Agenda reports pack
Argyll and Bute Council · 22 September 2026
Back to Argyll and Bute HSCP Audit and Risk Committee — 22 September 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
15 September 2026 NOTICE OF MEETING A meeting of the ARGYLL AND BUTE HSCP AUDIT AND RISK COMMITTEE will be held BY MICROSOFT TEAMS on TUESDAY, 22 SEPTEMBER 2026 at 9:30 AM, which you are requested to attend. BUSINESS 1. APOLOGIES FOR ABSENCE 2. DECLARATIONS OF INTEREST (IF ANY) 3. MINUTES (Pages 3 - 6) Argyll and Bute HSCP Audit and Risk Committee held on 16 June 2026 4. INTERNAL AUDIT UPDATE (Pages 7 - 18) Report by Chief Internal Auditor, Argyll and Bute Council 5. INTERNAL AUDIT REPORT STAKEHOLDER ENGAGEMENT (Pages 19 - 40) Report by Chief Internal Auditor, Argyll and Bute Council 6. INTERNAL AUDIT REPORT RISK MANAGEMENT (Pages 41 - 56) Report by Chief Internal Auditor, Argyll and Bute Council 7. EXTERNAL AUDIT CORRESPONDENCE AND ASSURANCE (Pages 57 - 82) Report by Head of Finance 8. AUDIT SCOTLAND PUBLICATIONS (Pages 83 - 258) Report by Head of Finance 9. INTERNAL AUDIT CONTRACT (Pages 259 - 262) Report by Head of Finance E1 10. INTERNAL AUDIT REPORT DIRECT PAYMENTS (Pages 263 - 282) Report by Chief Internal Auditor, Argyll and Bute Council 11. DATE OF NEXT MEETING Tuesday 15 December 2026 The Committee will be asked to pass a resolution in terms of Section 50(A)(4) of the Local Government (Scotland) Act 1973 to exclude the public for items of business with an “E” on the grounds that it is likely to involve the disclosure of exempt information as defined in the appropriate paragraph of Part I of Schedule 7a to the Local Government (Scotland) Act 1973. Public Document Pack
Page 2
The appropriate paragraphs are:- E1 Paragraph 3 Information relating to any particular applicant for, or recipient or former recipient of, any service provided by the authority. Paragraph 4 Information relating to any particular applicant for, or recipient or former recipient of, any financial assistance provided by the authority. Argyll and Bute HSCP Audit and Risk Committee Councillor Kieron Green (Chair) Councillor Ross Moreland Janice Preston Brian Steven Contact: Katie McKenzie, Committee Services Officer - 01546 604465
Page 3
MINUTES of MEETING of ARGYLL AND BUTE HSCP AUDIT AND RISK COMMITTEE held BY MICROSOFT TEAMS on TUESDAY, 16 JUNE 2026 Present: Councillor Kieron Green (Chair) Emily Austin Councillor Ross Moreland Janice Preston Brian Stevens Attending: Evan Beswick, Chief Officer, Argyll and Bute HSCP Charlotte Craig, Business Improvement Manager, Argyll and Bute HSCP James Gow, Head of Finance, Argyll and Bute HSCP Paul MacAskill, Chief Internal Auditor, Argyll and Bute Council Hazel MacInnes, Senior Committee Officer, Argyll and Bute Council Mark Outterside, Forvis Mazars Caroline Robertson, Head of Adults – Hospitals and Community Services, Argyll and Bute HSCP Mhairi Weldon, Senior Audit Assistant, Argyll and Bute Council 1. APOLOGIES FOR ABSENCE There were no apologies for absence intimated. The Chair advised that he had given permission in advance of the meeting for Emily Austin to attend the meeting as a proxy for Brian Stevens to facilitate representation on the Committee during transitional arrangements within the NHS Highland Board. 2. DECLARATIONS OF INTEREST There were no declarations of interest intimated. 3. MINUTES The Minutes of the meeting of the Argyll and Bute HSCP Audit and Risk Committee held on 17 February 2026 were approved as a correct record. 4. AUDIT AND RISK COMMITTEE ANNUAL REPORT 2025-26 The Committee gave consideration to a report providing a summary of the work of the Audit and Risk Committee, its auditors and an evaluation by the Chair for the year 2025- 2026. Decision The Audit and Risk Committee approved the Annual Report prior to submission to the Integration Joint Board. (Reference: Report by Chair of Audit and Risk Committee dated 16 June 2026, submitted) Page 3 Agenda Item 3
Page 4
5. ANNUAL AUDIT PLAN - ARGYLL AND BUTE INTEGRATION JOINT BOARD - YEAR ENDING 31 MARCH 2026 The Committee gave consideration to the Annual Audit Plan for Argyll and Bute Integration Joint Board for the year ending 31 March 2026. The report provided an overview of the planned scope and timing of the external audit including the significant and enhanced risks that had been identified. The external auditor advised that the report would be re-issued as the sequence of the items within the report was incorrect. Decision The Audit and Risk Committee – 1. noted the Annual Audit Plan for the year ending 31 March 2026; 2. agreed there were not any other risks (business, laws & regulation, fraud, going concern, etc.) that could result in material misstatements in the financial statements; and 3. agreed there were not any matters that warranted particular attention during the audit and/ or any areas where additional procedures could be undertaken. (Reference: Report by Forvis Mazars dated June 2026, submitted) 6. UNAUDITED ANNUAL ACCOUNTS 2025/26 The Unaudited Annual Accounts for the year 2025/26 were before the Committee for review and approval prior to submission to the external auditors and being made available for public inspection on 31 June 2026. Decision The Audit and Risk Committee – 1. reviewed the Unaudited Annual Accounts and Report, including the Annual Governance Statement and approved them for issue; 2. noted that the Integration Joint Board was reporting a favourable financial outturn and an increase in its reserves; 3. endorsed the earmarking of reserves detailed at note 6; and 4. noted that the accounts were prepared on a going concern basis. (Reference: Report by Head of Finance dated 16 June 2026, submitted) 7. INTERNAL AUDIT UPDATE The Committee gave consideration to a report providing an update on the work carried out by Argyll and Bute Council’s Internal Audit Team on audits which were of operational relevance to the Committee. Page 4
Page 5
Decision The Audit and Risk committee noted the progress on completion of the internal audit recommendations. (Reference: Report by Chief Internal Auditor dated 16 June 2026, submitted) 8. HSCP 2025/26 INTERNAL AUDIT ANNUAL REPORT The Committee gave consideration to a report presenting the final 2025/26 Argyll and Bute HSCP Internal Audit Report and providing a formal opinion for 2025/26 based on completed work. Decision The Audit and Risk Committee endorsed the 2025/26 Argyll and Bute HSCP Internal Audit Report. (Reference: Report by Chief Internal Auditor dated 16 June 2026, submitted) 9. REVIEW OF CARE ASSESSMENT AND RESOURCES ALLOCATION The Committee gave consideration to an Internal Audit report focused on Care Assessment and Resource Allocation. Decision The Audit and Risk Committee endorsed the Internal Audit report on Care Assessment and Resource Allocation. (Reference: Report by Chief Internal Auditor dated 16 June 2026, submitted) 10. STRATEGIC RISK REGISTER REVIEW The Committee gave consideration to a report providing an opportunity to review the Strategic Risk Register and consider the outcome of the Risk Appetite review. Decision The Audit and Risk Committee – 1. reviewed and approved the Strategic Risk Register; 2. noted the outcome of the Risk Appetite Workshop and considered if the Committee wished to recommend any changes to the risk appetite to the Integration Joint Board; and 3. noted that the Strategic Risk Register would be presented to the September 2026 meeting of the Integration Joint Board. (Reference: Report by Head of Finance dated 16 June 2026, submitted) Page 5
Page 6
11. INTEGRATION JOINT BOARDS - FINANCE BULLETIN 2024/25 The Committee gave consideration to a report presenting an Audit Scotland report that provided an overview of the performance of Integration Joint Boards, highlighting the financial challenges facing the sector and confirming that actual performance was now reflecting the adverse projections / forecasts made in recent years. Decision The Audit and Risk Committee noted – 1. the contents of the report published by Audit Scotland; 2. the severe financial and operational challenges that continue to face Health and Social Care; and 3. that the Argyll and Bute HSCP was in a relatively favourable financial position at the end of the 2024/25 year. (Reference: Report by Head of Finance dated 16 June 2026, submitted) 12. AUDIT SCOTLAND: PUBLICATIONS The Committee gave consideration to a report highlighting five reports of interest published recently by Audit Scotland. Decision The Audit and Risk Committee noted the Audit Scotland publications highlighted within the report. (Reference: Report by Head of Finance dated 16 June 2026, submitted) 13. DATE OF NEXT MEETING The Audit and Risk Committee noted that the next meeting would be held on Tuesday 22 September 2026 at 10.30am by Microsoft Teams. Page 6
Page 7
Classification: OFFICIAL Audit and Risk Committee Date of Meeting: 22 September 2026 Title of Report: Internal Audit Update Presented by: Paul MacAskill, Chief Internal Auditor The Committee is asked to: • review and consider the progress on completion of the internal audit recommendations. 1. EXECUTIVE SUMMARY 1.1 This report updates the Audit and Risk Committee (the Committee) on the work carried out by Argyll and Bute Council’s (the Council) Internal Audit Team on audits which are of operational relevance to the Committee. 1.2 Three audits have been completed since the last meeting of the Committee on 16 June 2026. 1.3 In addition, this paper provides an update on the actions from audit reports already presented to the Committee which were still open as at 30 June 2026. 2. DETAIL 2.1 The Council’s internal audit team are the appointed internal auditors for the HSCP and also, as part of delivering the Council’s annual internal audit plan, carry out operational audits on services delivered by the social care element of the HSCP. Audits relating to the HSCP internal audit plan are reported to the HSCP Audit and Risk Committee. Social care audits delivered as part of the Council’s internal audit plan are reported to both the HSCP Audit and Risk Committee and the Council’s Audit and Scrutiny Committee. Similarly audits delivered as part of the HSCP Audit Plan are reported to the Council’s Audit and Scrutiny Committee for information. Page 7 Agenda Item 4
Page 8
Classification: OFFICIAL 2.2 Internal audit reports include an action plan with a management response which establish the agreed action, timescale and responsible officer. Internal Audit record these in a database and, on a quarterly basis, follow them up to ensure they are being progressed. Internal Audit will only complete actions where evidence can be provided that the agreed action has been fulfilled appropriately. Table 1: H&SCP (IJB) Summary of Audit Actions as at 30 June 2026 Service Complete On Track Delayed Superseded Total H&SCP (IJB) – Adult Services (Hospital & Community Services) 0 2 0 0 2 H&SCP (IJB) – Strategic Planning, Performance & Technology 1 2 7 1 11 Total 1 4 7 1 13 Table 2: H&SCP (SW) Summary of Audit Actions as at 30 June 2026 Service Complete On Track Delayed Total H&SCP (SW) – Adult Services (Complex Care & Registered Services 0 0 1 1 H&SCP (SW) – Children and Families and Justice 2 0 2 4 H&SCP (SW) – Adult Services (Hospital & Community Services) 0 2 1 3 Total 2 2 4 8 Page 8
Page 9
Classification: OFFICIAL 2.3 Work in progress / Future work The approved plan for 2026/27 has three planned internal audit reviews, specifically, Financial Management Arrangements, Stakeholder Engagement and Risk Management. Two of these reviews have now been completed and are contained in the agenda pack for the September meeting, the third review is in progress and will be presented at a future meeting of this committee. One additional audit on Direct Payments has been completed at the request of management and is also contained in the agenda pack for this meeting. 3.0 RELEVANT DATA AND INDICATORS - NONE 4.0 CONTRIBUTION TO STRATEGIC PRIORITIES 4.1 Audit reports include agreed actions to strengthen internal control. 5.0 GOVERNANCE IMPLICATIONS 5.1 Financial Impact - None 5.2 Staff Governance - None 5.3 Clinical Governance - None 6.0 EQUALITY & DIVERSITY IMPLICATIONS - NONE 7.0 GENERAL DATA PROTECTION PRINCIPLES COMPLIANCE 7.1 This report in itself does not raise any GDPR issues however consideration of GDPR will feature in audits where appropriate. 8.0 RISK ASSESSMENT 8.1 The audit planning approach is a risk based one and individual audit reports provide an overall assessment on the management of risk. 9.0 PUBLIC & USER INVOLVEMENT & ENGAGEMENT - NONE 10.0 CONCLUSIONS 10.1 Satisfactory progress is being made implementing audit actions 11.0 DIRECTIONS Page 9
Page 10
Classification: OFFICIAL 11.1 Directions required to Council, NHS Board or both. Directions to: Tick No Directions Required X Argyll & Bute Council NHS Highland Health Board Argyll & Bute Council and NHS Highland Health Board REPORT AUTHOR AND CONTACT Author: Paul MacAskill Email: Paul.Macaskill@argyll-bute.gov.uk Appendix 1 – Visual representations of progress in addressing agreed actions Appendix 2 – Action Plan Points Delayed and Rescheduled Page 10
Page 11
Classification: OFFICIAL Appendix 1 – Visual representations of progress in addressing agreed actions Page 11
Page 12
Classification: OFFICIAL Appendix 2 – Action Plan Points Delayed and Rescheduled Service, Report, Plan no. & finding Agreed Action Original and Revised Dates Comment Responsible Officer Medium STRATEGIC PLANNING, PERFORMANCE & TECHNOLOGY Risk Management Operational Risk Registers All key business activities within the partnership have an operational risk register in place as required per the Strategy document. A review of these risk registers noted that they have not been updated and formally reviewed. Recommendation accepted. All operational risk registers will be updated on smart sheet. 31/12/2024 31/12/2025 01/04/2026 Superseded due to action being brought up in more recent review. Superseded Business Improvement Manager Low STRATEGIC PLANNING, PERFORMANCE & TECHNOLOGY HSCP - Governance Arrangements While training provisions are evident, details of IJB member training and induction are not currently published publicly. This limits transparency for stakeholders and potential board members. HSCP will on an ongoing basis publish a summary of the training and induction programme provided to IJB members, including any development opportunities. 30/04/2026 30 Sep 2026 This action is ongoing. Delayed and Rescheduled Business Improvement Manager Low STRATEGIC PLANNING, PERFORMANCE & TECHNOLOGY HSCP - Governance Arrangements HSCP will develop a concise governance summary guide, including officer responsibilities and reporting lines. 30/04/2026 30 Sep 2026 This action is ongoing. Delayed and Rescheduled Business Improvement Manager Page 12
Page 13
Classification: OFFICIAL Service, Report, Plan no. & finding Agreed Action Original and Revised Dates Comment Responsible Officer A summarised governance guide, including an organisational chart that outlines officer responsibilities and committee reporting lines, would improve accessibility for new members and external stakeholders. A summarised governance guide, including an organisational chart that outlines officer responsibilities and committee reporting lines, would improve accessibility for new members and external stakeholders. Low STRATEGIC PLANNING, PERFORMANCE & TECHNOLOGY HSCP - Partnership Working Performance Monitoring and Reporting The HSCP should continue to develop the existing workforce performance monitoring arrangements so that KPIs and RAG assessments remain clearly linked to strategic objectives and risks, and reporting continues to provide meaningful assurance to the IJB developed in partnership with both employing bodies. HSCP will further develop its performance dashboard or scorecard that visually aligns key performance indicators (KPIs) and RAG statuses with HSCP’s strategic objectives and risks. 30/04/2026 30/06/2026 30 Sep 2026 This is still-ongoing and requires development of monitoring of workforce planning as part of IPMF. Delayed and Rescheduled Business Improvement Manager Low STRATEGIC PLANNING, PERFORMANCE & TECHNOLOGY HSCP - Partnership Working The Chief Officer will ensure that induction materials for senior managers and key officers include a dedicated section on dispute resolution 30/04/2026 30 Sep 2026 This will be delivered in September, as a governance handbook and we are awaiting the update to national guidance due to the Business Improvement Manager Page 13
Page 14
Classification: OFFICIAL Service, Report, Plan no. & finding Agreed Action Original and Revised Dates Comment Responsible Officer Dispute Resolution Awareness The Chief Officer should embed this in induction for senior managers and key officers on the escalation routes set out in the Integration Scheme, to ensure a consistent understanding across the partnership and with wider partners. processes and escalation routes as set out in the Integration Scheme. amendment order on voting rights. Delayed and Rescheduled Medium STRATEGIC PLANNING, PERFORMANCE & TECHNOLOGY HSCP: WORKFORCE PLANNING Appendix 1 checklist Scottish Government guidance DL (2022)09 includes an Appendix 1 “Three-Year Workforce Plan – Indicative Content Checklist” to assure completeness (methodology, partner engagement, gap analysis, linkage to service/finance plans, and actions under the five pillars). No evidence was found that this checklist was completed or retained when the Plan was produced/refreshed. At the next Workforce Plan refresh, complete the Appendix 1 checklist in full. The Appendix 1 “Three-Year Workforce Plan – Indicative Content Checklist” from Scottish Government guidance DL (2022) 09 will be fully completed and retained as part of the documentation for the next Workforce Plan refresh. 30/04/2026 30 Sep 2026 This has been discussed in the Strategic Workforce Oversight Group. The Chair of the A&R Committee is to be approached and, if they agree, we are looking to add half an hour to the Workforce Planning slot to update the Committee. Delayed and Rescheduled Head of Strategic Planning, Performance and Technology: HSCP and People Partner: HSCP Medium STRATEGIC PLANNING, PERFORMANCE & TECHNOLOGY HSCP: WORKFORCE PLANNING Funding for Workforce Plan actions A costed funding map will be developed jointly by NHS Highland Finance/HR and Argyll & Bute Council Finance/HR, working in partnership with HSCP. The 30/06/2026 30 Sep 2026 This has been discussed in the Strategic Workforce Oversight Group. The Chair of the A&R Committee is to be approached and, if they agree, we are looking to add NHS Highland Finance and HR / Argyll and Bute Council Finance and HR Page 14
Page 15
Classification: OFFICIAL Service, Report, Plan no. & finding Agreed Action Original and Revised Dates Comment Responsible Officer The Strategic Workforce Plan and quarterly workforce reports show targeted investment (e.g., recruitment and retention initiatives, leadership programmes, UHI care-home training). However, they do not provide a consolidated, action-level breakdown of estimated costs or named funding sources. Costs are referenced only “as appropriate,” limiting assurance that priority actions are fully resourced and sustainable. map will set out, for each priority action, the estimated cost, named funding source or budget code, phasing, and expected benefits or savings. half an hour to the Workforce Planning slot to update the Committee. Delayed and Rescheduled Medium STRATEGIC PLANNING, PERFORMANCE & TECHNOLOGY HSCP: WORKFORCE PLANNING Agency Costs Reliance on supplementary staffing (bank and agency) is acknowledged in the Workforce Plan and risk documentation. However, the 2024/25 reporting does not provide a consolidated, service-level view of agency spend and FTE with 12-month trends, targets, or named owners. This limits targeted action, benefits tracking, and IJB oversight. Existing agency and supplementary staffing reporting will be consolidated and expanded into a single dashboard, developed jointly with Finance and HR. The dashboard will provide service-level spend and FTE, 12-month trends, key drivers (e.g., vacancy, sickness), and named owners. It will be cross-referenced within the regular Workforce Report to the IJB to support clearer oversight. 30/06/2026 30 Sep 2026 This has been discussed in the Strategic Workforce Oversight Group. The Chair of the A&R Committee is to be approached and, if they agree, we are looking to add half an hour to the Workforce Planning slot to update the Committee. Delayed and Rescheduled Deputy Director of People (NHS Highland) and Head of Customer Support Services (Argyll & Bute Council), in partnership with the HSCP Medium ADULT SERVICES (COMPLEX CARE & REGISTERED SERVICES) Learning & Physical Disability Care Packages Record keeping session (s) to be delivered by professional lead Senior Managers to implement case note audit 30/06/2024 31/12/2024 31/03/2025 30/09/2025 Case File Audit Procedure, subject to some minor amendments which are currently being Senior Managers (Adult Services) Page 15
Page 16
Classification: OFFICIAL Service, Report, Plan no. & finding Agreed Action Original and Revised Dates Comment Responsible Officer Case Notes Case notes are maintained on Eclipse, the replacement client database for Carefirst. It was noted that case notes were not always maintained and up to date. within their respective services – this should be linked to individual practitioner supervision. 31/01/2026 30/06/2026 30 Sep 2026 incorporated. An implementation plan, together with associated communications and training plans, has been developed. Delayed and Rescheduled Medium CHILDREN AND FAMILIES AND JUSTICE External Placements Model of Care and Costs The increasing demand within the Council is resulting in significant budget overspends and the demand for services is projected to increase in the coming years. In many cases there are no internal resources available to meet the needs of the young person, resulting in the only option being looking for external placements. Continue to explore options to develop internal resources for the education and care of Argyll and Bute's children within its existing asset base - specifically in line with Education's work on the development of Secondary Wellbeing Hubs and the development of the work of Children's Houses. As in finding 5 there is no need for a fundamental review of the models of care. 31/03/2026 30/06/2026 31 Mar 2027 This action is closely linked to the Education Review workstream 10 and cannot be done in isolation. The first meeting of this workstream is scheduled for August 26. Delayed and Rescheduled Head of Children Families and Justice Medium CHILDREN AND FAMILIES AND JUSTICE External Placements Sharing of Costs Clear costings are given from the providers, they are available to see in advance of contacting them to discuss any prospective Providers are expected to provide a more detailed breakdown of costs, particularly extra costs, to inform consideration and decision making at service level. 31/03/2026 30/06/2026 31 Dec 2026 It has been requested that the date of this action be extended to December 26 as this work is not as fully on track as anticipated due to continued absence. Finance teams are gathering % split projections from Head of Children Families and Justice Page 16
Page 17
Classification: OFFICIAL Service, Report, Plan no. & finding Agreed Action Original and Revised Dates Comment Responsible Officer placement, and these are available through the Scotland Excel procurement service website. The breakdown of all care and education placements is 38% education and 62% care with the placements agreed jointly by Heads of Service for both care and education. It is unclear whether Education are provided with a copy of the costs of the provision of the education in order that they can review best value for the service provided. There will need to be a focus on data trends. Scotland Xcel, so some slight progress has been made with information gathering also being requested directly from providers on more detailed invoicing. This is at the early stages. Delayed and Rescheduled Medium ADULT SERVICES (HOSPITAL & COMMUNITY SERVICES) Self-Directed Support Follow up Actions During the process of testing of records, it was noted that there was evidence that recommendations in Memos issued to the Care Mangers had not been followed up. This finding will be highlighted and shared with Service Managers and Team Managers to ensure that the message is communicated clearly to Social Work staff to take account of any advice and guidance in a complex area of practice and are fully aware of their responsibility to collaborate with practice leads and senior staff to ensure their practice is to the standard expected and achieves the best outcomes for the individual. 31/12/2025 30/06/2026 30 Sep 2026 This is still on-going. A request has been made – on behalf of the CO – assurance from the Senior Manager that the action has been progressed and completed. Delayed and Rescheduled Head of Hospitals and Community Care Page 17
Page 18
This page is intentionally left blank
Page 19
1 Classification: OFFICIAL Audit and Risk Committee Date of Meeting: 22 September 2026 Title of Report: Stakeholder Engagement Presented by: Paul Macaskill, Chief Internal Auditor The Committee is asked to: ▪ Review and endorse the Internal Audit report on Stakeholder Engagement 1. EXECUTIVE SUMMARY 1.1 An audit report focused on Stakeholder Engagement is being reported to the Audit and Risk Committee (the Committee). 1.2 Internal Audit provides a level of assurance upon completion of audit work. A definition for each assurance level is documented in each audit report. The table below provides a summary of the audit conclusions, and the full report is included as an appendix to this report. 2. RECOMMENDATIONS 2.1 The committee is asked to consider, discuss and approve the contents of the attached report. 3. DETAIL OF REPORT 3.1 The scope of the audit was to provide assurance over arrangements to engage effectively with all relevant stakeholders with reference to Locality Planning Groups (LPG) as outlined in the Terms of Reference agreed with the Head of Strategic Planning, performance and technology Argyll and Bute HSCP on 15th April 2026. 3.2 Three control objectives were assessed during the audit, these were: No of Actions Audit Name Assurance High Medium Low VFM Stakeholder Engagement Reasonable 0 1 1 0 Page 19 Agenda Item 5
Page 20
2 Classification: OFFICIAL Control Objective CO1 There are clearly defined strategies, policies and governance arrangements supporting effective stakeholder engagement CO2 Locality Planning Groups operate effectively, with appropriate representation, regular meetings and meaningful contribution to local and strategic planning. CO3 Stakeholder engagement is meaningful, with feedback captured, analysed and demonstrably used to inform decision-making and service design and Engagement activity is effectively monitored and reported, with appropriate scrutiny and challenge by senior management and the IJB. 3.3 Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. In particular the report highlights the following strengths and areas for improvement: Strengths • Argyll and Bute HSCP have an established and documented stakeholder engagement framework, supported by the Stakeholder Engagement and Communication Framework, Annual Engagement Plan and associated guidance. • Governance arrangements are in place through the Strategic Planning Group (SPG), Locality Planning Groups (LPGs) and Integration Joint Board (IJB), providing formal structures for stakeholder and community engagement. • The HSCP undertakes a wide range of engagement activity, with the Annual Performance Report demonstrating significant engagement across services and communities during the year. • Key strategic documents, including the Joint Strategic Plan and Annual Engagement Plan, recognise the importance of co- production, participation and involving stakeholders in service planning and redesign. • Regular reporting on engagement activity is provided to the IJB, demonstrating openness and transparency regarding engagement undertaken across the HSCP. • The Stakeholder Engagement and Communication Framework has been refreshed and continues to provide a structured approach to engagement across the organisation. Page 20
Page 21
3 Classification: OFFICIAL Areas for Improvement • The HSCP should strengthen the audit trail demonstrating how feedback received through stakeholder engagement influences decision-making, service planning and policy development, providing clearer evidence of the impact of engagement. • Governance reporting should place greater emphasis on evaluating the outcomes and effectiveness of engagement activity, rather than primarily reporting that engagement has taken place. • The HSCP should continue to strengthen evidence of co- production by demonstrating how stakeholders are involved throughout the design, development and implementation of services, rather than primarily during consultation stages. • The HSCP should ensure there is clearer evidence showing how issues and themes identified through Locality Planning Groups and other engagement mechanisms are escalated, considered and reflected in IJB decisions where appropriate 4. RELEVANT DATA AND INDICATORS – NONE 5. CONTRIBUTION TO STRATEGIC PRIORITIES 5.1 Internal audit reports include agreed actions to strengthen internal controls. 6. GOVERNANCE IMPLICATIONS 6.1 Financial Impact - None 6.2 Staff Governance - None 6.3 Clinical and Care Governance – None 7. PROFESSIONAL ADVISORY – NONE 8. EQUALITY & DIVERSITY IMPLICATIONS – NONE 9. GENERAL DATA PROTECTION PRINCIPLES COMPLIANCE 9.1 This report in itself does not raise any GDPR issues however consideration of GDPR will feature in audits where appropriate. 10. RISK ASSESSMENT 10.1 The audit planning approach is a risk based one and individual audit reports provide an overall assessment on the management of risk. Page 21
Page 22
4 Classification: OFFICIAL 11. PUBLIC & USER INVOLVEMENT & ENGAGEMENT – NONE 12. CONCLUSIONS 12.1 Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. 13. DIRECTIONS Directions required to Council, NHS Board or both. Directions to: tick No Directions required x Argyll & Bute Council NHS Highland Health Board Argyll & Bute Council and NHS Highland Health Board 14. PREVIOUS REVIEW OF THE REPORT Meeting Title of report Date Output (if relevant) n/a n/a n/a n/a REPORT AUTHOR AND CONTACT Author Name: Paul Macaskill Email: paul.macaskill@argyll-bute.gov.uk Page 22
Page 23
Classification: OFFICIAL Argyll & Bute Health & Social Care Partnership Internal Audit Report July 2026 Final High Medium Low VFM Number of Findings 0 4 1 0 Stakeholder Engagement Audit Opinion: Reasonable Page 23
Page 24
2 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 3 Topical Requirements ............................................................................................................................ 3 Key Dates ................................................................................................................................................ 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 5 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 11 Appendix 2 – Audit Opinion ................................................................................................................. 17 Contact Details Internal Auditor: David Sullivan Telephone: 01546 4186 e-mail: David.sullivan@argyll-bute.gov.uk www.argyll-bute.gov.uk Page 24
Page 25
3 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL 1. Executive Summary Introduction 1. As part of the 2026/27 internal audit plan, approved by the Audit & Risk Committee in February 2026, we have undertaken an audit of Argyll & Bute Health & Social Care Partnership (HSCP) system of internal control and governance in relation to Stakeholder Engagement. 2. The audit was conducted in accordance with the Global Internal Audit Standards (GIAS) with our conclusions based on discussions with Health & Social Care Partnership officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the HSCP. 3. The contents of this report have been agreed with the appropriate Health & Social Care Partnership officers to confirm factual accuracy, and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. A review of Stakeholder Engagement has been planned as part of the 2026/27 Argyll and Bute Health and Social Care Partnership (HSCP) Internal Audit programme. 5. Effective stakeholder engagement is a fundamental component of good governance and service delivery within HSCP. It ensures that communities, service users, staff, partners and other stakeholders are appropriately involved in the planning, design and delivery of services. 6. The Integration Joint Board (IJB) has a statutory responsibility to ensure that stakeholders are meaningfully involved in decision-making processes, in line with Scottish Government guidance Planning with People (2024), which promotes co-production and continuous engagement. 7. This audit is linked to the Strategic Risk Register: • SRR11 – Communications and Engagement with Communities, which identifies the risk of inadequate arrangements to communicate and engage effectively with stakeholders, communities and partners. Scope 8. The scope of the audit was to provide assurance over arrangements to engage effectively with all relevant stakeholders with reference to Locality Planning Groups (LPG) as outlined in the Terms of Reference agreed with the Head of Strategic Planning, performance and technology Argyll and Bute HSCP on 15th April 2026. Topical Requirements 9. Topical Requirements are a new, mandatory component of the updated International Professional Practices Framework for internal auditing, they must be followed when auditing subjects for which a Topical Requirement exists or when aspects of the Topical Requirement are identified within other audits. Page 25
Page 26
4 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL 10. The Cybersecurity Topical Requirement (issued February 2025) has been considered. While this audit does not focus on cybersecurity, digital engagement methods (e.g. social media) form part of stakeholder engagement. 11. The audit will therefore consider whether any relevant risks associated with digital engagement are appropriately recognised and managed. Key Dates 12. The Terms of Reference provided provisional timescales for the review to take place, the actual dates are noted below. Exhibit 1 – Key Dates Stage Actual Date Terms of Reference agreed 15TH April 2026 Fieldwork Commencement 1st May 2026 Draft Report issued 29th May 2026 Management Comments received 30th June 2026 Final Report issued 2nd July 2026 Audit and Risk Committee 22nd September 2026 Risks 13. The risks considered throughout the audit were: • SRR11: Communications and Engagement with Communities, which identifies the risk of inadequate arrangements to communicate and engage effectively with stakeholders, communities and partners. • Audit Risk 1: Stakeholder engagement arrangements are not clearly defined or effectively implemented, resulting in inconsistent or ineffective engagement • Audit Risk 2: Locality Planning Groups (LPGs) are not operating effectively, resulting in limited local input into planning and decision-making. • Audit Risk 3: Stakeholder feedback is not systematically captured, analysed or acted upon, resulting in limited impact on services • Audit Risk 4: Engagement activity is not effectively monitored or reported, limiting oversight and assurance to the IJB Audit Opinion 14. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 15. Our overall audit opinion for this audit is that we can take a Reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Page 26
Page 27
5 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL Recommendations 16. We have highlighted four medium priority recommendations and one low priority recommendation where we believe there is scope to strengthen the control and governance environment. These are summarised below: • Governance oversight and evaluative scrutiny of stakeholder engagement reporting should be strengthened. • A formally documented stakeholder engagement roles and responsibilities framework should be established. • Arrangements for recording and evidencing outcomes arising from Locality Planning Group discussions should be strengthened • Arrangements for evidencing, tracking and monitoring stakeholder engagement outcomes and their impact on operational actions and decision-making should be strengthened. • A clearly documented and consistently applied review cycle for engagement framework documentation should be established. 17. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 18. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 2 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 There are clearly defined strategies, policies and governance arrangements supporting effective stakeholder engagement. SRR11 Audit Risk 1 Substantial The HSCP has established a comprehensive stakeholder engagement framework supported by governance structures, strategic planning arrangements, and alignment with national guidance. Minor improvement opportunities were identified regarding formalisation of review arrangements and clearer documentation of roles and responsibilities. 2 Locality Planning Groups operate effectively, with appropriate representation, regular meetings and meaningful contribution to local and strategic planning. SRR11 Audit Risk 2 Reasonable Locality Planning Groups are formally established and operating across the HSCP, with evidence of ongoing engagement activity and contribution to strategic planning. However, limitations in operational documentation, escalation evidence, and measurable outcome tracking reduce assurance regarding the overall effectiveness and consistency of LPG arrangements. Page 27
Page 28
6 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL 3 Stakeholder engagement is meaningful, with feedback captured, analysed and demonstrably used to inform decision- making and service design and Engagement activity is effectively monitored and reported, with appropriate scrutiny and challenge by senior management and the IJB. SRR 11 Audit Risk 3 Audit Risk 4 Reasonable The HSCP has established structured arrangements for planning, delivering, and reporting stakeholder engagement activity, including formal processes for capturing and analysing stakeholder feedback. However, limited evidence was available demonstrating consistent evaluative scrutiny, measurable outcomes, and clear audit trails linking engagement activity to final operational or strategic decisions. 19. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings There are clearly defined strategies, policies and governance arrangements supporting effective stakeholder engagement 20. A review of the NHS Highland Engagement Hub confirmed that the HSCP utilises a structured and documented digital platform to support stakeholder engagement activities. The Hub provides a centralised mechanism for consultation and participation, including surveys, feedback tools, stakeholder information, and online engagement activity, demonstrating that formal arrangements are in place to facilitate ongoing engagement with stakeholders. 21. Further review of supporting documentation identified a comprehensive stakeholder engagement framework underpinning engagement activity across the HSCP. The Engagement Framework Refresh 2025 sets out the HSCP’s strategic approach to engagement, including defined engagement principles, governance structures, and supporting arrangements such as the Annual Engagement Plan and Engagement Specification. The Framework explicitly references alignment with Planning with People (2024) and the National Standards for Community Engagement. In addition, the Engagement Flowchart (May 2024) provides a structured end-to-end process for planning, delivering, analysing and reporting engagement activity, including requirements for stakeholder identification, equality impact assessment, analysis of responses, governance reporting, and feedback loops. 22. Review of the Joint Strategic Plan (JSP) Engagement Specification and associated Engagement Report further demonstrated evidence of structured engagement planning, stakeholder mapping, defined engagement methodologies, analysis of stakeholder responses, and linkage between engagement activity and development of strategic priorities. 23. A review of governance arrangements and supporting engagement documentation confirmed that stakeholder engagement is reported through established governance structures within the Page 28
Page 29
7 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL HSCP. The Engagement Framework Refresh 2025 identifies defined governance arrangements supporting stakeholder engagement, including the Strategic Engagement Advisory Group, Strategic Planning Group (SPG), and Integration Joint Board (IJB), with reporting routes established between operational engagement activity and senior governance structures. 24. Review of IJB minutes dated 19 November 2025 confirmed that the Board considered reports relating to the Annual Engagement Plan 2025–26, the updated Engagement Framework aligned to Planning with People (2024), and Locality Planning proposals. In addition, the JSP Engagement Specification and associated governance documentation identified evidence of formal engagement planning, governance oversight, and approval arrangements through SPG and senior management structures. 25. Overall, there is strong evidence that stakeholder engagement is supported through established governance structures, defined reporting arrangements, and formal oversight processes within the HSCP. 26. However, while governance and reporting arrangements are clearly established, evidence within governance minutes indicates that engagement reporting is primarily presented for noting, with limited evidence of detailed scrutiny, challenge, or evaluation of engagement effectiveness recorded within Board or committee discussions. Action Plan 1 27. A review of governance arrangements and supporting engagement documentation indicates that stakeholder engagement responsibilities are assigned to relevant officers and governance groups within the HSCP. The Engagement Framework Refresh 2025 identifies governance structures supporting engagement activity, including the Strategic Engagement Advisory Group, SPG, and IJB, while the Engagement Flowchart (May 2024) and JSP Engagement Specification refer to the use of lead officers, governance approval processes, and defined engagement responsibilities within operational planning arrangements. 28. However, during discussion with the HSCP officer responsible for engagement, management confirmed that there is no standalone document or formally defined roles and responsibilities framework clearly setting out stakeholder engagement responsibilities, accountabilities, and reporting lines across the organisation. As a result, while engagement responsibilities appear to operate effectively in practice, limited assurance is available that roles and responsibilities are consistently documented, communicated, and applied across all service areas. Action Plan 2 29. A review of governance documentation confirmed that the HSCP Engagement Framework has been subject to recent review and update. The Engagement Framework Refresh 2025 states that the framework has been updated to reflect changes in national guidance, including alignment with Planning with People (2024). In addition, review of IJB reporting dated 19 November 2025 confirmed that the updated Engagement Framework and Annual Engagement Plan were presented through established governance arrangements, demonstrating oversight and reporting to senior decision-making bodies. 30. However, while evidence of review activity and governance oversight was identified, audit testing did not identify a single fully documented and consistently applied review cycle covering all elements of the engagement framework, supporting operational guidance, and associated Page 29
Page 30
8 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL engagement documentation. As a result, assurance is reduced that all engagement arrangements will be reviewed systematically and consistently over time. Action Plan 5 Locality Planning Groups operate effectively, with appropriate representation, regular meetings and meaningful contribution to local and strategic planning. 31. Evidence confirms that Locality Planning Groups (LPGs) are formally established across Argyll and Bute HSCP, with a defined role and structure within the wider stakeholder engagement and strategic planning framework. 32. The LPG Option Appraisal confirms that locality planning is a statutory requirement under the Public Bodies (Joint Working) (Scotland) Act 2014 and identifies the development of a structured locality planning model across Argyll and Bute. In addition, review of Locality Planning Key Messages documentation from November 2025, January 2026 and March 2026 demonstrates that LPG arrangements are operational across localities and are being actively used to support stakeholder engagement and locality-based discussion. 33. The documentation reviewed also identified evidence of review and development of LPG structures, including the transition from four LPGs to two locality groupings (East and West LPGs), following review of participation, locality planning arrangements, and stakeholder engagement approaches. This demonstrates that LPG arrangements are subject to ongoing evaluation and updating. 34. Review of Strategic Planning Group (SPG) minutes and associated governance documentation further confirms that LPGs are embedded within the HSCP governance framework and form part of wider locality planning and stakeholder engagement arrangements. 35. A review was carried out of SPG minutes, IJB minutes, Annual Performance Reports, LPG Key Messages documentation, and JSP engagement documentation to assess the quality and relevance of discussions taking place within LPGs. 36. Evidence demonstrates that LPG activity is reported through governance arrangements, including updates on locality planning, stakeholder engagement activity, and community priorities. The documentation reviewed identified discussion of a range of relevant local issues and themes, including wellbeing, prevention, unpaid carers, sustainability, communication with communities, mental health, social support, and service accessibility. 37. The Joint Strategic Plan Engagement Report and LPG Key Messages documentation further demonstrate evidence of locality-based engagement activity, thematic discussion, stakeholder participation, and identification of community priorities across different geographical areas. This indicates that LPG discussions are supporting wider engagement activity and providing a forum for consideration of local stakeholder and community issues. 38. However, while evidence of meaningful discussion and stakeholder participation was identified, governance reporting and centrally available documentation generally remain high-level in nature, with limited operational detail regarding how discussions are formally analysed, prioritised, escalated, or translated into specific actions and measurable service improvements. In addition, documentation does not consistently demonstrate clear audit trails linking LPG discussions to subsequent governance decisions, operational actions, or monitored outcomes. Action Plan 3 Page 30
Page 31
9 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL 39. Review of stakeholder engagement documentation and governance reporting identified evidence that outputs from LPGs and wider engagement activity contribute to strategic planning and governance processes within the HSCP. 40. The JSP Engagement Report demonstrates that stakeholder feedback, thematic analysis, and locality engagement activity were used to inform development of strategic priorities and commissioning intentions. In addition, review of IJB reporting identified examples where engagement activity, consultation outcomes, and Integrated Impact Assessments were referenced within governance papers relating to strategic planning and budget proposals. 41. However, during discussion with the HSCP officer responsible for engagement, management were unable to provide a clear end-to-end example demonstrating how an issue raised through a LPG or wider stakeholder engagement activity had been formally escalated through governance arrangements and directly influenced a final strategic or operational decision. 42. As a result, while evidence demonstrates that stakeholder engagement activity contributes to governance reporting and strategic planning processes, assurance is reduced regarding the consistency and transparency of escalation arrangements and the extent to which engagement outcomes can be clearly linked to measurable operational or strategic decisions. Action Plan 4 Stakeholder engagement is meaningful, with feedback captured, analysed and demonstrably used to inform decision-making and service design and Engagement activity is effectively monitored and reported, with appropriate scrutiny and challenge by senior management and the IJB. 43. A review of stakeholder engagement documentation confirmed that engagement activities undertaken by the HSCP are supported by defined objectives, structured planning arrangements, and documented engagement methodologies. 44. Review of the HSCP Budget Saving Review engagement page confirmed that engagement activity was supported by a clearly defined purpose and context, including the financial challenges facing the HSCP and the need to identify savings and service priorities. The engagement exercise identified specific objectives, including gathering stakeholder views on proposed service changes and financial priorities, and utilised a range of engagement methods including surveys, online engagement activity, consultation exercises, and community engagement events. 45. Supporting documentation, including the NHS Highland Engagement Hub, Annual Engagement Plan 2025–26, Engagement Framework Refresh 2025, and JSP Engagement Specification, demonstrates that stakeholder engagement activity within the HSCP is formally planned, structured and aligned to organisational objectives and governance arrangements. Overall, there is strong evidence that stakeholder engagement activities are appropriately planned and supported by defined objectives, stakeholder identification processes, engagement methodologies, and governance oversight arrangements. 46. Review of stakeholder engagement documentation confirmed that the HSCP utilises structured mechanisms for capturing and handling stakeholder feedback across a range of engagement activities. 47. The NHS Highland Engagement Hub, Engagement Framework Refresh 2025, and supporting engagement documentation demonstrate that stakeholder views are systematically collected through a variety of engagement methods, including questionnaires, surveys, online Page 31
Page 32
10 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL engagement activity, consultation exercises, stakeholder workshops, community events, and Locality Planning Group discussions. 48. In addition, the Engagement Flowchart (May 2024) outlines formal processes for gathering feedback, analysing responses, incorporating engagement outcomes into governance and decision-making processes, and closing the feedback loop. 49. Review of IJB reporting and supporting governance documentation also identified examples where engagement feedback and Integrated Impact Assessments were referenced within decision-making papers relating to strategic planning and budget proposals. 50. Overall, there is strong evidence that the HSCP has established structured arrangements and formal processes for collecting, recording, and analysing stakeholder feedback across a range of engagement activities. However, while evidence was identified that stakeholder feedback and thematic analysis inform governance reporting, strategic planning and decision-making processes, limited evidence was available demonstrating how engagement outcomes are consistently prioritised, tracked and monitored through to measurable actions, service improvements or decision-making outcomes across all engagement activity. Action Plan 4 51. A review of IJB minutes indicates that stakeholder engagement reports are presented through established governance arrangements and are routinely submitted for consideration. However, the minutes show that these reports are primarily presented for noting, with limited evidence of detailed discussion, scrutiny, or challenge by Board members or senior management. 52. This suggests that while stakeholder engagement activity is reported, the level of oversight may be largely informational rather than evaluative. There is little documented evidence of critical review, questioning of outcomes, or challenge regarding the effectiveness and impact of engagement activity. Action Plan 1 Page 32
Page 33
Classification: OFFICIAL Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Medium 1 Engagement Reporting The HSCP should strengthen governance oversight arrangements for stakeholder engagement by ensuring that engagement reporting presented to governance groups includes appropriate evaluative scrutiny, challenge, and assessment of engagement effectiveness, outcomes, and impact on service planning and decision-making. In the absence of sufficient evaluative scrutiny and challenge of stakeholder engagement activity, there is a risk that governance groups are unable to fully assess the effectiveness, impact, and outcomes of engagement arrangements or identify opportunities for improvement. Management will review existing stakeholder engagement reporting arrangements to ensure that governance reports presented to the Strategic Planning Group and Integration Joint Board include appropriate evaluative information regarding engagement effectiveness, outcomes, and impact on service planning and decision-making where appropriate. Associate Director, Public Heath, NHS Highland Head of Strategic Planning, Performance and Technology Argyll and Bute HSCP 31st December 2026 Page 33
Page 34
12 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL No Finding Risk Agreed Action Responsibility / Due Date Medium 2 Roles and Responsibilities The HSCP should develop and maintain a formally documented stakeholder engagement roles and responsibilities framework (or equivalent RACI matrix) clearly defining accountability, operational responsibilities, governance reporting lines, and oversight arrangements for stakeholder engagement activity across the organisation. In the absence of a formally documented stakeholder engagement roles and responsibilities framework, there is a risk that engagement activity may be applied inconsistently across services, resulting in unclear accountability, inconsistent governance oversight, and reduced assurance regarding the effectiveness of stakeholder engagement arrangements Management will develop and document a stakeholder engagement roles and responsibilities framework to support clarity of accountability, governance reporting arrangements, and operational responsibilities across stakeholder engagement activity. Associate Director, Public Heath, NHS Highland Head of Strategic Planning, Performance and Technology Argyll and Bute HSCP 31st December 2026 Page 34
Page 35
13 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL No Finding Risk Agreed Action Responsibility / Due Date Medium 3 Recording of LPG discussions The HSCP should strengthen arrangements for recording, analysing, prioritising, and evidencing outcomes arising from Locality Planning Group discussions to ensure that stakeholder issues and community priorities are consistently translated into operational actions, governance reporting, and measurable service improvements. In the absence of clear processes and audit trails demonstrating how Locality Planning Group discussions are analysed, prioritised, escalated, and translated into measurable outcomes, there is a risk that stakeholder engagement activity does not consistently influence service planning, governance, or service improvement. Management will review arrangements for recording and monitoring Locality Planning Group discussions and outcomes to support more consistent documentation, escalation, and evidencing of actions arising from locality engagement activity. Associate Director, Public Heath, NHS Highland 31st December 2026 Page 35
Page 36
14 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL No Finding Risk Agreed Action Responsibility / Due Date Medium 4 Escalation and Tracking of Stakeholder Engagement Outcomes The HSCP should strengthen arrangements for evidencing and tracking how stakeholder engagement issues, feedback, and consultation outcomes are formally escalated through governance processes and translated into operational actions, strategic decisions, and measurable outcomes. In the absence of clear and auditable escalation and decision-tracking arrangements, there is a risk that stakeholder engagement activity does not consistently influence operational or strategic decision- making, reducing transparency, accountability, and assurance over the effectiveness of engagement arrangements. Management will review existing arrangements for evidencing and tracking stakeholder engagement outcomes to strengthen audit trails demonstrating how engagement feedback and consultation outcomes are escalated through governance arrangements and inform operational actions and strategic decision-making. Associate Director, Public Heath, NHS Highland Head of Strategic Planning, Performance and Technology Argyll and Bute HSCP 31st December 2026 Page 36
Page 37
15 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL No Finding Risk Agreed Action Responsibility / Due Date Low 5 Document Review Cycle The HSCP should establish and maintain a clearly documented and consistently applied review cycle covering the Engagement Framework, supporting operational guidance, engagement tools, and associated stakeholder engagement documentation to ensure arrangements remain current, aligned to national guidance, and subject to regular governance oversight. In the absence of a clearly documented and consistently applied review cycle for stakeholder engagement documentation, there is a risk that elements of the engagement framework, operational guidance, or supporting arrangements may not be reviewed systematically or updated in line with changes to national guidance, governance requirements, or operational practice. Management will establish a documented review schedule covering the Engagement Framework and associated stakeholder engagement documentation to support consistent review and alignment with national guidance and governance requirements. Associate Director, Public Heath, NHS Highland Head of Strategic Planning, Performance and Technology Argyll and Bute HSCP 31st December 2026 Page 37
Page 38
16 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the HSCP to achieve better value for money (VFM). Page 38
Page 39
17 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Stakeholder Engagement, July 2026 Classification: OFFICIAL Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues. Page 39
Page 40
This page is intentionally left blank
Page 41
1 Classification: OFFICIAL Audit and Risk Committee Date of Meeting: 22 September 2026 Title of Report: Risk Management Presented by: Paul Macaskill, Chief Internal Auditor The Committee is asked to: ▪ Review and endorse the Internal Audit report on Risk Management 1. EXECUTIVE SUMMARY 1.1 An audit report focused on Risk Management is being reported to the Audit and Risk Committee (the Committee). 1.2 Internal Audit provides a level of assurance upon completion of audit work. A definition for each assurance level is documented in each audit report. The table below provides a summary of the audit conclusions, and the full report is included as an appendix to this report. 2. RECOMMENDATIONS 2.1 The committee is asked to consider, discuss and approve the contents of the attached report. 3. DETAIL OF REPORT 3.1 The scope of the audit was to provide assurance that risk management procedures are robust and being complied with and supporting documents are up to date as outlined in the Terms of Reference agreed with the Business Improvement Manager on 18th June 2026. 3.2 Four control objectives were assessed during the audit, these were: No of Actions Audit Name Assurance High Medium Low VFM Risk Management Reasonable 1 0 1 0 Page 41 Agenda Item 6
Page 42
2 Classification: OFFICIAL Control Objective CO1 The HSCP has an up-to-date Risk Management Strategy, supporting procedures and governance arrangements which clearly define responsibilities for identifying, assessing, managing and reporting risks. CO2 Strategic risks are identified, assessed, owned and reviewed using a consistent methodology and are aligned to the HSCP's strategic objectives and priorities CO3 Strategic risks and associated mitigation actions are regularly monitored, reviewed and reported to management and governance bodies to support effective oversight and decision-making. C04 Appropriate arrangements are in place to support the development, implementation and maintenance of Operational Risk Registers across relevant services, including clear ownership, reporting arrangements and escalation routes to the Strategic Risk Register. 3.3 Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. The report highlights the following strengths and areas for improvement: Strengths • Argyll and Bute HSCP have an established and documented Risk Management Strategy that defines the framework for managing risk, including governance arrangements, roles and responsibilities, risk appetite and reporting requirements. • The Strategic Risk Register (SRR) is comprehensive and records strategic risks consistently, including risk descriptions, controls, mitigating actions, ownership, review dates and gross and residual risk scores. • The Strategic Risk Register is aligned to the Joint Strategic Plan, ensuring that strategic risks support the delivery of the HSCP's strategic priorities and objectives. • The Strategic Risk Register is subject to regular review by the Senior Leadership Team, Audit & Risk Committee and Integration Joint Board, providing appropriate governance, scrutiny and oversight of strategic risks. • The Audit & Risk Committee also considers external reports and publications, including Audit Scotland reports and the Global Risks Report, helping to ensure that strategic risks are considered within the wider external operating environment. Page 42
Page 43
3 Classification: OFFICIAL • The HSCP has developed a Risk Appetite Framework which supports consideration of risk tolerance when reviewing and managing strategic risks. Areas for Improvement • The HSCP should complete the development and implementation of the Operational Risk Register (ORR) framework, including documented governance, review, reporting and escalation arrangements across all relevant services. • The HSCP should formalise arrangements for monitoring and reporting progress in implementing Operational Risk Registers to provide assurance that they are being developed consistently and embedded across the organisation. • The HSCP should improve accessibility of key risk management documentation by making the Risk Management Strategy, guidance and supporting documents available through a central intranet location. 4. RELEVANT DATA AND INDICATORS – NONE 5. CONTRIBUTION TO STRATEGIC PRIORITIES 5.1 Internal audit reports include agreed actions to strengthen internal controls. 6. GOVERNANCE IMPLICATIONS 6.1 Financial Impact - None 6.2 Staff Governance - None 6.3 Clinical and Care Governance – None 7. PROFESSIONAL ADVISORY – NONE 8. EQUALITY & DIVERSITY IMPLICATIONS – NONE 9. GENERAL DATA PROTECTION PRINCIPLES COMPLIANCE 9.1 This report in itself does not raise any GDPR issues however consideration of GDPR will feature in audits where appropriate. Page 43
Page 44
4 Classification: OFFICIAL 10. RISK ASSESSMENT 10.1 The audit planning approach is a risk based one and individual audit reports provide an overall assessment on the management of risk. 11. PUBLIC & USER INVOLVEMENT & ENGAGEMENT – NONE 12. CONCLUSIONS 12.1 Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. 13. DIRECTIONS Directions required to Council, NHS Board or both. Directions to: tick No Directions required x Argyll & Bute Council NHS Highland Health Board Argyll & Bute Council and NHS Highland Health Board 14. PREVIOUS REVIEW OF THE REPORT Meeting Title of report Date Output (if relevant) n/a n/a n/a n/a REPORT AUTHOR AND CONTACT Author Name: Paul Macaskill Email: paul.macaskill@argyll-bute.gov.uk Page 44
Page 45
Classification: OFFICIAL Argyll & Bute Health & Social Care Partnership Internal Audit Report July 2026/27 Final High Medium Low VFM Number of Findings 1 0 1 0 Risk Management Audit Opinion: Reasonable Page 45
Page 46
2 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Risk Management, July 2026 Classification: OFFICIAL Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 3 Topical Requirements ............................................................................................................................ 3 Key Dates ................................................................................................................................................ 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 5 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ....................................................................................................................... 9 Appendix 2 – Audit Opinion ................................................................................................................. 11 Contact Details Internal Auditor: David Sullivan Telephone: 01546 604186 e-mail: David.sullivan@argyll-bute.gov.uk www.argyll-bute.gov.uk Page 46
Page 47
3 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Risk Management, July 2026 Classification: OFFICIAL 1. Executive Summary Introduction 1. As part of the 2026/27 internal audit plan, approved by the Audit & Risk Committee in February 2026, we have undertaken an audit of Argyll & Bute Health & Social Care Partnership (HSCP) system of internal control and governance in relation to Risk Management. 2. The audit was conducted in accordance with the Global Internal Audit Standards (GIAS) with our conclusions based on discussions with Health & Social Care Partnership officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the HSCP. 3. The contents of this report have been agreed with the appropriate Health & Social Care Partnership officers to confirm factual accuracy, and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. Risk management is a core component of effective governance within the Argyll and Bute Health and Social Care Partnership (HSCP). It ensures that risks to the delivery of strategic objectives are identified, assessed, managed and monitored appropriately. 5. The Integration Joint Board (IJB) is responsible for overseeing risk management arrangements supported by the Strategic and operational Risk Registers. Management have advised that work is currently underway to further develop and implement Operational Risk Registers (ORRs) across relevant services. This audit will therefore focus on strategic risk management arrangements and governance oversight whilst considering progress made in developing operational risk management arrangements. Scope 6. The scope of the audit was to provide assurance that risk management procedures are robust and being complied with and supporting documents are up to date as outlined in the Terms of Reference agreed with the Business Improvement Manager on 18th June 2026. Topical Requirements 7. Topical Requirements are a new, mandatory component of the updated International Professional Practices Framework for internal auditing, they must be followed when auditing subjects for which a Topical Requirement exists or when aspects of the Topical Requirement are identified within other audits. 8. The Cybersecurity Topical Requirement (issued February 2025) has been considered as part of this audit. While this audit is not specifically focused on cybersecurity, cyber risk forms part of the overall risk management framework and may be reflected within the Strategic Risk Register and operational risk registers. Page 47
Page 48
4 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Risk Management, July 2026 Classification: OFFICIAL 9. Accordingly, the audit will consider whether relevant risks, including cybersecurity where applicable, are appropriately captured, assessed and reported within the HSCP’s risk management arrangements. Key Dates 10. The Terms of Reference provided provisional timescales for the review to take place, the actual dates are noted below. Exhibit 1 – Key Dates Stage Actual Date Terms of Reference agreed 18th June 2026 Fieldwork Commencement 19th June 2026 Draft Report issued 2nd July 2026 Management Comments received 6th July 2026 Final Report issued 7Th July 2026 Audit and Scrutiny Committee 22nd September 2026 Risks 11. The risks considered throughout the audit were: • Audit Risk 1: Risk management arrangements, policies and supporting documentation are not maintained or kept up to date, resulting in inconsistent application of risk management processes • Audit Risk 2: Strategic risks are not identified, assessed or reviewed consistently, resulting in an incomplete understanding of risks that may affect delivery of the HSCP's strategic objectives. • Audit Risk 3: Strategic risks and mitigating actions are not effectively monitored, reported or challenged, limiting governance oversight and informed decision-making. • Audit Risk 4: Operational risk management arrangements are not fully developed or implemented across relevant services, resulting in service-level risks not being identified, monitored or escalated consistently. Audit Opinion 12. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 13. Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Page 48
Page 49
5 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Risk Management, July 2026 Classification: OFFICIAL Recommendations 14. We have highlighted one high priority recommendation and one low priority recommendation where we believe there is scope to strengthen the control and governance environment. These are summarised below: • Complete and implement the Operational Risk Register framework, including governance, reporting and escalation arrangements across all relevant services. • Improve accessibility of key risk management documentation through a central intranet location. 15. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 16. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 2 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 The HSCP has an up- to-date Risk Management Strategy, supporting procedures and governance arrangements which clearly define responsibilities for identifying, assessing, managing and reporting risks. Audit risk 1 High The HSCP has an effective and up-to- date Risk Management Strategy supported by clearly defined governance arrangements, roles and responsibilities. Audit testing confirmed that the framework is operating effectively and supports appropriate governance and oversight of risk. However, key risk management documentation is not currently available through a central intranet location, reducing accessibility for staff. 2 Strategic risks are identified, assessed, owned and reviewed using a consistent methodology and are aligned to the HSCP's strategic objectives and priorities Audit risk 2 High Audit testing confirmed that strategic risks are identified, assessed and managed using a consistent methodology, with clear ownership, mitigating actions and regular review. The Strategic Risk Register is aligned to the Joint Strategic Plan and supports effective oversight of the HSCP's strategic priorities. 3 Strategic risks and associated mitigation actions are regularly monitored, reviewed and reported to Audit Risk 3 High Audit testing confirmed that strategic risks and associated mitigating actions are subject to regular review through established governance arrangements. The Strategic Risk Register is monitored and reported to the Audit & Risk Committee and the Integration Joint Page 49
Page 50
6 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Risk Management, July 2026 Classification: OFFICIAL management and governance bodies to support effective oversight and decision-making. Board, providing effective oversight of the HSCP's strategic risk profile and supporting informed decision-making. 4 Appropriate arrangements are in place to support the development, implementation and maintenance of Operational Risk Registers across relevant services, including clear ownership, reporting arrangements and escalation routes to the Strategic Risk Register. Audit Risk 4 Limited HSCP has commenced the development of Operational Risk Registers and has established initial arrangements to support their implementation. However, the framework has not yet been fully implemented or supported by documented governance, reporting and escalation arrangements. In addition, ORR’S for relevant services have yet to be completed. It is therefore important that this process relating to ORRs are progressed and implemented as soon as practicably possible. 17. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings The HSCP has an up-to-date Risk Management Strategy, supporting procedures and governance arrangements which clearly define responsibilities for identifying, assessing, managing and reporting risks 18. Audit testing confirmed that the HSCP has an approved and up-to-date Risk Management Strategy in place which provides an appropriate framework for the management of risk across the organisation. The Strategy clearly defines the purpose of risk management, governance arrangements, roles and responsibilities, risk escalation procedures and reporting requirements. 19. The Strategy establishes the respective responsibilities of the Integration Joint Board (IJB), Audit & Risk Committee, Strategic Leadership Team and risk owners, and requires the Strategic Risk Register to be reviewed on a six-monthly basis. Review of the Strategic Risk Register Review reports confirmed that these arrangements are operating in practice, with the Strategic Risk Register being reviewed through the Audit & Risk Committee prior to consideration by the IJB. 20. Roles and responsibilities for risk management are clearly defined within the Strategy. Responsibilities are assigned to the IJB, Audit & Risk Committee, Chief Officer, Strategic Leadership Team, risk owners and other officers involved in the management and reporting of risk. In addition, the Strategic Risk Register assigns ownership for individual strategic risks, providing clear accountability for monitoring risks and implementing mitigating actions. Page 50
Page 51
7 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Risk Management, July 2026 Classification: OFFICIAL 21. The audit confirmed that risk management arrangements support delivery of the HSCP's strategic objectives. Strategic risks have been mapped to the Joint Strategic Plan priorities, providing a clear link between organisational objectives and the Strategic Risk Register. Review of governance reports also confirmed that the Risk Management Strategy is operating in practice through the regular review and reporting of strategic risks to the Audit & Risk Committee and the IJB. 22. Key documentation exists and is available to relevant officers, however it is not currently available through a central intranet location. Improving accessibility would further support staff awareness and consistent application of the HSCP's risk management arrangements across the organisation. Action Plan 2 Strategic risks are identified, assessed, owned and reviewed using a consistent methodology and are aligned to the HSCP's strategic objectives and priorities 23. Audit testing confirmed that the HSCP has established a comprehensive Strategic Risk Register (SRR) which provides a structured approach to identifying, assessing and monitoring risks that may impact delivery of the Joint Strategic Plan. The register is maintained using a consistent methodology and records risk descriptions, existing controls, mitigating actions, assigned risk ownership, review information and risk scores. 24. Review of the Strategic Risk Register confirmed that strategic risks appropriately reflect the main challenges facing the HSCP, including financial sustainability, workforce recruitment and retention, sustainability of commissioned providers, infrastructure and organisational transformation. The register also demonstrates that mitigating actions have been identified and documented for each strategic risk and that clear ownership has been assigned for monitoring and managing identified risks. 25. Audit testing also confirmed that strategic risks have been mapped to the HSCP's strategic objectives and Joint Strategic Plan priorities, providing a clear link between organisational objectives and strategic risk management. This supports management and governance bodies in identifying and monitoring risks which may impact delivery of the HSCP's strategic priorities. 26. The audit further confirmed that the HSCP has established a Risk Appetite Framework covering the principal categories of organisational risk. The framework has been considered through established governance arrangements and forms part of the overall risk management framework, providing management and governance bodies with a structured basis for considering risk when making strategic decisions. Strategic risks and associated mitigation actions are regularly monitored, reviewed and reported to management and governance bodies to support effective oversight and decision-making. 27. Audit testing confirmed that robust governance arrangements are in place to oversee the management and reporting of strategic risks. The Risk Management Strategy requires the Strategic Risk Register (SRR) to be reviewed on a six-monthly basis and audit testing confirmed that these review arrangements are operating in practice. 28. Review of Strategic Risk Register Review reports and supporting committee papers confirmed that the Audit & Risk Committee undertakes formal review of the Strategic Risk Register prior to Page 51
Page 52
8 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Risk Management, July 2026 Classification: OFFICIAL reporting to the IJB. This provides an appropriate governance framework for the scrutiny and oversight of strategic risks and ensures that significant risks are regularly considered by senior management and governance bodies. 29. The Audit & Risk Committee also considers a range of external reports and publications, including Audit Scotland reports and the Global Risks Report, to ensure that the HSCP's Strategic Risk Register is considered within the wider external operating environment. 30. The audit also confirmed that changes in strategic risk ratings are monitored through the SRR review process. Strategic Risk Register Review reports provide governance bodies with information on risk movements and the reasons for significant changes, supporting effective oversight of the HSCP's strategic risk profile. 31. Review of the SRR further confirmed that Very High strategic risks are clearly identified and subject to regular oversight through established governance arrangements. This provides assurance that the HSCP's most significant strategic risks receive appropriate management attention and governance oversight. Appropriate arrangements are in place to support the development, implementation and maintenance of Operational Risk Registers across relevant services, including clear ownership, reporting arrangements and escalation routes to the Strategic Risk Register. 32. Audit testing confirmed that the HSCP has recognised the need to develop Operational Risk Registers (ORRs) and management advised that work is currently underway to establish operational risk management arrangements across relevant services. Responsibility for progressing this work has been assigned to the Business Improvement Manager and a standard template for ORRs has been developed; however, supporting governance documentation has yet to be finalised. 33. At the time of audit, ORRs had not yet been fully populated and implemented, and Internal audit was unable to obtain evidence of a documented framework describing the proposed implementation approach, governance arrangements, implementation plans or progress reporting. In addition, formal arrangements defining how operational risks will be reviewed, monitored and escalated to the SRR had not yet been established. Action Plan 1 34. Whilst the SRR and associated governance arrangements are well developed and provide strong assurance over the management of strategic risks, the absence of a fully documented and implemented ORR framework limits assurance that operational risks will be identified, assessed, monitored and escalated consistently across all relevant HSCP services. 35. The audit therefore concluded that further work is required to complete the development and implementation of the ORR framework, including documenting governance arrangements, implementation plans, review processes, reporting arrangements and escalation criteria. Completion of this work will provide greater assurance that operational risks are managed consistently and that significant operational risks are appropriately escalated to the SRR where necessary. Action Plan 1 Page 52
Page 53
Classification: OFFICIAL Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date High 1 Operational Risk Registers Operational Risk Registers have not yet been fully implemented and there is no documented implementation framework covering governance, review arrangements, reporting or escalation. Operational risks may not be identified, assessed and escalated consistently across services. HSCP will complete the development and implementation of Operational Risk Registers across all relevant services, including documented governance arrangements, reporting processes and escalation criteria. Business Improvement Manager 31st December 2026 Low 2 Risk Management documentation Risk Management documentation is not available through a central intranet location. Staff may not always access the most current Risk Management documentation, reducing awareness and consistency. HSCP will consider publishing key risk management documentation through a central intranet location to improve staff accessibility and awareness. Business Improvement Manager 31st December 2026 Page 53
Page 54
10 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Risk Management, July 2026 Classification: OFFICIAL In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the HSCP to achieve better value for money (VFM). Page 54
Page 55
11 Argyll & Bute Health & Social Care Partnership – Internal Audit Report – Risk Management, July 2026 Classification: OFFICIAL Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues. Page 55
Page 56
This page is intentionally left blank
Page 57
1 Audit & Risk Committee Date of Meeting: 22 September 2026 Title of Report: External Audit Correspondence and Assurance Presented by: James Gow, Head of Finance The Audit & Risk Committee is asked to: • Note the correspondence to the Audit & Risk Committee from Mazars (appendix 1). • Review and approve the draft response (appendix 2). • Note the correspondence from Mazars addressed to the CFO and response (appendix 3 and 4). 1. EXECUTIVE SUMMARY The External Auditor has requested specific assurances from members of the Audit and Risk Committee (those charged with governance) and management regarding the audit of the IJB for financial year 2025/26. The appendices provide the request from the external auditor and a draft response from the Chair of the Audit Committee. 2. RECOMMENDATION 2.1 The Audit & Risk Committee is recommended to: • Note the correspondence to the Audit & Risk Committee from Mazars (appendix 1). • Review and approve the draft response (appendix 2). • Note the correspondence from Mazars addressed to the CFO and response (appendix 3 and 4). 3. DETAIL OF REPORT 3.1 Mazars have written to the Audit and Risk Committee and the Chief Finance Officer requesting specific assurances relating to the audit of the 2025/26 annual accounts of the IJB. 3.2 Appendix 1 provides the correspondence addressed to Audit Committee members, this outlines the reasons for the request. Appendix 2 provides a draft response. 3.3 The correspondence to the Chief Finance Officer and response are also attached as appendices to provide the committee with assurance that management are providing the auditor with similar assurances. 3.4 The Committee are requested to review and approve appendix 2 as a formal response to Mazars (subject to any requested amendments). Members should Page 57 Agenda Item 7
Page 58
2 note that a further detail is available to the audit team in the accounts, in the annual report of the Audit & Risk Committee and in all the agenda items considered by the Committee through the year. 4. RELEVANT DATA AND INDICATORS 4.1 Responses are based upon a wide range of governance and financial governance documents of the HSCP/IJB and both partners. 5 CONTRIBUTION TO STRATEGIC PRIORITIES 5.1 The maintenance of good governance processes is of strategic importance to the IJB. 6. GOVERNANCE IMPLICATIONS 6.1 Financial Impact – no direct impacts, however reference to financial sustainability and going concern status is included in the correspondence. 6.2 Staff Governance – no direct impacts. 6.3 Clinical Governance – no direct impacts. 7. Professional Advisory 7.1 Not applicable. 8. EQUALITY & DIVERSITY IMPLICATIONS 8.1 No direct impacts. 9. GENERAL DATA PROTECTION PRINCIPLES COMPLIANCE 9.1 None. 10. RISK ASSESSMENT 10.1 This report and associated correspondence provides assurance to the external auditor as part of the annual accounts audit process. It reduces the risk of mis- statement within the accounts. 11. PUBLIC & USER INVOLVEMENT & ENGAGEMENT 11.1 The 2025-26 audited annual accounts and external audit report will be publicly available. 12. CONCLUSIONS 12.1 The Audit & Risk Committee are requested to review the response to the external auditor to help facilitate the conclusion of the audit of the accounts for the year ended 31 March 2026. Page 58
Page 59
3 13. DIRECTIONS Directions required to Council, NHS Board or both. Directions to: tick No Directions required √ Argyll & Bute Council NHS Highland Health Board Argyll & Bute Council and NHS Highland Health Board 14. PREVIOUS REVIEW OF THE REPORT Meeting Title of report Date Output (if relevant) N/A AUTHOR NAME: James Gow, Head of Finance EMAIL: james.gow@argyll-bute.gov.uk Appendix 1 - Correspondence from Mazars to the Audit & Risk Committee Appendix 2 - Draft response from the Chair of the Audit & Risk Committee Appendix 3 - Correspondence from Mazars to the CFO Appendix 4 - Response from the CFO Page 59
Page 60
This page is intentionally left blank
Page 61
The Corner Bank Chambers 26 Mosley Street Newcastle Upon Tyne NE1 1DF Tel: +44 (0) 191 383 6300 forvismazars.com/uk Private & Confidential Audit and Risk Committee Kilmory Lochgilphead Argyll PA31 8RT Direct line: +44 (0)191 383 6339 Email: mark.outterside@mazars.co.uk Date: 30 July 2026 Dear Audit and Risk Committee Members, Argyll and Bute Integration Joint Board (the IJB) – 2025/26: Audit and Risk Committee briefing note – ISA 240 (Fraud), ISA 250 (laws and regulations), ISA 501 (litigation and claims) & ISA 570 (going concern) Introduction This letter aims to summarise for the Audit and Risk Committee (the Committee) the requirements under International Auditing Standards, in respect of preventing fraud in the annual accounts, compliance with laws and regulations, litigation and claims, and going concern. This letter requests an update from the Committee in order to inform our continuous audit planning as we move into the final stage of our audit of the IJB’s 2025/26 accounts. International Standard for Auditing 240 - The auditor’s responsibility to consider fraud in an audit of financial statements Background Under the ISA, the primary responsibility for preventing and detecting fraud rests with both management and ‘those charged with governance’, which for the IJB is the Audit and Risk Committee. This includes fraud that could impact on the accuracy of the annual accounts. The ISA requires us, as external auditors, to obtain an understanding of how the Committee exercises oversight of management’s processes for identifying and responding to the risks of fraud and the internal controls established to mitigate them. What is ‘fraud’ in the context of the ISA? The ISA views fraud as either: • the intentional misappropriation of the IJB’s assets (cash, property, etc); or • the intentional manipulation or misstatement of the financial statements. Page 61
Page 62
2 What are auditors required to do? We have to obtain evidence of how management and those charged with governance are discharging their responsibilities, if we are to properly discharge our responsibilities under ISA 240. We are therefore making requests from the Committee and management on the following, or similar, issues: 1) How does the Committee, in its role as those charged with governance, exercise oversight of management's processes in relation to: • Undertaking an assessment of the risk that the financial statements may be materially misstated due to fraud or error (including the nature, extent and frequency of these assessments); • Identifying and responding to risks of fraud in the organisation, including any specific risks of fraud which management have identified or that have been brought to its attention, or classes of transactions, account balances, or disclosure for which a risk of fraud is likely to exist; • Communicating to employees of views on business practice and ethical behaviour (for example by updating, communicating and monitoring against the organisation’s code of conduct); and • Communicating to those charged with governance the processes for identifying and responding to fraud or error? 2) How does the Committee oversee management processes to identify and respond to the risk of fraud and possible breaches of internal control? Is the Committee aware of any breaches of internal control during 2025/26? Please provide details. 3) Has the Committee knowledge of any actual, suspected or alleged fraud during the period 1 April 2025 – 31 March 2026? Where appropriate please provide details. 4) Has the Committee any suspicion that fraud may be occurring within the organisation? Please provide details. • Has the Committee identified any specific fraud risks within the organisation? Please provide details. • Does the Committee have any concerns that there are areas within the organisation that are at risk of fraud? Please provide details. • Are there particular locations within the organisation where fraud is more likely to occur? Please provide details. 5) Is the Committee satisfied that internal controls, including segregation of duties, exist and work effectively? Please provide details. • If not, where are the risk areas? Page 62
Page 63
3 • What other controls are in place to help prevent, deter or detect fraud? 6) Is the Committee satisfied that staff are encouraged to report their concerns about fraud, and the types of concerns they are expected to report? Please provide details. 7) From a fraud and corruption perspective, what are considered by the Committee to be high risk posts within the organisation? Please provide details. • How are the risks relating to these posts identified, assessed and managed? 8) Is the Committee aware of any related party relationships or transactions that could give rise to instances of fraud? Please provide details. • How are the risks associated with fraud related to such relationships and transactions mitigated? 9) Is the Committee aware of any entries made in the accounting records of the organisation that it believes, or suspects are false or intentionally misleading? Please provide details. • Are there particular balances where fraud is more likely to occur? Please provide details. • Is the Committee aware of any assets, liabilities or transactions that it believes were improperly included or omitted from the accounts of the organisation? Please provide details. • Could a false accounting entry escape detection? If so, how? • Are there any external fraud risk factors which are high risk of fraud? Please provide details. 10) Is the Committee aware of any organisational, or management pressure to meet financial or operating targets? Please provide details. • Is the Committee aware of any inappropriate organisational or management pressure being applied, or incentives offered, to you or colleagues to meet financial or operating targets? Please provide details. International Standard for Auditing 250 – Consideration of laws and regulations in an audit of financial statements Background Under the ISA, in the UK and Ireland, the primary responsibility for ensuring that the entity's operations are conducted in accordance with laws and regulations and the responsibility for the prevention and detection of non-compliance rests with management Page 63
Page 64
4 and ‘those charged with governance’, which for the IJB is the Audit and Risk Committee. The ISA requires us, as external auditors, to obtain an understanding of how the IJB gains assurance that all relevant laws and regulations have been complied with. What are auditors required to do? We have to obtain evidence of how management and those charged with governance are discharging their responsibilities, if we are to properly discharge our responsibilities under ISA 250. We are therefore making requests from the Committee, and will be making similar enquiries of management: 11) How does the Committee gain assurance that all relevant laws and regulations have been complied with. For example: • Is the Committee aware of the process management has in place for identifying and responding to changes in laws and regulations? Please provide details. • What arrangements are in place for the Committee to oversee this process? • Is the Committee aware of the arrangements management have in place, for communicating with employees, non-executive directors, partners and stakeholders regarding the relevant laws and regulations that need to be followed? Please provide details. • Does the Committee have knowledge of actual or suspected instances where appropriate laws and regulations have not been complied with, and if so is it aware of what actions management is taking to address it? Please provide details. International Standard for Auditing 501 – Specific consideration of the potential for, and actual, litigation and claims affecting the financial statements Background This ISA deals with specific considerations by the auditor in obtaining sufficient appropriate audit evidence, in this instance with respect to the completeness of litigation and claims involving the entity. The ISA requires us, as external auditors, to design and perform audit procedures in order to identify litigation and claims involving the entity which may give rise to a risk of material misstatement. What are auditors required to do? We have to obtain evidence of how management and those charged with governance are discharging their responsibilities, if we are to properly discharge our responsibilities under ISA 501. We are therefore making requests from the Committee, and will be making similar enquiries of management: 12) Is the Committee aware of any actual or potential litigation or claims that would affect the financial statements? Please provide details. Page 64
Page 65
5 International Standard for Auditing 570 – Consideration of the going concern assumption in an audit of financial statements Background Financial statements are generally prepared on the basis of the going concern assumption. Under the going concern assumption, an audited body is ordinarily viewed as continuing in operation for the foreseeable future. Accordingly, assets and liabilities are recorded in financial statements on the basis that the audited body will be able to realise its assets and discharge its liabilities in the normal course of its operations. What are auditors required to do? If used, we are required to consider the appropriateness of management’s use of the going concern assumption in the preparation of the financial statements if we are to properly discharge our responsibilities under ISA 570. We are therefore making the following request from the Committee: 13) How has the Committee assessed and satisfied itself that it is appropriate to adopt the going concern basis in preparing the financial statements? 14) Has the Committee identified any events or conditions since the assessment was undertaken which may cast significant doubt on the organisation’s ability to continue as a going concern? Please provide details. The way forward The information you provide will help inform our understanding of the IJB and its business processes, prior to the start of the final stage of the audit of the 2025/26 financial statements. I would be grateful for your responses, which should be formally considered and communicated to us on the Committee’s behalf to cover the year to 31 March 2026, by 31 August 2026. In the meantime, if you have any queries, please do not hesitate to contact me. Yours sincerely, Mark Outterside Director Forvis Mazars LLP Page 65
Page 66
This page is intentionally left blank
Page 67
Classification: OFFICIAL Date: Your Ref: Our Ref: Enquiries to: Direct Line: Email Kilmory Lochgilphead Argyll PA31 8RT 22 September 2026 Kieron Green kieron.green@argyll- bute.gov.uk Dear Mark, Audit of Argyll and Bute Integration Joint Board’s (IJB’s) Financial Statements for the year ending 31 March 2026 Thank you for your letter in respect of the above addressed to the Audit & Risk Committee. I would refer you to the governance statements in the Annual Accounts, the Committee’s Annual Report and provide some additional information in response to each of your points on behalf of the Audit & Risk Committee in italics below: 1) How does the Committee, in its role as those charged with governance, exercise oversight of management's processes in relation to: • undertaking an assessment of the risk that the financial statements may be materially misstated due to fraud or error (including the nature, extent and frequency of these assessments); • identifying and responding to risks of fraud in the organisation, including any specific risks of fraud which management have identified or that have been brought to its attention, or classes of transactions, account balances, or disclosure for which a risk of fraud is likely to exist; • communicating to employees of views on business practice and ethical behaviour (for example by updating, communicating and monitoring against the organisation’s code of conduct); and • communicating to those charged with governance the processes for identifying and responding to fraud or error? The Committee ensures that the IJB has an appropriately qualified and experienced Chief Finance Officer in place. It also ensures that there are appropriate financial regulations in place and an effective Internal Audit Service. The Committee reviews the strategic risk register, oversees the internal audit plan and reviews all audit reports. Its minutes are considered in detail by the full IJB at each meeting. It also receives regular reports published by Audit Scotland and these include reports on fraud, public sector accounting and financial management issues. The Committee reviews all internal and external audit reports in detail and tracks the progress made by management in addressing recommendations made by the auditors. The Committee is not currently aware of any actual examples of fraud or error. Both internal and Page 67
Page 68
Classification: OFFICIAL external audit are invited to attend all meetings of the Audit and Risk Committee and from financial year 2026/27 these meetings will be held in public. The committee also provides an annual report on its activities to the IJB, this report summarises the work of the committee during the year and provides an evaluation of performance and assurance. 2) How does the Committee oversee management processes to identify and respond to the risk of fraud and possible breaches of internal control? Is the Committee aware of any breaches of internal control during 2025/26? Please provide details. The Committee is informed of all Internal Audit work as part of the approved internal audit plan, any additional work that is requested of the Internal Audit Team and without exception, all the findings are considered by the Committee in order to provide assurance where applicable. All issues relating to control weaknesses and/or fraud are contained within the audit reports and these actions are monitored on a quarterly basis by the Committee to ensure that appropriate progress is being made in relation to the implementation. The Committee receives periodic updates from management on strategic and operational risk, mitigations and also through other oversight reports which provide financial and governance reporting throughout the year. Members of the Committee are also members of the IJB and therefore gain assurance from multiple sources from participating fully in the governance processes. Please see above, the Committee is not aware of any breaches of internal control during 2025/26. 3) Has the Committee knowledge of any actual, suspected or alleged fraud during the period 1 April 2025 – 31 March 2026? Where appropriate please provide details. No. 4) Has the Committee any suspicion that fraud may be occurring within the organisation? Please provide details. • Has the Committee identified any specific fraud risks within the organisation? Please provide details. • Does the Committee have any concerns that there are areas within the organisation that are at risk of fraud? Please provide details. • Are there particular locations within the organisation where fraud is more likely to occur? Please provide details. The Committee is not aware of any fraud within the organisation. It places reliance on the work of internal audit to identify areas where the risk is highest and audit time is allocated to these areas. The management of client funds and the recent internal audit review of payroll processes within the care at home services and an additional review of Direct Payments provide recent examples of high risk areas considered in detail by the Committee. The audit plan is risk based and is designed to ensure appropriate coverage of areas of the highest risk. 5) Is the Committee satisfied that internal controls, including segregation of duties, exist and work effectively? Please provide details. • If not, where are the risk areas? • What other controls are in place to help prevent, deter or detect fraud? Page 68
Page 69
Classification: OFFICIAL Yes, the committee is satisfied that internal controls are in place and are working effectively. Where recommendations for improvement have been made the committee tracks progress in implementing these. It places reliance on the systems and processes of the HSCP and both partners as well as upon the work of the internal audit and the role of the Chief Finance Officer and the Senior leadership Team. 6) Is the Committee satisfied that staff are encouraged to report their concerns about fraud, and the types of concerns they are expected to report? Please provide details. The Committee is aware that financial regulations are in place and that these are communicated to staff as appropriate. The HSCP and its partners have a range of processes and procedures in place that encourage and enable staff to report concerns and for these to be investigated. 7) From a fraud and corruption perspective, what are considered by the Committee to be high risk posts within the organisation? Please provide details. • How are the risks relating to these posts identified, assessed and managed? Management, finance, payroll, procurement and posts which have responsibility for managing client funds are regarded as higher risk. Robust recruitment processes, detailed procedures and the focus of internal audit time in these areas are the main ways in which this risk is managed. 8) Is the Committee aware of any related party relationships or transactions that could give rise to instances of fraud? Please provide details. • How are the risks associated with fraud related to such relationships and transactions mitigated? No, the committee is not aware of any relationships or transactions that could give rise to instances of fraud – the HSCP maintains a register of interest for board members and senior staff. 9) Is the Committee aware of any entries made in the accounting records of the organisation that it believes or suspects are false or intentionally misleading? Please provide details. • Are there particular balances where fraud is more likely to occur? Please provide details. • Is the Committee aware of any assets, liabilities or transactions that it believes were improperly included or omitted from the accounts of the organisation? Please provide details. • Could a false accounting entry escape detection? If so, how? • Are there any external fraud risk factors which are high risk of fraud? Please provide details. The Committee is not aware of any accounting entries which it suspects are false or intentionally misleading. The Committee provides oversight in respect of finance and accounting processes and places reliance on the Chief Financial Officer, audit processes and the arrangements in place within both partners. It does not have operational responsibility for accounting entries. 10) Is the Committee aware of any organisational, or management pressure to meet financial or operating targets? Please provide details. • Is the Committee aware of any inappropriate organisational or management pressure being applied, Page 69
Page 70
Classification: OFFICIAL or incentives offered, to you or colleagues to meet financial or operating targets? Please provide details. International Standard for Auditing 250 – Consideration of laws and regulations in an audit of financial statements Background Under the ISA, in the UK and Ireland, the primary responsibility for ensuring that the entity's operations are conducted in accordance with laws and regulations and the responsibility for the prevention and detection of non-compliance rests with management and ‘those charged with governance’, which for the IJB is the Audit and Risk Committee. The ISA requires us, as external auditors, to obtain an understanding of how the Committee gains assurance that all relevant laws and regulations have been complied with. What are auditors required to do? We have to obtain evidence of how management and those charged with governance are discharging their responsibilities, if we are to properly discharge our responsibilities under ISA250. We are therefore making requests from the Committee, and will be making similar enquiries of management: The HSCP is expected to operate within the budget allocated by NHS Highland and Argyll and Bute Council. Operating performance is measured and subject to analysis at a local and national level to ensure that relevant policies and commitments are fulfilled. This does not involve inappropriate pressure or incentives being offered to anyone working within, or involved in the governance of the HSCP. The Committee is not aware of any failure to comply with laws and regulations. The Committee receives assurance on this from management and Audit and Risk Committee members participation in the wider operation of the HSCP / IJB. Committee members are also on the board of NHS Highland and are Councillors thereby gaining an opportunity to consider NHSH and Council reports on the performance of the HSCP independently of HSCP management. 11) How does the Committee gain assurance that all relevant laws and regulations have been complied with. For example: • Is the Committee aware of the process management has in place for identifying and responding to changes in laws and regulations? Please provide details. • What arrangements are in place for the Committee to oversee this process? • Is the Committee aware of the arrangements management have in place, for communicating with employees, non-executive directors, partners and stakeholders regarding the relevant laws and regulations that need to be followed? Please provide details. • Does the Committee have knowledge of actual or suspected instances where appropriate laws and regulations have not been complied with, and if so is it aware of what actions management is taking to address it? Please provide details. International Standard for Auditing 501 – Specific consideration of the potential for, and actual, litigation and claims affecting the financial statements Background This ISA deals with specific considerations by the auditor in obtaining sufficient appropriate audit evidence, in this instance with respect to the completeness of litigation and claims involving the entity. The ISA requires us, as external auditors, to design and perform audit procedures in order to identify litigation and claims Page 70
Page 71
Classification: OFFICIAL involving the entity which may give rise to a risk of material misstatement. What are auditors required to do? We have to obtain evidence of how management and those charged with governance are discharging their responsibilities, if we are to properly discharge our responsibilities under ISA501. We are therefore making requests from the Committee, and will be making similar enquiries of management: As above, the Committee is not aware of any instances where the HSCP / IJB has failed to comply with legislation or regulations. The Committee places reliance on the management team, audit and independent regulatory inspection processes. It also places reliance on the governance processes within both partners in discharging its duties in respect of the above points. 12) Is the Committee aware of any actual or potential litigation or claims that would affect the financial statements? Please provide details. The Committee is not aware of any actual or potential litigation or claims that would affect the financial statements. International Standard for Auditing 570 – Consideration of the going concern assumption in an audit of financial statements Background Financial statements are generally prepared on the basis of the going concern assumption. Under the going concern assumption, an audited body is ordinarily viewed as continuing in operation for the foreseeable future. Accordingly, assets and liabilities are recorded in financial statements on the basis that the audited body will be able to realise its assets and discharge its liabilities in the normal course of its operations. What are auditors required to do? If used, we are required to consider the appropriateness of management’s use of the going concern assumption in the preparation of the financial statements if we are to properly discharge our responsibilities under ISA570. We are therefore making the following request from the Committee: 13) How has the Committee assessed and satisfied itself that it is appropriate to adopt the going concern basis in preparing the financial statements? 14) Has the Committee identified any events or conditions since the assessment was undertaken which may cast significant doubt on the organisation’s ability to continue as a going concern? Please provide details The HSCP seeks to operate on a financially sustainable basis, its budget is confirmed by both partners each year. It has operated within the resources allocated to it for the past five years and has generated a small general reserve. There are no events that cast doubt on the organisations ability to continue as a going concern in the next year. There is a sector wide financial sustainability issue (reported recently by Audit Scotland) and the HSCP, in line with the rest of the sector, is concerned about the level of future resourcing and has identified a significant potential budget gap for 2027/28 and beyond. Management and the IJB are currently working on options for addressing this as outlined in the papers that are considered by the IJB and Finance and Policy Committee. The scale of the challenge, however, is severe and the committee is Page 71
Page 72
Classification: OFFICIAL concerned that actions that may be required to address the budget gap will impact adversely on the ability of the IJB to deliver on its strategic objectives. I hope that these assurances, along with the external audit work conducted provides sufficient assurance in respect of these matters. Yours sincerely Cllr Kieron Green Chair – Audit & Risk Committee Page 72
Page 73
The Corner Bank Chambers 26 Mosley Street Newcastle Upon Tyne NE1 1DF Tel: +44 (0)191 383 6300 forvismazars.com/uk Private & Confidential James Gow Direct line: +44 (0)191 383 6339 Chief Financial Officer Email: mark.outterside@mazars.co.uk Kilmory Lochgilphead Argyll PA31 8RT Date: 30 July 2026 Dear James, Audit of Argyll and Bute Integration Joint Board’s Financial Statements for the year ended 31 March 2026 Auditing standards require us to obtain an understanding of Argyll and Bute Integration Joint Board’s (the IJB’s) management processes and arrangements. This enables us to deliver an efficient audit, reducing the time which finance staff need to spend responding to auditor queries. Auditing standards require us to formally update our understanding annually. I am writing to ask that you please provide a response to the following questions, in respect of preventing fraud in the annual accounts, compliance with laws and regulations, litigation and claims, and going concern. A similar request has been made to the Audit and Risk Committee. International Standard for Auditing 240 - The auditor’s responsibility to consider fraud in an audit of financial statements We have to obtain evidence of how management are discharging their responsibilities, if we are to properly discharge our responsibilities under ISA 240. We are therefore making requests to you, on behalf of management, on the following issues: 1) What are management’s processes in relation to: • Undertaking an assessment of the risk that the financial statements may be materially misstated due to fraud or error (including the nature, extent and frequency of these assessments); • Identifying and responding to risks of fraud in the organisation, including any specific risks of fraud which management have identified or that have been brought to its attention, or classes of transactions, account balances, or disclosure for which a risk of fraud is likely to exist; • Communicating to employees’ views on business practice and ethical behaviour (for example by updating, communicating and monitoring against the organisation’s code of conduct); and • Communicating to those charged with governance the processes for identifying and responding to fraud or error? Page 73
Page 74
2 2) What is management’s processes to identify and respond to the risk of fraud and possible breaches of internal control? Is management aware of any breaches of internal control during 2025/26? Please provide details. 3) Do you have knowledge of any actual, suspected or alleged fraud during the period 1 April 2025 to 31 March 2026? Where appropriate please provide details. 4) Do you have any suspicion that fraud may be occurring within the organisation? Please provide details. • Has management identified any specific fraud risks within the organisation? Please provide details. • Does management have any concerns that there are areas within the organisation that are at risk of fraud? Please provide details. • Are there particular locations within the organisation where fraud is more likely to occur? Please provide details. 5) Are you satisfied that internal controls, including segregation of duties, exist and work effectively? Please provide details. • If not, where are the risk areas? • What other controls are in place to help prevent, deter or detect fraud? 6) How are staff encouraged to report their concerns about fraud, and what are the types of concerns they are expected to report? Please provide details. 7) From a fraud and corruption perspective, what do you consider to be high risk posts within the organisation? Please provide details. • How are the risks relating to these posts identified, assessed and managed? 8) Are you aware of any related party relationships or transactions that could give rise to instances of fraud? Please provide details. • How are the risks associated with fraud related to such relationships and transactions mitigated? 9) Are you aware of any entries made in the accounting records of the organisation that it believes, or suspects are false or intentionally misleading? Please provide details. • Are there particular balances where fraud is more likely to occur? Please provide details. • Are there any assets, liabilities or transactions that it believes were improperly included or omitted from the accounts of the organisation? Please provide details. Page 74
Page 75
3 • Could a false accounting entry escape detection? If so, how? • Are there any external fraud risk factors which are high risk of fraud? Please provide details. 10) Are you aware of any organisational, or management pressure to meet financial or operating targets? Please provide details. • Are you aware of any inappropriate organisational or management pressure being applied, or incentives offered, to you or colleagues to meet financial or operating targets? Please provide details. International Standard for Auditing 250 – Consideration of laws and regulations in an audit of financial statements We have to obtain evidence of how management are discharging their responsibilities if we are to properly discharge our responsibilities under ISA 250. We are therefore making requests to you, on behalf of management, on the following issues: 11) How does management gain assurance that all relevant laws and regulations have been complied with. For example: • What process is in place for identifying and responding to changes in laws and regulations? Please provide details. • What arrangements are in place for the Audit and Risk Committee to oversee this process? • What arrangements are in place for communicating with employees, non-executive directors, partners and stakeholders regarding the relevant laws and regulations that need to be followed? Please provide details. • Do you have knowledge of actual or suspected instances where appropriate laws and regulations have not been complied with, and if so, what actions management is taking to address it? Please provide details. International Standard for Auditing 501 – Specific consideration of the potential for, and actual, litigation and claims affecting the financial statements We have to obtain evidence of how management and those charged with governance are discharging their responsibilities if we are to properly discharge our responsibilities under ISA 501. We are therefore making requests to you, on behalf of management, on the following issues: 12) Are you aware of any actual or potential litigation or claims that would affect the financial statements? Please provide details. Page 75
Page 76
4 International Standard for Auditing 570 – Consideration of the going concern assumption in an audit of financial statements We are required to consider the appropriateness of management’s use of the going concern assumption in the preparation of the financial statements if we are to properly discharge our responsibilities under ISA 570. We are therefore making requests to you, on behalf of management, on the following issues: 13) How has management assessed and satisfied itself that it is appropriate to adopt the going concern basis in preparing the financial statements? 14) Has management identified any events or conditions since the assessment was undertaken which may cast significant doubt on the organisation’s ability to continue as a going concern? Please provide details. The way forward The information you provide will help inform our understanding of the IJB and its business processes, prior to the start of the final stage of the audit of the 2025/26 financial statements. I would be grateful for your responses, which should be formally considered and communicated to us on the management’s behalf to cover the year to 31 March 2026, by 31 August 2026. In the meantime, if you have any queries, please do not hesitate to contact me. Yours sincerely, Mark Outterside Director Forvis Mazars LLP Page 76
Page 77
1 Classification: OFFICIAL Date: Your Ref: Our Ref: Enquiries to: Direct Line: Email Kilmory Lochgilphead Argyll PA31 8RT 22 September 2026 James Gow james.gow@argyll-bute.gov.uk Dear Mark, Audit of Argyll and Bute Integration Joint Board’s Financial Statements for the year ending 31 March 2026 Thank you for your letter in respect of the above. I would refer you to the governance statements in the Annual Accounts, responses to audit queries and provide some additional information in response to each of your points in italics below: 1) What are management's processes in relation to: • undertaking an assessment of the risk that the financial statements may be materially misstated due to fraud or error (including the nature, extent and frequency of these assessments); The HSCP has financial regulations in place which reduce the risk of fraud and error occurring. The finance teams within NHSH and A&B Council work to set timetables and guidelines and their work is reviewed by management and by internal and external auditors. Management accounts are prepared, reviewed and reported monthly. Additionally, the Internal Auditor reviewed financial management arrangements and provided assurance on this. Reviews are carried out by myself and within financial management structures in both NHS Highland and Argyll & Bute Council. • identifying and responding to risks of fraud in the organisation, including any specific risks of fraud which management have identified or that have been brought to its attention, or classes of transactions, account balances, or disclosure for which a risk of fraud is likely to exist; The management accounts and procurement teams have procedures in place to manage this risk. These include a series of internal controls relating to the processing of invoices, matching these to purchase orders and the investigation of any discrepancies between orders and invoices. There are extensive controls in place to manage the risk of Payroll fraud within both NHS Highland and Argyll & Bute Council. The internal audit plans within the HSCP and both partners takes account of risk and their work is directed accordingly to mitigate risk. • communicating to employees views on business practice and ethical behaviour (for example by updating, communicating and monitoring against the organisation's code of conduct); Page 77
Page 78
2 Classification: OFFICIAL Financial Regulations are updated regularly and are communicated to staff when they are updated. The Finance teams meet regularly with budget holders and provide support in ensuring that processes and procedures are understood and followed. Non-compliance, where it is identified, is addressed with staff concerned and where appropriate escalated to senior management and audit. • communicating to those charged with governance the processes for identifying and responding to fraud or error? The Audit & Risk Committee have responsibility for governance oversight. They receive assurance in the form of reports by management, the participation in the National Fraud Initiative by both partner bodies, reports from External Audit and through oversight of the Internal Audit plan and the reports arising from the work of Internal Audit. The Committee also track progress made by management in responding to Audit Recommendations. They also receive copies of relevant reports published by Audit Scotland which regularly highlight examples of fraud in the public sector. 2) What is management's processes to identify and respond to the risk of fraud and possible breaches of internal control? These are set out in the financial regulations and procedural documentation followed by the finance, purchasing and procurement; HR and payroll teams and administration teams operating within each partner. Is management aware of any breaches of internal control during 2025/26? Please provide details. No. Additional internal audit work in respect of direct payments was commissioned due to concerns about compliance with procedures in 2026/27. 3) Do you have knowledge of any actual, suspected, or alleged fraud during the period 1 April 2025 to 31 March 2026? Where appropriate please provide details. No 4) Do you have any suspicion that fraud may be occurring within the organisation? Please provide details. a Has management identified any specific fraud risks within the organisation? Please provide details. b Does management have any concerns that there are areas within the organisation that are at risk of fraud? Please provide details. c Are there particular locations within the organisation where fraud is more likely to occur? Please provide details. Management has no suspicion that fraud may be occurring within the HSCP. Risks are identified as part of the internal audit programme. Specific risks are greater in respect of payroll and where cash handling and client funds are involved. These are areas which are reviewed regularly by audit and procedures and processes have been strengthened recently to address these risks. This has been reported in detail to the Audit & Risk Committee and the procedures approved by the Finance & Policy Committee. Page 78
Page 79
3 Classification: OFFICIAL 5) Are you satisfied that internal controls, including segregation of duties, exist and work effectively? Please provide details. a If not, where are the risk areas? b What other controls are in place to help prevent, deter, or detect fraud? Yes — controls are in place within both partners to manage this risk appropriately. These include segregation of duties and are regularly reviewed as part of the internal audit programme. Staff are encouraged to escalate any concerns they have in respect of adherence to policies and procedures. 6) How are staff encouraged to report their concerns about fraud, and what are the types of concerns they are expected to report? Please provide details. Budget holders are reminded of the financial regulations on a regular basis. These were reviewed in early 2024 and approved by the IJB at its meeting in May 2024. The new version was circulated to relevant staff following the IJB meeting. This is also covered in staff induction where appropriate. Finance staff are also encouraged to raise concerns during their review of budgets and will escalate these to senior finance staff and the Chief Finance Officer where material. 7) From a fraud and corruption perspective, what do you consider to be high risk posts within the organisation? Please provide details. a How are the risks relating to these posts identified, assessed, and managed? Management, finance, ICT, procurement and posts which are involved in the handling of client funds and operation of payroll procedures. The processes described above relating to financial regulations, procurement controls, segregation of duties and audit review of high risk areas are the ways in which these risks are managed. All supervisory staff and managers are aware of their own areas of high risk and the reporting lines for escalation of any concerns. 8) Are you aware of any related party relationships or transactions that could give rise to instances of fraud? Please provide details. a How are the risks associated with fraud related to such relationships and transactions mitigated? No — registers of interest for senior staff and Board Members are maintained and reviewed regularly. No concerns have been raised in this regard by the public or through complaints or audit processes. Further mitigations are through purchasing, procurement and financial processes. 9) Are you aware of any entries made in the accounting records of the organisation that it believes, or suspects are false or intentionally misleading? Please provide details. a Are there particular balances where fraud is more likely to occur? Please provide details. b Are there any assets, liabilities, or transactions that it believes were improperly included or omitted from the accounts of the organisation? Please provide details. Page 79
Page 80
4 Classification: OFFICIAL c Could a false accounting entry escape detection? If so, how? d Are there any external fraud risk factors which are high risk of fraud? Please provide details. Management are not aware of any false or intentionally misleading accounting entries or statements in the accounts. Both accounting teams work within an internal control and review framework that is designed to mitigate this risk. This includes regular management review, segregation of duties and internal audit revies. There are no transactions that have been improperly included or omitted from the accounts. Additional review is carried out within the finance teams of both partners in addition to the HSCP level review and reporting processes. 10) Are you aware of any organizational, or management pressure to meet financial or operating targets? Please provide details. a Are you aware of any inappropriate organizational or management pressure being applied, or incentives offered, to you or colleagues to meet financial or operating targets? Please provide details. No — The HSCP is expected to operate within the budget allocated by NHS Highland and Argyll and Bute Council. Operating performance is measured and subject to professional review and analysis to ensure that relevant policies and commitments are fulfilled. This does not involve inappropriate pressure or incentives being offered to anyone working within, or involved in the governance or management of the HSCP. Additional review work is carried out by professional staff within both partner organizations. 11) How does management gain assurance that all relevant laws and regulations have been complied with. For example: a What process is in place for identifying and responding to changes in laws and regulations? Please provide details. b What arrangements are in place for the Performance, Audit and Risk Committee to oversee this process? c What arrangements are in place for communicating with employees, non-executive directors, partners and stakeholders regarding the relevant laws and regulations that need to be followed? Please provide details. d Do you have knowledge of actual or suspected instances where appropriate laws and regulations have not been complied with, and if so what actions management is taking to address it? Please provide details. The management team regularly review new and emerging legislation. It seeks to comply with all legislation and respond appropriately to consultations by Government. New legislation, policies and procedures are cascaded throughout the HSCP as appropriate. Management are not aware of any actual or suspected instances where laws and regulations have not been complied with. The Audit and Risk Committee and Clinical and Care Governance Committee receive reports from auditors and regulatory bodies which provide assurance in this regard. I also refer you to a more detailed response on this point provided in the Signals portal. Page 80
Page 81
5 Classification: OFFICIAL 12) Are you aware of any actual or potential litigation or claims that would affect the financial statements? Please provide details. No, I am not aware of any actual or potential litigation or claims that would affect the financial statements. 13) How has management assessed and satisfied itself that it is appropriate to adopt the going concern basis in preparing the financial statements? The HSCP seeks to operate on a financially sustainable basis, its budget is confirmed by both partners each year and it holds a small amount of funding in reserve. There are no events that cast doubt on the organisations ability to continue as a going concern. However, the HSCP has been reporting for some time that it required to reduce spend in order to operate on a financially sustainable basis. Like most of the health and social care sector, it has identified a substantial budget gap for 2027/28 and currently working with partners to address this. The Budget Outlook report provides the current medium term financial projections. 14) Has management identified any events or conditions since the assessment was undertaken which may cast significant doubt on the organization’s ability to continue as a going concern? Please provide details. No, the sector is under severe financial pressure and the management team are working with partners to establish what actions require to be taken to ensure that the HSCP is operating on a sustainable basis. Resources are in place to fund the HSCP’s activities throughout the next year. The recent announcements by the Scottish Government in respect of public sector reform indicate that structural change in the health and social care sector is expected in the medium term. Yours Sincerely James Gow Chief Financial Officer Page 81
Page 82
This page is intentionally left blank
Page 83
1 Classification: OFFICIAL Audit & Risk Committee Date of Meeting: 22 September 2026 Title of Report: Audit Scotland: Publications Presented by: James Gow, Head of Finance The Audit & Risk Committee is asked to: • Note the Audit Scotland publications. 1. EXECUTIVE SUMMARY Audit Scotland regularly publish reports which are relevant to public bodies. This report highlights four reports published in recently that may be of interest to the Committee. 2. RECOMMENDATION 2.1 The Audit & Risk Committee is recommended to: • Note the contents of the publications. 3. DETAIL OF REPORT 3.1 Audit Scotland publish their reports on their web-site: https://www.audit- scotland.gov.uk/publications. This report highlights four recent publications: • Local Government Budgets 2026/27 • Quality of Public Audit in Scotland 2025/26 • Code of Audit Practice 2026 • National Fraud initiative 2026/27 3.2 Local government Budgets (Appendix 1) This bulletin provides an overview of the 2026/27 budgets of Scotland’s 32 Local Authorities. Some of the key findings outlined are: • Scottish Government funding to councils is £15.7 billion in 2026/27, a 1% real-terms increase, but capital funding has been reduced by 15%, limiting investment in infrastructure. Page 83 Agenda Item 8
Page 84
2 Classification: OFFICIAL • Councils face a combined budget gap of £529m, driven by rising demand and cost pressures, particularly in social care. • Councils have balanced budgets through a combination of: o Council tax increases averaging 7.7% o £180 million of savings o Increased fees and charges o Use of £122 million of reserves. • Councils are contributing £4.3 billion to Integration Joint Boards (IJBs) for social care services, about a quarter of revenue spend. • Financial pressures are expected to continue, with almost £1 billion of cumulative budget gaps by 2028/29, raising concerns about long-term financial sustainability and the need to redesign or reduce services. • Most councils consulted residents on budget decisions and carried out equality impact assessments. The report provides interesting comparative data and re-iterates themes highlighted previously including increasing demand for services, on-going financial pressures and the requirement to reduce and/or transform services. Audit Scotland again devote a large section of the report to highlight the importance of community engagement and equality impact processes when considering service change and budget / council tax setting. 3.3 Quality of Public Audit in Scotland (Appendix 2) This report provides an overview of the work of public audit for 2025/26 and concludes that the quality of public audit in Scotland remains high, with strong compliance with auditing and ethical standards. External and internal quality reviews found that performance audits assessed were of high quality and 86% of financial audits reviewed demonstrated good quality and strong compliance with standards: • Strong compliance with ethical requirements and quality management standards by all audit providers. • All performance audit outputs were delivered on time and met quality targets. • Significant improvements have been made in addressing issues identified in previous quality reviews. • Stakeholder feedback remained positive, with annual audits and performance audit reports generally rated as useful and high quality. The main challenge continues to be the timeliness of financial audits. Only 55% of 2024/25 audits were completed by target dates, the situation is improving with an expectation of further improvement in the coming year. Delays were particularly evident in local government and central government audits, often due to prioritisation of larger audits, staffing pressures, or delays in receiving information from audited bodies. Overall, the report provides assurance that public audit quality in Scotland is strong and improving, while recognising that audit delivery times remain a challenge. 3.4 Code of Audit Practice (Appendix 3) The Code of Audit Practice 2026 sets out the framework for external public audit in Scotland for the period 2027/28 to 2031/32. It outlines the responsibilities of auditors appointed by the Auditor General for Scotland and the Accounts Page 84
Page 85
3 Classification: OFFICIAL Commission for Scotland, and the standards they must follow. The main themes include: • Independent assurance over public finances, ensuring public money is used legally, properly, efficiently and effectively. • A continued focus on financial management, financial sustainability, governance and leadership, and effective use of resources as core areas of audit scrutiny. • Stronger emphasis on Best Value arrangements, particularly within local government, to support continuous improvement in public services. • A risk-based, proportionate and data-driven audit approach, allowing auditors to focus on areas of greatest risk and public interest. The Code aims to ensure audit continues to drive improvement in accountability and transparency across the public sector by providing independent assurance on how public resources are managed and reported. 3.5 National Fraud Initiative in Scotland (Appendix 4) The report provides an overview of the National Fraud Initiative (NFI) in Scotland for using the 2024/25 data. The NFI uses data matching across public sector organisations to identify fraud, error, overpayments and opportunities for additional income. The report highlights that the NFI is an important and effective counter-fraud tool in the context of significant financial pressure on public services. • In 2024/25 the NFI exercise generated £21.7 million (a small decrease on the prior year), comprising overpayments recovered, additional income, future savings and estimated fraud prevention. • Since 2006/07, the NFI has identified approximately £201 million of cumulative outcomes in Scotland. • The largest areas of savings were: ▪ Pensions (£4.8m) ▪ Council Tax Single Person Discounts (£4.1m) ▪ Council Tax Reduction Scheme (£1.7m) ▪ Duplicate Creditor Payments (£1.1m) ▪ Non-Domestic Rates Small Business Bonus Scheme (£0.8m) • Delivery of the NFI has improved, with fewer significant issues identified by auditors, although some organisations could improve the timeliness and focus of match investigations. • Audit Scotland is exploring new fraud detection opportunities, including pilots involving welfare recipient residency checks and social housing subletting. Some examples of where fraud was identified are listed below: • More than one simultaneous full-time employment cases • Employees working while off sick • Undeclared financial interests • Duplicate creditor payments – 260 totalling £1.1m • Pension overpayments following death (108 cases and £4.8m of savings) Page 85
Page 86
4 Classification: OFFICIAL • Council Tax fraud and error – 2,367 single person discounts • Social Care Payment Overpayments relating to mortality screening (44 cases) Additionally the scheme has identified blue badge abuse, concessionary travel mis-use and housing waiting list fraud. The report confirms that participation by public bodies is generally positive. The HSCP periodically provides assurance from both partners to the audit and risk committee in respect of their arrangements to identify, investigate and prevent fraud and error in this context. 4. RELEVANT DATA AND INDICATORS 4.1 Audit Scotland Reports rely on a wide range of data and information. 5 CONTRIBUTION TO STRATEGIC PRIORITIES 5.1 Audit Scotland Reports are of strategic relevance to public service delivery in Scotland. 6. GOVERNANCE IMPLICATIONS 6.1 Financial Impact – no direct impacts but the nature of the financial challenges facing the public sector is a key theme. 6.2 Staff Governance – none directly. 6.3 Clinical Governance – none directly. 7. PROFESSIONAL ADVISORY 7.1 The report has been circulated for information. 8. EQUALITY & DIVERSITY IMPLICATIONS 8.1 None directly. 9. GENERAL DATA PROTECTION PRINCIPLES COMPLIANCE 9.1 None. 10. RISK ASSESSMENT 10.1 This report summarises a series of contextual reports which generally support the assessment of risk in the Strategic Risk Register. 11. PUBLIC & USER INVOLVEMENT & ENGAGEMENT 11.1 Audit Scotland reports are publicly available. 12. CONCLUSIONS 12.1 This report seeks to bring key public sector audit reports to the attention of the Committee. Page 86
Page 87
5 Classification: OFFICIAL 13. DIRECTIONS Directions required to Council, NHS Board, or both. Directions to: tick No Directions required √ Argyll & Bute Council NHS Highland Health Board Argyll & Bute Council and NHS Highland Health Board 14. PREVIOUS REVIEW OF THE REPORT Meeting Title of report Date Output (if relevant) N/A AUTHOR NAME: James Gow, Head of Finance EMAIL: james.gow@argyll-bute.gov.uk Appendix 1 – Local Government Budgets 2026/27 Appendix 2 – Quality of Public Audit in Scotland 2025/26 Appendix 3 – Code of Audit Practice 2026 Appendix 4 – National Fraud Initiative Page 87
Page 88
This page is intentionally left blank
Page 89
Prepared by Audit Scotland June 2026 Bulletin Local government budgets 2026/27 Page 89
Page 90
2Local government budgets 2026/27 Contents Key facts 3 Key messages 5 Commission expectations 7 Introduction 8 1. Scottish Government funding to councils 10 2. Council budgets 15 3. Consulting with communities 31 Appendix 1 35 Appendix 2 36 Accessibility You can find out more and read this report using assistive technology on our website www.audit.scot/accessibility. Page 90
Page 91
3Key facts Key facts Local government budgets 2026/27: £15.7 billion total funding from the Scottish Government 1 per cent real terms increase in funding (revenue and capital) to councils in 2026/27 compared to 2025/26 2 per cent real terms increase in revenue funding to councils in 2026/27 compared to 2025/26 15 per cent real terms reduction in capital funding to councils in 2026/27 compared to 2025/26 £18.9 billion councils’ approved net revenue budgets £5 billion councils’ approved capital budgets (General Fund £3.5 billion; Housing Revenue Account £1.5 billion) 7.7 per cent average council tax increase (varies between four and ten per cent across councils) £529 million revenue budget gap identified by councils at time of setting 2026/27 budgets (around three per cent of councils’ General Fund revenue budgets) £4.3 billion councils’ revenue contributions to Integration Joint Boards (IJBs), (around 24 per cent of councils’ General Fund revenue budgets) a real terms increase of £220 million compared to 2025/26 Page 91
Page 92
Key facts 4 Budget actions: £221 million increase to council tax £17 million increase to income (including fees and charges) £168 million agreed savings (recurring) £12 million agreed savings (non-recurring) £122 million use of reserves 30 the number of councils that carried out a budget consultation to inform 2026/27 budget-setting 31 the number of councils that carried out equality impact assessments as part of budget-setting Page 92
Page 93
5 Key messages Key messages 1 Despite a small real terms increase in Scottish Government funding for 2026/27, councils still face major risks to their financial sustainability as funding fails to keep pace with rising demand and increasing costs. Much of the recently baselined General Revenue Grant funding is still effectively directed towards specific existing commitments, restricting flexibility. Councils identified a combined budget gap of around £529 million for 2026/27, representing a gap of around three per cent of total General Fund revenue budgets across Scotland. 2 A 15 per cent decrease in capital funding is limiting councils’ capacity to sustain and develop infrastructure, resulting in greater dependence on borrowing and heightened long-term financial risk. Nevertheless, overall, councils are expanding their capital budgets for housing, with all councils committing to investment in new housing for 2026/27. 3 To achieve a balanced budget in 2026/27, councils are implementing a range of local measures, including planned savings of one per cent of the combined net revenue budget across services and the use of reserves. All councils increased council tax for a second consecutive year by an average of 7.7 per cent and collectively expect to raise more than £1.2 billion through fees and charges for local services. Page 93
Page 94
Key messages 6 4 Projected reductions in Scottish Government funding over the medium term are expected to intensify financial pressures and increase the risk of councils becoming financially unsustainable, unless they stop, reduce or significantly redesign services. Funding for social care, mainly through Integration Joint Boards (IJBs), represents a high proportion of council spend, with increasing demand for these services, putting pressure on council budgets. Councils continue to forecast short-term budget gaps to 2028/29 and are considering a wide range of measures to achieve balanced budgets in future years. As savings options increasingly focus on changes that impact on services offered to people, effective and consistent consultation with communities will be essential. Page 94
Page 95
7Commission expectations Commission expectations This is our third bulletin on council budgets. Within our previous bulletins we acknowledged variation in how budgets are presented and set out a range of expectations relating to the transparency of council budget papers. There has been good progress against most of the expectations set out in Local government budgets 2025/26 (Appendix 2). However, further improvements could be made in the transparency of budget papers and the financial monitoring provided to elected members, and how communities are consulted about budget decisions. With financial pressures forecast to remain, and the continued need to identify savings through stopping, reducing and redesigning services to address these, it is more important than ever for budget-setting to be clear and well managed. The decisions taken by councils when setting their budgets impact us all. Without clear and transparent reporting, however, it is difficult for elected members and communities to fully engage and participate in making these decisions. We have therefore set out the commission’s expectations for councils’ annual budget-setting as a checklist (Supplement) for elected members in order to assist them when making decisions on setting budgets. Page 95
Page 96
8Introduction Introduction 1. Audit Scotland has prepared this budget bulletin on behalf of the Accounts Commission to summarise key issues arising from our analysis of the 2026/27 budgets recently agreed by Scotland’s 32 councils. 2. Councils are legally required to set a balanced budget for each upcoming financial year. This means that a council’s funding and income must cover their anticipated expenditure. Councils might identify a budget gap as they are preparing their budgets. This is the difference between their anticipated expenditure for the year and the funding and income they expect to receive. Councils will identify and agree actions, including savings measures or using reserves, to allow them to set a balanced budget. 3. The wide range of approaches councils take to budget-setting and the level of information, and the way that it is publicly reported, make it challenging to report a definitive national position. Some of the variation between councils is due to differing approaches to budgeting. We have added caveats to the exhibits and text where caution is required. 4. This report is in three parts: • Part 1 outlines the Scottish Government’s 2026/27 funding allocation to councils and highlights trends in revenue and capital settlements compared with previous years. • Part 2 assesses how councils have balanced their 2026/27 budgets, including the use of reserves and other measures. This is based on data returns submitted to us by all councils in March and April 2026, shortly after agreeing their 2026/27 budgets. We welcomed the positive engagement from councils and auditors in completing and returning their data return. • Part 3 reviews how councils engaged with stakeholders and considered equality impacts when making budget decisions. 5. As part of the data return, we asked councils to identify the assumptions they made when calculating projected revenue budget gaps over the short term. As expected, these assumptions varied across the country and across a range of factors although there are no identified outliers. Page 96
Page 97
Introduction 9 6. This year’s budget bulletin provides increased emphasis on: • the impact that challenging capital settlements have on councils’ ability to invest in local infrastructure • the level of savings required by Integration Joint Boards (IJBs) in setting their 2026/27 budgets, including the proportion that relates specifically to social care services and the impact this has on council budgets • the share of council’s capital budgets that sits within the Housing Revenue Account (if applicable), where that money comes from, and planned expenditure. 7. When looking at trends, we convert some financial data into real terms, adjusting it for inflation to make trend information comparable. We have used the March 2026 deflators published by HM Treasury to adjust financial information from past or future years into 2026/27 prices. 8. The report is part of a series of overview outputs produced for the Accounts Commission. These reports provide an independent overview of the financial and operational performance of Scotland’s local government sector. The next reports will be our annual financial bulletins on councils, and IJBs, assessing their financial performance in the most recently audited financial year. Page 97
Page 98
10 1. 1. Scottish Government funding to councils 1. Scottish Government funding to councils Overall Scottish Government funding to councils is increasing slightly, in real terms, in 2026/27 compared to last year. However, rising demand and a significantly lower capital allocation in 2026/27 will continue to challenge councils’ financial sustainability if they continue to operate under the current model of service delivery. Total Scottish Government funding to councils is increasing slightly in 2026/27 9. The Scottish Government will provide a total of £15.7 billion of funding (revenue and capital) to local government in 2026/27 (Exhibit 1), a one per cent real terms increase compared to 2025/26. 10. The funding going to councils will likely change throughout the year as the Scottish Government reprioritises resources from other portfolios to local government or additional funding becomes available. For example, councils received £177 million of additional funding during 2025/26, confirmed through the autumn and spring budget revisions. It is therefore likely that the 2026/27 budget to local government will also change. Exhibit 1. Scottish Budget initial local government settlement 2024/25 to 2026/27 Overall Scottish Government funding to local government is increasing in 2026/27 despite a reduction in the capital settlement. Cash terms (£ million) Real terms (£ million) 2024/25 2025/26 2026/27 2024/25 2025/26 2026/27 Total local government funding 13,913 15,165 15,687 14,652 15,469 15,687 Total revenue funding 13,257 14,397 15,018 13,961 14,686 15,018 Total capital funding 656 767 669 691 783 669 Note: Real terms funding has been adjusted into 2026/27 prices using March 2026 GDP deflators. Source: Analysis of Scottish Government Finance Circulars The Scottish Government adjusts its budget during the year. This generally takes place during the annual autumn and spring budget revisions which are approved by the Scottish Parliament and may include allocating additional funding for specific purposes, as well as in- year transfers between spending portfolios. Page 98
Page 99
1. Scottish Government funding to councils 11 Revenue funding to all councils is increasing in 2026/27 11. The finance circular outlines the revenue and capital funding that councils will receive from the Scottish Government in 2026/27. Revenue funding contributes to the day-to-day costs incurred by councils, such as employing staff. The Scottish Government is allocating £15 billion of revenue funding to local government in 2026/27, a real terms increase of £331 million (two per cent) from last year (Exhibit 2, page 12). All councils will receive a real and cash terms increase in revenue funding from the Scottish Government in 2026/27. 12. The settlement differs from the figures presented in the draft Scottish Budget due to changes made prior to it receiving parliamentary approval. For example, the Scottish Government provided councils with £20 million of additional funding to support the Real Living Wage across adult and children’s social care and early learning and childcare. While baselining additional funding into the GRG is intended to enhance councils’ financial flexibility and align with national commitments to reduce ring-fencing, much of this funding remains directed towards specific policies and priorities 13. In recent years, there has been a significant increase in the General Revenue Grant (GRG) provided to councils, reflecting the Scottish Government’s decision to baseline several, previously ring-fenced, grants. Our Supplement to the Financial bulletin 2024/25 sets out the funds baselined into the GRG. Between 2024/25 and 2026/27, the GRG has increased in real terms by £869 million (eight per cent). There has been a modest increase in GRG funding to councils over the last year, with a real terms increase of £89 million (0.8 per cent). Over the same period, specific revenue grants, which are ring-fenced by the Scottish Government, have reduced by over 20 per cent (£56 million). 14. The Scottish Government states that increasing GRG funding supports the goals of the Verity House Agreement to lessen ring-fenced funds. However, much of the new funding is required to meet existing commitments, such as £244 million of the total £770 million in 2026/27 allocated for teacher pay increases. Councils must continue using GRG funding for these obligations, limiting flexibility in spending plans. The General Revenue Grant (GRG) is funding provided by the Scottish Government to help councils finance their general services. Unlike specific revenue grants, GRG is typically not ring- fenced for specific purposes, providing councils with a degree of flexibility over how to allocate this funding. However, the Scottish Government directs councils to spend some GRG funding on national policy initiatives, and those expectations are generally agreed with the Convention of Scottish Local Authorities (COSLA). Though not formally ring-fenced, the Scottish Government provides this funding with an expectation that councils will spend it on specific services. The GRG allocation to councils is based on factors such as deprivation, levels of rurality and population size. It is also based on individual funding formulas assigned to a particular local service area. The formula used to determine the funding allocation depends on the specific circumstances for that service area. This allows the Scottish Government to calculate each council’s share of the GRG. The Scottish Government jointly agrees the methodology of distributing funding to councils with COSLA which requires regular review. Scottish Government adjusts the allocation to each council as part of the agreed funding methodology to recognise that the indicators used, for example, population size, may lead to significant annual reductions or increases for some. The floor restricts the scale of any grant increase or reduction within a set parameter to reduce the impact in any one financial year. Page 99
Page 100
1. Scottish Government funding to councils 12 Note: Prior years have been adjusted into 2026/27 prices using the March 2026 GDP deflators. Source: Analysis of Scottish Government Finance Circulars Exhibit 2. Scottish Government revenue allocation to local government in real terms 2024/25 to 2026/27 All councils are receiving an increase in their revenue allocation in 2026/27. Recent property revaluations are driving a significant increase in councils’ non-domestic rates income 15. An increase in non-domestic rates (NDR) income is driving the overall increase in revenue funding in 2026/27. Funding to councils arising from non-domestic rates income is increasing in real terms by £298 million (nine per cent) between 2025/26 and 2026/27. This partly reflects the impact of the new non-domestic property revaluation taking effect from 1 April 2026, which is expected to result in a higher aggregate NDR yield in the first year of the revaluation cycle. 16. The Scottish Government takes account of the estimated income that councils expect to receive in council tax and NDR income when determining the final GRG allocation to councils. A significantly reduced capital settlement from the Scottish Government is making it harder for councils to invest in local infrastructure 17. Councils use capital funding to buy, maintain or improve assets such as buildings, general infrastructure and equipment. The Scottish Government is allocating £669 million of capital funding to local government in 2026/27, a 15 per cent (£114 million) real terms reduction compared to last year (Exhibit 3, page 13). Non-domestic rates (NDR) are a tax on businesses and other non- domestic properties which helps to fund local services. The Scottish Government sets the rate of tax, councils collect the money, and the Scottish Government redistributes it as part of its funding allocations to councils. The independent Scottish Assessors calculate the rateable value of every non-domestic property every three years. The 2026 revaluation increased the rateable value on a significant number of non-domestic properties, including council-owned buildings. The Scottish Government has announced a package of support to help those affected by increases in NDR. £3.2bn £3.2bn £3.5bn £0.3bn £0.3bn £0.2bn £10.5bn £11.2bn £11.3bn General Revenue Grant Non-Domestic Rates Specific Revenue Grants 2024/25 2025/26 2026/27 Page 100
Page 101
1. Scottish Government funding to councils 13 18. Twenty-eight councils are receiving a lower capital allocation in 2026/27 compared to the previous year. This impacts on their ability to invest in local infrastructure, including increasing the pressures on future revenue budgets (paragraph 57). 19. The Scottish Government and COSLA also use a needs-based formula to distribute the capital allocation to councils, which is more variable year-to-year than revenue funding. The General Capital Grant is distributed based largely on population size and road-length with councils choosing which projects to fund. Specific Capital Grants are intended to fund specific national policy priorities. 20. A reduction in the core capital allocation increases the financial sustainability pressures facing councils and the need for greater and more focused capital planning, including: • Councils increasing their borrowing to fund capital projects. Borrowing costs, like interest payments, must be met from councils’ revenue budgets, increasing the pressures further. • Councils delaying vital investment in local assets. This means local assets deteriorate further or councils are forced to close them completely. Exhibit 3. Scottish Budget local government capital settlement in real terms 2024/25 to 2026/27 Councils are receiving a lower capital allocation from the Scottish Government in 2026/27 compared to the last two years. Note: Prior years have been adjusted into 2026/27 prices using the March 2026 GDP deflators. Source: Analysis of Scottish Government Finance Circulars £563m £569m£656m £128m £100m £126m 2024/25 2025/26 2026/27 General Capital Grant Specific Capital Grants Page 101
Page 102
1. Scottish Government funding to councils 14 • A lack of investment in key local infrastructure impacting on wider outcomes, such as community health and wellbeing. • A requirement to review existing capital plans to ensure their affordability under existing pressures. Further reductions in Scottish Government funding over the medium term will heighten the risk of councils becoming financially unsustainable 21. Alongside the draft 2026/27 budget, the Scottish Government published the Scottish Spending Review, which sets out indicative multi-year spending plans from 2026/27 to 2028/29 (and to 2029/30 for capital). This is a projected level of spend rather than a final settlement and does not provide a council-level breakdown of funding. As such, there is a lack of information which could provide councils with sufficient information to assist in effective medium-term financial planning. 22. The Scottish Spending Review projects that revenue funding for councils will decline in real terms by £528 million (four per cent) between 2026/27 and 2028/29. Councils will therefore continue to face significant challenges including where to stop, reduce or significantly redesign services in order to remain financially sustainable, as demand rises and costs increase while projected funding falls, as set out in our Local government in Scotland: Financial bulletin 2024/25. 23. The Scottish Spending Review also shows that the capital pressures facing councils are set to continue. Capital funding from the Scottish Government to councils is expected to decrease in real terms by £28 million (four per cent) from 2026/27 to 2029/30. This reduction will impact on councils’ ability to invest in infrastructure projects, such as building new schools. Councils will need to assess how the projected reduction in their capital settlement, together with cost increases, will affect their longer-term infrastructure strategies. Page 102
Page 103
152. Council budgets 2. Council budgets Rising demand and increasing costs mean that councils are continuing to face growing financial challenges. Councils are using reserves, savings, borrowing and increases in council tax to manage shortfalls. Councils’ General Fund revenue budget for 2026/27 has increased since 2025/26 24. Each year, councils set a revenue budget to cover the costs of providing services and other expenses for the upcoming year. They are required to ensure that this revenue budget is balanced annually. For 2026/27, councils reported a General Fund revenue budget of around £18.9 billion, increasing from around £18.3 billion in 2025/26 (in real terms). While this is an increase in available budget for councils in the coming year, this sits alongside the challenging context of Scotland’s public finances. There is a rising demand for services provided by councils, increased costs and inflation putting pressure on budgets despite the increase in funding. 25. Most General Fund revenue funding comes from the Scottish Government, with 60 per cent from the GRG. The remaining revenue funding for councils comes from a number of sources including NDR, council tax, use of reserves and other grants and funding from the Scottish and UK governments (Exhibit 4). Exhibit 4. Sources of funding for councils’ 2026/27 General Fund revenue budgets Source: Council data returns 0 2 4 6 8 10 12 General Revenue Grant Non-domestic rates Council tax Reserves Other grants, funding and income 0.9% 0.9% 20.1% 18.4% 59.7% £ billion Page 103
Page 104
2. Council budgets 16 IJB funding is a major pressure on councils’ revenue budgets 26. IJBs receive annual funding from their council and NHS board partners to deliver local health and social care services. Councils are allocating £4.3 billion of revenue funding to IJBs in 2026/27. This represents around 24 per cent of the combined 2026/27 revenue budgets for all councils (excluding Highland who currently operates a lead agency model) and a £220 million real terms increase since last year. Three councils are allocating 30 per cent or more of their revenue budgets to IJBs in 2026/27. 27. The Accounts Commission’s Integration Joint Boards: Financial bulletin 2024/25 highlights the critical financial pressures facing IJBs. Twenty councils were able to provide information on savings required by IJBs in 2026/27, showing that the financial pressures are continuing. Overall, those IJBs are expected to deliver £179 million of savings in 2026/27, £103 million within social care services (57 per cent of all savings required by IJBs). 28. The Integration Joint Boards: Financial bulletin 2024/25 also highlights that reserve levels continue to fall across IJBs, with the total level of reserves held by IJBs now lower than the budget gap forecast for the year ahead. While several councils have sought to address health and social care pressures through additional uplifts to the IJB, they are acknowledging this only provides short-term stability. Councils are largely recognising that if IJBs cannot contain financial pressures, then additional funding may be sought from partners during the financial year, which could lead to councils making further saving measures. 29. Individual IJBs are acting in response to the significant financial pressures accumulating from rising demand and constrained funding settlements, for example: • Perth and Kinross IJB approved a Financial Recovery Plan for 2025/26 to manage in-year pressures, mainly through the use of council reserves. While some measures continue, the 2026/27 plan focuses on sustainable service redesign. This comes alongside significant savings already delivered and ongoing financial pressures, with recognition that further measures may risk reduced access to care. • North Ayrshire Council has moved to a ‘critical only’ threshold for funded adult social care support, meaning only those at critical risk will receive support. The change follows severe financial pressures, with rising demand and increasing care delivery costs not matched by available funding. Page 104
Page 105
2. Council budgets 17 At the time of setting their 2026/27 budget, almost all councils reported a budget gap 30. Where councils are reporting that their spending across the year will be greater than their available income, we refer to this as a budget gap. The budget gap is the difference between anticipated income (not including income drawn from council reserves) and anticipated expenditure (taking into account any savings approved before the 2026/27 budget process began). 31. At the time of setting their budgets, councils identified a combined budget gap of £528.6 million, representing a gap of around three per cent of councils’ total combined General Fund revenue budgets for 2026/27. This proportion has remained broadly consistent over the last seven years. Exhibit 5, (page 18) sets out the budget gaps for individual councils as a percentage of their individual revenue budgets. Page 105
Page 106
2. Council budgets 18 Exhibit 5. 2026/27 budget gap in each council, as a percentage of their General Fund revenue budget (gap in £ millions shown in brackets) Note: Shetland and Orkney hold significant reserves related to oil and gas harbour activity. They are excluded from this chart as they are outliers due to their planned use of reserves to balance the budget. At the time of setting its budget, South Lanarkshire reported a surplus position. There are differences in the way councils approach and present their budget and identify budget gaps, including when saving measures and other actions are agreed. This means that comparisons should be made with caution. Source: Council data returns -1% 0% 1% 2% 3% 4% 5% 6% 7% South Lanarkshire (-£1.5m) Fife (£3.6m) Renfrewshire (£5.0m) East Lothian (£3.5m) Dundee City (£5.0m) Inverclyde (£4.0m) Aberdeen City (£11.0m) North Lanarkshire (£19.3m) City of Edinburgh (£27.9m) East Ayrshire (£9.5m) Aberdeenshire (£19.2m) East Renfrewshire (£8.7m) Dumfries and Galloway (£12.5m) Highland (£23.4m) Falkirk (£14.5m) West Lothian (£20.2m) Moray (£10.6m) Stirling (£11.4m) Eilean Siar (£5.0m) Angus (£13.9m) North Ayrshire (£17.8m) Clackmannanshire (£7.0m) Glasgow City (£86.7m) Perth and Kinross (£20.7m) Scottish Borders (£16.3m) Midlothian (£13.3m) Argyll and Bute (£14.9m) West Dunbartonshire (£15.9m) South Ayrshire (£20.7m) East Dunbartonshire (£23.7m) Councils Page 106
Page 107
2. Council budgets 19 Councils are taking various actions to close their 2026/27 budget gaps 32. Each council is required to set a balanced budget, so any identified budget gap must be addressed via a series of measures when the council agrees its budget. Councils can use a range of tools to help balance their budgets, either by generating additional income or by reducing expenditure. Actions include increasing council tax rates, increasing fees and charges, identifying new saving opportunities and drawing on council reserves (Exhibit 6). 33. Budgets may also include measures to fund additional investment or to increase reserves. At the time of setting their budgets, councils approved measures of around £626.4 million to meet the £528.6 million budget gap and to fund £97.8 million of revenue investment. 34. Councils should prioritise recurring measures that deliver long-term savings, such as redesigning services or increasing annual income through changes to council tax. Non-recurring measures, such as delaying expenditure or leaving posts temporarily vacant, are short term and cannot sustainably close a budget gap. Any gap covered by these one-off actions will reappear in future years, and therefore should be addressed through recurring measures. Exhibit 6. Councils’ bridging actions in their 2026/27 budgets Councils are taking various actions to close their 2026/27 budget gap and fund additional investment. 0 50 100 150 200 250 Other recurring actions Other non-recurring actions Non-recurring savings Increase to income Use of reserves Recurring savings Increase to council tax rates/base £ million 1.8% 2.7% 5.4% 8.5% 19.4% 26.8% 35.2% Note: Other non-recurring actions mainly relate to measures being taken by Glasgow City Council to address homelessness pressures. Percentages do not sum to 100 per cent due to rounding. Source: Council data returns Page 107
Page 108
2. Council budgets 20 Councils continue to rely on identified savings across different service areas to address financial challenges 35. All councils have identified the service areas where they expect to make savings when setting their 2026/27 budgets, where previously some councils had savings that were unidentified. Although this represents appropriate financial planning at the time of setting the budget, councils may still need to identify further saving measures if unforeseen in-year pressures arise. 36. Councils are planning £179.6 million worth of saving measures through 2026/27 budgets, representing one per cent of the General Fund revenue budget for all councils. Around £168.1 million are recurring savings with £11.5 million of non-recurring savings identified. Increasing the share of recurring savings is important for ongoing financial management as it provides a more reliable financial base going forward. 37. At the time of budget-setting, South Ayrshire Council planned the largest level of savings as a proportion of its 2026/27 total General Fund revenue budget. The council plans to deliver recurring savings of £9.4 million in 2026/27, representing around 2.4 per cent of its 2026/27 General Fund revenue budget. Most of these savings are within corporate functions and environmental services, particularly through changes to waste management services. 38. Statutory services, like education and social work services, limits councils’ ability to reduce spending in these areas, with savings more common within non-statutory services. Corporate services have the most individual saving measures across all councils, amounting to around £66.7 million, representing over a third of the total value of all 2026/27 saving measures. Around 74 individual saving measures are within culture and leisure, economic development and environmental services. This represents around £46.6 million of saving measures. 39. Our recently published report Delivering for the future – Transformation: How councils are redesigning and delivering more efficient services set out the need for sustainable change through transformation of services, presenting a mixed picture of how well councils are doing this. All councils increased their council tax rates in 2026/27 40. Councils had full flexibility in 2026/27 to determine their council tax levels. All councils increased their council tax rates in 2026/27, with increases ranging from four per cent in City of Edinburgh Council to ten per cent in Aberdeenshire and Moray councils (Exhibit 7, page 21). Page 108
Page 109
2. Council budgets 21 Source: Council data returns and Scottish Government Council Tax documents Exhibit 7. Band D Council Tax rates in each council, 2024/25 – 2026/27 Council Tax rates increased between four and ten per cent in 2026/27. 0 200 400 600 800 1,000 1,200 1,400 1,600 1,800 Shetland Islands Eilean Siar South Lanarkshire Angus North Lanarkshire Dumfries and Galloway Scottish Borders Falkirk Orkney Islands Fife West Lothian Aberdeenshire West Dunbartonshire Perth and Kinross Clackmannanshire East Renfrewshire East Dunbartonshire Highland Inverclyde Moray East Lothian Renfrewshire City of Edinburgh North Ayrshire South Ayrshire Argyll and Bute Stirling Dundee City East Ayrshire Aberdeen City Glasgow City Midlothian £ Councils 2024/25 Council Tax (Band D) 2025/26 increase 2026/27 increase Page 109
Page 110
2. Council budgets 22 41. In total, councils expect to receive £248 million from increases to council tax in 2026/27. The income individual councils expect to raise from council tax depends on several local factors, such as the scale of the increase, the size of the council area, and the nature of the local housing stock, as well as local demand and priorities. 42. Councils have different council tax baselines, calculated using the number of homes in the area, converted to the equivalent number of homes in band D. For 2026/27, Aberdeen City Council agreed a 6.8 per cent increase, bringing its band D council tax charge to £1,747, while Aberdeenshire Council approved a ten per cent increase, resulting in a band D charge of £1,686. Councils such as Aberdeen City, with a higher value baseline, will therefore raise more income for each one per cent increase. Overall, there is a 23.7 per cent difference between the lowest (£1,468) and highest (£1,816) band D rates in Scotland. 43. The Council Tax Reduction (CTR) scheme provides support to a range of claimants, recognising that council tax increases disproportionately impact lower income households. Among the council areas with the highest levels of deprivation, Glasgow City Council applied one of the lowest council tax increases in 2026/27, at 5.9 per cent. Increases in Dundee City, West Dunbartonshire and Inverclyde councils were close to the national average increase of 7.7 per cent. North Ayrshire exceeded the average, with an increase of 8.5 per cent. 44. Our 2025/26 budget bulletin reported significant increases in local council tax rates. Overall, percentage increases were lower in 2026/27 than in 2025/26, but cumulative two-year increases across Scotland range from 12.3 per cent in City of Edinburgh Council to 25.8 per cent in Falkirk Council. The average cumulative council tax increase over the last two years is 18 per cent. There is no clear link between council size and the level of council tax increase. For example, Glasgow City Council, with the largest population, has approved a cumulative increase of 13.8 per cent, while Shetland Islands Council, which has one of the smallest populations and the second lowest Band D rate (Exhibit 7, page 21), has approved an 18 per cent increase, reflecting the national average. 45. Councils also now have the power to set the amount of an additional premium on the council tax rate for empty properties and second homes. Several councils plan to make use of the new power in 2026/27. Councils anticipate raising over £1 billion in 2026/27 from charging to access certain local services 46. Councils also generate income from the fees and charges they set for using certain services. For example, councils will charge for accessing local leisure facilities, like swimming pools, or collecting certain household waste. Council tax makes up a relatively small proportion of a council’s total revenue budget, representing around 20 per cent of overall council income in 2026/27. A percentage increase in council tax does not result in an equivalent percentage increase in a council’s total budget. For example, if council tax represents 20 per cent of a council’s income, a ten per cent increase in council tax results in only a two per cent increase in the council’s overall funding. This is often referred to as the council tax gearing effect. Page 110
Page 111
2. Council budgets 23 47. Thirty-one councils provided information about the income they expect to receive from fees and charges in 2026/27. Councils expect to receive £1.2 billion from fees and charges in 2026/27, representing around 6.7 per cent of the combined revenue budgets. Income from fees and charges in 2026/27 is largely equivalent to the estimated income received by councils from fees and charges in 2025/26. 48. All councils will increase fees and charges in 2026/27, with the largest percentage rises concentrated in environmental services. The Accounts Commission’s spotlight report on culture and leisure services highlights councils’ increasing reliance on charging individuals to access services. It also highlights inconsistencies in how these charges impact different groups. 49. Seventeen councils are introducing new fees and charges in 2026/27. These are mostly within environmental services and economic development and planning. Three councils are removing certain fees and charges in 2026/27. 50. During the 2026/27 budget cycle, six councils approved tighter eligibility criteria for certain services, including introducing different charging policies for certain users of services. For example, in one council non-residents will face higher charges for accessing bereavement services compared to those living in the area. 51. Across a sample of budget consultations, there is evidence that some councils are clearly communicating that fees and charges may be increased or amended as part of addressing identified budget gaps. Consultations typically outline the need for savings, income generation and service changes, and invite residents to comment on proposed options before decisions are made. Councils are continuing to use reserves to balance their budgets 52. As previously set out by the Accounts Commission (Local government budgets 2025/26), councils’ continued use of reserves to balance budget pressures is not sustainable. At the end of 2025/26, councils estimated a total of £2.6 billion in their General Fund, a usable reserve, with £2 billion committed. Of this total amount held in the General Fund, £0.17 billion (seven per cent) was specifically earmarked for contingency. Page 111
Page 112
2. Council budgets 24 53. When setting 2026/27 budgets, councils approved the use of £0.19 billion of General Fund reserves. Councils are generally using reserves to manage short-term financial pressures rather than to support ongoing expenditure. For example, reserves are being used to fund specific non-recurring pressures, one-off investment, as well as planned use of service concession flexibility. Some councils have included the use of reserves as a short-term measure within their budget strategies to enable efficiency measures or transformational change. 54. While some councils are using reserves on a one-off basis to manage short-term financial pressures, all acknowledge that using reserves to fund budget gaps is not sustainable in the long term, and that reserves must be managed carefully to ensure minimum uncommitted reserve levels are maintained. Reductions in Scottish Government capital funding are increasing council borrowing and risk exacerbating financial sustainability pressures 55. Councils use their capital budgets to fund local infrastructure projects, like building new schools. The significant capital pressures facing councils are making it difficult to invest in local infrastructure. The impact from reduced capital funding from the Scottish Government is exacerbated by the inflationary pressures making infrastructure projects more expensive. These pressures are set to continue as capital funding from the Scottish Government is expected to reduce further with high inflation continuing to impact on the cost of projects (paragraph 23). 56. The funding of capital budgets comes from a variety of sources (Exhibit 8, page 26). The total General Fund capital budget for all councils in 2026/27 is £3.5 billion, representing a real terms increase of £0.30 billion (9.3 per cent) over the last year. However, 14 councils are reducing their General Fund capital budgets in 2026/27. 57. Borrowing is the main way that councils fund capital projects, representing around 71 per cent of all General Fund capital funding in 2026/27. Councils intend to borrow £2.48 billion in 2026/27 to fund local infrastructure projects, a real terms increase of £0.41 billion from the previous year. The Accounts Commission’s 2024/25 Financial bulletin on councils explains how councils are relying more on borrowing to finance projects with debt repayment costs putting pressure on future revenue budgets. Page 112
Page 113
2. Council budgets 25 58. Four councils say they are planning an innovative approach to fund local infrastructure projects in 2026/27, including: • Angus Council set aside £0.75 million as part of its 2026/27 council tax increase to cover loan repayments and interest. This increases the council’s ability to borrow money for capital investment with an additional £16 million of spending planned through an Angus Public Infrastructure Fund. • South Lanarkshire Council is investing £2 million to cover the upfront costs of creating commercial spaces for local organisations. This funding allows the council to access more than £11 million of total investment in commercial properties, which will be paid for over time through rental income. All councils that own housing are investing in new builds 59. Twenty-six councils own and maintain council housing. Councils are required to have a Housing Revenue Account (HRA) to record all income and expenditure for the direct provision of housing services. Councils are committing a combined £1.5 billion from their capital budgets to the HRA in 2026/27, a £20.8 million (1.4 per cent) real terms increase compared to the previous year. Despite this, nine councils are reducing capital funding to their HRA in 2026/27. 60. Borrowing is the major source of finance for councils’ HRA capital budgets, accounting for around 74 per cent in 2026/27. This is a slightly higher proportion than in 2025/26. Higher borrowing increases the pressures on future HRA revenue budgets because councils must set aside funding to cover debt repayment costs. 61. HRA funding allows councils to progress their local housing priorities. • All councils with an HRA are planning expenditure on new builds in 2026/27. Councils expect to spend £0.66 billion on new housing this year, a real terms increase of £74.5 million (12.8 per cent) compared to 2025/26. • Councils are planning to increase spending in real terms on refurbishment and repair and maintenance costs by £23.1 million (3.1 per cent) between 2025/26 and 2026/27. • Councils are also planning around £113 million in other areas of expenditure, such as buying back former council housing. 62. The Auditor General and Accounts Commission are undertaking a report on housing services across Scotland. This report is due for publication in early 2027. The Housing Revenue Account (HRA) is a ring-fenced account relating to local authority housing. The HRA is intended to record expenditure and income on running a council’s own housing stock and closely related services or facilities, which are provided primarily for the benefit of the council’s own tenants. Page 113
Page 114
2. Council budgets 26 Exhibit 8. Sources of capital budgets for 2025/26 and 2026/27 Borrowing is the main way that councils fund capital projects. 0.0 0.5 1.0 1.5 2.0 2.5 Other Developer contributions Capital receipts Internal revenue funding Specific Capital Grants General Capital Grants Borrowing £ billion 2025/26 2026/27 1.9% 5.3% 3.3% 2.4% 2.6% 2.5% 2.4% 2.0% 7.0% 6.9% 64.4% 70.6% 16.4% General Fund 12.3% 0.0 0.25 0.50 0.75 1.0 1.25 Other Developer contributions Capital receipts Internal revenue funding Specific Capital Grants General Capital Grants Borrowing £ billion 2025/26 2026/27 0.1% 4.4% 2.1% 0.1% 2.8% 2.2% 71.8% 1.4% 2.2% HRA 73.9% 10.2% 10.8% 9.3% 8.8% Note: Figures for 2025/26 have been adjusted into 2026/27 prices using the March 2026 GDP deflators. Capital receipts are income councils generate from selling existing assets. Source: Council data returns Page 114
Page 115
2. Council budgets 27 Councils are considering a range of issues to set balanced budgets in the future 63. Councils are anticipating that funding pressures will continue in the medium term, reflecting projected spending levels set out in the Scottish Spending Review (paragraph 22). In projecting future revenue budget gaps, councils have considered and made assumptions about a range of funding and cost pressures (Exhibit 9, page 28). Page 115
Page 116
2. Council budgets 28 Exhibit 9. Factors considered by councils when projecting future revenue budget gaps Source: Council data returns Considerations Pay settlements All councils considered current and future pay settlements, with assumed increases ranging from two to 3.5 per cent. Around one third of councils assumed a pay increase of three per cent. Pension contributions Fewer than half of councils considered potential changes to employer pension contributions. Where these were considered, most councils assumed no imminent change. The most recent Scottish Local Government Pension Scheme triennial valuation was undertaken in March 2026 and will set contribution rates from 1 April 2027 onwards. Inflation Most councils took account of general and service specific inflationary pressures, particularly in relation to contracts and energy or wider utility costs. Demand More than two-thirds of councils factored in service demand, with some assuming increased demand in future years. While the scale varied across councils, many highlighted growing pressures in social care, homelessness and Additional Support Needs. Council Tax More than two-thirds of councils considered future changes to council tax rates. Of these, around half assumed increases ranging from two to ten per cent in 2027/28, and from one to seven per cent in 2028/29. Some anticipated higher council tax income due to an increase in the number of taxable properties. Non-Domestic Rates Approximately one-third of councils considered potential changes to Non Domestic Rates (NDR). Some councils that did not factor in changes noted that NDR decisions are determined by the Scottish Government and are therefore outside local control. Fees & charges More than two-thirds of councils considered changes to fees and charges. Some councils applied inflationary uplifts, typically between two and six per cent, while others assumed no increases. Borrowing / debt Most councils considered the cost of borrowing and debt servicing, based on expected loan repayments, interest rate assumptions and agreed capital investment plans. These costs are generally incorporated within longer-term financial plans, with additional borrowing costs reflected in annual budgets. Reserves More than two-thirds of councils considered their level and use of reserves. Some assumed little or no use of general fund reserves to balance budgets. Where reserves are used, councils typically draw on specific earmarked funds and apply controls, such as spreading the impact over time or restricting use to short-term pressures. Savings More than half of councils considered the risk of savings plans not being fully delivered. While councils acknowledged that failure to achieve planned savings could affect services, most assumed that approved savings would be delivered in full, or that alternative measures would be identified where necessary. Page 116
Page 117
2. Council budgets 29 64. We reported in the Local Government: Financial bulletin 2024/25 that a number of earlier Private Finance Initiative (PFI) contracts are now nearing expiry, with councils actively preparing for, or managing, complex contract exit arrangements. While councils have not generally made assumptions about PFI handback implications, a sample review indicates that councils are considering these risks during budget setting. This includes keeping money aside to cover unitary charges, and in some cases, setting aside funds to cover potential property repair and maintenance costs. Councils are continuing to forecast budget gaps over the short term 65. Given the ongoing public sector financial pressures (paragraph 22), councils are projecting they will continue to have gaps in their revenue budgets; £486.9 million in 2027/28 and £476.6 million in 2028/29. Exhibit 10, (page 30) sets out projected gaps across all councils. There are differences in the way councils’ approach and present their budget and identify budget gaps including when saving measures are agreed so figures may not be directly comparable. 66. Although some pressures in these forecasts are expected to be resolved or reduce over time, councils still face a combined revenue gap of £964 million across the next two years. To bridge this shortfall, they will need to raise additional income, identify further savings, or rethink how – and what – services they deliver. Page 117
Page 118
2. Council budgets 30 Councils Budget gap 2027/28 £ million Budget gap 2028/29 £ million Cumulative gap to 2028/29 £ million Cumulative gap as % of 2026/27 General Fund revenue budget Highland 4.8 0.8 5.7 0.7% West Lothian 11.5 - 11.5 1.8% South Lanarkshire 9.7 19.5 29.2 2.7% City of Edinburgh 11.8 31.4 43.2 2.8% Dundee City 7.8 7.1 15.0 2.9% Fife 8.5 26.6 35.1 2.9% Perth and Kinross 5.2 10.6 15.9 3.0% Falkirk 9.4 5.9 15.3 3.0% Renfrewshire 4.6 16.2 20.7 3.3% Moray 2.9 7.4 10.3 3.3% Angus 5.2 8.6 13.7 3.5% East Renfrewshire 8.0 5.2 13.2 3.6% North Ayrshire 9.0 9.2 18.3 3.8% East Ayrshire 6.0 12.0 18.0 3.9% South Ayrshire 9.9 6.4 16.3 4.1% Inverclyde 5.2 6.2 11.5 4.2% North Lanarkshire 26.0 25.4 51.3 4.3% Argyll and Bute 10.2 5.6 15.8 4.4% East Lothian 10.5 8.4 18.9 5.0% Scottish Borders 11.9 9.8 21.7 5.2% Dumfries and Galloway 13.9 14.1 28.0 5.4% Stirling 8.1 10.2 18.3 5.7% Midlothian 13.5 9.3 22.8 6.7% Eilean Siar 3.6 6.0 9.6 6.8% Aberdeen City 30.2 18.5 48.7 7.0% Glasgow City 95.3 72.0 167.3 7.5% Clackmannanshire 10.1 3.5 13.6 7.5% West Dunbartonshire 10.9 14.3 25.2 7.7% Aberdeenshire 42.4 28.3 70.6 8.2% East Dunbartonshire 23.1 22.2 45.2 11.8% Orkney Islands 21.0 23.1 44.1 28.7% Shetland Islands 36.9 32.8 69.7 37.4% Scotland 486.9 476.6 963.5 5.1% Exhibit 10. Councils’ projected budget gaps to 2027/28 and 2028/29 The cumulative projected budget gap to 2028/29 is almost £1 billion. Note: A detailed 2028/29 budget gap is not currently available for West Lothian Council. Shetland and Orkney hold significant reserves related to oil and gas harbour activity and are outliers due to their use of these reserves. Source: Council data returns Page 118
Page 119
313. Consulting with communities 3. Consulting with communities As councils continue to make challenging budget decisions, they must ensure the communities affected are fairly and consistently consulted. While the majority of councils consulted on their 2026/27 budgets, there is variation in how effectively they are consulting with communities 67. Councils must effectively consult with residents in helping to identify ways to address their funding pressures. As demand for services grows and resources become constrained, it is important that councils explain the difficult decisions they must make, including how public funds are used to maintain and improve services, and how they are protecting essential services. 68. Twenty-seven councils consulted with residents on their 2026/27 budget. Most councils consulted clearly with residents on the funding pressures they are facing and on possible actions to close their budget gap. Councils commonly sought views on priority areas and presented savings options and potential income-generation measures to address financial pressures. 69. There was some variation in how councils consulted on their 2026/27 budgets, but most did so through online public consultations and surveys. Some councils also used community engagement methods such as community meetings, roadshows or workshops. Some councils provided evidence of new ways they undertook engagement as part of their 2026/27 budget-setting process, examples include: • South Lanarkshire Council consulted separately with children and young people on budget proposals. Recognising that the views of young people are often missed in normal budget consultation processes. • Angus Council changed their approach to allow more open comments on specific services and budget areas, gathering more in-depth qualitative feedback than before. In addition, QR codes were added to posters to make it easier for people to access online surveys directly. Page 119
Page 120
3. Consulting with communities 32 • Officers and elected members from Scottish Borders Council ran targeted consultation exercises with community groups and the public, including within schools, supermarkets and colleges. This allowed for more face-to-face engagement with people who may not normally complete online consultations. Facilitated sessions were also held with groups who are less frequently represented in formal consultation exercises to ensure their views were also included. These are often missed in standard consultations. 70. Councils should use a range of methods to engage and consult with stakeholders, as this helps ensure wider participation in ways that are accessible and meaningful, including people whose voices are under-represented, and reduces the risk that any groups or individuals are excluded. High levels of engagement and participation lead to better informed decision-making by ensuring a wide range of views and experiences are considered. Councils also need to ensure they are transparent, as part of their engagement, about why they have made decisions, especially when these decisions directly affect communities. 71. Councils should also consult with a wide range of stakeholders on their budget decisions, allowing them to better understand the impact decisions have on different groups. There was variation in how councils consulted with established groups on their 2026/27 budget proposals. Twenty-nine (of 31) councils engaged with their local IJBs as part of their budget setting process, and more than half (17) engaged with Community Planning Partnerships. Other stakeholder groups councils engaged with include: • Staff, unions and communities – engagement most commonly focused on internal stakeholders and local communities, with 26 councils engaging with staff and trade unions, 23 involving tenants and residents’ associations, and 22 engaging with community groups. • Children, young people and families – most councils sought views from families and young people, with 19 councils engaging with children and young people (including school pupils) and 16 engaging with parent councils. • Business and other stakeholders – 15 councils engaged with the business community and seven councils engaged with other users of services or stakeholders, including third-sector partners and charities such as Women’s Aid. 72. A review of a sample of council budget consultation documents shows residents expressing strong support towards protecting frontline services. Residents highlight the importance of protecting education, social care, children and family services, and libraries, leisure, and wider community facilities. Page 120
Page 121
3. Consulting with communities 33 73. Across budget consultations, councils explain that limited and often ring-fenced funding, especially for statutory services like education and social care, means that protecting these areas may lead to reductions, service changes, closures to non-statutory or discretionary services, or higher charges elsewhere. 74. Councils included budget proposals that would reduce access to key local facilities, such as leisure centres or libraries, or lowering educational or social care support. These proposals were developed during budget consultations and prior to final funding settlements, reflecting the range of savings options councils were considering at the time. As funding settlements were finalised and public consultations considered, there are examples of councils scaling back on proposals or abandoning them altogether: • Stirling Council – rejected savings proposals that would have a greater impact on families and vulnerable groups. • Inverclyde Council – withdrew plans for savings to libraries, swimming pools, and community safety teams after feedback from residents. • Argyll and Bute Council – councillors rejected savings proposals that would have reduced library and leisure services. • Fife Council – prioritised protecting vital services, supporting vulnerable residents, and investing in education and anti-poverty initiatives. Councils are using Equality Impact Assessments to understand the effect budget decisions may have on their communities 75. Public bodies use Equality Impact Assessments (EIAs) to understand the potential impact from new policies or budget decisions on individuals with protected characteristics. EIAs help identify ways to advance equality and highlight potential discrimination. Public bodies must complete an EIA whenever introducing a new policy or making a strategic decision that impacts on different groups. Public bodies must do this early in the process to allow the findings to shape the decision- making process. 76. Councils must complete an EIA to understand how their budget decisions may affect groups and communities, particularly those with protected characteristics under the Equality Act 2010. This becomes even more important as councils continue to face significant financial pressures, including reducing services. Thirty-one (of 32) councils carried out EIAs. The Accounts Commission’s Spotlight on culture and leisure services found the quality of EIAs varies when councils are making changes to services that impact on communities. Page 121
Page 122
3. Consulting with communities 34 77. The Accounts Commission explained within last year’s budget bulletin its expectations around councils fully and transparently explaining the impact budget decisions may have on those with a protected characteristic. This information, including the actions to mitigate potential discrimination, should be clearly accessible for everyone. Page 122
Page 123
Appendix 1 35 Appendix 1 Councils’ 2026/27 revenue budgets, budget gaps, approved savings and other budget measures Councils General Fund revenue budget 2026/27 £ million Budget gap 2026/27 £ million Approved savings 2026/27 £ million Other measures 2026/27 £ million Aberdeen City 697.2 11.0 3.5 11.1 Aberdeenshire 866.2 19.2 9.3 10.3 Angus 388.1 13.9 5.3 8.6 Argyll and Bute 362.0 14.9 6.1 8.8 City of Edinburgh 1,534.5 27.9 20.0 31.3 Clackmannanshire 181.2 7.0 3.6 3.4 Dumfries and Galloway 515.8 12.5 4.2 8.3 Dundee City 521.3 5.0 0.8 6.6 East Ayrshire 460.2 9.5 3.5 6.1 East Dunbartonshire 381.8 23.7 4.1 19.6 East Lothian 379.9 3.5 1.4 2.1 East Renfrewshire 363.1 8.7 3.2 5.5 Eilean Siar 140.8 5.0 0.4 4.6 Falkirk 508.4 14.5 10.2 7.1 Fife 1,205.3 3.6 0.1 14.1 Glasgow City 2,233.8 86.7 31.9 71.7 Highland 868.0 23.4 5.4 18.1 Inverclyde 276.6 4.0 0.6 3.5 Midlothian 340.7 13.3 0.6 12.7 Moray 311.7 10.6 4.2 6.3 North Ayrshire 486.1 17.8 0.2 17.5 North Lanarkshire 1,182.6 19.3 9.2 22.0 Orkney Islands 153.3 21.3 0.2 21.1 Perth and Kinross 533.8 20.7 8.8 12.4 Renfrewshire 630.9 5.0 2.4 10.7 Scottish Borders 418.0 16.3 7.6 8.7 Shetland Islands 186.5 43.7 0.0 43.7 South Ayrshire 398.1 20.7 9.4 11.3 South Lanarkshire 1,086.7 -1.5 4.2 11.5 Stirling 323.0 11.4 5.5 6.0 West Dunbartonshire 325.7 15.9 5.4 10.5 West Lothian 634.6 20.2 8.5 11.7 Scotland 18,895.8 528.6 179.6 446.8 Note: The approach councils take to budget setting, defining budget gaps and the measures taken to address these gaps varies across councils therefore caution should be taken when comparing councils. In each council, the sum of approved savings and other measures may be greater than the budget gap; budgets may also include measures to fund additional investment or increase reserves. Approved savings include both recurring and non-recurring savings. Other measures include increases to council tax, increases to income, use of reserves and other actions, as set out in Exhibit 6. Page 123
Page 124
Appendix 2 36 Appendix 2 Progress against the expectations in the Local Government Budgets 2025/26 Councils should: Progress/ status In future, we expect to see councils encourage more active participation in the budget-setting process by ensuring that: Budget papers and financial monitoring reports provided to elected members include clear and understandable headline figures that state the impact of specific budget decisions on the overall financial position of the council Mixed progress There is mixed progress in how effectively councils are presenting key financial information in budgetary reports that are also publicly available. Budgets should link back to the council’s corporate plan to allow elected members to make spending choices better informed by, and based upon, the council’s priorities Progress Thirty-one councils linked their 2026/27 budget back to its corporate plan. Linking key financial plans back to corporate plans ensures that resources are targeted towards key strategic priorities. Fundamental information, such as the forecast budget gap, is clearly presented as part of the consultation process with residents Progress A sample review of budget consultations indicates most councils clearly identify their budget gaps, with some also providing detail over multiple financial years. Estimated costings of how specific proposals will contribute to managing the budget gap are made available to residents, including the potential contribution of any proposed increase to council tax and the anticipated impact on levels of service delivery Progress A sample review indicates that most councils make estimated costings available for proposed measures, including indicative savings or income from council tax increases, with high-level information on the anticipated impact on service delivery, though the level of detail can vary. General public consultations are supplemented by targeted consultations with groups most impacted by changes to specific services and that consideration is given to how to encourage participation Mixed progress Thirty councils consulted to some extent on their 2026/27 budget. Most councils consulted with local IJBs and residents on budget proposals, but there is a mixed approach in how councils engaged with targeted groups. The ongoing impact of budget decisions are fully assessed, including through Equality Impact Assessments, to enable elected members to make informed decisions. Progress Thirty-one councils confirmed they carried out an EQIA on their 2026/27 budgets. EQIAs are a statutory requirement to ensure decision- makers are aware of the impact on groups with a protected characteristic. Page 124
Page 125
Audit Scotland 4th Floor 102 West Port Edinburgh EH3 9DN Phone: 0131 625 1500 www.audit.scot ISBN 978 1 918486 10 0 Bulletin Local government budgets 2026/27 Page 125
Page 126
This page is intentionally left blank
Page 127
Quality of public audit in Scotland Annual report 2025/26 Page 127
Page 128
Quality of public audit in Scotland: Annual report 2025/26 | 2 Contents Key messages 3 Introduction 5 1. Ethics 6 2. Audit delivery 7 3. Quality standards 16 4. Quality results 18 5. Audit quality survey 27 6. Other measures 32 Appendix 35 Accessibility You can find out more and read this report using assistive technology on our website www.audit.scot/accessibility. Page 128
Page 129
Key messages | 3 Key messages 1 Our external and internal quality reviews found that all performance audits that were assessed demonstrated high levels of compliance with international auditing standards. This evidences that performance audit methodologies are operating well, and audit staff are consistently delivering high-quality audits. All performance audit outputs were delivered on time in accordance with the scheduled work programme. 2 Our external and internal quality reviews found that 86 per cent of financial audits (annual audits) that were assessed were of good quality with high levels of compliance with auditing standards, and audit staff are delivering high-quality audits. 3 Auditors are demonstrating that significant issues raised by previous external and internal quality reviews are being fully addressed. 4 All auditors confirmed that they have systems in place to comply with International Standard for Quality Management 1 (ISQM1) and that they comply with ethical requirements. 5 Auditors have maintained performance in the number of financial audits delivered or expected to be delivered by target dates (55 per cent for 2023/24 and 2024/25 audits) and a further eight per cent of 2024/25 audits have been completed more than a month earlier than the previous year (nine per cent for 2023/24 audits). Although audit delivery by target dates in 2024/25 was not an improvement on 2023/24, this was significantly due to auditors prioritising larger audits (such as local government councils) as part of a deliberate approach to return to target dates over the course of the appointment. 6 Audit delivery remains a key area of management focus, particularly improving delivery in the local government sector. For context, delivery has remained stable or improved across most sectors, with the exception of central government: Page 129
Page 130
Key messages | 4 • Delivery in local government by target date improved to 45 per cent. Of the 68 local government bodies that did not meet the target date, 42 were completed within three months of that date. A total of 79 per cent of local government audits (97 out of 123) were therefore completed by the end of the 2025 calendar year. • Of the 43 central government bodies that did not meet target dates, 39 were completed by the statutory deadline for laying the accounts in Parliament of 31 December 2025. This meant that 95 per cent (78 out of 82) of accounts that require to be laid in Parliament met the statutory date. • NHS audits have maintained strong delivery performance at 91 per cent. • Delivery of further education audits has improved significantly, increasing to 90 per cent meeting target dates. 7 Auditors are planning to meet target dates for 74 per cent of 2025/26 financial audits. Audit Scotland has developed an escalation procedure to support the audits most at risk of missing their target delivery dates returning back on course. The number of audits delivered on time should approach expected performance levels by the end of the appointment period in 2026/27, provided that appropriate quality and timely financial reporting and support is provided by public bodies and no significant new obstacles arise. 8 Stakeholder perceptions on the quality and usefulness of annual audits and performance audit outputs indicates that auditors are performing their work to a good level. 9 Annual audit plans and annual audit reports demonstrated a high level of compliance with the Code of Audit Practice 2021 and related guidance. Page 130
Page 131
Introduction | 5 Introduction 1. The Auditor General for Scotland and Accounts Commission published a revised Audit Quality Framework (AQF) in 2024. This sets out Audit Scotland's approach to achieving high-quality public audit across all audit work and providers. The Audit Quality and Appointments (AQA) team prepares this report to provide assurance on audit quality, including compliance with the Financial Reporting Council’s Ethical Standard, to the Auditor General for Scotland and the Accounts Commission. AQA does not conduct audit work and is independent from auditors. 2. This report is based on the Audit Quality Indicators (AQIs) from the AQF. The AQF set AQIs with targets, which are used as thresholds to prompt further investigation. This report includes the results of each AQI and, where the AQI is not met, AQA’s assessment of the circumstances and what AQA and audit providers are doing to secure continuous improvement. Public audit in Scotland 3. The Auditor General for Scotland and the Accounts Commission set out the principles and themes of public audit in Scotland and how it fits with, and responds to, the public policy environment in Scotland in Public audit in Scotland 2023–28. They also set out the scope for public audit for auditors to follow in the Code of Audit Practice 2021 (the Code). 4. The public audit model in Scotland includes a series of controls to reduce threats to auditor independence. These include the independent appointment of auditors by the Auditor General for Scotland and Accounts Commission, rotation of auditors every five years, independent fee-setting arrangements, independent approval procedures for any non-audit services work and a comprehensive AQF. Audit Scotland and appointed firms 5. Public audit is conducted by Audit Scotland auditors and appointed firms who are subject to an open and rigorous procurement process. Approximately two-thirds of financial and Best Value annual audit work is carried out by Audit Services Group, with the remaining third conducted by appointed firms. The firms appointed are Azets Audit Services, Deloitte, EY, Forvis Mazars, Grant Thornton and KPMG. Performance audit and additional Best Value work is carried out by Audit Scotland auditors. This report provides an assessment of the quality of all audit providers. Page 131
Page 132
1. Ethics | 6 1. Ethics Compliance with ethical standards Introduction 6. All auditors must comply with the FRC's Ethical Standard and the Code to avoid any actual or perceived conflicts of interest. Audit Scotland and appointed firms are required to confirm their compliance with the Ethical Standard annually. 7. Audit Scotland monitors the scope and value of any non-audit services (NAS) which could compromise the auditor’s independence and scrutinises all applications to carry out NAS. Findings Audit quality indicator 1: Percentage of audit providers confirming compliance with ethical requirements Target: 100 per cent Actual performance: 100 per cent 8. All auditors confirmed that they complied with ethical requirements. 9. Auditors carried out permitted NAS to the value of £25,000 during the 2024/25 audits. This equates to 0.09 per cent of the total fees. This compares to £23,000 which equated to 0.08 per cent of total fees during 2023/24 audits. 10. AQA only approved work that clearly complied with the Ethical Standard and the Code. Conclusion Auditors complied with their ethical requirements, so no conflicts of interest arose when carrying out their audits. Page 132
Page 133
2. Audit delivery | 7 2. Audit delivery Monitoring of audit outputs against target dates Introduction 11. Audit Scotland sets target dates for key milestones and audit completion to ensure that audits are completed in a timely manner. Audit Scotland expects auditors to do all they can to meet the targets but also recognises that there may be events beyond auditors’ control that result in the targets being missed. Audit Scotland recognises the need to balance delivery recovery while maintaining audit quality, protecting staff wellbeing, and preserving relationships with audited bodies. Achieving timely audit completion is a shared responsibility between auditors and audited bodies, supported by effective collaboration. 12. The target is for key milestones and audit completion to be delivered on time or improving. The pandemic caused audits to be delayed, and auditors are working to get back to target dates, so we consider audits that were completed less than 11 months after the previous year’s audit is concluded to be improving. 13. The Auditor General for Scotland and Accounts Commission have a work programme that covers a range of public sector bodies and services. The Auditor General for Scotland and Accounts Commission review the work programme quarterly to ensure it remains relevant, focused, and up to date and reflects their strategic priorities. Findings Audit quality indicator 2: Percentage of audits meeting key planning milestones by the target date, ie annual audit plan is submitted by target date Target: 100 per cent on time or improving Actual performance: 84 per cent 14. A total of 178 of 213 (84 per cent) 2025/26 annual audit plans due by 31 March 2026 were submitted by the target date (80 per cent in 2024/25). This failed to meet the target. Annual audit plans for further education are due by 30 June 2026. 15. Of the 35 audits where the annual audit plan was not prepared by the target date: Page 133
Page 134
2. Audit delivery | 8 • 18 were for bodies where the late completion of the 2024/25 audit contributed to the delay • four were for bodies where the 2024/25 audit was not yet complete • six were due to an administrative delay • three were due to prioritisation of other audits • two were due to audit staff availability • two were because it is the first year’s audit for the body. Audit quality indicator 3: Percentage of audits completed by the target date Target: 100 per cent on time or improving Actual performance: 63 per cent 16. Overall, 55 per cent of 2024/25 audits were completed by the target date (55 per cent in 2023/24) (Exhibit 1). A further eight per cent of audits that were completed after target dates were completed less than 11 months after the previous year’s audit (nine per cent 2023/24) (Exhibits 1 and 2, page 9). This resulted in 63 per cent of 2024/25 audits being on time or improving (64 per cent in 2023/24), below the target. 17. Further analysis shows 64 per cent of Audit Services Group audits were delivered by target dates and 40 per cent of firm audits were delivered by target dates. A further two per cent of Audit Services Group audits and a further 17 per cent of firm audits completed after target dates were finalised less than 11 months after the previous year’s audit. Exhibits 1 to 4 on the following pages provide more analysis on audit delivery based on the performance of all auditors combined. Page 134
Page 135
2. Audit delivery | 9 Exhibit 1 Audit delivery by target dates is increasing or remaining stable in all sectors apart from Central government Percentage of audits completed by target dates analysed by sector and year. Source: Audited accounts Exhibit 2 An additional eight per cent of audits are making progress to get back to target dates Percentage of 2024/25 audits on time and making progress analysed by sector. Source: Audited accounts 91% 90% 55% 51% 45% 0% 20% 40% 60% 80% 100% 2021/22 2022/23 2023/24 2024/25 NHS Further education All Central government Local government 45% 91% 51% 90% 55% 15% 10% 8% 0% 20% 40% 60% 80% 100% Local government NHS Central government Further education All On time Making progress Page 135
Page 136
2. Audit delivery | 10 Exhibit 3 2024/25 audits Number of 2024/25 audits completed analysed by sector. Sector Local government NHS Central government Further education All Number of audits 123 23 87 20 253 Audits completed by target date 55 21 44 18 138 Audits late and making progress 19 0 0 2 21 Audits late and not making progress 49 2 43 0 94 Source: Audit Scotland 18. Although delivery has not progressed as much as planned, delivery has remained stable or improved across most sectors. The Central government (CG) sector is the exception, with a decline in the number of audits meeting target dates (51 per cent in 2024/25 compared to 60 per cent in 2023/24). 19. It is important to note that the delivery target dates for CG bodies are 31 August for CG agencies and non-ministerial departments and 31 October for CG NDPBs and similar bodies. These target dates fall before the statutory deadline of 31 December. Of the 82 sets of accounts that require to be laid in Parliament, 95 per cent (78 of 82) were completed by the statutory deadline for laying. Three of these audits were completed in January 2026 and one was completed in March 2026. All four audits were delayed due to finance staff availability at the audited bodies. 20. The main reasons for the 43 CG audits that were late and not making progress were as follows: • 14 were due to prioritisation of other audits (paragraph 31). This prioritisation was used as part of a deliberate planned approach to return to target dates over the course of the appointment. • Seven were due to board dates set after the deadline. • Seven were due to delays in receiving pension information. • Five were due to finance staff availability at the audited body. Page 136
Page 137
2. Audit delivery | 11 21. Delivery in local government by target date improved to 45 per cent (42 per cent in 2023/24). A further 15 per cent of local government audits were making progress when compared to delivery in 2023/24 (14 per cent). There has been an increase in the number of council audits meeting target dates in 2024/25 compared to 2023/24, as auditors are prioritising these larger audits. 22. Of the 68 local government bodies that did not meet the target date, 42 were completed within three months of that date. A total of 79 per cent of local government audits (97 out of 123) were therefore completed by the end of the 2025 calendar year. The main reasons for local government audits being completed after this date, or yet to be completed, are late prior year sign offs and delays in receiving information from finance teams. NHS audits have maintained strong delivery performance at 91 per cent (91 per cent in 2023/24). Delivery of further education audits has improved significantly, increasing to 90 per cent meeting target dates (70 per cent in 2023/24). 23. There remains one 2022/23 audit (of a small audited body) that is not complete. The auditor is working with the body to complete the 2022/23, 2023/24 and 2024/25 audits as a single batch during the summer of 2026. 24. There is one further outstanding 2023/24 audit, relating to one council. The delay is due to challenges with the implementation of a new financial ledger. The auditor expects to sign off this audit in summer 2026 and is working with the public body to progress audit delivery for the remainder of their appointment. 25. For 2024/25 audits, 12 audits remain incomplete and are delayed by more than nine months beyond the target date. All of the outstanding audits are local government audits. Page 137
Page 138
2. Audit delivery | 12 Exhibit 4 2024/25 audits Number of 2024/25 audits completed late or still outstanding, analysed by sign-off timescales. Sector NHS CG agencies CG NDPBs Councils IJBs Other LG FE All <1 month 1 1 7 1 3 13 1–2 months 1 7 17 1 3 6 1 36 2–3 months 3 3 5 4 15 30 3–6 months 4 1 4 2 8 1 20 6–9 months 2 2 4 >9 months 5 2 5 12 Source: Audit Scotland 26. Based on auditor plans to deliver their 2025/26 audits and best estimates of future progress, 94 per cent of audits should return to expected dates by 2026/27 provided that no significant new obstacles arise. Auditors and audited bodies must continue to work collaboratively to progress delayed audits. 27. Audits failed to meet target dates or make progress for a variety of reasons. Often there are multiple causes for delays. Where there is a delay, it can lead to circumstances that cause further delays. Of the 94 audits that were late and not making progress, 37 were primarily due to the auditor, 35 were primarily due to the body and 22 were beyond the control of either. 28. Of the 37 (40 per cent) audits delayed primarily because of the auditor, 28 were because auditors prioritised other audits, eight were because of audit staff availability and one was because of an unplanned engagement quality review. 29. Of the 35 (37 per cent) audits delayed primarily because of the body, the primary reasons are shown in Exhibit 5 (page 13). Page 138
Page 139
2. Audit delivery | 13 Exhibit 5 Audit amendments Primary reasons for delays to audits that failed to meet target dates or make progress caused by audited bodies. Source: Audit Scotland 30. Of the 22 (23 per cent) audits delayed by reasons beyond the control of both the auditor and the audited body, 12 were because of delays the year before and ten were because auditors were unable to obtain audit information from bodies other than the audited body. For example, a delay in receiving pension information. 31. The largest single cause of delays was from auditors prioritising other larger audits. Audit Services Group and Grant Thornton used this as part of a planned approach to return to target dates over the course of the appointment. This is a reasonable approach to balance the need to recover to target dates with delivering high-quality audit and maintain staff wellbeing. 32. In autumn 2025, AQA developed an escalation procedure to support the delivery of audits for the Auditor General for Scotland and the Accounts Commission. The escalation procedure is designed to enable proportionate and appropriate intervention to support the return of audits to delivery by target dates by the end of this appointment round. 33. These escalation steps have been applied to the audits that are most at risk of missing their target delivery dates. This is reported as part of AQA’s audit delivery reporting to the Executive Team. 34. Auditors will continue to work closely with audited bodies to prioritise and reprioritise audit work as required – for example, reallocating resources when there are delays in responses from audited bodies due to unexpected complexities or difficulties with staffing. 10 Board date set after deadline 9 Late providing audit evidence 7 Audit amendments 9 Finance staff availability Page 139
Page 140
2. Audit delivery | 14 Audit quality indicator 4: Percentage of performance audit outputs published as planned per Audit Scotland’s work programme Target: 90 per cent Actual performance: 100 per cent 35. A total of 37 of 37 (100 per cent, 87 per cent 2024/25) performance audit outputs were published as planned during the year 2025/26, meeting the target (Exhibit 6). Exhibit 6 2025/26 performance audit outputs Number of 2025/26 performance audit outputs published on time or late by type. Source: Audit Scotland 36. The Auditor General and Controller of Audit published ten statutory reports in 2025/26, all within the statutory laying date. 10 14 6 6 3 7 7 3 1 0 2 4 6 8 10 12 14 National reports 24/25 National reports 25/26 Best Value 24/25 Best Value 25/26 Briefings 24/25 Briefings 25/26 Blogs 24/25 Blogs 25/26 On time Late Page 140
Page 141
2. Audit delivery | 15 Conclusion Auditors have maintained performance in the number of financial audits delivered or expected to be delivered by target dates (55 per cent for 2023/24 and 2024/25 audits) and a further eight per cent of 2024/25 audits have been completed more than a month earlier than the previous year (nine per cent for 2023/24 audits). Although audit delivery by target dates in 2024/25 was not an improvement on 2023/24, this was significantly due to auditors prioritising larger audits (such as local government councils) as part of a deliberate approach to return to target dates over the course of the appointment. Audit delivery remains a key area of management focus, particularly improving delivery in the local government sector. Delivery has remained stable or improved across most sectors, with the exception of central government. We anticipate that the number of financial audits delivered on time should approach expected performance levels by the end of the appointment round in 2026/27, provided that appropriate quality and timely financial reporting and support is provided by public bodies and no new significant obstacles arise. Auditors completed their planning for 2025/26 annual audits by the target date or shortly afterwards where this was reasonably possible. All performance audit outputs were delivered on time. Audit Scotland actions AQA will continue to monitor auditors’ plans to improve delivery performance and apply the escalation procedure where necessary. Audit Scotland has developed an escalation procedure to support the audits most at risk of missing their target delivery dates back on course. AQA will continue to discuss how the most delayed audits can be brought back to expected dates with both bodies and auditors. Page 141
Page 142
3. Quality standards | 16 3. Quality standards Compliance with relevant quality standards Introduction 37. Audit Scotland requires auditors to comply with the International Standard for Quality Management 1 (UK) (ISQM1). This requires auditors to annually evaluate their System of Quality Management (SoQM) and conclude whether the SoQM provides individuals with reasonable assurance that the following objectives are being achieved: • Auditors and personnel fulfil their responsibilities in accordance with professional standards and applicable legal and regulatory requirements, and conduct engagements in accordance with such standards and requirements. • Engagement reports issued by auditors are appropriate in the circumstances. Findings Audit quality indicator 5: Percentage of audit providers confirming compliance with ISQM1 system of quality management requirements Target: 100 per cent Actual performance: 100 per cent 38. All auditors confirmed that they complied with ISQM1 system of quality management (SoQM) requirements. This includes completing an annual evaluation of the SoQM. 39. Five out of seven auditors (Azets, ASG, Deloitte, Grant Thornton KPMG) concluded that the SoQM provides reasonable assurance that the objectives of the system are being achieved. Two auditors (EY and Forvis Mazars) stated that their annual evaluation of their systems of quality management also provide reasonable assurance, except for specific matters that required to be addressed. Page 142
Page 143
3. Quality standards | 17 40. EY concluded that their ‘SoQM provides reasonable assurance except for two matters related to identified deficiencies, that had a severe but not pervasive effect on the design, implementation and operation of the SoQM’.1 41. Forvis Mazars concluded that ‘except for matters related to deficiencies that have a severe but not pervasive effect on the design, implementation and operation of the SoQM, the SoQM provides the firm with reasonable assurance that the objectives of the SoQM are being achieved. No pervasive deficiencies were identified’.2 Forvis Mazars also confirmed that they have addressed the issues identified in the prior year. 42. AQA have received assurances from Forvis Mazars and EY that these matters did not impact any of their Scottish public sector audits, and that they are implementing remediation plans to address the identified issues. AQA are satisfied with these responses. 43. Audit Services Group confirmed that they complied with ISQM1 SoQM arrangements. This conclusion is supported by ICAEW who conduct a review of Audit Scotland’s SoQM as part of their annual quality review. ICAEW concluded that Audit Scotland has a clear and structured approach to monitoring audit quality and evaluating its SoQM. In their summary report ICAEW stated: ‘We did not identify any matters for attention from work on aspects of SoQM at either Audit Scotland or the appointed firms’. This demonstrates a clear commitment to improving audit quality and aligns with the expectations of ISQM1. Conclusion All auditors have systems in place to comply with ISQM1 and have appropriate plans for improvements to their audit methodologies where required. 1 Further details are available on page 20 of the EY Transparency report 2025. 2 Further details are available on page 113 of the Forvis Mazars Transparency report 2025. Page 143
Page 144
4. Quality results | 18 4. Quality results External and internal quality reviews Introduction 44. Audit quality reviews provide evidence on whether audit work complies with the Code and International Standards on Auditing (ISAs). They also highlight areas to improve audits in the future. 45. Audit Scotland commissions the Institute of Chartered Accountants in England and Wales (ICAEW) to carry out external reviews. Senior and appropriately experienced staff from each firm carry out internal reviews. 46. Reviews use the Financial Reporting Council’s scoring methodology for consistency and comparability (Exhibit 7). Exhibit 7 External quality review grading Description of each grade used in audit quality reviews. Grade Standard Description 1 Good We identified no areas for improvement of sufficient significance to include in our report. 2 Limited improvements required We identified one or more areas for improvement of limited significance. 3 Improvements required We identified one or more key findings requiring more substantive improvements. 4 Significant improvements required We identified significant concerns in one or more areas regarding the sufficiency or quality of audit evidence, the appropriateness of key audit judgments or another substantive matter such as auditor independence. Source: Financial Reporting Council Page 144
Page 145
4. Quality results | 19 Findings Audit quality indicator 6: Percentage of external quality reviews requiring no more than limited improvements Target: 80 per cent annual Actual performance for financial audits: 75 per cent Actual performance for performance audits: 100 per cent 47. ICAEW carries out a programme to review each firm over a three-year cycle, each Audit Scotland audit director over a three-year cycle for both financial audit and performance audit work, and each Audit Scotland senior manager with engagement lead responsibilities over a six-year cycle. This is to ensure a proportional approach is taken that is reflective of the size of each auditor’s portfolio. Financial audits 48. ICAEW found that six of eight (75 per cent) external reviews required no more than limited improvements (Exhibit 8). This is just below the target of 80 per cent but has significantly improved since last year (62.5 per cent) and are the best results in the current five-year audit period which began in 2022/23. Exhibit 8 Financial audit external quality reviews Number of reviews at each grade, by auditor and year. Source: Audit Scotland 0 1 2 3 4 5 1 2 3 4 1 2 3 4 1 2 3 4 2022/23 2023/24 2024/25 KPMG Grant Thornton Forvis Mazars EY Deloitte Azets Audit Services Group Page 145
Page 146
4. Quality results | 20 49. Audit Scotland achieved three audits of ‘Good’ grade and one audit with a ‘Limited improvements required’ grade. The work to support the wider scope responsibilities including Best Value was of a good standard. 50. The quality reviews identified several areas of good practice including good consideration of group accounts, a detailed understanding of the services provided by the audited body and an adaptable approach to the testing of non-pay expenditure. 51. ICAEW concluded that two Audit Scotland audits were ‘Improvements required’ grade. These grades were due to issues that are specific to these audits: gaining sufficient evidence to support the valuation of a complex financial model, and the testing approach used to gain assurance over activity-based expenditure. Apart from these issues, the audits were of good quality. ICAEW did not find any thematic findings from their reviews. 52. ICAEW’s selection included an audit that had been previously reviewed by I&Q in 2023/24. I&Q had assessed the 2023/24 audit as a ‘Limited improvements required’ grade. ICAEW assessed this audit to be of ‘Good’ grade and confirmed that the issues noted by I&Q in their 2023/24 review had been fully addressed. This provides evidence that Audit Scotland’s quality monitoring arrangements are working effectively. 53. As part of their work we requested ICAEW to review two audits that received a ‘Significant improvements required’ grade in 2023/24. ICAEW reviewed the equivalent two 2024/25 audits and found that the matters requiring significant improvement had been addressed (see paragraphs 64 and 68). This demonstrates audit teams are taking effective and timely action to make quality improvements where required. Performance audits 54. Both performance audit output reviews required no more than limited improvements (Exhibit 9, page 21) meeting the target. The results for performance audit have been at a consistently high standard for the last four years. Page 146
Page 147
4. Quality results | 21 Exhibit 9 Performance audit external quality reviews Number of reviews at each grade, by output type and year. Source: Audit Scotland Audit Quality indicator 7: Percentage of internal quality reviews requiring no more than limited improvements Target: 80 per cent annual Actual performance for financial audits: 93 per cent Actual performance for performance audits: 100 per cent 55. Auditors conduct reviews of their own portfolio of audits to assure themselves of compliance with internal quality management standards and support continuous improvement. Audit Scotland’s contract with the firms requires them to conduct at least one review of a Scottish public sector audit each year. 56. The timing of when internal reviews are conducted for each auditor varies throughout the year. This means that the 2024/25 results for Forvis Mazars are not yet available for this report and will therefore be included in next year’s report. 57. Furthermore, Exhibit 10 (page 22) has been updated to show all completed internal reviews for 2023/24. All of these additional reviews met the required target of requiring no more than limited improvements, with the exception of one Deloitte internal review which received a ‘Significant improvements required’ grade (see paragraph 67 for more detail). 0 1 2 1 2 3 4 1 2 3 4 1 2 3 4 2023/24 2024/25 2025/26 Performance audit: Auditor General Performance audit: Joint Performance audit: Accounts Commission Page 147
Page 148
4. Quality results | 22 Financial audits 58. Auditors found that 13 of 14 internal reviews (93 per cent) required no more than limited improvements, meeting the target. Exhibit 10 Financial audit internal quality reviews Number of reviews at each grade, by auditor and year. Source: Audit Scotland 59. The reviews identified several areas of good practice including: • the planning files completed were a good standard, with clear documentation of the audit approach and risk assessment • clear oversight by engagement leads • scrutiny of key judgements was evident in audit files including a thorough review of indexation applied to non-current assets which identified several errors • audit work was well documented on audit files to support conclusions in the Annual Audit Report. 60. One internal review for Audit Services Group was an ‘Improvements required’ grade. Areas for improvement include: • strengthening the documentation of the risk assessment and substantive testing of a material valuation model • improving the risk assessment of the audited body’s IT applications used to prepare the financial statements 0 2 4 6 8 10 1 2 3 4 1 2 3 4 1 2 3 4 2022/23 2023/24 2024/25 KPMG Grant Thornton Forvis Mazars EY Deloitte Azets Audit Services Group Page 148
Page 149
4. Quality results | 23 • enhancing the review of the methodology and assumptions applied by a management expert used by the audited body to value non-current assets. Performance audit outputs 61. Both performance audit output reviews required no more than limited improvements (Exhibit 11), meeting the target. Exhibit 11 Performance audit internal quality reviews Number of reviews at each grade, by output type and year. Source: Audit Scotland 62. The reviews identified several areas of good practice including: • strong evidence of the team scoping the audit effectively • the audit team developed a records management note which meant that most files could be easily located • individual team members’ skills and expertise strengthened the team and improved the efficiency of the audit work. Audit quality indicator 8: Percentage of external quality reviews requiring significant improvements Target: 0 per cent annual Actual performance (for both financial and performance audits): 0 per cent Financial audits 63. External quality reviews did not identify any financial audit outputs as requiring significant improvements, meeting the target (12.5 per cent in 2023/24). 0 1 2 1 2 3 4 1 2 3 4 1 2 3 4 2023/24 2024/25 2025/26 Performance audit: Auditor General Performance audit: Joint Performance audit: Accounts Commission Page 149
Page 150
4. Quality results | 24 64. ICAEW conducted a focused review of one 2023/24 audit completed by ASG that required significant improvements and found that the matters requiring significant improvement had been addressed. Performance audit outputs 65. External quality reviews did not identify any performance audit outputs as requiring significant improvements, meeting the target. Audit quality indicator 9: Percentage of internal quality reviews requiring significant improvements Target: 0 per cent annual Actual performance (for both financial and performance audits): 0 per cent Financial audits 66. Internal quality reviews did not identify any financial audit outputs as requiring significant improvement, meeting the target. 67. This was shown as 0 per cent in the 2024/25 Quality of public audit in Scotland annual report, based upon the information that was available at the time. After the report was published, Deloitte reported that one of their 2023/24 Scottish public sector audits had been reviewed by their internal quality team and had received a ‘Significant improvements required’ grade (Exhibit 10, page 22). 68. The review identified several areas which did not meet the expected auditing standards. The main findings related to overuse of substantive analytical review, insufficient evidence on property plant and equipment work, and other documentation failures. The review did not find any errors in the 2023/24 audited accounts. 69. Deloitte addressed the issues found by the internal quality review. ICAEW reviewed the 2024/25 audit to ensure that the issues had been fully addressed. ICAEW’s review found that the matters requiring significant improvement had been addressed. Performance audit outputs 70. Internal quality reviews did not identify any performance audit outputs as requiring significant improvements, meeting the target. Page 150
Page 151
4. Quality results | 25 ICAEW Audit Scotland summary 71. ICAEW provided the following comments on the audits they reviewed: We undertook eight file reviews of financial audits, six covering Audit Scotland and two from appointed firms. In addition, we conducted a focused review to follow up on issues that required significant improvement at our previous visit in a file we reviewed at Audit Scotland. We also inspected two performance audits, both conducted by Audit Scotland. The quality of audit work, across financial and performance audits, was of a generally good standard in many areas. On the financial audit files reviewed, six of the eight files were either good or generally acceptable. We did not identify any significant thematic areas. In the files requiring improvement, both related to audits conducted by Audit Scotland, we identified weaknesses in testing financial assets, and risk assessing, including the development of an audit response to expenditure with differing recognition criteria. The performance audits were both generally of a good standard. As part of the financial audit, we also reviewed audit work to support the wider scope responsibilities. We did not identify any findings in these reviews. The responses of both Audit Scotland and the appointed firms demonstrate they are intending to take appropriate action to address all the findings raised. This includes plans to conduct detailed root cause analysis on files that require improvement. We identified good practice across all files reviewed and mainly related to aspects of comprehensive and clearly documented audit work and audit approaches. We did not identify any matters for attention from work on aspects of SoQM at either Audit Scotland or the appointed firms. Conclusion Our external and internal quality reviews found that all performance audits demonstrated high levels of compliance with international auditing standards. This evidences that performance audit methodologies are operating well, and audit staff are delivering high-quality audit work. Our external and internal quality reviews found that 86 per cent of financial annual audits were of good quality with high levels of compliance with auditing standards, and audit staff are delivering high- quality audits. ICAEW’s follow ups of audits previously assessed as requiring more than limited improvements provide assurance that auditors are taking sufficient and appropriate action in response to review findings. Page 151
Page 152
4. Quality results | 26 Audit Scotland actions Audit Scotland’s Innovation and Quality team will support the audits with improvements required through facilitating root cause analysis, undertaking hot reviews and supporting engagement quality reviews. Page 152
Page 153
5. Audit quality survey | 27 5. Audit quality survey Stakeholder perceptions Introduction 72. AQA commissions Progressive to conduct an annual independent stakeholder feedback survey. The survey is sent to all directors of finance, chief executives, and chairs of boards or audit committees (or their respective equivalents) whose 2024/25 audits were completed by the close of the survey. The survey invites the recipients to give their perspectives about the 2024/25 audit. 73. Progressive invited 547 individuals (539 in 2023/24) in audited bodies to provide feedback on the 2024/25 financial audits and performance audit outputs published in the past year. A total of 170 individuals (278 in 2023/24) completed responses (31 per cent, 51.6 per cent 2023/24). Although, the response rate has decreased in 2024/25, the response rate is similar to other stakeholder feedback surveys of this type. The response rate is sufficiently large to show that stakeholders are willing to engage with us on their views of public audit and making further improvements to audit quality. 74. The survey asked stakeholders to consider financial audit work under the following criteria: • Perception of the usefulness of the annual audit overall. • Perception of the appropriateness of coverage of wider scope. • Perception of the appropriateness of coverage of Best Value (local government only). 75. The survey asked stakeholders to consider performance audit outputs against principles based on the International Organisation of Supreme Audit Institutions (INTOSAI) standards. These were whether a report is: • high quality, which means that the report is comprehensive, convincing, timely, reader-friendly and balanced • useful, which means that recommendations are likely to contribute significantly to addressing the weaknesses or problems identified by the audit. 76. The survey asked stakeholders to respond to questions using a scale of 1 to 5 where 1 is ‘very poor’ and 5 is ‘very good’. We analyse responses by using the mean score. This is the average of respondents’ views on a question within a particular category, either by sector or auditor. Page 153
Page 154
5. Audit quality survey | 28 Findings Audit quality indicator 10: Perception of the usefulness of the annual audit Target: 4 out of 5 Actual performance: Perception of the usefulness of the annual audit overall: 4.2 out of 5 Perception of the appropriateness of coverage of wider scope: 4.2 out of 5 Perception of the appropriateness of coverage of Best Value: 3.7 out of 5 Perception of the usefulness of the annual audit overall 77. Stakeholders’ views on the usefulness of the annual audit have slightly decreased with 83 per cent of stakeholders believing their annual audit is fairly or very useful (85 per cent in 2023/24) with a mean score of 4.2 (4.3 in 2023/24). This still exceeds the target in all sectors (Exhibit 12). Exhibit 12 Stakeholder perceptions on financial audits exceeds the target in all sectors Mean score for the usefulness of the annual audit. Source: Progressive 4.2 4.2 4.5 4.1 4.2 0 1 2 3 4 5 Local government Central government NHS Further education All sectors 2022/23 2023/24 2024/25 Page 154
Page 155
5. Audit quality survey | 29 Perception of the appropriateness of coverage of wider scope 78. Stakeholders’ views on how well auditors covered wider scope in their annual audit report met the target in all sectors (Exhibit 13), with a mean score of 4.2 (new indicator in 2024/25); 82 per cent of stakeholders reported that the audit report covered the wider scope of the audit fairly or very well. Exhibit 13 Stakeholders’ views on wider scope coverage met the target in all sectors Mean score for the appropriateness of coverage of wider scope in the annual audit report. Source: Progressive Perception of the appropriateness of coverage of Best Value 79. Stakeholders’ views on how well auditors covered Best Value in their annual audit report decreased at 3.7 (3.9 in 2023/24) and did not meet the target. The scores are based on very small sample sizes which can result in larger fluctuations. AQA’s review of 2024/25 annual audit plans and annual audit reports found that generally, auditors were complying with the requirements of the current Code of Audit Practice. Best Value audit is an area currently under review in the proposed revised Code of Audit Practice. Audit quality indicator 11: Stakeholder perception on the quality of performance audit outputs Target: 4 out of 5 Actual performance: Overview reports: 4.1 out of 5 Performance audits: 4.1 out of 5 4.0 4.2 4.5 4.2 4.2 0 1 2 3 4 5 Central government Local government NHS Further education All sectors 2024/25 Page 155
Page 156
5. Audit quality survey | 30 80. Stakeholder perception on the quality of performance audit outputs has overall, slightly improved. The mean score is 4.1 (4.0 in 2023/24) for performance audits and 4.1 for overview reports (4.1 in 2023/24), (Exhibit 14), meeting the target for both types of report. Exhibit 14 Stakeholder perception of the quality of performance audit outputs has slightly improved Mean score of perception of the quality of performance audits and overview reports. Source: Progressive Audit quality indicator 12: Stakeholder perception on the usefulness of performance audit outputs Target: 4 out of 5 Actual performance: Overview reports: 4.2 out of 5 Performance audits: 3.9 out of 5 81. Stakeholder perception on the usefulness of performance audit outputs has also overall, slightly improved. The mean score is 3.9 (3.9 in 2023/24) for performance audits and 4.2 for overview reports (4.0 in 2023/24), (Exhibit 15, page 31), just below the target for performance audits and meeting the target for overviews. 4.1 4.14.0 4.14.1 4.1 0 1 2 3 4 5 Performance audits Overviews 2023 2024 2025 Page 156
Page 157
5. Audit quality survey | 31 Exhibit 15 Stakeholder perception of the usefulness of performance audit outputs has slightly improved Mean score of perception of the usefulness of performance audits and overview reports. Source: Progressive Conclusion Stakeholder perceptions on the quality of audit work indicates that auditors are performing their work to a good level. There is no systemic cause for concern in the small number of indicators below target. Audit Scotland actions AQA has discussed the results with each auditor to understand the circumstances where feedback has been negative. 4.0 3.93.9 4.03.9 4.2 0 1 2 3 4 5 Performance audits Overviews 2023 2024 2025 Page 157
Page 158
6. Other measures | 32 6. Other measures Other measures of audit quality Introduction 82. AQA reviewed a sample of audit outputs to assess their quality and to monitor timelines, scope, compliance with the Code requirements, compliance with Guidance on planning the annual audit, compliance with ISAs (UK) and clarity of recommendations. 83. High-quality audit outputs provide assurance to stakeholders and add value by recommending improvements, identifying risks, increasing insight, and facilitating foresight. Findings Annual audit plans (AAPs) 84. All AAPs reviewed showed a good level of compliance with the 2021 Code and 2024/25 Guidance on planning the annual audit. Areas of good practice by auditors included: • clear explanation of auditors’ responsibilities in relation to Best Value for both central government and local government bodies • clear explanations of significant risks identified and planned responses to address these risks • statements noting that wider scope risks are subject to review throughout the audit • statements that qualitatively material items may be reported even if below clearly trivial threshold • an explanation of the respective roles of the Auditor, Accounts Commission, Controller of Audit and Audit Scotland. 85. Our review found significant improvements in how auditors of local government pension funds described their planned audit work on Best Value, and in the way auditors of non-local government bodies explain their work to meet their Best Value responsibilities compared to prior year. Annual audit reports (AARs) 86. Most AARs (90 per cent) reviewed demonstrated a high level of compliance with the Code and related guidance. Examples of good practice included: Page 158
Page 159
6. Other measures | 33 • clear explanations on the significant judgements made in determining materiality • use of audit quality indicators to set out the timing and quality of working papers providing a helpful summary for the audited body • clear narrative that explains what the auditor found and the auditor’s judgement in respect of the effectiveness and appropriateness of the arrangements that audited bodies have in place regarding the wider-scope audit • clear recommendations that are useful, specific and practicable • clear statements on causes of delays to audits with clear details on the reasons for additional fees • detailed follow-up of prior year recommendations. 87. The most common areas for improvement were: • Auditors should ensure that all AARs are addressed to the audited body and (depending on the sector) to either the Auditor General or Controller of Audit. • Auditors should ensure that all AARs provide an explanation of the significant judgements in determining materiality amounts. • Auditors should ensure that all AARs contain a reference to the level of performance materiality that has been set and how this was applied by the auditor in their audit of the accounts. • Auditors should ensure that all AARs contain a clear conclusion on the effectiveness of arrangements by the accountable officer to secure Best Value. • Auditors should ensure that all recommendations have an agreed target date and responsible officer for implementing recommendations. Best Value thematic reports 88. All Best Value thematic reports that were reviewed were of a good quality, clearly written and complied with the Guidance on planning the audit and the Code of audit practice. Conclusion Auditors’ AAPs, AARs and Best Value thematic reports demonstrated a high level of compliance with reporting requirements under the Code and related guidance. Page 159
Page 160
6. Other measures | 34 Audit Scotland actions AQA has discussed findings with auditors and confirmed the changes auditors plan to make in response to the findings. AQA will continue to monitor outputs to ensure they are of high quality and compliant with the Code and related guidance. Page 160
Page 161
Appendix | 35 Appendix Audit Quality Indicators 2025/26 3 Improving means within 11 months from date output was last signed. This is considered an appropriate timescale for effective audit reporting to stakeholders. AQI Service area Target Actual Result 1 Independence Percentage of audit providers confirming compliance with ethical requirements. Ethics, page 6 100% 100% (100% for 2023/24) Target met 2 Performance monitoring and remediation Percentage of audits meeting key planning milestones by the target date, ie annual audit plan is submitted by target date. Audit delivery, page 7 100% on time or improving3 84% (80% for 2024/25) Target not met 3 Performance monitoring and remediation Percentage of audits completed by the target date. Audit delivery, page 8 100% on time or improving 63% (64% for 2023/24) Target not met 4 Performance monitoring and remediation Percentage of performance audit outputs published as planned per Audit Scotland’s work programme. Audit delivery, page 14 90% 100% (87% for 2024/25) Target met Page 161
Page 162
Appendix | 36 AQI Service area Target Actual Result 5 Quality monitoring Percentage of audit providers confirming compliance with ISQM1 system of quality management requirements. Quality standards, page 16 100% 100% (100% for 2023/24) Target met 6 Quality monitoring Percentage of financial audit external quality reviews requiring no more than limited improvements. (Grade 1 & 2) 80% annual 75% (62.5% for 2023/24) Target not met Percentage of performance audit external quality reviews requiring no more than limited improvements. (Grade 1 & 2) Quality results, page 19 100% (100% for 2023/24) Target met 7 Quality monitoring Percentage of financial audit internal quality reviews requiring no more than limited improvements. (Grade 1 & 2) 80% annual 93% (85% for 2023/24) Target met Percentage of performance audit internal quality reviews requiring no more than limited improvements. (Grade 1 & 2) Quality results, page 21 100% (100% for 2023/24) Target met 8 Quality monitoring Percentage of financial audit external quality reviews requiring significant improvements. (Grade 4) 0% annual 0% (12.5% for 2023/24) Target met Percentage of performance audit external quality reviews requiring significant improvements. (Grade 4) Quality results, page 23 0% (0% for 2023/24) Target met Page 162
Page 163
Appendix | 37 4 This was shown as 0% in the 2024/25 Quality of public audit in Scotland annual report, based upon the information that was available at the time. However, after the report was published Audit Scotland was informed by Deloitte that one of their audits had been reviewed by their internal quality team and had received a ‘Significant improvements required’ grade. This is also shown at Exhibit 10. 5 Target applies to a, b, and c (where applicable). AQI Service area Target Actual Result 9 Quality monitoring Percentage of financial audit internal quality reviews requiring significant improvements. (Grade 4) 0% annual 0% (7% for 2023/244) Target met Percentage of performance audit internal quality reviews requiring significant improvements. (Grade 4) Quality results, page 24 0% (0% for 2023/24) Target met 10 Stakeholder perception a) Perception of the usefulness of the annual audit overall 4/55 a) 4.2/5 (4.3/5 2023/24) Target met b) Perception of the appropriateness of coverage of wider scope b) 4.2/5 (New indicator) Target met c) Perception of the appropriateness of coverage of Best Value (LG only) Audit quality survey, page 28 c) 3.7/5 (3.9/5 2023/24) Target not met 11 Stakeholder perception Perception of the quality of: a) Overview reports 4/5 a) 4.1/5 (4.1/5 2023/24) Target met b) Performance audits Audit quality survey, page 29 b) 4.1/5 (4.0/5 2023/24) Target met Page 163
Page 164
Appendix | 38 AQI Service area Target Actual Result 12 Stakeholder perception Perception of the usefulness of: a) Overview reports 4/5 a) 4.2/5 (4.0/5 2023/24) Target met b) Performance audits Audit quality survey, page 30 b) 3.9/5 (3.9/5 2023/24) Target not met Page 164
Page 165
Quality of public audit in Scotland Annual report 2025/26 Audit Scotland, 4th Floor, 102 West Port, Edinburgh EH3 9DN Phone: 0131 625 1500 www.audit.scot ISBN 978 1 918486 13 1 AS.5.0 Page 165
Page 166
This page is intentionally left blank
Page 167
Code of Audit Practice 2026 Prepared by Audit Scotland for the Auditor General for Scotland and Accounts Commission for Scotland June 2026 Page 167
Page 168
2Code of Audit Practice 2026 Contents Foreword 3 1. Status, application and principles 5 2. Assurance on the annual accounts 12 3. Assurance on wider scope reporting areas 15 4. Assurance on Best Value arrangements 23 5. Planning audit work and reporting results 28 6. Assurance on specific areas 35 7. Insights, intelligence and other support 37 8. Assurance on smaller audited bodies 41 9. Performance audits 43 Appendix 1. Supplementary guidance and professional standards 46 Appendix 2. Parties in public audit in Scotland 49 Appendix 3. Statutory responsibilities 53 Glossary 57 Accessibility You can find out more and read this report using assistive technology on our website www.audit.scot/accessibility. Page 168
Page 169
3Foreword Foreword Auditor General for Scotland and Chair of the Accounts Commission for Scotland Stephen Boyle Auditor General for Scotland Jo Armstrong Chair of Accounts Commission for Scotland Our Code of Audit Practice (the Code) defines the independent external audit of public bodies in Scotland for the five-year period from 2027/28 to 2031/32. All auditors appointed by the Auditor General and the Accounts Commission to perform audits for that period are required to comply with the Code. We have retained a single, combined Code to apply across all sectors to promote consistency, effectiveness, and value in public audit work in Scotland. We believe this will support assurance across organisational and sectoral boundaries as public services increasingly work in partnership and look to integrate service delivery. Public bodies are responsible for safeguarding public finances, protecting against fraud and other irregularities, making the best use of their resources and ensuring good governance, and securing Best Value in the delivery of their functions. External audit is an essential feature which provides assurance that public bodies properly discharge their responsibilities. Auditors are independent of the bodies they audit and report their findings in public. In that way, auditors provide independent assurance and promote improvement. This supports democratic scrutiny of how public money is raised and spent, and the outcomes achieved. We consulted widely on the development of this Code in order that it reflects the issues stakeholders perceive to be the most relevant to public audit over the next five years. It builds on the 2021 Code, but a number of refinements have been made to the audit model, including a separate assurance framework for bodies with the lowest levels of expenditure. There will also be a stronger focus on Best Value in local government by requiring appointed auditors to focus on Best Value, and removing a perceived overlap with wider scope work; annual thematic reviews will continue but will be done on a sample basis and delivered by a central Audit Scotland team. We believe this Code adopts a principles- based approach, allowing auditors to exercise professional judgement and respond flexibly to local risks. It is concise, high-level and applicable across all public bodies, while enabling auditors to tailor their work to sector developments and the audited body’s specific circumstances. The Code supports the outcomes set out in Public audit in Scotland and underlines the respective responsibilities of auditors and audited bodies including partnership working, financial management and sustainability, and performance management and reporting. Once we have appointed an auditor, they operate independently. The Code cannot direct an auditor Page 169
Page 170
4Foreword to reach a particular judgement or express a particular opinion; the audit work required is influenced by the Code, professional standards, and local risks and circumstances. Although the Code cannot place requirements on audited bodies themselves, successful delivery of an audit is predicated on audited bodies meeting responsibilities to support the audit process. This includes providing auditors with the facilities and information they reasonably require on a timely basis and to an appropriate standard, making use of technology to deliver an efficient audit, and facilitating a data-driven audit approach where possible. Timely completion of audits is important to accountability; publication of audited accounts is a joint endeavour between appointed auditors and audited bodies who should work together to achieve completion dates. We believe the Code provides a robust framework for high quality, independent audit during a period of significant change and uncertainty, helping to strengthen accountability and drive improvement in the use of public money through strong safeguards of independence, objectivity and audit quality, and by providing the people of Scotland with independent assurance on the use of public money. Page 170
Page 171
51. Status, application and principles 1. Status, application and principles Purpose of this section 1. This section covers the purpose of public audit, the status of the Code and its application, and sets out principles which should underpin the conduct and work of appointed auditors in discharging their responsibilities. Purpose of public audit 2. Public sector bodies are accountable for their use of public money. Independent external audit of the services delivered by public bodies and the spending they incur in doing so is a necessary safeguard to provide objective assurance to the public and their representatives to support democratic accountability. 3. Public audit in Scotland is founded on the statutory responsibilities of the Auditor General, the Accounts Commission, and the auditors they appoint. 4. Public sector external auditors examine whether public money is properly accounted for and that resources are used well. As with the audit of the annual accounts in the private sector, public sector external audit involves providing an opinion on the truth and fairness of the annual accounts, but it also covers an audited body’s arrangements for ensuring:: • public money is being used in accordance with the law and for approved purposes • propriety and that public business is being conducted in a way that meets parliamentary and public expectations • economy, efficiency and effectiveness in its use of resources. 5. It is not part of an auditor’s functions to question the merits of an audited body’s policy, but they examine the arrangements by which policy decisions are reached and consider the effects of legislation and guidance, and the implementation of policy. 6. Public audit cannot, however, act as a substitute for audited bodies’ own responsibilities. It does not replace the need for an audited body to obtain legal or other professional advice and to put in place effective internal control arrangements, including arrangements for internal audit. It is for audited bodies to ensure that their business is conducted in Page 171
Page 172
1. Status, application and principles 6 accordance with the law and proper standards, and that public money is safeguarded, properly accounted for and used economically, efficiently and effectively. Purpose and status of the Code 7. This Code describes the purpose and scope of public audit in Scotland. It replaces the Code issued in June 2021 and comes into effect for audits of financial years starting from 2027/28. 8. The Code sits at the centre of the arrangements for public audit in Scotland, and it is a condition of their audit appointment that auditors comply with its requirements. The Code: • sets out the framework for strong and effective public audit which supports accountability and provides independent assurance that public money is spent and reported properly • applies to all audit work undertaken by appointed auditors and by performance auditors including the audit of the annual accounts, which has a wider scope than the private sector, performance auditing and auditing Best Value arrangements • reflects the legal requirements for audit, as well the professional standards with which auditors must comply • sets out the arrangements which promote auditor independence and monitor audit quality. 9. Guidance is used to help inform auditors’ judgements and promote a consistent approach to changing public service priorities and risks. The types of guidance which supplement this Code are explained in Appendix 1 (page 46). Framework for public audit in Scotland Code of Audit Practice Public audit Letter of appointment Quality arrangements Audit Scotland guidance Public audit in Scotland Legislation Page 172
Page 173
1. Status, application and principles 7 General principles of public audit 10. The Code continues to take a principles-based approach. This allows appointed auditors to adopt a flexible approach that is responsive to sector developments and to the specific circumstances faced by each audited body. The extent and nature of work required to perform a high- quality audit is determined by each appointed auditor in response to local circumstances. General principles of public audit: • Public accountability • Wider audit scope • Integrity, objectivity and independence • Professional judgement • Risk-based and proportionate • Professional scepticism • Data-driven • Appropriate skills and knowledge • Audit quality • Cooperation • Public reporting Code of Audit Practice Public accountability 11. Appointed auditors carry out their work on behalf of the public and in the public interest. 12. Auditors should, however, be mindful of the unique position they hold, and ensure that they have open and transparent arrangements in place that recognise their responsibilities to both the audited body and also to the public. Wider audit scope 13. Reflecting the fact that public money is involved, public audit is planned and undertaken from a wider perspective than in the private sector. The wider scope reporting areas specified by the Auditor General broadens the audit of the annual accounts to include consideration of financial management; financial sustainability; vision, leadership and governance; and use of resources to improve outcomes. 14. In local government, the wider scope of the audit includes a statutory responsibility to consider the arrangements to secure Best Value which is equivalent to the wider scope reporting areas. Integrity, objectivity and independence 15. Appointed auditors carry out their work with integrity and objectivity to underpin and safeguard their independence at all times. Auditors Page 173
Page 174
1. Status, application and principles 8 also comply with the applicable ethical framework, including any ethical standards set by a relevant regulatory body, along with any additional requirements set out by the auditor’s recognised supervisory body, or any other body charged with oversight of the auditor’s independence. 16. Appointed auditors must be, and should be perceived to be, impartial and independent. This gives stakeholders confidence that auditors will have the willingness to challenge management where appropriate, and conduct a robust audit. Accordingly, auditors do not carry out any other work for an audited body if that work would impair their independence in carrying out any of their responsibilities under this Code or might reasonably be perceived as doing so. Audit Scotland has safeguards in place to consider any non-audit services. Professional judgement 17. Appointed auditors discharge their responsibilities in compliance with the requirements of legislation, this Code and supplementary guidance from Audit Scotland, and relevant professional standards. 18. The Code cannot direct an auditor to reach a particular conclusion. Auditors use their professional judgement to apply the principles and requirements set out in this Code to the particular circumstances that exist at different audited bodies. Auditors conduct their work economically, efficiently and effectively, and in as timely a way as possible. 19. An integrated approach is adopted to work under the Code, where the knowledge gathered, and work carried out in support of each of the auditor’s responsibilities, informs the auditor’s judgements as a whole. Risk-based and proportionate 20. Audits are fundamentally risk-based. This means that they are driven by a robust risk assessment, informed by a thorough understanding of the audited body and its environment. Auditors allocate more time and resources to higher risk areas. This principle is the source of most of the proportionality that is inherent in an audit. 21. Audits are designed to meet the auditor’s responsibilities set out in this Code tailored to the circumstances in place at the audited body and the audit risks to which they give rise. 22. Auditors weigh the significance of issues identified against the amounts involved in relation to the size of the body concerned to determine whether further action is proportionate and in the public interest, having regard to any guidance issued by Audit Scotland. 23. Auditors also consider carefully the practical and resource implications for the audited body when framing recommendations arising from their work. Page 174
Page 175
1. Status, application and principles 9 Professional scepticism 24. In carrying out their work, appointed auditors exercise professional scepticism. Professional scepticism is a core part of an auditor’s mindset. It is characterised by a willingness to challenge audited bodies, and the experts they use, to look for contradictory as well as corroborative evidence and to critically assess information. 25. Auditors obtain and document such information and explanations as they consider necessary to provide sufficient, appropriate evidence in support of their conclusions and opinions. Data-driven 26. In order to undertake audits efficiently, where possible, appointed auditors adopt a data-driven (or data-enabled) audit that uses data analytics and technology to review, analyse, and test datasets. 27. A data-driven approach allows deeper insights, detects risks and anomalies, and can increase audit coverage and efficiency. Appropriate knowledge and skills 28. Auditors ensure that they have the necessary skills, knowledge and experience to discharge their functions effectively and have arrangements in place to ensure that audit teams have sufficient knowledge of the relevant public sector financial reporting, regulatory and legislative frameworks. 29. Skills include, not only the traditional skill-sets required of auditors, but also the ability to deliver data-driven audits. 30. Auditors ensure that audit teams comply with statutory and other relevant requirements relating to the security, transfer, holding, disclosure and disposal of information, particularly personal information received or obtained during the course of their audit work. Audit quality 31. Auditors are expected to carry out audits to a high standard of quality. The Auditor General and the Accounts Commission require assurance on the quality of public audit in Scotland through comprehensive audit quality arrangements that apply to all audit work and providers. 32. Audit Scotland maintains and delivers an Audit Quality Framework through a team which is independent of appointed auditors. The team assesses audit quality and provides assurance through independent reporting to the Auditor General and the Accounts Commission. Results are used to highlight good practice and areas for improvement. This supports continuous improvement in audit quality. 33. The Audit Quality Framework includes a programme of external quality assessments of all the appointed auditors by an independent Page 175
Page 176
1. Status, application and principles 10 professional regulatory body. Audited bodies’ views on the audit received are also considered on an annual basis. This information is used to assess the delivery of audit work and the extent to which it meets the relevant professional standards. Cooperation 34. Public bodies increasingly operate, commission and deliver services in a range of partnerships and other forms of joint working or contracts with other public, private or third-sector bodies. In meeting their statutory duties, appointed auditors consider how best to obtain assurance over such arrangements, working effectively with other auditors where appropriate. 35. Auditors are mindful of the activities of inspectorates and other scrutiny bodies and take account of them where relevant to prevent duplication and ensure that the demands on audited bodies are managed effectively. In so doing, auditors are informed by the reported results of inspectorates and other scrutiny bodies in relation to corporate or service performance. 36. Auditors are not required to carry out procedures to assess the quality of, or re-perform, the work of inspectorates and other scrutiny bodies, except where it would be unreasonable not to do so, for example, to provide assurance in support of the audit opinion on the financial statements. 37. In respect of the audited body, auditors: • adopt a constructive approach to their work • share and discuss their audit plan at an early stage • build effective coordination arrangements with internal audit, using the work of internal audit where, in the auditor’s judgement and in line with professional standards, this is appropriate. 38. Where there is a change in the appointed auditor, auditors also ensure that they cooperate effectively during the handover period, having regard to any guidance issued by Audit Scotland to support the efficient and effective discharge of responsibilities. 39. Appointed auditors are required to work collaboratively with Audit Scotland in sharing intelligence and insights. This includes contributing to the performance audit programme of the Auditor General and Accounts Commission, including the production of statutory reports. Where Audit Scotland performance auditors request information from appointed auditors, it is important that such information is provided in a timely manner. Page 176
Page 177
1. Status, application and principles 11 40. Cooperation also includes highlighting current issues as well as attending and contributing to periodic meetings with other appointed auditors hosted by Audit Scotland. Public reporting 41. Appointed auditors report their findings publicly. Auditors report using their professional judgement and applying the following principles: • Reporting on a timely basis, clearly, concisely and objectively without fear or favour. Timely reporting means: – producing audit reports on time, supported by high-quality audit work, to allow audited bodies to comply with the requirements placed on them to publish their audited annual accounts – ensuring that when matters of concern arise during the course of the audit, auditors raise them promptly with the body and consider whether the matter needs to be brought to public attention at the appropriate time. • Using language that readers will understand, reflecting the principle that audit reporting is for the benefit of the public as well as the body being audited. • Reflecting the wider scope of public audit by covering the range of audit responsibilities under the Code, and being open and transparent about the scope and nature of the work carried out. • Setting conclusions out clearly, along with the evidence on which those conclusions are based. • Where there are areas for improvement, explaining the impact they have on the audited body, and the actions the body should take in response in the form of specific and measurable recommendations. Responsibilities of audited bodies 42. This Code applies to the audit of public bodies which spend public money, including the Scottish Government, central government bodies, the NHS in Scotland, local government bodies and further education colleges. 43. The Code cannot place requirements on audited bodies themselves. The successful delivery of an audit under the Code is, however, predicated on the audited body meeting its statutory responsibilities to provide the auditor with the facilities and information the auditor reasonably requires for the purposes of their functions on a timely basis and to an appropriate standard. 44. Each section of this Code therefore sets out the responsibilities of audited bodies as required by legislation, other codes, or manuals. Page 177
Page 178
122. Assurance on the annual accounts 2. Assurance on the annual accounts All audited bodies except smaller audited bodies Purpose of this section 45. This section of the Code covers the audit of a public body’s annual accounts. 46. An auditor appointed to a body that meets the definition of a smaller audited body should refer to Section 8 (page 41) of the Code for the adaptations that apply to smaller bodies. Responsibilities of audited bodies 47. Audited bodies must prepare annual accounts comprising financial statements and other related reports. They have responsibility for: • preparing financial statements which give a true and fair view of their financial position and their expenditure and income, in accordance with the applicable financial reporting framework and relevant legislation • maintaining accounting records and working papers that have been prepared to an acceptable professional standard and that support the disclosures in their financial statements and related reports • assessing the appropriateness of the going concern basis of accounting • ensuring the regularity of transactions, by putting in place systems of internal control to ensure that the transactions are in accordance with applicable legislation and guidance • preparing and publishing, along with their financial statements, related reports such as an annual governance statement, management commentary/performance report and a remuneration report in accordance with prescribed requirements • ensuring that the management commentary/performance report is fair, balanced and understandable while communicating relevant information to users about the body and its financial performance clearly and concisely • allowing auditors access to accounting records and IT systems in a manner that facilitates the delivery of a data-driven audit. Page 178
Page 179
2. Assurance on the annual accounts 13 48. The specific responsibilities of different types of audited body regarding the production and reporting of their annual accounts vary depending on relevant legislation and other requirements. However, the publication of the annual accounts is an essential means by which the audited body accounts for its stewardship and use of the public money at its disposal. 49. The precise form and content of the audited body’s annual accounts, and any additional schedules or returns for consolidation purposes, should reflect the requirements of the applicable financial reporting framework in place for that particular type of audited body and any additional guidance issued in support of that framework. Responsibilities of appointed auditors 50. Appointed auditors are responsible for performing an audit of the annual accounts prepared by public bodies and expressing an opinion on them. 51. Other than for smaller audited bodies explained in Section 8, the Auditor General and the Accounts Commission require the audit of a body’s annual accounts to be carried out in accordance with: • International Standards on Auditing (ISAs) in the UK issued by the Financial Reporting Council (FRC) • guidance on the application of the ISAs (UK) to public audit provided in the Public Audit Forum’s 10: Audit of Financial Statements and Regularity of Public Sector Bodies in the United Kingdom • the Ethical Standard issued by the FRC. 52. Appointed auditors consider significant risks of misstatement in the financial statements and related reports within the annual accounts. They use their professional judgement to assess risks within individual audited bodies and design their audit approach in response to those risks. Auditors should pay due regard to any guidance provided by Audit Scotland. 53. Auditors are required by ISA (UK) 570 to assess the appropriateness of the going concern basis of accounting. Auditors should pay due regard to the application guidance in Practice Note 10 which advises that in most public bodies, the use of the going concern basis of accounting is straight-forward because the applicable financial reporting frameworks envisage that it will apply where the body’s services will continue to be delivered by the public sector. 54. For the avoidance of doubt, a conclusion that the going concern basis of accounting is appropriate does not provide any assurance regarding financial sustainability which auditors consider and report on separately as Page 179
Page 180
2. Assurance on the annual accounts 14 part of their Best Value and wider scope responsibilities. Auditors should be clear on that when communicating with audited bodies. 55. Auditors appointed by the Auditor General have a statutory responsibility to consider the regularity of an audited body’s transactions and report an opinion. 56. Auditors give their opinions on the various parts of the annual accounts in accordance with the legislative and other requirements in an Independent Auditor’s Report. This is described further in Section 5 (page 28). Page 180
Page 181
153. Assurance on wider scope reporting areas 3. Assurance on wider scope reporting areas All sectors except local government. All bodies except smaller bodies Purpose of section 57. This section of the Code covers the assurance from auditors appointed by the Auditor General on a public body’s arrangements in four specified reporting areas. 58. An auditor appointed to a body that meets the definition of a smaller audited body should refer to Section 8 of the Code for the adaptations that apply to smaller bodies. Responsibilities of applicable audited bodies 59. Audited bodies have the primary responsibility for ensuring the proper financial stewardship of public funds, compliance with relevant legislation and establishing effective arrangements for governance, propriety and regularity that enable them to successfully deliver their objectives. 60. Those with a management role in an audited body and those charged with governance who have oversight of management make a vital contribution to discharging these responsibilities. 61. An Accountable Officer is designated by the Permanent Secretary of the Scottish Government for parts of the Scottish Administration and sponsored bodies. The role of Accountable Officer is a personal responsibility for the propriety and regularity of the public finances for the relevant part of the Scottish Administration or public body and ensuring that resources are used economically, efficiently and effectively. Accountable Officer responsibilities are detailed in the Scottish Public Finance Manual. 62. Audited bodies, through the Accountable Officer, are responsible for maintaining: • strong corporate governance arrangements • standards of conduct for prevention and detection of fraud and other irregularities • a financial position that is soundly based • a robust internal audit function Page 181
Page 182
3. Assurance on wider scope reporting areas 16 • arrangements to secure Best Value. Corporate governance 63. Each audited body is responsible for establishing arrangements to ensure the proper conduct of its affairs including the legality of activities and transactions, and for monitoring the adequacy and effectiveness of these arrangements. Audited bodies should involve those charged with governance (including audit committees or equivalent) in monitoring these arrangements. Prevention and detection of fraud and error 64. Audited bodies are responsible for establishing arrangements, including an internal audit function, for the prevention and detection of fraud, error and irregularities, bribery and corruption, and to ensure that their affairs are managed in accordance with proper standards of conduct. Maintaining a sound financial position 65. Audited bodies are responsible for putting in place proper arrangements to ensure that their financial position is soundly based having regard to: • such financial monitoring and reporting arrangements as may be specified • compliance with any statutory financial requirements and achievement of financial targets • balances and reserves, including strategies about levels and their future use • how they plan to deal with uncertainty in the medium and longer term • the impact of planned future policies and foreseeable developments on their financial position. Best Value 66. The Scottish Public Finance Manual sets out a specific responsibility for Accountable Officers to ensure that arrangements have been made to secure Best Value, that is, arrangements to secure continuous improvement in the delivery of public services. Accountable Officers are required to ensure accountability and transparency through effective performance reporting for both internal and external stakeholders. 67. The Police and Fire Reform (Scotland) Act 2012 also places a statutory duty to make arrangements to secure Best Value in carrying out their functions on the Scottish Police Authority; the Chief Constable of the Police Service of Scotland; and the Scottish Fire and Rescue Service. Page 182
Page 183
3. Assurance on wider scope reporting areas 17 The Auditor General has the statutory power to initiate examinations into these arrangements. 68. Ministerial guidance sets out the duty of Accountable Officers to ensure that arrangements to secure Best Value are in place. The guidance in force at the time of preparing this Code is framed around seven Best Value themes and sets out the evidence that a public body should be able to demonstrate. Internal audit 69. Audited bodies are required to establish and maintain an internal audit function as a support to management in maintaining effective systems of control and performance. The internal audit function and programme of work are expected to comply with the Global Internal Audit Standards and application note for the UK public sector. Responsibilities of appointed auditors Reporting areas 70. Appointed auditors are required by this Code to satisfy themselves that audited bodies have made proper arrangements in four specified reporting areas. Four reporting areas: Financial management Financial sustainability Vision, leadership and governance Effective use of resources Page 183
Page 184
3. Assurance on wider scope reporting areas 18 Reporting area Definition Examples of key matters to consider Financial management Financial management is concerned with financial capacity, sound budgetary processes and whether the control environment and internal controls are operating effectively. • Are there suitably qualified and experienced officials leading the body’s finance team supported by sufficient financial skills, capacity, and capability in the body? • Does the body have arrangements to ensure systems of internal control are operating effectively? • Can the body demonstrate the effectiveness of the budgetary control system in communicating accurate and timely financial performance? • How accurate is financial forecasting and is it an embedded part of financial management and reporting arrangements? • Does the body have savings plans in place, and are they risk assessed and regularly monitored to ensure savings are being delivered? Financial sustainability Financial sustainability looks forward to the medium and longer term to consider whether the body is planning effectively to continue to deliver its services and the way in which they should be delivered. Note: this is a separate consideration to whether the going concern basis of accounting is appropriate. • How effective are the financial planning systems in identifying and addressing risks to financial sustainability across the medium and longer terms? • How appropriate are the arrangements put in place to address any identified funding gaps? • Are there plans in place to support how efficiency targets are to be met? • Does the body understand the long-term pressures, including demand pressures, and have these been built into plans and strategies? • Are the long-term revenue consequences of borrowing and other forms of financing on affordability clearly set out? • Are investment decisions informed by clear business cases, and is it clear how investments will be funded and how success will be measured? Cont. Page 184
Page 185
3. Assurance on wider scope reporting areas 19 Reporting area Definition Examples of key matters to consider Vision, Leadership and governance Vision, leadership and governance is concerned with the effectiveness of scrutiny and governance arrangements, leadership and decision making, and transparent reporting of financial and performance information. • Does the body have a clear vision and strategy, and do they include a clear set of priorities? • Can the body demonstrate that the governance arrangements are appropriate and operating effectively? • Is there evidence of effective scrutiny, challenge and transparency on decision making and financial and performance reports at governance committees? • Is there a corporate approach to continuous improvement, with regular updating and monitoring of improvement plans? • Are appropriate procedures applied consistently to ensure that members and staff comply with relevant codes of conduct and policies? • Do performance reports contain clear objectives, targets, benchmarks, and comparisons, and is there a clear flow from corporate plans? Effective use of resources Audited bodies need to make best use of their resources to meet stated outcomes and improvement objectives, through effective planning and working with strategic partners and communities. This includes demonstrating economy, efficiency, and effectiveness through the use of financial and other resources and reporting performance against outcomes. • Can the audited body demonstrate that outcomes are improving? • Does the audited body provide information about how services are improving? • Have alternative models of service delivery been considered? • Is benchmarking carried out to identify areas for improvement? • Are user needs and views considered in the evaluation of service delivery and quality? Page 185
Page 186
3. Assurance on wider scope reporting areas 20 Auditor action 71. The action that appointed auditors should take in respect of each of the four specified reporting areas is set out below: Audit stage Auditor action Planning/risk assessment Auditors use guidance issued by Audit Scotland on behalf of the Auditor General that supplements this Code to identify and assess risks that the audited body has weaknesses in its arrangements in the four specified reporting areas. Auditors should include in their Annual Audit Plans the procedures they will carry out in respect of risks of significant weaknesses. Execution of plan Auditors carry out procedures focussed on any risks included in the Annual Audit Plans to consider whether the body has proper arrangements in the four specified reporting areas. Reporting Auditors report a conclusion in the Annual Audit Report each year, based on the procedures performed, that is intended to give reasonable assurance on the arrangements in place for each of the four specified reporting areas. Where auditors identify significant weaknesses in arrangements, they should make recommendations to remedy the weaknesses. Conclusions should be reported and recommendations made in accordance with Section 5 of this Code. 72. Appointed auditors should, having regard to relevant supplementary guidance issued by Audit Scotland, undertake sufficient procedures to be satisfied as to whether, in each auditor’s view, the audited body has proper arrangements in place in each specified reporting area. 73. As the subject matter of this work is the arrangements in place, rather than historical financial information, the supplementary guidance from Audit Scotland uses as a reference point the principles in the International Standard on Assurance Engagements (ISAE 3000) rather than ISAs (UK). 74. The work carried out by auditors should be underpinned by consideration of the arrangements the audited body is expected to have in place. This should be based on the supplementary guidance issued by Audit Scotland. The guidance may set out areas of focus specified by the Auditor General, where judged necessary. 75. Appointed auditors should take into account their knowledge of the relevant sector as a whole, and the audited body specifically, to identify any risks that, in the auditor’s judgement, are relevant to the auditor’s work on the four specified reporting areas. An understanding of the sector includes the relevant regulatory framework in which the audited body operates. Page 186
Page 187
3. Assurance on wider scope reporting areas 21 76. Auditors’ work on arrangements in the four specified reporting areas should be informed by: • the audited body’s governance statement and any additional reporting by the body on the arrangements it has in place to manage risks to the achievement of its responsibilities relevant to the four reporting areas • evidence that the audited body’s arrangements were in place during the reporting period • evidence obtained from the auditor’s other work, including previous work on arrangements in the reporting areas, work completed as part of the audit of the annual accounts and the audited body’s response to this work • evidence provided by the internal audit function • national or sectoral reporting by Audit Scotland • the work of inspectorates and other scrutiny bodies, where the scope and results are relevant to auditors’ responsibilities. Auditors are not required to quality-assure or re-perform the work of others and may use such work to the extent that, in their judgement, it is appropriate to do so • any other evidence source that auditors regard as necessary to facilitate the discharge of their responsibilities for the four reporting areas. 77. Determining how much work to do on the arrangements is a matter of auditor judgement. Auditors should clearly document the work they have undertaken and report each year in accordance with Section 5 of this Code. 78. Auditors should keep their risk assessment under continuous review. Where appropriate, auditors should update their work to reflect emerging risks or findings, including risks flagged in guidance issued by Audit Scotland. Auditors should document any changes to their planned work and ensure these are communicated to the audited body. 79. In evaluating the audited body’s arrangements, it is not part of the responsibilities of auditors to question the merits of the audited body’s policy decisions. However, auditors may examine the arrangements by which policy decisions are reached and implemented. 80. The work of auditors should be designed to provide reasonable assurance to enable them to report in accordance with Section 5 of this Code on the arrangements the body has in place in the four specified reporting areas for each relevant period. 81. Where auditors identify significant weaknesses in arrangements as part of their consideration of the four specified reporting areas, they should make recommendations in accordance with Section 5 of this Code. Page 187
Page 188
3. Assurance on wider scope reporting areas 22 82. Auditors may also identify examples of good practice as part of their normal audit work on the specified reporting areas. Auditors should consider sharing any good practice identified, provided it does not impact on their independence, by reporting in accordance with Section 5 of this Code. In considering what to share, auditors should bear in mind that good practice: • may include methods, procedures, or approaches used by audited bodies that auditors consider to be particularly effective, efficient, and beneficial • goes beyond basic requirements or standard procedures, and results in a higher level of quality, performance, or outcomes • is different to ‘best practice’ which represents the most effective or efficient approach among all known options. Best Value 83. For central government and NHS bodies, auditors should consider the arrangements put in place by Accountable Officers to meet their Best Value duty. In practice, auditors’ work on the four specified reporting areas is used as a basis to also reach a conclusion on the Best Value arrangements. Each reporting area is aligned with a related Best Value theme as set out in the version of the ministerial guidance in force at the time of preparing this Code. This alignment is set out in the following table (any changes to the themes over the period covered by the Code will be reflected in supplementary guidance from Audit Scotland): Reporting area Related Best Value theme Financial sustainability • Use of resources Financial management • Use of resources • Governance and accountability • Performance management Vision, leadership and governance • Vision and leadership • Governance and accountability • Effective partnerships • Sustainability • Equality Use of resources • Use of resources 84. Auditors report a conclusion in the Annual Audit Report each year in accordance with Section 5 of this Code that gives reasonable assurance on the arrangements in place to secure Best Value. 85. Determining whether work is required in addition to that needed to conclude on the four specified reporting areas is a matter of auditor judgement. Auditors should clearly document any additional work they have undertaken. Page 188
Page 189
234. Assurance on Best Value arrangements 4. Assurance on Best Value arrangements Local government except smaller audited bodies Purpose of section 86. This section of the Code covers the assurance from auditors appointed by the Accounts Commission on a local government body’s arrangements to secure Best Value. 87. An auditor appointed to a body that meets the definition of a smaller audited body should refer to Section 8 of the Code for the adaptations that apply to smaller bodies. Responsibilities of local government bodies 88. Local government bodies have a duty under the Local Government in Scotland Act 2003 to make arrangements to secure Best Value. Best Value is defined in the Act as continuous improvement in the performance of the body’s functions. 89. The Scottish Government’s statutory guidance on Best Value currently in force requires bodies to demonstrate that they are delivering Best Value in respect of the following seven themes. Best value themes: 1 Vison and leadership 2 Governance and accountability 3 Effective use of resources 4 Partnership and collaborative working 5 Working with communities 6 Sustainable development 7 Fairness and equality Page 189
Page 190
4. Assurance on Best Value arrangements 24 Responsibilities of appointed auditors 90. Appointed auditors are required by legislation to satisfy themselves that local government bodies have made proper arrangements for securing Best Value. The Accounts Commission considers that the statutory guidance on Best Value issued by the Scottish Government represents proper arrangements and therefore requires appointed auditors to focus on assessing a body’s compliance with the statutory guidance. 91. The action that appointed auditors should take is set out below: Audit stage Auditor action Planning/risk assessment Auditors identify and assess risks that the audited body has not complied with the statutory guidance issued by the Scottish Government. Auditors should include in their Annual Audit Plans the procedures they will carry out in respect of risks of significant non- compliance. Execution of plan Auditors carry out procedures focused on any risks of significant non-compliance included in the Annual Audit Plans to consider whether the body has proper arrangements in place for securing Best Value that are in accordance with the statutory guidance. Reporting Auditors report a conclusion in the Annual Audit Report each year, based on the procedures carried out, that is intended to give reasonable assurance on the arrangements in place for securing Best Value. Where auditors identify significant non-compliance with the statutory guidance, they should make recommendations to remedy the non-compliance. Conclusions should be reported and recommendations made in accordance with Section 5 of this Code. 92. Appointed auditors should have regard to relevant guidance issued by Audit Scotland on behalf of the Accounts Commission that supplements this Code. Auditor should undertake sufficient work to be satisfied as to whether, in each auditor’s view, the local government body has proper arrangements in place to secure Best Value that are in accordance with the statutory guidance. 93. In carrying out this work, auditors are not required to satisfy themselves that the local government body has achieved Best Value during the reporting period. 94. As the subject matter of this work is the arrangements in place, rather than historical financial information, the supplementary guidance from Audit Scotland uses as a reference point the principles in the Page 190
Page 191
4. Assurance on Best Value arrangements 25 International Standard on Assurance Engagements (ISAE 3000) rather than ISAs (UK). 95. The work carried out by auditors should be underpinned by consideration of what arrangements the local government body is expected to have in place. This should be based on the statutory guidance that local government bodies are required to comply with during the reporting period, together with any guidance provided by Audit Scotland that supplements this Code. The supplementary guidance may set out areas of focus specified by the Accounts Commission, where judged necessary. 96. In the version of the statutory guidance in force at the time of preparing this Code, the Commission considers that the financial management and planning section within the effective use of resources theme covers financial sustainability and financial management. The conclusion on Best Value reported by auditors therefore implicitly covers these elements of the overall arrangements. 97. Auditors should take into account their knowledge of the local government sector as a whole, and the audited body specifically, to identify any risks that, in each auditor’s judgement, are relevant to the Best Value arrangements. An understanding of the sector includes the relevant regulatory framework in which the audited body operates. 98. Auditors’ work on Best Value arrangements should be informed by: • self-assessment undertaken by the body on the arrangements it has in place to manage risks to the achievement of Best Value, including use of the Local Government Benchmark Framework and peer reviews • evidence that the audited body’s arrangements were in place during the reporting period • evidence obtained from the auditor’s other work, including previous work on Best Value arrangements, work completed as part of the audit of the annual accounts and the audited body’s response to this work • evidence provided by the internal audit function • the work of inspectorates and other scrutiny bodies, where the scope and results are relevant to the auditor’s Best Value responsibilities. Auditors are not required to quality-assure or re-perform the work of others and may use such work to the extent that, in their judgement, it is appropriate to do so • any other evidence source that auditors regard as necessary to facilitate the performance of their statutory duties. 99. Determining how much work to do on arrangements to secure Best Value is a matter of auditor judgement. Auditors should clearly document Page 191
Page 192
4. Assurance on Best Value arrangements 26 the work they have undertaken and report each year in accordance with Section 5 of this Code. 100. Auditors should keep their risk assessment under continuous review. Where appropriate, auditors should update their work to reflect emerging risks or findings. Auditors should document any changes to their planned work and ensure these are communicated with the audited body. 101. In evaluating the audited body’s Best Value arrangements, it is not part of the responsibilities of auditors to question the merits of the audited body’s policy decisions. However, auditors may examine the arrangements by which policy decisions are reached and implemented. 102. The work of auditors should be designed to provide reasonable assurance to enable them to report a conclusion in accordance with Section 5 of this Code on the arrangements the body has in place to secure Best Value for the relevant period. 103. Where auditors identify significant non-compliance with the Best Value statutory guidance, they should make recommendations in accordance with Section 5 of this Code. 104. Auditors may also identify examples of good practice as part of their audit work on Best Value arrangements. Auditors should consider sharing any good practice identified, provided it does not impact on their independence, by reporting in accordance with Section 5 of this Code. In considering what to share, auditors should bear in mind that good practice: • may include methods, procedures, or approaches used by audited bodies that auditors consider to be particularly effective, efficient, and beneficial • goes beyond basic requirements or standard procedures, and results in a higher level of quality, performance, or outcomes • is different to ‘best practice’ which represents the most effective or efficient approach among all known options. Responsibilities of Audit Scotland 105. Audit Scotland provides appointed auditors with guidance on behalf of the Accounts Commission to support them in discharging their Best Value responsibilities. 106. A central team in Audit Scotland carries out more detailed work on a sample of councils focussing on different themes specified by the Accounts Commission each year. Page 192
Page 193
4. Assurance on Best Value arrangements 27 Responsibilities of the Controller of Audit 107. The Controller of Audit reports to the Commission under Section 102 of the Local Government (Scotland) Act 1973 on how local government bodies perform their duties relating to Best Value. The Controller adopts a risk-based approach to decide which bodies to report upon, and bases each report on the work carried out by appointed auditors and the central Audit Scotland team. Page 193
Page 194
285. Planning audit work and reporting results 5. Planning audit work and reporting results All audited bodies Purpose of section 108. This section of the Code covers the requirements for how appointed auditors should plan their audits and report the results. 109. An auditor appointed to a body that meets the definition of a smaller audited body should refer to Section 8 of the Code for the adaptations that to smaller bodies. Audit outputs 110. Auditors should produce the following outputs annually for those charged with governance at each audited body: • Annual Audit Plan • Independent Auditor’s Report • Annual Audit Report. 111. Annual reporting of the audit provides transparency. The above outputs are published on Audit Scotland’s website and should be prepared in accordance with the objectives for public reporting set out in Section 1 (page 5) of this Code. 112. Other specific outputs are covered in Section 6 (page 35) of this Code. Auditors may also produce reports to the management of an audited body, as required and where relevant. Annual Audit Plan Purpose of output 113. The Annual Audit Plan should contain an overview of the planned scope and timing of the audit of the annual accounts, specified reporting areas where applicable, and Best Value to be carried out in accordance with applicable professional standards, this Code, and guidance from Audit Scotland. Addressees 114. The Annual Audit Plan should be addressed to the audited body. Page 194
Page 195
5. Planning audit work and reporting results 29 Content 115. Appointed auditors should prepare their Annual Audit Plans in accordance with guidance from Audit Scotland, but in summary plans should generally include the components set out in the following table: Required component Explanation Name of engagement lead The engagement lead is the public sector equivalent of engagement partner and is: • the individual in Audit Scotland appointed as auditor • the partner or other individual in the firm who is responsible for delivery of the audit on behalf of the firm. Planned work This should set out the work planned to meet the auditor’s responsibilities in accordance with guidance from Audit Scotland. Work to address risks Where significant risks to the annual accounts or arrangements for the specified reporting areas or Best Value are identified, auditors should indicate the audit work planned to address them. Outputs A complete list of outputs planned to be produced by auditors. Responsibilities The respective responsibilities of the audited body and auditor. Independence Confirmation of the independence of the auditor. Materiality An explanation of the concept of materiality, the materiality thresholds applied, and the significant judgements made in determining them. Smaller audited bodies Where applicable, an explanation that the audited body has been classified as a smaller audited body. Agreed fee for the audit Confirmation of the fee agreed with the audited body for the audit. Where the agreed fee is higher than the amount expected by Audit Scotland, an explanation of why that is the case. Independent Auditor’s Report Purpose of output 116. The Independent Auditor’s Report sets out the auditor’s opinions on the financial statements and other reports within an audited body’s annual accounts, and conclusions on related matters. 117. It is incorporated within the audited body’s published annual accounts. Addressees 118. The Independent Auditor’s Report is addressed to the audited body and (as appropriate) the Auditor General and the Scottish Parliament or the Accounts Commission; and any other relevant addressees as specified by the Auditor General or Accounts Commission. Page 195
Page 196
5. Planning audit work and reporting results 30 119. Except where signed by the Auditor General, the Independent Auditor’s Report is signed with the name of the engagement lead for each audit. Content 120. The Auditor General and the Accounts Commission specify the form of the Independent Auditors Report in guidance provided by Audit Scotland, based on the applicable financial reporting framework within which public bodies operate and following consultation with auditors. 121. Other than for defined smaller audited bodies, the specified form of the Independent Auditor’s Report complies with ISA (UK) 700. This includes the reporting of key audit matters required by ISA (UK) 701 for any audited body that meets the definition of public interest entity or reports compliance with the UK Corporate Governance Code. This Code extends the application of ISA (UK) 701 to all other audited bodies but, as explained below, reporting is in the Annual Audit Report. Opinions and conclusions 122. The Independent Auditor’s Report is addressed to the audited body and (as appropriate) the Auditor General and the Scottish Parliament or the Accounts Commission; and any other relevant addressees as specified by the Auditor General or Accounts Commission. Except where signed by the Auditor General, the Independent Auditor’s Report is signed with the name of the engagement lead for each audit. 123. The Independent Auditor’s Report sets out the auditor’s opinions on the financial statements and other reports within an audited body’s annual accounts. It is incorporated within the audited body’s published annual accounts. The required opinions and conclusions that should be expressed in the Independent Auditor’s Report are summarised in the following table: Opinion or conclusion Explanation Opinion on the audited body’s financial statements This opinion is on whether the financial statements: • give a true and fair view of the financial position of the audited body and its expenditure and income for the period in question • have been prepared properly in accordance with the relevant financial reporting framework as set out in legislation, applicable accounting standards or other direction. Opinion on the audited part of remuneration report This opinion is on whether the audited part of the remuneration report has been properly prepared in accordance with the applicable reporting framework. Cont. Page 196
Page 197
5. Planning audit work and reporting results 31 Opinion or conclusion Explanation Opinion on management commentary/performance report and governance statement This opinion is on whether the management commentary/ performance report and governance statement (or equivalent statements): • are consistent with the financial statements • have been prepared properly in accordance with the relevant financial reporting framework. Opinion on regularity This opinion is on whether, in all material respects, the expenditure and income recorded in the financial statements is in accordance with legislation and applicable guidance. This applies to auditors appointed by the Auditor General. Conclusion on the going concern basis of accounting This conclusion is on whether: • the going concern basis of accounting is appropriate • any material uncertainties that may cast significant doubt on the body’s ability to adopt the going concern basis of accounting have been disclosed by the body. Conclusions reported by exception These conclusions are reported in cases where: • adequate accounting records have not been kept • the financial statements are not in agreement with the accounting records • information required by the auditor has not been provided by the audited body. Annual Audit Report Purpose of output 124. The Annual Audit Report is issued by appointed auditors at the conclusion of each year’s audit. Addressees 125. The Annual Audit Report is addressed to the audited body and the Auditor General, or the Controller of Audit, and other recipients specified in guidance from Audit Scotland. Content 126. The content of the Annual Audit Report includes: • For auditors appointed by the Auditor General, conclusions and recommendations on the arrangements in place in the four reporting areas specified in Section 3 of this Code and the arrangements for Best Value based on the procedures that they have carried out. Page 197
Page 198
5. Planning audit work and reporting results 32 • For auditors appointed by the Accounts Commission, conclusions and recommendations on the arrangements in place to secure Best Value. Auditors also report a conclusion on each council’s arrangements for statutory performance information explained in Section 6. • For all audited bodies, significant matters arising from the audit of annual accounts in accordance with ISA (UK) requirements for reporting to those charged with governance. Conclusions 127. Auditors appointed by the Auditor General should, based on the procedures performed: • clearly state a conclusion, for each of the four specified reporting areas, as to whether there are proper arrangements in place • clearly state a conclusion for Best Value, as to whether there are proper arrangements in place. 128. If auditors appointed by the Auditor General identify significant weaknesses in arrangements, the stated conclusion should be modified and a recommendation to address the weakness should be reported. 129. Auditors appointed by the Accounts Commission should clearly state a conclusion as to whether, based on procedures performed, the body has proper arrangements in place to secure Best Value in accordance with the statutory guidance. 130. If auditors appointed by the Commission identify significant non- compliance with the statutory guidance, the conclusion should be modified and a recommendation to address the non-compliance should be reported. 131. Auditors should include in their Annual Audit Report a clear commentary to support their conclusions on the arrangements that audited bodies have in place. Simply providing a factual description of the arrangements in place at an audited body, without clearly setting out judgements on those arrangements, would not be sufficient to meet this responsibility. Auditors appointed by the Accounts Commission should ensure that their commentary includes explicit and prominent references to the financial sustainability and financial management elements of the arrangements to secure Best Value. Significance 132. Appointed auditors should use their judgement to ensure any weaknesses, cases of non-compliance, or other matters reported are significant: Page 198
Page 199
5. Planning audit work and reporting results 33 • The concept of ‘significance’ applies to the appointed auditor’s consideration of the arrangements in the four specified reporting areas and Best Value. • A matter is significant if, in each auditor’s professional view, it is reasonable to conclude that the matter would be of importance to the Auditor General, Commission, Controller of Audit, those charged with governance at an audited body, or is otherwise in the public interest. • Significance has both qualitative and quantitative aspects. Recommendations and good practice 133. Where appointed auditors identify weaknesses or cases of non- compliance in arrangements that they judge to be significant, they should make recommendations setting out: • their judgement on the nature of the weakness they have identified • the evidence on which their view is based • the impact on the body • the action the body needs to take to address the weakness • the timescales for taking the action. 134. Auditors should follow up the implementation of recommendations in accordance with any guidance from Audit Scotland. 135. Auditors may also share examples of good practice identified as part of their normal audit work. Audit Scotland may include the good practice examples that are reported in outputs to disseminate more widely. 136. In making recommendations, and sharing good practice, auditors should avoid any perception that they have any role in the decision- making arrangements of the audited body. It is not appropriate for auditors to act in any way that suggests they are advisors to audited bodies, and it is not auditors’ responsibility to find solutions to weaknesses or non-compliance identified. 137. Audit Scotland’s impact monitoring and evaluation framework gathers evidence and reports on the impact of Public Audit in Scotland, including progress against outcomes. This includes evaluating evidence from all auditors on their impact, including progress on recommendations as reported in the Annual Audit Report, highlighting good practice, and reporting any local improvements due to audit work. Key audit, planning and scoping matters from the audit of the annual accounts 138. ISA (UK) 701 requires the auditors of listed companies, public interest entities, and entities which have adopted the UK Corporate Page 199
Page 200
5. Planning audit work and reporting results 34 Governance Code to communicate key audit matters in the Independent Auditors Report. That requirement has been extended to apply to all audited bodies covered by this Code, but the key matters should be communicated in the Annual Audit Report. In summary, auditors should: • determine the matters communicated to those charged with governance that were of most significance in the audit of the accounts (that is, key audit matters) • highlight each key audit matter in the Annual Audit Report including a reference to the related disclosures, if any, in the financial statements • explain why the matter was considered to be of most significance in the audit and how it was addressed in the audit, including significant judgments made by the auditor with respect to the matter. 139. Annual Audit Reports are also required to include the following planning and scoping matters: • any revisions to the materiality thresholds set out in the Annual Audit Plan, including an explanation of the significant judgments in determining the revised amounts • an overview of the scope of the audit, including an explanation of how it addressed each of the significant risks of material misstatement and how it was influenced by the auditor’s application of materiality. Page 200
Page 201
356. Assurance on specific areas 6. Assurance on specific areas All audited bodies Purpose of section 140. This section of the Code covers additional specific areas on which appointed auditors are required to provide assurance or report findings. Claims and returns Responsibilities of audited bodies 141. Councils are required to submit claims and returns to central government bodies. These include claims for housing benefit subsidy and returns for non-domestic rates. 142. Audited bodies may also be required to provide information in consolidation schedules. These include returns to assist with the production of whole of government accounts (WGA). 143. Some audited bodies prepare annual reports that contain financial information derived from, but separate to, their annual accounts. Responsibilities of appointed auditors 144. Appointed auditors are required to provide assurance, or report findings, in respect of specified claims and returns. 145. Auditors should comply with guidance in this regard issued by Audit Scotland. Public rights of inspection and objection Responsibilities of audited bodies 146. Local government bodies have the statutory responsibility to make arrangements for public inspection and objection to their unaudited annual accounts. 147. The arrangements should reflect the right that members of the public have to: • inspect a local government body’s accounts, books and records and take copies Page 201
Page 202
6. Assurance on specific areas 36 • lodge with the appointed auditor a written objection to the accounts. Responsibilities of appointed auditors 148. If requested by an objector, the local government body or any officer of the body who may be concerned, the appointed auditor should give the relevant party an opportunity to appear before, and be heard by, the appointed auditor with respect to the objection. 149. Appointed auditors should have regard to guidance issued by Audit Scotland when dealing with objections to the accounts of a local government body. Statutory Performance Information Responsibilities of the Accounts Commission 150. The Accounts Commission issues a Statutory Performance Information (SPI) Direction to councils which sets out certain performance information that they are required to publish. Responsibilities of audited bodies 151. Councils are required to publish the specified information in accordance with the SPI Direction. Responsibilities of appointed auditors 152. Auditors are required to satisfy themselves that the council has made proper arrangements for preparing and publishing statutory performance information. 153. Auditors should report the following in their Annual Audit Report: • A conclusion on each council’s arrangements for preparing and publishing the statutory performance information. • Any instances where the arrangements or reporting are not in accordance with the Direction. • Areas where the arrangements require to be improved. Page 202
Page 203
377. Insights, intelligence and other support 7. Insights, intelligence and other support All audited bodies Purpose of section 154. This section of the Code covers specific areas where appointed auditors are required to provide insights, intelligence and other support. Statutory reports Responsibilities of Auditor General and Controller of Audit 155. Section 22 of the Public Finance and Accountability (Scotland) Act 2000 gives the Auditor General the power to prepare a report on matters arising from the audit of the accounts of a public body for which the Auditor General appoints the external auditor (including the Scottish Government, NHS bodies, colleges and non-departmental public bodies). 156. The Controller of Audit has a power, or may be required by the Accounts Commission to, prepare a report on matters arising from the audit of a local government body under Section 102 of the Local Government (Scotland) Act 1973. The Commission provides a response to each report. 157. Reports made under these powers are known as statutory reports. The Auditor General or Controller of Audit decides who is best placed to lead the preparation of the statutory report. Responsibilities of appointed auditors 158. Appointed auditors should alert Audit Scotland of any significant matters arising during the annual audit which may result in a statutory report. This brings the matter to the attention to the Auditor General or the Controller of Audit, as appropriate, who then decides whether a statutory report should be prepared. 159. It is the responsibility of the appointed auditor to advise the audited body that a statutory report is to be prepared. Appointed auditors either lead or support the preparation of statutory reports, and should do so in compliance with guidance from Audit Scotland. Page 203
Page 204
7. Insights, intelligence and other support 38 Issues of concern about an audited body Members of the public 160. Members of the public can contact Audit Scotland where they have concerns about a public body that falls under the remit of the Auditor General or the Accounts Commission. An issue of concern includes weak financial management or a breakdown in governance arrangements at an audited body. The issue should be raised with the body in the first instance. Responsibilities of Audit Scotland 161. Audit Scotland manages correspondence it receives from a member of the public on an audited body relating to issues of concern. Audit Scotland shares relevant correspondence with the appointed auditor of the body to ensure they are aware of the issues of concern that have been raised. 162. The key factor in determining whether Audit Scotland treats a matter as an issue of concern is the relevance to the Auditor General or the Accounts Commission’s role and functions. Audit Scotland make this judgement using their professional and technical knowledge. The cost of carrying out such work is also a consideration to ensure resources are used efficiently. 163. If the matter does not fall within the remit of the Auditor General or the Commission, it may be redirected to a more appropriate body. Responsibilities of appointed auditors 164. Appointed auditors should promptly consider any correspondence shared with them. Auditors may be required to carry out preliminary enquiries and then decide, in conjunction with Audit Scotland, the appropriate action to take. 165. Where a case requires work additional to that expected under the audit appointment, Audit Scotland may commission the necessary work from the relevant auditor. Information returns Responsibilities of Audit Scotland 166. Audit Scotland requires appointed auditors to complete information returns during the audit appointment. These returns are used for several purposes including benchmarking, risk assessment, and performance audit work and programme development. 167. Audit Scotland will ensure the requests are made at an appropriate time in the audit process. Page 204
Page 205
7. Insights, intelligence and other support 39 Responsibilities of appointed auditors 168. Auditors should complete information returns with due care and attention and in accordance with requested timescales. Duty of care Responsibilities of audited bodies 169. Audited bodies are responsible for ensuring their reporting and wider regulatory responsibilities are met and that there is appropriate liaison with the appointed auditor about timing of regulatory announcements. 170. This does not alter the auditor’s duty of care or powers to report in public. Responsibilities of appointed auditors 171. While the results of audits will be made available to the public, the appointed auditors’ duty of care in respect of the audit of the bodies covered by the Code formally extends only to: • for local government bodies: the audited body, the Accounts Commission, the Controller of Audit and Audit Scotland • for all other bodies: the audited body, the Auditor General, Audit Scotland and the Scottish Parliament (under statute, most audited accounts require to be laid before the Parliament). 172. Appointed auditors do not undertake to have responsibilities to members, directors, accountable officers, managers or the Scottish ministers in their individual capacities, or to third parties. Requests from audited bodies for auditors’ views Responsibilities of audited bodies 173. Audited bodies may seek appointed auditors’ views on the regularity, accounting treatment or performance management implications of transactions, or proposed courses of action, before embarking upon them. 174. Audited bodies are responsible for deciding whether to embark on transactions or courses of action. Responses made by auditors should not be taken by audited bodies as suggesting that proposed transactions or courses of action will be exempt from challenge in future, whether by auditors or others entitled to object to them. Responsibilities of appointed auditors 175. When their views are sought by audited bodies, appointed auditors should bear in mind that they: Page 205
Page 206
7. Insights, intelligence and other support 40 • must not allow their independence to be compromised in any way by involvement in audited bodies’ decision-making • must comply with ethical standards • are not financial or legal advisers to audited bodies • must not act in a way that might compromise their ability to report on a matter, or to exercise the powers conferred by statute on them, the Auditor General, the Controller of Audit, the Accounts Commission or Audit Scotland. Whistleblowing 176. The Auditor General, the Accounts Commission, Audit Scotland and appointed auditors are prescribed persons under the Public Interest Disclosure Act. These prescribed persons consider any relevant concerns from whistleblowers and investigate further where appropriate. Data matching Responsibilities of Audit Scotland 177. Audit Scotland may conduct data matching to compare information within and between public bodies to identify potential fraudulent transactions, claims or errors. 178. To this end, Audit Scotland coordinates the National Fraud Initiative in Scotland which is a data matching exercise. Audit Scotland and appointed auditors share information on identified frauds and Audit Scotland provides guidance to support appointed auditors in considering fraud risks. Page 206
Page 207
418. Assurance on smaller audited bodies 8. Assurance on smaller audited bodies All smaller bodies for the audit of the accounts, wider scope reporting areas, and Best Value Purpose of section 179. This section of the Code sets out adaptations to the standard audit model for defined smaller audited bodies. Rationale for adaptations for smaller audited bodies 180. A key principle of public audit is proportionality. The Auditor General and Accounts Commission are clear that the benefit derived from the independent assurance provided by external audit must be greater than the cost of delivering the audit. However, the Auditor General and Commission recognise that may not be the case for bodies with relatively low expenditure without appropriate adaptations to the audit model. 181. The adaptations to the standard audit model for smaller audited bodies set out in this Code is intended to provide a proportionate level of assurance. Definition of smaller audited body 182. Smaller audited bodies are defined for the audit of the annual accounts and reporting on specified reporting areas using an expenditure threshold set by the Auditor General and the Accounts Commission. However, the Auditor General and the Commission have discretion to decide that any public body under the threshold should not be treated as a smaller body. Bodies will remain classified as a smaller audited body throughout the audit appointment other than in exceptional circumstances. 183. For reporting on Best Value in local government, bodies other than councils (including administered pension funds where applicable) and integration joint boards are treated as quasi smaller bodies. Audit of the annual accounts 184. As an adaptation to the standard model set out at Section 1 of this Code, an audit of the annual accounts in accordance with the ISAs Page 207
Page 208
8. Assurance on smaller audited bodies 42 (UK) is not required for audited bodies that are classified as smaller audited bodies. 185. Auditors should instead comply with guidance on the audit of smaller bodies issued by Audit Scotland on behalf of the Auditor General and Accounts Commission. That guidance supplements this Code and sets out a framework that is intended to provide a proportionate level of assurance for smaller bodies. The guidance uses as a reference point the principles in the International Standard on Review Engagements (ISRE) 2400 issued by the International Auditing and Assurance Standards Board (IAASB) rather than ISAs (UK). 186. Auditors appointed by the Auditor General have a statutory responsibility to give an opinion on the regularity of transactions for all audited bodies. There is therefore no adaptation in this Code to that requirement for smaller bodies. Specified reporting areas 187. Auditors appointed by the Auditor General to audit smaller bodies are required to consider and report conclusions on all four reporting areas specified in Section 3 of this Code. However, as an adaptation to the standard model, auditors are required to provide a proportionate level of assurance on the arrangements in place in each reporting area and for Best Value. 188. Auditors should comply with guidance on the audit of smaller bodies issued by Audit Scotland on behalf of the Auditor General that supplements this Code. The supplementary guidance sets out a framework for providing a proportionate level of assurance. Best Value in local government 189. Auditors appointed by the Accounts Commission to audit quasi smaller bodies, as adaptations to Section 4 of this Code: • are required to consider how the body demonstrates that it is meeting its Best Value responsibilities • should not apply the requirements set out in Section 4 in respect of considering the Best Value themes • are required to report a conclusion that gives a proportionate level of assurance that proper arrangements for Best Value are in place • should comply with guidance on the audit of smaller bodies issued by Audit Scotland on behalf of the Accounts Commission that supplements this Code. The supplementary guidance sets out a framework for providing a proportionate level of assurance. Page 208
Page 209
439. Performance audits 9. Performance audits Purpose of section 190. This section of the Code covers the responsibilities of the Auditor General, the Accounts Commission, performance auditors, and appointed auditors for performance audits undertaken by Audit Scotland. Responsibilities of the Auditor General and the Accounts Commission 191. The Auditor General has statutory powers to initiate examinations into the economy, efficiency and effectiveness of certain bodies or office-holders. 192. The Accounts Commission has statutory powers to undertake studies into, and publish recommendations made on, improving economy, efficiency and effectiveness in the provision of services by local government bodies and Best Value. 193. This Code describes the examinations and studies referred to in the legislation collectively as performance audits. 194. The Auditor General and the Accounts Commission decide the audit work that Audit Scotland performance auditors will undertake on their behalf. They: • consider factors such as public interest, materiality, the scale of the issues and the risks involved, whether the work would be timely, proportionate and be beneficial • use feedback from stakeholder engagement and consultation, which includes the Scottish Parliament, the Scottish Government and local government, to inform the themes and proposed topics for performance audit work. Responsibilities of Audit Scotland performance auditors 195. The performance audit programme of the Auditor General and Accounts Commission is delivered by performance auditors in Audit Scotland. Performance auditors deliver the programme in accordance with Performance Audit Standards issued by the International Organisation of Supreme Audit Institutions (INTOSAI). Page 209
Page 210
9. Performance audits 44 196. Performance audit work may focus on a particular audited body or sector, or consider broader cross-cutting arrangements to track spending and performance across the whole system of public service delivery. The sectoral outputs may take the form of overview reports on sectors or types of bodies. The outputs use information from the audited accounts and Annual Audit Reports. 197. Performance auditors in Audit Scotland: • work efficiently to maximise use of resources, minimise duplication of work and demands on audited bodies by, for example, sharing relevant information internally within Audit Scotland and with appointed auditors that could have a bearing or significance on other audit work • undertake sufficient relevant collection of evidence to enable reliable conclusions to be drawn • review whether audited bodies have properly considered significant relevant matters that have been identified previously by inspectorates and other scrutiny bodies, and whether recommended actions have been implemented • produce outputs that are accessible and written in plain language, are open about the scope and limits of the work, and refer to examples of notable improvement and good practice, as appropriate • provide audited bodies and relevant third parties with fair opportunity to comment, particularly to answer any criticism and to comment on the factual accuracy of the findings • make recommendations for improvement, where relevant, which are useful, specific and practicable, in the public interest, and take account of the expected costs and challenges of implementation. 198. After reporting findings and recommendations, performance auditors: • request a response from relevant parties to those findings and recommendations, and consider whether they are satisfied that findings and recommendations have been properly considered • monitor actions taken in response to the recommendations • comment, as necessary and appropriate, on progress in implementing recommendations, including in respect of those that have not been properly considered or acted upon. Responsibilities of appointed auditors 199. Appointed auditors support the performance audit programme by providing information and data to, and sharing insights with, Audit Scotland performance auditors. Page 210
Page 211
9. Performance audits 45 200. This includes appointed auditors completing information returns provided by performance auditors. The Auditor General and Commission expect appointed auditors to: • complete the information returns taking due care and attention • agree factual information with the audited body • submit the completed information returns to Audit Scotland in accordance with specified timescales • promptly follow up any reasonable requests for further information or clarifications. 201. Appointed auditors also have a key role in following up at individual audited bodies the implementation of recommendations made in performance audit outputs. Page 211
Page 212
46Appendix 1. Supplementary guidance and professional standards Appendix 1. Supplementary guidance and professional standards Purpose of appendix 202. This appendix explains the guidance issued by Audit Scotland that supplements the Code and sets out the appropriate professional standards for each element of public audit in Scotland. Responsibilities of Audit Scotland 203. Audit Scotland issues guidance on behalf of the Auditor General and the Accounts Commission which supplements this Code. The supplementary guidance includes: • detailed requirements with which the auditor must comply in discharging their responsibilities under the Code (mandatory guidance) • material which is intended to inform, rather than direct, auditors to support a shared understanding of the application of the Code (advisory guidance). 204. Supplementary guidance issued by Audit Scotland may be updated during the appointment period to reflect new or emerging risks and changes in professional requirements. 205. Appointed auditors and other interested parties are consulted on the content of guidance issued by Audit Scotland in order to achieve a wide understanding of the issues and risks facing audited bodies and the practicalities and costs of implementing the proposed audit response. Status of supplementary guidance 206. Guidance from Audit Scotland that supplements this Code explicitly states whether it is mandatory or advisory. The status of each type of guidance, and a non-exhaustive list of examples, is set out in the following table (page 47): Page 212
Page 213
Appendix 1. Supplementary guidance and professional standards 47 Type Status Examples Mandatory guidance Guidance with which auditors are required to comply in performing the responsibilities set out in the Code. • Guidance on planning annual audits. • Guidance on Independent Auditors Reports. • Guidance on the audit of the accounts of smaller bodies. • Guidance on wider scope reporting areas and Best Value. • Guidance on claims and returns. Advisory guidance Guidance with which auditors are expected to pay due regard, but may be able to legitimately justify not applying depending on circumstances, ie an ‘apply or explain’ basis. If they decide not to apply it, auditors should clearly document their reasons. • Guidance to inform auditors’ judgement on accounting treatment. • Responses from consulting with Audit Scotland on technical accounting matters. Professional standards 207. The Ethical Standard and Quality management standards issued by the FRC (or successor body) apply to all audits. The following professional standards should apply to each element of the annual audit and to performance audits: Element of audit Applicable professional standard Audit of the annual accounts (except smaller bodies) ISAs (UK) issued by the FRC (or successor body). Any international standards issued by the IAASB specified in guidance from Audit Scotland which may include ISA 810 on summary financial statements. Practice Note 10 issued by the Public Audit Forum. Audit of the annual accounts (smaller bodies) Guidance from Audit Scotland that uses as a reference point the principles in ISRE 2400 issued by the IAASB. Practice Note 10 (section on regularity only). Wider scope reporting areas Guidance from Audit Scotland that uses as a reference point the principles in ISAE (UK) 3000 issued by the FRC. Best Value arrangements Guidance from Audit Scotland that uses as a reference point the principles in ISAE (UK) 3000. Claims and returns Guidance from Audit Scotland that uses as a reference point the principles in ISRS 4400 Agreed Upon Procedures Engagements issued by the IAASB. Performance audits Performance Audit Standards issued by INTOSAI. Page 213
Page 214
Appendix 1. Supplementary guidance and professional standards 48 Responsibilities of appointed auditors 208. Appointed auditors are required to: • follow the appropriate professional standard • contribute as required to consultations on the content of guidance issued by Audit Scotland • comply with mandatory guidance • apply advisory guidance or justify why not applying it was appropriate in the circumstances. Page 214
Page 215
49Appendix 2. Parties in public audit in Scotland Appendix 2. Parties in public audit in Scotland Purpose of appendix 209. This appendix explains the main parties involved in public audit in Scotland. The Auditor General for Scotland 210. The Auditor General is an independent Crown appointment, made on the recommendation of the Scottish Parliament under the Scotland Act 1998. The Auditor General is independent and not subject to the control of any member of the Scottish Government or the Parliament. 211. The Auditor General is responsible under the Public Finance and Accountability (Scotland) Act 2000 for appointing independent auditors to audit the accounts of most public bodies in Scotland, except for the local government sector. 212. The following bodies are within the audit remit of the Auditor General: • the Scottish Government, its executive agencies and its non-ministerial departments • Scottish Parliamentary Corporate Body and Commissioners and ombudsman Auditor General for Scotland responsibilities under the Scotland Act 1998 and the Public Finance and Accountability (Scotland) Act 2000 Audit Scotland established under the Public Finance and Accountability (Scotland) Act 2000 to support close working between the Auditor General and Accounts Commission Accounts Commission for Scotland responsibilities under the Local Government (Scotland) Act 1973 Page 215
Page 216
Appendix 2. Parties in public audit in Scotland 50 • non-departmental public bodies • National Health Service bodies • further education colleges • some public corporations. 213. Audited accounts and reports by the Auditor General are sent to Scottish ministers to be laid before the Scottish Parliament. 214. The Auditor General may initiate examinations into the economy, efficiency and effectiveness with which relevant public bodies have used resources in discharging their functions, and Best Value. The Accounts Commission for Scotland 215. The Accounts Commission is an independent public body. Its members are appointed by Scottish ministers to hold local government to account. The Accounts Commission was established under the Local Government (Scotland) Act 1973. The following bodies are within the remit of the Accounts Commission: • councils • Integration Joint Boards • local government committees, pension funds, joint committees and joint boards • trustees for charities, foundations, mortification or other purpose where a council or some of its members are the sole trustees • Transport Partnerships created under the Transport (Scotland) Act 2005. 216. The Accounts Commission has five principal responsibilities: • Securing the external audit of local government bodies’ accounts and the audit of Best Value and community planning. • Considering reports made by the Controller of Audit; making recommendations to Scottish ministers and to local government bodies; and advising Scottish ministers on matters relating to the accounting of local government. • Carrying out or promoting national performance audit work to improve economy, efficiency and effectiveness, improving financial or other management and in relation to Best Value. • Issuing a Statutory Direction to local government bodies which sets out certain performance information that they are required to publish. • Coordinating the scrutiny of local government in Scotland. Page 216
Page 217
Appendix 2. Parties in public audit in Scotland 51 217. The Accounts Commission has the power to make findings and reports, to make recommendations to Scottish ministers and local government bodies, and to hold public hearings. In specific circumstances involving illegal expenditure or financial loss, the Accounts Commission may impose sanctions including censure, suspension or disqualification of councillors from office. Controller of Audit 218. Under the Local Government (Scotland) Act 1973, the Accounts Commission appoints a Controller of Audit to consider the results of the audit of accounts and Best Value. The Controller of Audit makes reports to the Accounts Commission on matters arising from the accounts and on Best Value and acts independently of the Accounts Commission when reporting to it. Audit Scotland 219. Audit Scotland is a statutory body established under the Public Finance and Accountability (Scotland) Act 2000. It is Scotland’s national public sector audit agency which provides the Auditor General and the Accounts Commission with the services they need to carry out their duties. 220. Audit Scotland is governed by a board consisting of a non- executive board chair and two non-executive members (all appointed by the Scottish Commission for Public Audit, a commission of the Scottish Parliament), the Auditor General and the chair of the Accounts Commission. The Auditor General is designated Audit Scotland’s Accountable Officer and is responsible for the financial arrangements of Audit Scotland. 221. Audit Scotland aims to ensure that public audit in Scotland: • is delivered to the highest professional, technical and ethical standards • makes a positive difference to how public money is spent, Best Value and the outcomes that people experience • provides insights into what works and what needs to improve • offers foresight on future risks and opportunities for improvement. 222. Audit Scotland supports the Auditor General and the Accounts Commission in the independent appointment of auditors, delivers the respective performance audit and Best Value work programmes of the Auditor General and the Accounts Commission and undertakes many of the annual financial audits of public bodies across Scotland’s public sector. Page 217
Page 218
Appendix 2. Parties in public audit in Scotland 52 223. Audit Scotland also has a key leadership role in ensuring that public audit in Scotland is independent, objective, politically neutral and adds value. It does this through coordinating and supporting the delivery of high-quality public audit in Scotland in consultation with key stakeholders. It provides technical audit support and works with professional regulators, audit and accountancy bodies and firms, to promote and strengthen public audit and improve financial and performance reporting by public bodies. This includes preparing guidance on technical auditing and accounting issues and on planning, conducting and reporting the audit. Auditors appointed by the Auditor General and the Accounts Commission 224. Auditors appointed by the Auditor General and the Accounts Commission undertake the audit of accounts, wider scope reporting areas and Best Value, and other matters specified by this Code. 225. Once appointed, auditors act independently in carrying out their responsibilities and in exercising professional judgement. 226. The appointed auditor reports to the audited body and others on the results of audit work. 227. Appointed auditor responsibilities are derived from statute, relevant professional standards, other professional requirements and best practice, this Code and guidance from Audit Scotland. 228. Weaknesses or risks, including fraud and other irregularities, identified by auditors are only those which come to their attention during their normal audit work in accordance with the Code and may not be all that exist. Page 218
Page 219
53Appendix 3. Statutory responsibilities Appendix 3. Statutory responsibilities Purpose of schedule 229. This Schedule of the Code sets out the statutory responsibilities of the Auditor General, Accounts Commission, Controller of Audit and appointed auditors. Auditor General legislation Responsibility Reference in Public Finance and Accountability (Scotland) Act 2000 This section and Section 22 apply to any account which is, required to be audited by the Auditor General. It is for the Auditor General personally to decide who is to audit the account. The account is to be audited by the Auditor General, or a qualified person appearing to the Auditor General to be suitable for appointment. Section 21 Appointed auditors’ reports must set out their findings on: • whether the expenditure and receipts shown in the accounts were incurred or applied in accordance with: – any enactment by virtue of which the expenditure was incurred or the income received – the Budget Act(s) for the financial year – Sections 4 to 7 (relating to the Scottish Consolidated Fund) • where sums have been paid out of the Fund for the purpose of meeting such expenditure, whether the sums were applied in accordance with Section 65 of the Scotland Act 1998 • whether the expenditure and receipts shown in the accounts were incurred or applied in accordance with any applicable guidance issued by the Scottish ministers • whether the accounts comply with any applicable direction by virtue of any enactment. Section 22(1) Appointed auditors must send the accounts to the Auditor General who may prepare a statutory report on the accounts under Section 22 of the 2000 Act. Section 22(3) Cont. Page 219
Page 220
Appendix 3. Statutory responsibilities 54 Responsibility Reference in Public Finance and Accountability (Scotland) Act 2000 The Auditor General may initiate examinations into the economy, efficiency and effectiveness with which bodies and officeholders have used their resources in discharging their functions. Section 23(1) The range of bodies where an examination under Section 23(1) may be carried out includes all those required to be audited by the Auditor General and any other body specified by the Scottish ministers. Section 23(2) to (5) It is for the Auditor General personally to initiate an examination under this section and to decide who is to carry out the examination. Section 23(8) The examiner is not entitled to question the merits of the policy objectives of the body, but may consider the appropriateness of any criteria used by the body to assess use of resources. Section 23(9) The auditor or examiner has the right of access to documents and information which they may reasonably require to enable them to discharge their responsibilities. Auditors and examiners may also require from any person holding, or accountable for, any such document any assistance, information or explanation which they reasonably think necessary. Section 24 Accounts Commission audits Responsibility Reference in Local Government (Scotland) Act 1973 The accounts of every local authority requires to be audited by a professional accountant, who is either a member of the staff of Audit Scotland or is an approved auditor appointed by the Commission. Section 96(4) In auditing the accounts, appointed auditors are required to satisfy themselves that: • the accounts have been prepared in accordance with all applicable statutory requirements • proper accounting practices have been observed in the preparation of the accounts • the body has made proper arrangements for securing Best Value and is complying with its community planning duties • councils have made arrangements for collecting, recording and publishing prescribed performance information • hear any objection to the financial statements lodged by an interested person. Section 99 Cont. Page 220
Page 221
Appendix 3. Statutory responsibilities 55 Responsibility Reference in Local Government (Scotland) Act 1973 An auditor has a right of access at all reasonable times to all such documents relating to the accounts of a local government body necessary to examine for the purpose of auditing those accounts. Auditors are entitled to require from any officer of that body or any other person holding or accountable for any such document such information and explanation as they think necessary. Section 100 Where any person objects to the accounts of a local government body, the auditor is required, if so requested by that person or the members or officers of the body, to afford the opportunity of appearing before and being heard by the auditor. Section 101(1) to (3) Within fourteen days of the completion of the audit, auditors are required to place on the audited accounts a certificate, in such form as the Commission may direct, to the effect that the accounts have been audited in accordance with the provisions of the Act. Section 101(4) The Controller of Audit may, and if required by the Accounts Commission must, submit reports to the Commission about: • the audited accounts of local government bodies • any matters arising that the Controller of Audit considers should be considered by the body or brought to the attention of the public • the performance of a local government body of their duties relating to Best Value and community planning. Section 102(1) The Controller of Audit may make a special report to the Accounts Commission where the Controller is of the opinion that: • an item of account is contrary to law • there has been a failure to bring into account a sum which ought to have been brought into account • a loss has been incurred or deficiency caused by the negligence or misconduct of a person, or by the failure of a body to carry out a statutory duty • a sum has been credited or debited to the wrong account. Section 102(3) The Accounts Commission may direct the Controller of Audit to carry out further investigations, hold a public hearing or state its findings. Section 103B The Accounts Commission has powers to undertake or promote comparative and other studies designed to enable it to make and publish recommendations for: • the securing by local government bodies of Best Value • improving economy, efficiency and effectiveness in the provision of services by local government bodies • improving the financial or other management of local government bodies. Section 97A Cont. Page 221
Page 222
Appendix 3. Statutory responsibilities 56 Responsibility Reference in Local Government (Scotland) Act 1973 Section 97B of the Local Government (Scotland) Act 1973 covers the requirement of bodies and individuals to provide information and documents to the Accounts Commission, including in relation to the Commission’s powers under Section 97A of the Act. Section 97B The Accounts Commission, at the request of the Secretary of State, can conduct studies designed to improve economy, efficiency, effectiveness and quality of performance in the discharge by local authorities of functions relating to the administration of housing benefit. Section 105A Page 222
Page 223
57Glossary Glossary Term Definition Accountable Officer Accountable Officers have personal responsibility for the propriety and regularity of the finances of the part of the Scottish Administration or public body for which they are answerable to Parliament, and for ensuring the economic, efficient, and effective use of resources. Accountable Officer responsibilities are set out in the Public Finance and Accountability (Scotland) Act 2000 and detailed in the Scottish Public Finance Manual. Annual accounts (or accounts) The suite of financial statements and related reports that must be prepared and published by an audited body and subjected to audit. Appointed auditor (or auditor) External auditors of public bodies appointed by the Accounts Commission under Section 97 of the Local Government (Scotland) Act 1973 or the Auditor General under Section 21 of the Public Finance and Accountability (Scotland) Act 2000. These include appointed auditors in Audit Scotland and appointed firms. Audit Quality Framework The framework sets out the arrangements for assessing the quality of work delivered by appointed auditors. The framework is maintained and delivered independently of appointed auditors by Audit Scotland. Audited body A body (or account) for which the Auditor General or the Accounts Commission is responsible for appointing an auditor, comprising the members of the body (for example, elected members of a local government body or executive and non-executive directors of NHS bodies), an Accountable Officer, management and other officers, as appropriate. Annual Audit Report A report issued by appointed auditors at the conclusion of the year’s audit setting out: • significant matters arising from the audit of annual accounts • conclusions and recommendations on the arrangements in wider scope reporting areas and arrangements for securing Best Value. See also Independent Auditor’s Report. Assurance framework for smaller bodies A framework set out in supplementary guidance that provides a proportionate level of assurance for audited bodies that meet the definition of ‘smaller audited body’ specified by the Auditor General and Accounts Commission. Best Value The specific responsibility on local government bodies and the Accountable Officer of other public bodies to make arrangements to secure continuous improvement in the delivery of public services. Cont. Page 223
Page 224
Glossary 58 Term Definition Code (the) The Code of Audit Practice prepared by Audit Scotland and issued on behalf of the Auditor General and the Accounts Commission. Appointed auditors are required to comply with the Code’s requirements and guidance that supplements the Code that is described as mandatory. Controller of Audit The officer appointed by the Accounts Commission to report to them on matters arising from the audit of the accounts and the audit of Best Value. Engagement Lead The person with primary responsibility for delivering the annual audit or performance audit. The engagement lead on an annual audit is the appointed auditor where it is carried out by Audit Scotland or the individual signing on behalf of an appointed firm. Ethical Standard Standard of ethical conduct issued by the Financial Reporting Council intended to maintain integrity, independence and objectivity that appointed auditors are required to comply with when conducting their work. Financial Reporting Council The Financial Reporting Council (FRC) is responsible in the UK for issuing auditing, ethical and quality management standards to financial auditors. References to FRC in the Code should be read to apply to any successor body as appropriate. Financial Reporting Framework A financial reporting framework is a set of rules, standards, and guidelines that set out how audited bodies prepare, measure, and present their annual accounts ensuring transparency, consistency, and comparability for users. Financial statements Statements that audited bodies are required to prepare setting out what they spend and receive and what they own and owe. They are a key element of the annual accounts. Financial sustainability Looking forward to the medium and longer term to consider whether an audited body is planning effectively to continue to deliver its services and the way in which they should be delivered. Firms The private sector bodies appointed by the Auditor General or the Accounts Commission to deliver audits under the Code. Good practice Methods, procedures, or approaches used by audited bodies that auditors consider to be particularly effective, efficient, and beneficial, and that go beyond basic requirements or standard procedures, and results in a higher level of quality, performance, or outcomes. It is different to ‘best practice’ which represents the most effective or efficient approach among all known options. (Annual) Governance Statement Audited bodies are required to prepare a governance statement alongside their financial statements. It brings together in one place an audited body’s disclosures about its governance framework, including risk management and internal control, and how this has operated during the year. Cont. Page 224
Page 225
Glossary 59 Term Definition Guidance Guidance (both mandatory or advisory) issued by Audit Scotland on behalf of the Auditor General and the Accounts Commission which supplements this Code. Independent Auditor’s Report This report sets out in accordance with ISA (UK) 700 the auditor’s opinions on the financial statements and other reports within an audited body’s annual accounts. See also Annual Audit Report. International Standards on Auditing Standards issued by the FRC that apply to the audit of the annual accounts that is intended to give reasonable assurance. International Standard on Review Engagements 2400 Standard issued by the IAASB that applies to a review of the annual accounts. The standard does not apply directly but is used as a key reference point for Audit Scotland guidance on the audit of smaller bodies. International Standard on Assurance Engagements (UK) 3000 Standard issued by the FRC that applies to engagements where the subject matter is not historical financial information. The standard does not apply directly but is used as a key reference point for Audit Scotland guidance on wider scope reporting areas and Best Value. Local government bodies Councils, joint boards, committees, pension funds, integration joint boards and other bodies established under the Local Government (Scotland) Act 1973, as amended. Pay due regard to The Code requires appointed auditors to ‘pay due regard to’ some guidance provided by Audit Scotland on behalf of the Auditor General and Accounts Commission. This means that appointed auditors must take into account the guidance, and if they decide not to follow it, they must give clear (in the sense of objective, proper, and legitimate) reasons within audit documentation as to why they have not followed the guidance. Performance Audit Standard The authoritative international standard on public sector performance auditing issued by the International Organisation of Supreme Audit Institutions. Professional standards Standards which auditors are required to comply with when conducting work required by this Code as set out in Appendix 1. Regularity This is the collective term for the statutory responsibility of auditors appointed by the Auditor General to report whether expenditure and income have been incurred or applied in accordance with applicable legislation or guidance issued by the Scottish ministers. Should Appointed auditors’ compliance with the Code is mandatory. The use of ‘should’ highlights a specific requirement placed on the auditor within the Code (and mandatory supporting guidance). Cont. Page 225
Page 226
Glossary 60 Term Definition Significance The concept of ‘significance’ applies to the appointed auditor’s consideration of the wider scope reporting areas and Best Value that are not addressed by the assessment of materiality for the audit of the annual accounts. A matter is significant if, in the auditor’s professional view, it is reasonable to conclude that the matter would be of importance to the Auditor General, Accounts Commission, Controller of Audit, or those charged with governance at the audited body, or is otherwise in the public interest. Significance has both qualitative and quantitative aspects. Smaller audited body Adaptations to the standard audit model are permitted for bodies that meet the definition of ‘smaller audited body’ specified by the Auditor General and Accounts Commission. The key condition is met for a body if the body’s gross expenditure does not exceed a level specified by the Auditor General and Accounts Commission. Those charged with governance The persons with responsibility for overseeing the strategic direction of the audited body and obligations related to its accountability, including overseeing the financial reporting process. Whole of Government Accounts The Whole of Government Accounts are the consolidated financial statements for the whole of the UK public sector, showing what the UK Government spends and receives, and what it owns and owes. Wider scope This describes the concept that the audit of a public body has a scope that is wider than in the private sector. This includes Best Value in local government and wider scope reporting areas in other sectors. Wider scope reporting areas Auditors appointed by the Auditor General are required by this Code to report conclusions on whether audited bodies have made proper arrangements in the four reporting areas of financial management; financial sustainability; vision, leadership and governance; and use of resources to improve outcomes. Page 226
Page 227
Code of Audit Practice 2026 Audit Scotland, 4th Floor, 102 West Port, Edinburgh EH3 9DN Phone: 0131 625 1500 www.audit.scot ISBN 978 1 918486 15 5 Page 227
Page 228
This page is intentionally left blank
Page 229
The National Fraud Initiative in Scotland 2026 Prepared by Audit Scotland August 2026 Page 229
Page 230
2The National Fraud Initiative in Scotland 2026 Contents Key facts 3 Key messages 4 Recommendations 5 Introduction 6 1. Overall outcomes 9 2. Delivering and developing the NFI in Scotland 14 3. Analysis by outcome area 18 Appendix 27 Accessibility You can find out more and read this report using assistive technology on our website www.audit.scot/accessibility. Page 230
Page 231
3Key factsKey facts Key facts 127 Organisations mandated to participate in the NFI in Scotland 1,000+ Organisations participating in the NFI across the UK £201m Cumulative outcomes in Scotland since participation began in 2006/07 Outcomes reported in Scotland – two years to 31 March 2026 £6.0m Overpayments and additional income £8.9m Roll forward estimated savings and additional income £6.8m Notional outcome estimates £21.7m Total outcomes Main areas of saving £4.8m Pensions £4.1m Council tax single person discounts £1.7m Council tax reduction scheme relief £1.1m Duplicate creditor payments £0.8m Non-domestic rates small business bonus scheme £0.6m Social care payments Page 231
Page 232
4Key messages Key messages Key messages Key messages The National Fraud Initiative (NFI) continues to play a key role in the battle against fraud and error across the public sector in Scotland and the rest of the United Kingdom. Data is matched across a range of systems and between bodies every two years, to identify matches and anomalies worthy of further review and investigation. 1 The NFI remains vitally important at a time of ongoing financial pressures across the public sector. In addition to the monetary outcomes identified by bodies participating, it also helps deter fraud and can provide wider assurance that controls are working effectively. 2 The 2024/25 NFI data matching exercise identified £21.7 million of outcomes. There was a slight fall in overall outcomes when compared to the previous NFI exercise, but this is due mainly to reduced savings from housing benefits as the number of recipients continues to fall. Excluding housing benefits, other outcomes identified by Scottish bodies have increased overall. 3 Delivery of the NFI is improving, with auditors reporting fewer significant issues than in previous exercises. Following up matches plays an important role in supporting the effectiveness of the NFI but, in some cases, there is scope for this to be timelier and better focused. This reflects both the complexity of this work and the availability of staff to support it. We will continue to work with public bodies to support effective and efficient delivery of the NFI through our ongoing engagement activities. Page 232
Page 233
5RecommendationsRecommendations Recommendations Participating bodies should: • Use the NFI self-appraisal checklist as part of planning for the 2026/27 exercise, and ensure the planned approach is clearly articulated and optimises the use of available resources to address risks and maximise savings. • Review payroll to payroll matches as soon as reports become available and follow up all full-time to full-time matches immediately. • Put in place arrangements for regular monitoring of follow-up activity and, where necessary, seek to understand reasons for low or nil outcomes. • Address any NFI delivery issues raised by auditors in their annual audit reports. Page 233
Page 234
6Introduction Introduction The National Fraud Initiative (NFI) enables participating bodies to proactively detect and prevent fraud using data matching. It allows the identification of savings, acts as a wider deterrent, and can also provide assurance that financial controls are working as intended. The National Fraud Initiative 1. The NFI is a biennial proactive data matching exercise designed to identify and prevent fraud. It remains vitally important during a time of ongoing financial pressure across the public sector. The widespread availability of artificial intelligence also has the potential to support more sophisticated fraud attempts. The Public Sector Fraud Authority (PSFA) leads on the delivery of the NFI in England and facilitates it across the UK. Audit Scotland lead on the delivery of the exercise in Scotland. How the NFI works is outlined in Exhibit 1. Exhibit 1. How the biennial NFI exercise works Data matching exercise every two years in partnership with the Public Sector Fraud Authority Participating bodies submit data to a secure website The NFI system matches data within and between bodies to identify anomalies Potential anomalies called ‘matches’ are reported to participating bodies to review, investigate and record outcomes Auditors monitor participating bodies’ progress NFI outcomes are reported by participating bodies, auditors and Audit Scotland Source: Audit Scotland Page 234
Page 235
Introduction 7 2. The NFI can help identify and prevent a range of fraud, with past successes and ongoing matches acting as an overall wider deterrent. The types of fraud the NFI can help identify and prevent include: • fraudulent payments of wages and salaries, pensions, and amounts to suppliers • fraudulent claims for benefits, discounts and reliefs • tenancy fraud • fraudulent use of Blue Badges (disabled parking permits) and concessionary travel passes. The NFI acts as a deterrent and has wider benefits 3. In addition to the monetary outcomes it delivers, the NFI also generates wider benefits which can be more difficult to quantify. These include its fraud deterrent effect, and the assurance it can provide to bodies where no issues are identified (Exhibit 2). Exhibit 2. Wider benefits of the National Fraud Initiative Monetary outcomes Helps identify and recover substantial sums lost to fraud and error. Deterrence Discourages fraud and error through the threat of detection. Identifying control weaknesses Highlights areas where fraud prevention controls need to be strengthened. Providing wider assurance Demonstrates that robust measures are in place to protect public funds. Source: Audit Scotland Page 235
Page 236
Introduction 8 Statutory basis for the NFI 4. Audit Scotland works with a range of Scottish public bodies and their external auditors using powers introduced by the Criminal Justice and Licensing (Scotland) Act 2010 and incorporated into Part 2A of the Public Finance and Accountability (Scotland) Act 2000. These powers enable personal data to be matched for the purpose of assisting in the prevention and detection of fraud. 5. Audit Scotland is responsible for maintaining a Code of data matching practice which all bodies participating in the exercise subscribe to and observe. The code helps ensure that the exercise is properly controlled, and that data is handled in accordance with the law. 6. The Code of data matching practice is in the process of being updated. The revised version has recently been out for consultation in advance of the next NFI exercise which is due to start with data submission in the autumn of 2026. Elements of UK-wide data are shared with the private sector to support fraud detection 7. In recent years, and in line with the data sharing principles in the UK Economic Crime Plan, the PSFA has been facilitating search access to the NFI data pool for a number of private sector bodies. This allows it to undertake point of application checks to flag potential fraud, including, for example, highlighting where applicants for services misrepresent their identity or residency. 8. The PSFA considers this to be an appropriate use of the data collected as it contributes to the detection and prevention of fraud in the UK. The outcomes of this work are not allocated or apportioned across different areas of the UK and are not included in the totals within this report. Bodies that participate in the NFI 9. Audit Scotland has the power to mandate NFI participation of public bodies that are audited by the Auditor General for Scotland and Accounts Commission for Scotland. In 2024/25, we mandated 127 bodies to take part. In addition to mandated bodies many councils also submit payroll data for their arm’s-length external organisations (ALEOs) and for Valuation Joint Boards. 10. Across the UK there are around 1,000 bodies participating in the NFI. Data matching takes place across them all. Full details of participating Scottish bodies can be found on the Audit Scotland website. Reporting NFI results over time By using GDP deflators to adjust actual overpayments and additional income, and the latest PSFA multipliers to recalculate notional outcomes and estimates, we have adjusted previously reported results into 2024/25 prices. This makes values and trends more comparable over time and, where we use these adjusted figures within this report, we refer to them as real terms. Details of the PSFA methodology used for the calculation of savings estimates and the notional value of prevented fraud can be found in the Appendix. Page 236
Page 237
91. Overall outcomes 1. Overall outcomes Reported NFI outcomes fell in real terms from £22.1 million to £21.7 million in the most recent exercise, due largely to a fall in housing benefit savings. Excluding housing benefit, other outcomes identified by Scottish bodies increased overall. Overall outcomes have fallen slightly in real terms 11. Since participation started in 2006/07, around £201 million of cash outcomes have been reported from the NFI in Scotland. In real terms, outcomes from recent exercises average over £20 million biennially. While outcomes fell by £0.4 million between 2022/23 and 2024/25, the NFI continues to make a positive contribution across the public sector in Scotland (Exhibit 3). Exhibit 3. NFI outcomes by exercise and type In real terms, outcomes reported in 2024/25 fell slightly. Notional outcome estimates: not directly linked to actual overpayments or additional income, eg blue badges, housing tenancy and waiting lists Forward savings estimates: from overpayments, additional income and prevented fraud Actual overpayments and additional income 2018/19 2020/21 2022/23 2024/25 7.1 5.4 6.3 6.0 9.3 7.7 9.7 8.9 3.3 5.7 6.0 6.8 £19.8m £18.8m £22.1m £21.7m Note on adjustments to prior years: £0.91 million notional outcomes relating to 2020/21 were previously reported for the first time in 2022/23 and these have now been moved to 2020/21. A further £0.35 million of council tax savings has been removed from 2022/23 following clarification that the amount did not arise from NFI activity. £0.18 million of concessionary travel outcomes in 2022/23 have been reclassified from notional to actual. Source: Audit Scotland analysis of NFI outcomes data Page 237
Page 238
1. Overall outcomes 10 12. Outcomes reported as part of the NFI 2024/25 include £6.0 million of actual overpayments and additional income. Participants estimate that 96 per cent of this, around £5.7 million, is available for recovery and collection directly benefiting participating body finances. 13. Reported outcomes also include £8.9 million of forward savings estimates which may also impact participating body finances. For example, the removal of single person discounts or council tax reduction scheme reliefs has the potential to increase the amount of council tax collectable in future years. 14. Other notional outcomes of £6.8 million are also reported. These are estimates of the value of other fraud and error where amounts are not directly recoverable, collectable or avoided. There may be some indirect impact on participating body finances, for example, through reduced homelessness costs when a tenancy is recovered, or potential for increased income from parking charges if a blue badge is taken out of circulation. Most outcomes arise from the matching of council datasets, but participants from other sectors have identified duplicate creditor payments and payroll fraud 15. The NFI matches data from a range of service areas, and savings accrue in the main to the bodies responsible for the relevant income and payments streams. Many participating bodies only submit payroll and creditor payments datasets for matching, enabling organisations to identify duplicate payments and payroll fraud. 16. Councils also submit a range of other datasets giving rise to significant outcomes. As well as recurring council dataset submissions, matching of social care payments was reintroduced in 2025 and two non-domestic rates small business bonus scheme matching runs have also been included in 2024/25. 17. The Scottish Public Pensions Agency submits pensions data and the Student Awards Agency for Scotland submits details of student loans. Outcomes by data matching are as shown in Exhibit 4 (page 11). Page 238
Page 239
1. Overall outcomes 11 Exhibit 4. NFI outcomes by data match area Outcomes from housing benefits and council tax single person discounts have fallen while those for creditors and the council tax reduction scheme have risen. Council Tax SPD Blue Badges Non-Domestic Rates Pensions Housing Benefit Housing Tenancy Council Tax Reduction Scheme Housing waiting lists Creditors Concessionary Bus Travel Payroll Care Home Payments Council Tax SPD Blue Badges Non-Domestic Rates Pensions Housing Benefit Housing Tenancy Council Tax Reduction Scheme Housing waiting Lists Creditors Concessionary Bus Travel Payroll Care Home Payments Council Tax SPD Blue Badges Non-Domestic Rates Pensions Housing Benefit Housing Tenancy Council Tax Reduction Scheme Housing waiting lists Creditors Concessionary Bus Travel Payroll Care Home Payments 0 £1m £2m £3m £4m £5m £6m Overpayments and additional income Forward savings estimates Notional outcome estimates 2024/25 2022/23 2020/21 Source: Audit Scotland analysis of NFI outcomes data Page 239
Page 240
1. Overall outcomes 12 When the fall in housing benefit savings is excluded, the outcomes in other areas identified by Scottish bodies have increased 18. Housing benefit savings, pensions and council tax single person discounts (CTSPD) are the main areas of decline in 2024/25. Housing benefit savings continue to fall as claimants migrate to universal credit. And more councils have moved to the use of third-party providers for matching and follow up of CTSPD. Pensions outcomes remain volatile, being affected by speed of follow up and the age of pensioners who pass away. 19. When the decline in housing benefit savings is excluded there has been an overall increase in outcomes identified by Scottish bodies. Movements in outcomes by data match area are shown in Exhibit 5. Exhibit 5. Movements in NFI outcomes: 2022/23 to 2023/24 When the decline in housing benefit savings is excluded, there has been an overall increase in outcomes. Non-Domestic Rates Council Tax Reduction Scheme Care Home Payments Housing waiting lists Housing Tenancy Creditors Blue Badges Payroll Concessionary Bus Travel Council Tax SPD Pensions Housing Benefit Overpayments and additional income Forward savings estimates Notional outcome estimates 0 £0.5m£-0.5m£-1.0m£-1.5m £1.0m £3.7m £-2.3m Source: Audit Scotland analysis of NFI outcomes data Page 240
Page 241
1. Overall outcomes 13 20. There have been increases in outcomes and savings from non-domestic rates small business bonus scheme due to additional matching runs, and from the reintroduction of mortality screening of social care payments. There has also been additional income from the removal of council tax reduction scheme reliefs and increased savings from the identification of duplicate creditor payments. More housing tenancies have been recovered and more applicants removed from housing waiting lists. Details about individual match areas can be found in Part 3. Page 241
Page 242
142. Delivering and developing the NFI in Scotland 2. Delivering and developing the NFI in Scotland NFI delivery remains generally sound, with fewer bodies assessed as having significant issues in 2024/25. However, in many cases follow-up activity could be timelier and better focused. The NFI in Scotland supports good financial governance and is being delivered effectively 21. The NFI forms an integral part of the financial governance arrangements of participating bodies and is usually referenced in fraud strategies and policies. Some bodies also make explicit reference to the exercise in their annual governance statements that form part of their annual accounts. 22. We ask auditors to assess NFI data submission and follow-up activity by participating bodies and to provide a Red, Amber, Green assessment. Auditor responses from the last three exercises are summarised by sector in Exhibit 6 (page 15), with fewer bodies assessed by their auditors as having significant issues with delivery in 2024/25. 23. In 2024/25, both data submission and follow-up of match reports were assessed by auditors as satisfactory or generally satisfactory in most cases. A small number of bodies were assessed as having more significant issues with delivery. Two bodies were assessed as having fundamental issues with submission of datasets for matching (five bodies received red ratings in 2022/23). Page 242
Page 243
2. Delivering and developing the NFI in Scotland 15 Exhibit 6. Auditor assessments of NFI delivery by sector Fewer bodies have been assessed as having significant issues with delivery in 2024/25. 0% 20% 40% 60% 80% 100% 2020/21 2022/23 2024/25 0% 20% 40% 60% 80% 100% 2020/21 2022/23 2024/25 0% 20% 40% 60% 80% 100% 2020/21 2022/23 2024/25 0% 20% 40% 60% 80% 100% 2020/21 2022/23 2024/25 Satisfactory/ generally satisfactory Significant issues More fundamental issues Local government NHS Central government Colleges Source: Audit Scotland analysis of auditor returns Page 243
Page 244
2. Delivering and developing the NFI in Scotland 16 The importance of effective follow-up activity and the self-appraisal checklist 24. The more effective NFI follow-up activity is, the greater the outcomes and benefits from the data matching exercise. This includes its deterrence effect, something that may potentially have wider benefit extending beyond participating bodies. 25. Effective local delivery of NFI requires effective project management by an NFI key contact with suitable authority and sufficient time to coordinate the exercise. A high-level commitment to the exercise from senior management and those charged with governance also helps ensure an appropriate scrutiny of approach, and accountability for delivery. It is important that follow-up activity is timely and properly focused. 26. We have produced an NFI self-appraisal checklist for participating bodies to consider as part of the planning process for the 2026/27 NFI. It includes key scrutiny questions for those charged with governance alongside information for coordinating NFI delivery. We continue to consider how best to develop and expand the NFI to make it more effective 27. We continue to work with auditors and public bodies to support the delivery of an effective NFI in Scotland. This includes regular consideration of the following important areas: • Inclusion of new public sector bodies: we mandated 127 bodies to participate in the 2024/25 exercise. This does not include all public bodies in Scotland, for example 30 smaller central government bodies were not included, primarily due to their size. We will consider expansion of the exercise during discussion of fees with the PSFA. • Refreshing NFI governance arrangements: ensuring the Code of data matching practice, NFI privacy notice and other documentation reflects legislative and technological developments and remain fit for purpose. • Giving due consideration to how best use can be made of artificial intelligence as part of the NFI exercise, and across public bodies, to address more sophisticated frauds while remaining compliant with relevant legislation. 28. As part of our work to consider how to ensure that the NFI remains an important and effective mechanism that supports the Scottish public sector we are undertaking specific work in three important areas: • We are currently working with Social Security Scotland on a pilot exercise checking residency of welfare payment recipients. The pilot has cleared the initial governance stage and is proceeding to Page 244
Page 245
2. Delivering and developing the NFI in Scotland 17 data matching. If the pilot identifies significant levels of fraud, we will incorporate the match into future NFI exercises from 2028/29. • We are working with the City of Edinburgh Council on a pilot exercise to detect and prevent fraudulent social housing subletting via an online marketplace and hospitality brokerage website. • In our last report, The National Fraud Initiative in Scotland 2024, we reported that we had invited a number of housing associations to participate in the 2024/25 NFI on a voluntary pilot basis. We were unable to secure voluntary participation from across the sector to proceed with a viable pilot exercise. This was due to concerns raised about data processing arrangements related to private sector sharing at a UK level (paragraph 7). The matter was referred to the Scottish Government and the option to mandate the involvement of housing associations in a pilot exercise was considered. Following full consideration of the issues, the Scottish Government has concluded that there is insufficient justification at this stage to pursue legislative change to extend mandatory participation. We will continue to work with housing associations, the Scottish Government and the Public Sector Fraud Authority to identify how perceived barriers to voluntary participation can be removed. Page 245
Page 246
183. Analysis by outcome area 3. Analysis by outcome area Detailed analysis of the NFI in Scotland 2024/25, and comparisons to previous NFI exercises, demonstrates the value it continues to add. The NFI matches data across different datasets to address specific risks 29. Public bodies submit a range of datasets as part of the biennial NFI data matching exercise. Each dataset is matched against the others to address identified fraud risks. For example, payroll matches help to identify people employed in more than one full-time post; creditors matches can identify duplicate payments; and matches across council tax and housing datasets can identify eligibility issues and undeclared changes of circumstances. 30. The overall outcomes from the 2024/25 data matching exercise were reported in Part 1. We provide some more detailed analysis of the data matching carried out as part of the 2024/25 NFI in Scotland below. Payroll matches identified several cases of dual full-time employment and working in secondary roles while off sick 31. Participating bodies submit details from their payroll systems for matching to help identify occupational fraud and error. In the 2024/25 exercise: • Two cases of dual full-time working (holding more than one full-time job) were identified, with another three potential cases still under investigation. These cases usually result in dismissal or resignation and, in some cases, prosecution (2022/23: five cases). • Three cases of working in a secondary role while off sick from the main employer were identified, with a further five potential cases still under investigation. These cases are usually dealt with in-house and typically involve disciplinary action (2022/23: seven cases). • The NFI also matches payroll records to creditor payments and to Companies House data to identify any undeclared pecuniary interests and/or fraudulent disbursements. Matching resulted in one disciplinary procedure in 2024/25. Registers of interests were also updated in a number of cases. Page 246
Page 247
3. Analysis by outcome area 19 Duplicate creditor payments worth over £1.1 million were identified in 2024/25 32. Participating bodies submit details of payments made to suppliers (people or organisations) for goods and services, and data is matched internally to identify potential duplicate payments. 33. In addition to identifying duplicate creditor payments, the NFI also checks whether suppliers have been set up more than once on master files, something which increases the risk that duplicate payments can be made. Participating bodies can then cleanse their records and reduce ongoing risk. Where no errors are identified from review of matches, participating bodies can often take assurance that their control arrangements are working effectively. 34. The number and value of duplicate creditor payments reported in 2024/25 increased to 260 payments with a value of £1.1 million (146 payments with a value of £0.8 million in 2022/23). This increase is due in part to delays in the review of matches from the previous exercise, with the results from this work (37 payments with a value of £0.2 million) reported in 2024/25. However, there has also been better focused follow up by many bodies in 2024/25. Overpayment numbers and values reported for recent exercises are shown in Exhibit 7. Exhibit 7. Duplicate creditor payments by NFI exercise The number and value of identified duplicate payments increased in 2024/25. 2018/19 2020/21 2022/23 2024/25 £0.8m £0.6m £0.8m £1.1m Overpayments 147 Case numbers: 144 146 260 Source: Audit Scotland analysis of NFI outcomes data Page 247
Page 248
3. Analysis by outcome area 20 More pensions were stopped or amended in 2024/25, but the value of savings and outcomes recorded decreased 35. The NFI includes mortality screening of public sector pensions. Pensions in payment are matched to records of deaths enabling administering authorities to stop or amend payments where deaths have not previously been notified. The number of stopped or amended pensions increased in 2024/25, to 108, but recorded outcomes decreased (Exhibit 8). 36. The PSFA methodology for forward savings estimates is based on a potential payment period from the date overpayments are identified until the date the deceased pensioner would have reached the age of 85. In addition to mortality screening of pensions in payment, the NFI also: • mortality screens deferred pensions (where employees have left the scheme but not yet retired) so that crystallised benefits can be paid out. This identified 36 cases • matches pensions to payroll to help identify cases where pension abatement rules have been broken. Two pensions requiring abatement were identified in 2024/25. Exhibit 8. Pension overpayments and estimated forward savings by NFI exercise The number of overpayments increased in 2024/25, but their value decreased. 2018/19 2020/21 2022/23 2024/25 £3.6m £1.7m £5.6m £4.4m Pension forward savings estimate £4.1m £0.5m £0.5m £0.4m£0.1m £1.8m £6.1m £4.8m Pension overpayments 69 Case numbers: 81 76 108 Source: Audit Scotland analysis of NFI outcomes data Page 248
Page 249
3. Analysis by outcome area 21 Additional income from the withdrawal of council tax single person discounts has been decreasing in recent years, partly due to non-NFI checking of eligibility 37. People living on their own are eligible for a 25 per cent single person discount (SPD) on their annual council tax bill. The NFI matches SPD recipients to the electoral register, other NFI datasets, HMRC household composition data, and death registration information. 38. Councils were able to withdraw £1.6 million of SPDs because of NFI data matches in the two years since our last report in 2024. The roll-forward estimate of additional income associated with these cases is estimated at a further £2.5 million (based on a two-year roll-forward of the annualised saving) (Exhibit 9). 39. Additional income in this area has been declining across NFI exercises partly due to an increase in the number of councils using third party providers for the matching and follow up of SPDs. Eleven councils now use third party providers, an increase of two from the previous exercise. This reduces the level of reported savings identified as part of NFI data matching. Exhibit 9. Additional income from council tax single person discounts by NFI exercise The number and value of discounts removed because of NFI have been falling. 2018/19 2020/21 2022/23 (restated) 2024/25 £2.3m £2.1m £1.8m £1.6m £3.9m £3.5m £2.8m £2.5m Council tax SPD forward savings estimate £6.2m £5.6m £4.5m £4.1m Council tax SPD removed 4,588 Case numbers: 3,720 3,006 2,376 Note: 2022/23 figures were restated to exclude £0.36 million of outcomes which were found to have not arisen from NFI matching. Source: Audit Scotland analysis of NFI outcomes data Page 249
Page 250
3. Analysis by outcome area 22 Additional income arising from the withdrawal of council tax reduction scheme (CTRS) reliefs increased again 40. Council tax reduction is available to low-income households in Scotland. The NFI matches CTRS data to other datasets, such as payroll, pensions, and HMRC records to help identify undeclared income. 41. Additional income from the removal of council tax reductions has increased to £1.7 million in 2024/25 (from £1.1 million in 2022/23). Roll forward estimates of additional income have also increased. The increase is due largely to successful matches of CTRS to HMRC data on income and capital, a relatively new match type where historic cases are being identified for the first time (Exhibit 10). Exhibit 10. Council tax reduction scheme relief withdrawn by NFI exercise The number and value of discounts removed because of NFI has been increasing. 2018/19 2020/21 2022/23 2024/25 £0.3m £0.6m £0.8m £1.2m £0.2m £0.3m £0.3m £0.5m Forward savings estimate £0.5m £0.9m £1.1m £1.7m Discounts removed 280 Case numbers: 773 472 555 Source: Audit Scotland analysis of NFI outcomes data Page 250
Page 251
3. Analysis by outcome area 23 Non-domestic rates (NDR) Small Business Bonus Scheme matches have resulted in outcomes of around £4 million since their introduction 42. The Scottish Government’s non-domestic rates (NDR) Small Business Bonus Scheme (SBBS) offers relief to eligible small businesses. To qualify, the combined rateable value of a business’ premises must be £35,000 or less, and each individual property must have a rateable value of £20,000 or less. The scheme provides tapered relief, from 100 per cent down to 0 per cent as rateable values increase. 43. The NFI matches SBBS relief recipients across council areas to identify cases where combined rateable values may have breached the cumulative thresholds. Three matching runs have now been completed. The additional income from the second and third matching runs are included in the total outcomes for the 2024/25 NFI exercise. The outcomes, by matching run, are shown on a cash basis in Exhibit 11. Exhibit 11. Non-domestic rates Small Business Bonus Scheme withdrawn Case numbers and additional income have dropped since the first matching run. Run 1 2020/21 Run 2 2023/24 Run 3 2024/25 £0.9m £0.4m £0.4m £1.5m £0.4m £0.4m Estimated forward savings £2.4m £0.8m £0.8m Actual relief withdrawn 226 Case numbers: 82 64 Source: Audit Scotland analysis of NFI outcomes data Page 251
Page 252
3. Analysis by outcome area 24 Housing benefits outcomes are decreasing as the number of claimants continues to fall 44. Housing benefits (HB) help people on low incomes pay their rent. Reported savings from the follow-up HB matches in 2024/25 totalled £0.9 million. Outcomes in 2020/21 were impacted by Covid and those for 2022/23 were higher than expected due to the processing of backlogs by the Department of Work and Pensions (DWP) (Exhibit 12). Exhibit 12. Housing Benefits overpayments and forward savings The trend in HB savings is downward, in line with the roll out of universal credit. 2018/19 2020/21 2022/23 2024/25 £2.7m £1.1m £2m £0.7m £1.3m £0.5m £0.6m £0.2m Forward savings estimate £4.0m £1.6m £2.6m £0.9m Overpayments Note: In 2024/25, the savings identified by the DWP relating to Scotland were not directly identifiable and the PSFA have apportioned total UK outcomes based on the numbers of referrals made. Source: Audit Scotland analysis of NFI outcomes data Page 252
Page 253
3. Analysis by outcome area 25 45. The long-term trend in reported savings from HB matches has been downward and has been impacted by: • HB cases in payment continue to decrease as benefit recipients move on to universal credit • NFI no longer matches HB to payroll and pensions as the DWP’s Verify Earnings and Pensions alerts service notifies councils directly of cases for investigation. 46. HB matches involving suspected fraud are referred to the DWP for investigation. In 2024/25, almost £0.7 million of overpayments and forward savings are thought to have arisen from these referrals. With £0.2 million identified locally by councils, largely from the follow up of matches to student loans and taxi drivers. Adult concessionary travel screening has prevented fraud and identified savings of around £0.15 million 47. Adult concessionary bus travel mortality screening was rolled out to councils in September 2023 (reported in 2024). A second matching run was undertaken based on passes in circulation in May 2024 and the results are reported here. Cross-checks by Transport Scotland identified the extent to which passes had been used where the passholder’s death had not been previously reported. 48. In 2024/25, the full fare value of identified fraud was £0.2 million (£0.31 million in 2022/23) with an underlying cost to Transport Scotland of around £0.11 million (bus companies are not reimbursed for the full fare value of journeys). While it is not possible to recover these overpayments, the cancellation of passes prevents future fraud. The estimated value of prevented fraud is in the region of £0.26 million (£0.45 million in 2022/23) giving an underlying saving at £0.15 million (£0.25 million in 2022/23). 49. Concessional travel passes can also be used on Edinburgh Trams and the Glasgow Subway. We have not identified the extent of prevented fraud or underlying savings for these networks, but cancellation also curtails any ongoing use of passes on them. The NFI prevents blue badges being reissued in the event of fraudulent applications for renewal 50. The blue badge scheme allows individuals with mobility problems to park for free at on-street parking meters, in many ‘pay and display’ bays, in designated blue badge spaces, and on single or double yellow lines in certain circumstances. 51. The NFI matches blue badges issued to records of deaths, enabling badges to be cancelled. Cancellation of badges does not stop them Page 253
Page 254
3. Analysis by outcome area 26 being used, but it does mean that they cannot be reissued, and it also enables them to be recovered in use via spot checks. 52. The NFI has enabled councils to cancel just over 5,000 passes in 2024/25. The PSFA outcome methodology assigned an average value of £695 to each blue badge cancelled and reported, resulting in a notional outcome of £3.5 million. Social care payments mortality screening was reintroduced late in 2025 and savings have been identified 53. The mortality screening of care home and personal care payments was reintroduced in October 2025. As of 31 March 2026, 44 overpayments were identified amounting to £185,000. The forward savings estimate, based on the roll forward of the weekly amount for 14 weeks, is a further £386,000. In 2024/25, 17 housing tenancies were recovered due to NFI data matching, providing a notional outcome of £1.3 million 54. With reported housing shortages and high levels of homelessness, addressing tenancy fraud is increasingly important. The NFI uses council housing tenancy data to identify where the named tenant has passed away or appears to be residing elsewhere. This helps councils identify whether there has been abandonment, inappropriate succession or fraudulent subletting. 55. In 2024/25, councils were able to identify and recover 17 properties (including one on behalf of a Registered Social Landlord); this is up from 12 recoveries in 2022/23. The PSFA outcome methodology attributes a value of £78,300 for each property recovered, based on lost income and costs associated with an average fraudulent tenancy. In 2024/25, almost 400 applications were removed from housing waiting lists due to NFI data matching 56. Councils maintain waiting lists for council housing and, in some cases, for all social housing in their area. The NFI matches waiting list data to housing tenancy data and to other data sets, enabling undisclosed changes in circumstances to be picked up. This enables removal of ineligible applicants from the waiting list, stops inappropriate allocations, and accelerates allocations to people in genuine need of social housing. 57. In 2024/25, 397 applicants were removed from housing waiting lists giving a notional outcome of £1.7 million based on PSFA methodology of applying £4,283 for each applicant removed. Page 254
Page 255
27Appendix Appendix Estimated outcomes methodologies Most NFI financial outcomes include an estimated element Most NFI datasets have a methodology to calculate forward savings or the estimated value of fraud and error identified or potential fraud prevented (where there is no direct payment or income stream involved). These methodologies are developed by the Public Sector Fraud Authority (PSFA) and take account of a number of factors including: • data relevant to the fraud problem, including national published data and data from previous NFI cases • the policy context relative to the fraud problem • alignment where possible with relevant estimated savings methodologies used in other central government departments. All methodologies are reviewed prior to the start of each new NFI exercise. Any changes are reviewed by the PSFA NFI Governance Board and approved by the PSFA Fraud Prevention Panel. This panel consists of cross-government counter-fraud experts (including representatives from DWP, HMRC, NHS, MOD, BEIS, DFID, NAO, etc.) who review and challenge, where necessary, methodologies for calculating the estimated value of fraud prevention initiatives across government departments. Page 255
Page 256
Appendix 28 A summary of the outcomes methodology calculations applied to NFI datasets is set out in the following table: Data match Basis of calculation of forward savings and estimated outcomes Council tax single person discount Forward savings – Annual value of the discount cancelled multiplied by two years. Council tax reduction scheme Forward savings – Weekly change in council tax discount multiplied by 40 weeks. Housing benefit Forward savings – Weekly benefit reduction multiplied by 29 weeks. Pensions Forward savings – Annual pension multiplied by the number of years until the pensioner would have reached the age of 85. Social care payments Forward savings – weekly payment amount multiplied by 14 weeks. Housing tenancy Notional outcomes – £78,300 per property recovered, based on: the annual cost of temporary accommodation of £12,000; and an average three-year fraudulent tenancy at time of identification plus forward savings for an additional three years; legal costs to recover property; re-let cost; and rent foregone during the void period between tenancies. Housing waiting lists Notional outcomes – £4,283 for each case based on the annual estimated cost of housing a family in temporary accommodation, the duration a fraud may continue undetected and the likelihood a waiting list applicant would be provided a property. Blue badges Notional outcomes – Number of badge holders confirmed as having died, multiplied by £695 (average value on cases reported in 2024/25) to reflect potential lost parking and congestion charge revenue from fraudulent use. Concessionary bus travel Forward savings – Number of bus passes used fraudulently multiplied by £420. Based on average fraudulent use and reflecting two years’ forward use. Payroll Notional outcomes – £6,054 for each employee dismissed or who resigns because of NFI matching. NDR SBBS Forward savings – Annual value of the relief cancelled multiplied by two years. Page 256
Page 257
The National Fraud Initiative in Scotland 2026 Audit Scotland, 4th Floor, 102 West Port, Edinburgh EH3 9DN Phone: 0131 625 1500 www.audit.scot ISBN 978 1 918486 19 3 Page 257
Page 258
This page is intentionally left blank
Page 259
1 Classification: OFFICIAL Audit & Risk Committee Date of Meeting: 22 September 2026 Title of Report: Internal Audit Contract Presented by: James Gow, Head of Finance The Audit & Risk Committee is asked to: • Note the current independent internal audit service contract ends on 31 March 2027. • Agree an approach to commissioning of the internal audit service from April 2027 and instruct management to progress. 1. EXECUTIVE SUMMARY 1.1 1.2 The IJB is required to have an internal audit service in place. Following a competitive tender exercise, the Argyll and Bute Council Internal Audit Service were appointed by the IJB as its internal auditor for a period of three years form 1 April 2021 to 31 March 2024, this was extended for a further three years to 31 March 2027. The Audit and Risk Committee are now required to decide on an approach to procuring a new contract for the IJB. The Internal Audit Service is a critical aspect of the governance and assurance framework. The service is independent of management and therefore the Audit & Risk Committee is expected to ensure that appropriate arrangements are in place. This report outlines two potential approaches for securing a new internal audit contract. The uncertainty regarding the public sector reform agenda makes consideration of a short-term pragmatic option at the present time. 2. INTRODUCTION 2.1 This report outlines the options for securing an internal audit service from 1 April 2027. The Integration Scheme indicates that the IJB will normally seek to procure its Internal Audit Service from the internal audit provider of one of the partner bodies. This is to reduce duplication and ensure that the service benefits from the intelligence gathered through the audits for at least one of the two partner bodies. This is important as it is the partners that operate and provide many of the corporate systems used by the HSCP. Page 259 Agenda Item 9
Page 260
2 Classification: OFFICIAL 3. DETAIL OF REPORT 3.1 3.2 3.3 3.4 The IJB is required to have an independent internal audit service in place. The current internal audit service is provided by the Argyll & Bute Council Internal Audit Service. They were appointed for 3 years following a competitive procurement process from 1 April 2021 to 31 March 2024, this was extended for a further 3 years to 31 March 2027. The Audit and Risk Committee is required to decide on an approach to putting a new contract in place from 1 April 2027 onwards. The internal audit service is a key part of the governance, control and assurance framework. For it to be effective, the service is required to be independent of management. The main objective of internal audit is to provide a high quality, independent audit service to the IJB which provides annual assurances in relation to internal controls and governance arrangements. In addition to this primary assurance role, internal audit also: support the Head of Finance (Section 95 Officer) and the Audit & Risk Committee in the discharge of their duties, provide guidance on control implications for new systems or process and support the IJB and the Senior Leadership Team during key transformational / change projects. The GIAS (Global Internal Audit Standards) set out the requirements of the service and the role of the Chief Internal Auditor (CIA). This includes requirements to prepare a risk-based audit plan which takes into account the IJB’s strategic objectives, associated risks and the views of senior management and the Committee. It is a requirement that the service should be fully compliant with these standards. The normal practice of putting in place a three-year contract ensures that the internal auditor can design a risk-based programme that covers all major risk areas over the contract duration. However, the Committee may wish to consider extending the current contract on a single year basis as a consequence of the uncertainty created by the recent announcement in respect of public sector reform. The proposals indicate substantial change for the sector but there is no clear timeline at present and there is a lack of clarity in respect of the future of the IJB and governance arrangements. A one-year contract would provide continuity through what could become a challenging period from a governance and assurance perspective. An alternative approach would be to request a three-year proposal in a standard mini-competition format from the Internal Audit providers for both partners: -Argyll & Bute Council Internal Audit Service -Azets – Internal Audit Provider for NHS Highland Both have indicated that they would be participate in the process. If this approach is adopted the Audit Committee will be required to lead the approval of the specification, evaluation process and recommend an appointment to the IJB. Appropriate notice periods would be included in the Page 260
Page 261
3 Classification: OFFICIAL 3.5 contract to allow for potential structural changes within a three-year time horizon. NHS Highland are due to re-tender their contract with Mazars within 3 years, again subject to the timelines for public sector reform. The Committee may wish to consider appointing a sub-group to lead this work to ensure it concludes by 31 March 2027 if this approach is to be adopted. The current cost of the service for 50 days audit input is £25,000 which has been fixed for the past 3 years. It is expected that the cost of any new contract will increase due to inflationary pressures. 4. RELEVANT DATA AND INDICATORS 4.1 Internal audit contract and feedback from other procurement processes for similar services. Committee view of the performance of the current service provider. 5. CONTRIBUTION TO STRATEGIC PRIORITIES 5.1 Ensuring that appropriate governance and control measures are in place is a strategic priority for the IJB. 6. GOVERNANCE IMPLICATIONS 6.1 Financial Impact – minor impact from the increase in Internal Audit costs. 6.2 Staff Governance – none. 6.3 Clinical Governance – none. 7. 7.1 8. PROFESSIONAL ADVISORY None. EQUALITY AND DIVERSITY IMPLICATIONS 8.1 9. 9.1 None. GENERAL DATA PROTECTION PRINCIPLES COMPLIANCE None. 10. RISK ASSESSMENT 10.1 The proposed extension to the existing service is assessed as being a lower risk option than re-tendering the service at this point in time. 11. PUBLIC AND USER INVOLVEMENT AND ENGAGEMENT 11.1 None. Page 261
Page 262
4 Classification: OFFICIAL 12. CONCLUSIONS 12.1 The Audit & Risk Committee is asked to consider the options outlined in this report and make a decision on the preferred way forward to ensure a new internal audit contract is in place from 1 April 2027. It is important that the process is led by the Committee to ensure appropriate independence. 13. DIRECTIONS Directions required to Council, NHS Board or both. Directions to: tick No Directions required x Argyll & Bute Council NHS Highland Health Board Argyll & Bute Council and NHS Highland Health Board REPORT AUTHOR AND CONTACT James Gow, Head of Finance, james.gow@argyll-bute.gov.uk Page 262
Page 263
Document is Restricted Page 263 Agenda Item 10NOT FOR PUBLICATION by virtue of paragraph(s) 3, 4 of Schedule 7A of the Local Government(Scotland) Act 1973
Page 264
This page is intentionally left blank
Page 265
Document is Restricted Page 267 NOT FOR PUBLICATION by virtue of paragraph(s) 3, 4 of Schedule 7A of the Local Government(Scotland) Act 1973
Page 266
This page is intentionally left blank