Item 8 - Appendix 2
West Dunbartonshire Council · 15 June 2022
Back to Audit Committee — 15 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Appendix 2 Assurance Statement for the year ended 31 March 2022 From the Shared Service Manager – Audit & Fraud To the Members of West Dunbartonshire Council, the Chief Executive and the Section 95 Officer (Chief Officer - Resources) As Shared Service Manager - Audit & Fraud of West Dunbartonshire Council, I am pleased to present my annual statement on the adequacy and effectiveness of the internal financial control system of the Group Accounts prepared by the Council for the year ended 31 March 2022. Respective responsibilities of management and internal auditors in relation to internal control It is the responsibility of the Council’s senior management to establish an appropriate and sound system of internal financial control and to monitor the continuing effectiveness of that system. It is the responsibility of the Shared Service Manager – Audit & Fraud to provide an annual overall assessment of the robustness of the internal financial control system. The Council’s framework of governance, risk management and internal control The Council has a responsibility to ensure that its business is conducted in accordance with legislation and proper standards. The governance framework comprises the systems and processes, culture and values by which the Council is directed and controlled and how it accounts to communities. It enables the Council to monitor the achievement of its strategic priorities and to consider whether those objectives have led to the delivery of appropriate services and value for money. The main objectives of the Council’s internal control systems are to ensure: • Adherence to management policies and directives in order to achieve the organisation’s objectives. • Economic, efficient, effective and safe use of resources and assets. • The relevance, reliability and integrity of information, so ensuring as far as possible the completeness and accuracy of records. • Compliance with statutory requirements. The system of internal control is a significant element of the governance framework. Any system of control can only ever provide reasonable and not absolute assurance that control weaknesses or irregularities do not exist or that there is no risk of material errors, losses, fraud, or breaches of laws or regulations. Accordingly, the Council is continually seeking to improve the effectiveness of its systems of internal control in order to identify and prioritise the risks that would prevent the achievement of the Council’s strategic objectives.
Page 2
The work of internal audit Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management and internal control processes. The Council’s Internal Audit Section operates in accordance with the Public Sector Internal Audit Standards (PSIAS) which have been agreed to be adopted from 1st April 2013 (revised in 2017) by the relevant public sector Internal Audit Standard setters. PSIAS applies the Institute of Internal Auditors International Standards to the UK Public Sector. PSIAS requires that a Quality Assurance and Improvement Programme (QAIP) is developed in order to provide assurance that internal audit activity: • Is conducted in accordance with an Internal Audit Charter. • Operates in an efficient and effective manner. • Is perceived to be adding value and improving operations. An internal self-assessment of internal audit practices has been carried out by Internal Audit every year since PSIAS became effective on 1st April 2013, with improvements identified and implemented as appropriate. PSIAS also requires, as outlined in Standard 1300 “QAIP”, that: “External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organisation. External assessments can be in the form of a full external assessment or a self-assessment with independent external validation”. The last external review was carried out during 2015/16. The next external review was due to be carried out by 31 March 2021 however this was deferred to 2022 due to the pandemic. The internal review confirms a high level of compliance and that the Internal Audit Section generally conforms with the requirements of PSIAS. The Internal Audit Section undertakes an annual programme of work based on a risk assessment process which is revised on an ongoing basis to reflect evolving risks and changes within the Council. All Internal Audit reports identifying control weaknesses and/or areas of non-compliance with expected controls are brought to the attention of management and the Audit Committee together with appropriate recommendations and agreed action plans. It is management’s responsibility to ensure that proper consideration is given to Internal Audit reports and that appropriate action is taken on audit recommendations. The internal auditor is required to ensure that appropriate arrangements are made to determine whether action has been taken on internal audit recommendations or that management has understood and assumed the risk of not taking action. Agreed actions arising from Internal Audit reports are followed up on a monthly basis as action dates fall due.
Page 3
Regular reporting on action plan implementation is provided on a monthly basis to senior management and to each meeting of the Audit Committee. Internal Audit and Corporate Fraud staff regularly attended the following external user group meetings: • SLACIAG, the purpose of which is to develop and improve the practice of internal audit activity with Scottish local authorities. It achieves this by meeting to discuss issues of common concern, commissioning work to develop ideas, sharing good practice, working in partnership with other professional / governing bodies and promoting SLACIAG as the representative body for internal audit in local authorities; and • The Scottish Local Authority Investigators Group (SLAIG): This group consists of fraud practitioners from local authorities in Scotland, with the objectives of: o Raising the profile of the counter fraud agenda; o Sharing good practice; o Raising awareness of the risk of fraud; and o Ensuring that fraud is investigated in a professional manner. COVID-19 The significant incident in late March 2020 and the Council’s responses as a Category 1 responder during the COVID-19 Pandemic continued to test how well the Council’s risk management, governance and internal control framework was operating during 2021/22. Regular COVID-19 Update reports were provided to Committee as appropriate. All members of the council’s Senior Leadership Team and key stakeholders participated in a variety of Local Authority specific Covid-19/Business Continuity response groups supported by the Civil Contingencies Service. A comprehensive Covid-19 Impact Risk Register was developed covering all aspects of service delivery affected by the pandemic which has been maintained on a regular basis. With significant disruption to how services continued during 2021/22, the CMT developed plans to ensure the council continued to meet requirements and achieve the strategic priorities set out in the Strategic Plan. This planning activity considered the reflective learning from the first phase of responding to the pandemic and ongoing engagement with key stakeholders in planning future service provision. Basis of Opinion My evaluation of the control environment is informed by a number of sources: • The audit work undertaken by Internal Audit during the year to 31 March 2022. • The assessment of risk completed during reviews of the annual audit plan.
Page 4
• The Code of Good Governance self-assessment process undertaken by the Chief Officers for the services for which they were responsible during the year to 31 March 2022. • The Council’s Annual Governance Statement for the year ended 31 March 2022. • Reports issued by the Council’s External Auditors, Audit Scotland, and other review agencies. • My knowledge of the Council’s governance, risk management and performance management and monitoring arrangements. Limitation to Resources or Scope of Internal Audit Work There were resource challenges at the start of the year including staff illness and an unforeseen staff vacancy arising which hampered the team’s ability to complete all fieldwork for the 2021/22 Audit Plan by 31 March 2022. Staffing numbers have now stabilised and the audit plan will be completed by end of June 2022. There were no significant threats identified to the independence of the internal audit activity such as inappropriate scope or resource limitations. Opinion The report concludes that the majority of West Dunbartonshire Council’s established internal control procedures operated as intended to meet management's control requirements for each area reviewed by Internal Audit in 2021/22. The overall audit opinion is Generally Satisfactory with some improvement needed. Signature: Andi Priestman Title: Shared Service Manager – Audit & Fraud Date: 18 May 2022
Page 5
Opinion Types Satisfactory Controls evaluated are adequate, appropriate and effective to provide reasonable assurance that risks are being managed and objectives should be met. • A limited number of amber rated issues may have been identified, but generally only green issues have been found in individual audit assignments. • None of the individual assignment reports have an overall opinion of Requires Improvement or Unsatisfactory. Generally Satisfactory with some improvement needed A few specific control weaknesses were noted: generally however, controls evaluated are adequate, appropriate and effective to provide reasonable assurance that risks are being managed and objectives should be met. • A number of amber rated issues identified in individual audit assignments that collectively do not significantly impact the system of internal control. • Red rated issues that are isolated to specific systems or processes. • None of the individual assignment reports have an overall opinion of Unsatisfactory. Major improvement needed Numerous specific control weaknesses were noted. Controls evaluated are unlikely to provide reasonable assurance that risks are being managed and objectives should be met. • A high number of amber rated issues that collectively have a significant impact on some parts of the system of internal control but are not widespread. • A number of red rated issues that collectively have a significant impact on some parts of the system of internal control but are not widespread. • A small number of individual assignment reports have an overall opinion of Requires Improvement or Unsatisfactory. Unsatisfactory Controls evaluated are not adequate, appropriate or effective to provide reasonable assurance that risks are being managed and objectives should be met. • Amber and red rated issues identified in individual assignments that collectively are widespread to the system of internal control. • A high number of individual assignment reports have an overall opinion of Requires Improvement or Unsatisfactory.