management and monitoring arrangements.

Page 9

Opinion 
It is my opinion that the adequacy and effectiveness of the Council’s governance, risk and
control framework is Generally Satisfactory with some improvement needed for the year
to 31 March 2026. 
Gillian McConnachie CA
Chief Internal Auditor 
10 June 2026

Page 10

Annual Opinion Types    
Satisfactory  Controls evaluated are adequate, appropriate and effective to provide
reasonable assurance that risks are being managed and objectives
should be met. 
• A limited number of Amber rated issues may have been
identified, but generally only green issues have been found in
individual audit assignments. 
• None of the individual assignment reports have an overall
opinion of Requires Improvement or Unsatisfactory.  
Generally
Satisfactory
with some
improvement
needed 
A few specific control weaknesses were noted: generally however,
controls evaluated are adequate, appropriate and effective to provide
reasonable assurance that risks are being managed and objectives
should be met. 
• A number of Amber rated issues identified in individual audit
assignments that collectively do not significantly impact the system
of internal control. 
• Red rated issues that are isolated to specific systems or
processes. 
• None of the individual assignment reports have an overall
opinion of Unsatisfactory. 
Major
improvement
needed 
Numerous specific control weaknesses were noted.  Controls
evaluated are unlikely to provide reasonable assurance that risks are
being managed and objectives should be met. 
• A high number of Amber rated issues that collectively have a
significant impact on some parts of the system of internal control
but are not widespread. 
• A number of Red rated issues that collectively have a
significant impact on some parts of the system of internal control
but are not widespread. 
• A small number of individual assignment reports have an
overall opinion of Requires Improvement or Unsatisfactory. 
Unsatisfactory  Controls evaluated are not adequate, appropriate or effective to
provide reasonable assurance that risks are being managed and
objectives should be met. 
• Amber and Red rated issues identified in individual
assignments that collectively are widespread to the system of
internal control. 
• A high number of individual assignment reports have an overall
opinion of Requires Improvement or Unsatisfactory.

Page 11

Progress on the 2025-26 internal audit plan    
Planned audit coverage 2025/26 Status 
Risk Based Reviews   
Budgetary Control (c/f 24/25) In progress
Care At Home - Delayed Discharge 
Arrangements
Deferred to 26/27
Estates – Commercial and Industrial Property
Rents and Leases
Deferred to 26/27
Regularity Audits  
High Earners – Quarterly check In progress (complete for Quarters
1 to 2)
Section Payments Not completed
Education Control Self-Assessment Not completed
Corporate Purchase Cards – quarterly check Not completed
ALEO Review
West Dunbartonshire Leisure Trust  Not completed
IJB Review
West Dunbartonshire Integrated Joint Board  In progress and nearing
completion.
VJB Review
Valuation Joint Board  Not completed  
The following audits from the 2024/25 plan were completed or are nearing completion:
24/25 Audit Plan Completion Status 
Risk Based Reviews   
Void Management  Complete
Housing Repairs and Maintenance Complete
Procurement Compliance Nearing completion

Page 12

Audit History – Audits completed over last 3 years 
Report Title Status
Findings Control
Environment
Opinion Red Amber Green
Risk Based Reviews
Completed in 2025/26
Housing Repairs and
Maintenance Final Report 2 11 3 Requires
Improvement
Void Management Final
Report 0 4 4 Satisfactory
Procurement Compliance Substantially
Complete TBC TBC TBC
No significant
issues
identified to
date
Completed in 2024/25     
Commercial Waste
Income Billing and
Collection
Final Report 0 3 3 Satisfactory
Debt Recovery Final Report 0 1 2 Satisfactory
UK Shared Prosperity
Fund Final Report 0 3 1 Satisfactory
Completed in 2023/24      
Corporate Complaints Complete 1 4 0 Requires
Improvement
Supporting Employee
Attendance Complete 0 4 2 Satisfactory
FM Cleaning – Stock
Control Complete 0 5 1 Satisfactory
Corporate Procurement –
Procurement under £10k Complete 0 1 1 Satisfactory
Non-Domestic Rates
(Limited scope) Complete 0 3 4 Satisfactory

Page 13

Grading definitions: 
Grade Definition
Strong In our opinion there is a sound system of internal
controls designed to ensure that the organisation is
able to achieve its objectives.  
Satisfactory In our opinion isolated areas of control weakness
were identified which, whilst not systemic, put some
organisation objectives at risk.  
Requires Improvement In our opinion systemic and/or material control
weaknesses were identified such that some
organisation objectives are put at significant risk.
Unsatisfactory In our opinion the control environment was
considered inadequate to ensure that the
organisation is able to achieve its objectives. 
Report Title Status
Findings Control
Environment
Opinion Red Amber Green
Education Control Self-
Assessment Complete 0 3 1 Satisfactory
HSCP – Imprest Complete 0 2 2 Satisfactory

Page 14

No embedded text on this page.