Self Directed Support (DirectPayments) Final Audit Report
Argyll and Bute Council · 16 December 2025
Back to Audit and Scrutiny Committee — 16 December 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Report November 2025 FINAL High Medium Low VFM Number of Findings 0 6 0 0 Self-Directed Support Audit Opinion: Reasonable
Page 2
2 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Key Dates ................................................................................................................................................ 4 Risks ........................................................................................................................................................ 5 Audit Opinion ......................................................................................................................................... 5 Recommendations ................................................................................................................................. 5 2. Objectives and Summary Assessment ........................................................................................... 6 3. Detailed Findings ............................................................................................................................ 8 Appendix 1 – Action Plan ..................................................................................................................... 12 Appendix 2 – Audit Opinion ................................................................................................................. 15 Contact Details Internal Auditor: Moira Weatherstone Telephone: 01546 604146 e-mail: moira.weatherstone@argyll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 1. Executive Summary Introduction 1. As part of the 2025/26 internal audit plan, approved by the Audit & Scrutiny Committee in March 2025, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Self-Directed Support (Direct Payments) 2. The audit was conducted in accordance with the Global Internal Audit Standards (GIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. The Social Care (Self-directed Support) (Scotland) Act 2013 (the Act) which came into force on 1 April 2014, makes legislative provisions relating to the arrangement of care and support (“community care services” and “children’s services”) in order to provide a range of options to individuals as to how they are to be provided with their support. 5. After an assessment has been completed and if an individual meets the eligibility criteria, the allocated worker will discuss ways of meeting the assessed need and will explain the 4 options available under Self Directed Support. These are: • Option 1 – Direct Payment; • Option 2 – Direct your own support; • Option 3 – Services arranged for you by the Local Authority; • Option 4 – Mixture of the three above. 6. A Direct Payment (Self Directed Support) is an amount of money paid by Argyll & Bute Health & Social Care Partnership (HSCP) to enable individuals who meet the eligibility criteria to source their own care and support. Self-directed support is where a person takes responsibility for managing their own support, it is about giving people more choice on how their support services are designed and making sure they receive support that meets their needs. It allows people to choose how their support is provided to them by giving them as much ongoing control as they want over the money spent on their support. This can be by means of employing a personal assistant or an agency. 7. Self-directed support (SDS) aims to give individuals more flexibility, choice and control over their health and social care support and is based on five key principles: respect, fairness, freedom, safety and independence. Where an assessment has been undertaken and support needs
Page 4
4 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 identified, Social Work will discuss the support needs with the client and a support plan will be agreed and any financial contribution by the client will be discussed. 8. SDS can be used in many ways. A client can get support to live in their own home, such as help with having a bath or getting washed and dressed. Out of the home it could be support to go to college, to continue in employment or take a job, or to enjoy leisure pursuits more. Instead of relying on activities run at a day centre for example, the client could arrange for a personal assistant to help them attend local classes, go swimming, or be a volunteer helping others. It could also be used to provide respite or for equipment and temporary adaptations. 9. If a client has been assessed as being eligible for certain support needs, four options on how to receive services through SDS are available: • A direct payment that you can use to organise and pay for your own support; • SW can make arrangements for the support the client has chosen and if it is provided by someone other than the HSCP, the HSCP will pay the relevant contribution; • The HSCP can choose the best support for the client, make arrangements to set it up and if it is provided by someone other than the HSCP, the HSCP will pay the relevant contribution; • A combination of any of the above. 10. Within the Council area the HSCP currently provide around 200 Self Directed Support payments through a budget of £4,170,908 for 2024/25. This includes payments for supported living, respite, homecare and children with disabilities. The projected outturn at the end of March 2025 was £4,614,447. Scope 11. The scope of the audit was to review the assessment of processes in place for the checking of evidence, receipts and accounts for payment as outlined in the Terms of Reference agreed with the Chief Officer – HSCP on 18 June 2025. Key Dates 12. The Terms of Reference provided provisional timescales for the review to take place, the actual dates are noted below. Exhibit 1 – Key Dates Stage Actual Date Terms of Reference agreed 18 June 2025 Fieldwork Commencement 19 June 2025 Draft Report issued 5 August 2025 Management Comments received 12 November 2025 Final Report issued 13 November 2025 Audit and Scrutiny Committee 16 December 2025
Page 5
5 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 Risks 13. The risks considered throughout the audit were: • SRR07: Failure of the HSCP to deliver on its Strategic Priorities results in deteriorating health and wellbeing outcomes for the population and / or reduced access to appropriate health and social care services. This could also result in financial and reputational risk to the Council. • Audit Risk 1: failure to ensure that staff are provided with support and training to manage Self-Directed Support packages (Direct Payments) • Audit Risk 2: failure to have processes in place for checking documentation and accounts in respect to Direct Payments made Audit Opinion 14. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 15. Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Recommendations 16. We have highlighted six medium priority recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: • Guidance within the Agreement document should be updated to include further information on the management of Direct Payments in terms of accumulated fund or the requirement to top up of funds, including details of the circumstances that would give rise to the repayment of funds. • The Self-Directed – ‘Option 1 Direct Payments Information – Supported Persons Guidance’ should be strengthened to include the statement that following financial review funds may be requested to be returned to the authority and in what circumstances. • Financial reviews should be completed in a timely manner with consideration being given to providing additional assistance to the Finance Officer – AWI to clear the outstanding backlog. • Process should be put in place to ensure Care Managers follow through and complete the recommendations in financial review memos. • Care Plans should be reviewed and kept up to date to ensure the Direct Payment remains appropriate. • A robust ‘single’ recording system should be put in place to ensure that there is a complete overview of when financial reviews are undertaken, when Care Plans are
Page 6
6 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 reviewed and when requests contained in the Memos following a financial review are completed. 17. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 18. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Policies and procedures are in place for the management of Self- Directed Support (Direct Payments) SRR07 Substantial Policies and procedures are in place and are up to date. A policy and procedural document – Self Directed Support, Direct Payments Option 1, Policy and Procedural Guidance for Staff and Managers is available, the most recent version, V2.5 and is dated May 2025. The purpose of the policy is to reflect the provisions of The Self- directed Support (Direct Payment) (Scotland) Regulations 2014 which came into force on the 1st of April 2014 following the enactment of the Social Care (Self-directed Support) (Scotland) Act 2013. In addition, the policy informs the procedures outlined in Part B of the document which are applicable to all Social Work service users (“supported person”) and should be adopted by all staff. A leaflet – Option 2 Individual Service Funds (ISF) provides an outline guide to the four options available to client, providing further details for Option 2 which allows the client to direct Argyll and Bute Council to commission services from a support provider on your behalf. Information is available on the Council website. In addition, when supported people are being assessed they are provided with information on independent advice, advocacy, Community Contacts and Carers Centres. During the course of the audit, new guidance came into
Page 7
7 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 effect in July 2025 for the financial review of Direct Payments – ‘Staff Guidance – Direct Payment Finance Reviews’. This guidance is to be read in conjunction with the Self-Directed Support Direct Payments Option 1 Policy and Guidance. 2 Policies and procedures have been distributed to staff and training provided for the management of Self- Directed Support (Direct Payments) Audit risk 1 Substantial Policies, procedures, guidance documents and other relevant information is available for staff on the HSCP SharePoint site. Training is provided by the Self-Directed Support Officer. Training was previously undertaken face to face as group sessions with the Self-Directed Support Officer attending all areas and Islands throughout Argyll & Bute to deliver training for staff. As working from home practices have developed, training is now provided through the TEAMS platform. 3 Processes are in place for the checking of evidence, receipts and accounts relating to Self- Directed Support (Direct Payments) Audit Risk 2 Reasonable Processes and procedures are in place for the checking of financial records which require to be maintained by those in receipt of Direct Payments. A review timetable has been established and the Finance Administration Officer (AWI) has responsibility for undertaking these reviews. From a sample size of 205, testing was undertaken of thirteen Supported Person’s financial records and this highlighted that financial reviews had not been undertaken in accordance with the agreed timetable and there remains a significant backlog of case to review. It should be noted that the backlog of reviews is historical and that the Finance Administration Officer AWI inherited this work. Work is well underway, however, at the time of reporting there were 172 client financial records which have been received but were waiting to be reviewed. 19. Further details of our conclusions against each control objective can be found in Section 3 of this report.
Page 8
8 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 3. Detailed Findings Policies and procedures are in place for the management of Self-Directed Support (Direct Payments) 20. Policies and procedures are in place for the management of Self-Directed Support (Direct Payments). A policy and procedural document – Self Directed Support, Direct Payments Option 1, Policy and Procedural Guidance for Staff and Managers is in place, the most recent version, V2.5, dated May 2025. This is a two-part document with Part A being Option 1 – Direct Payment Policy (a payment which is made to a supported person which can be used to purchase support. The supported person can do this on their own or get help from family, friends and support organisations). Part B is the Direct Payment Procedural Guidance. 21. The purpose of the policy is to reflect the provisions of The Self-directed Support (Direct Payment) (Scotland) Regulations 2014 which came into force on the 1st of April 2014 following the enactment of the Social Care (Self-directed Support) (Scotland) Act 2013. In addition, the policy informs the procedures outlined in Part B of the document which are applicable to all social work service users (“supported person”) and is required to be adopted by all staff. The document should be read in conjunction with all other supporting documentation which is available on the Social Work SharePoint site. Roles and responsibilities are outlined in the document in the form of a flow chart. 22. The process for referral, determining eligible needs, support plan agreement and review are as per departmental processes and procedures for assessment, care management and eligibility criteria. 23. Option 1 Direct Payments Information Supported Person’s Guidance details background information, including the 4 Options available to those assessed with eligible needs. It explains what Direct Payments are, advises about the scheme, outlines the necessity to open a bank account for the specific purpose of receiving the payment and details how the payments can be used. It outlines that all bank statements, letters and cheque books for the account must be kept and that there is an expectation that these are made available to Social Work Services for the purpose of monitoring the account. It further clarifies that the account will be reviewed regularly at intervals designated by the HSCP and that if funds in the Direct Payment account total more than the 2 months’ contingency allowed, the excess funds will require to be returned to Argyll & Bute HSCP. 24. During the course of the audit, new guidance came into effect in July 2025 for the financial review of Direct Payments – ‘Staff Guidance – Direct Payment Finance Reviews’. This guidance is to be read in conjunction with the Self-Directed Support Direct Payments Option 1 Policy and Guidance. 25. Information is available on the Council website. In addition, when a supported person is being assessed they are provided with information on independent advice, advocacy, community contacts and Carers Centres. Two documents and a leaflet are provided to individuals which give comprehensive guidance on Self-Directed Support, including the management of the payment. The Self-Directed Support Officer provides comprehensive information on Self Directed Support
Page 9
9 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 at an ‘in person’ or online meetings with anyone considering a Direct Payment option. Ongoing support is provided, as necessary by the Self-Directed Support Officer. Policies and procedures have been distributed to staff and training provided for the management of Self-Directed Support (Direct Payments) 26. Policies, procedures, guidance documents as detailed above, along with other relevant information is available for staff on the HSCP SharePoint site. A staff survey was undertaken to gauge the understanding, awareness and accessibility of documents relating to Direct Payments and although the survey response rate was low there was some assurance that staff know where to access information or get support from the results produced. 27. Training is provided by the Self-Directed Support Officer. Training was previously undertaken face to face as group sessions with the Self-Directed Support Officer attending all areas and Islands throughout Argyll & Bute to deliver training for staff. As working from home practices have developed, training is now provided through the TEAMS platform. Processes are in place for the checking of evidence, receipts and accounts relating to Self- Directed Support (Direct Payments) 28. Everyone in receipt of a Direct Payment is required to sign a legally binding Direct Payment Agreement. The agreement places responsibility and obligations upon the supported person and the HSCP to ensure that appropriate funding is provided regularly to meet the needs of the individual and that they spend the funding they receive appropriately and in terms of their Care Plan. The Supported Person is accountable to the HSCP for how the Direct Payment money is spent and are expected to provide evidence they have spent the funding as agreed. If in any circumstances the Direct Payment stops and it is assessed there has been an overpayment of monies, then there is an obligation that the supported person will be required to repay the overpayment to us. Action Plan 1 29. Supported Persons are provided with a document ‘Option 1 Direct Payments Information – Supported Persons Guidance’. This document provides comprehensive information on Self- Directed Support and the management of payments. It details the responsibilities in terms of Argyll & Bute HSCP being accountable for public funds and its responsibilities to monitor direct payments to ensure they are spent appropriately and that they represent cost effective use of resources. The Guidance provides clarity in terms of the requirement to keep a range of financial documentation and provide the HSCP with financial information on their Direct payments at designated intervals. The guidance also states that if the Direct Payment agreement is terminated either by the supported person or by Argyll & Bute HSCP or if the supported person is deceased all unspent funds must be returned to Argyll & Bute HSCP. Action Plan 2 30. For financial and monitoring purposes, the Supported Person must record of all income and expenditure on the Direct Payment bank account statements. All items of expenditure must be recorded separately on a template Financial Return Form, which is provided. For each separate payment made:
Page 10
10 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 • the date of payment; • person/organisation to whom the payment is being made (payee) • the nature of the payment; • cheque number (if appropriate) and • the total amount must be recorded. In addition, for each item of expenditure recorded there must be an invoice or a receipt to support the payment made, this must be kept up to date. A financial review timetable has been established with clear timeframes published. 31. Where appropriate employment records (PAYE, National Insurance, Liability Insurance etc.) for all the carers/ personal assistants employed or contracted by supported person must be kept. Time sheets (or rotas) indicating the days and times carers have worked should be submitted when a financial review is requested. However, a number of Supported Persons use the services of a payroll company who maintains responsibility for the management of employment, including managing timesheets and payroll. 32. Statutory guidance to accompany the Social Care (Self-directed Support) (Scotland) Act 2013 states that depending on the circumstances surrounding any decision to terminate a direct payment the local authority may need to decide if it is appropriate to seek recovery of unspent funds. The legislation enables the authority to require some or all of the money they have paid out to be repaid if it is not satisfied that it has been used to secure the support to which it relates. The Council is required to take into account hardship considerations in deciding whether to seek repayments. In addition, the Social Work Finance Team will review bank balances prior to the end of the financial year, or at any reasonable time, and may seek to reclaim any excess funds held. 33. From a sample size of 205, testing was undertaken of thirteen Supported Person’s financial records and this highlighted that financial reviews had not been undertaken in accordance with the agreed timetable and there remains a significant backlog of case to review. Work is well underway, however, at the time of reporting there were 172 client financial records which have been received but were waiting to be reviewed. The testing of records identified there were instances where: • Supported persons’ not using their full assessed hours resulting in accumulation of funds in the Direct Payment bank account; • Supported Persons paying over the agreed hourly rate for a service and whereby this is acceptable, additional funds must be repaid to the Direct Bank Account by the Supported Person. Testing of records showed that additional funds were not being paid to cover the additional costs and that advanced payments provided by the Council were used to cover the deficit; • One record highlighted that there was unauthorised use of the Self-Directed Support payment which was being used to fund everyday bills; • Supported persons paying over the agreed hourly rate for services, whilst not using the full assessed hours resulting in accumulation of funds in the Direct Payment bank account;
Page 11
11 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 • Overspending on agreed hourly rates and above assessed hours whilst not topping up the Direct Payment bank account, placing reliance on advance payments to cover ongoing costs. Action Plan 3 34. If, during the review of the Supported Persons financial records it is identified that there is an accumulation of funds, funds not being used as agreed in the care plan or funds not being ‘topped up’ in the bank account to cover additional care costs, a memo is sent to the Care Manager to action and follow up. During the process of testing of records, it was noted that there was evidence that recommendations in Memos issued to the Care Mangers had not been followed up. Action Plan 4 35. The Direct Payment Policy and Guidance document states that reviews will be undertaken to ensure that the supported person’s needs are being met and that the Direct Payments arrangements continue to be appropriate and that it is essential the Care Manager communicates directly with the supported person where possible to ensure that they are happy with the arrangements. Of the records reviewed, four records were recently set up with up-to- date Care Plans, four records Care Plans had been reviewed in 2025, two records were due for review and two records were overdue. Action Plan 5 36. We were unable to establish if all Direct Payment Care Plans had been reviewed and were up to date. All Direct Payment service agreements continue to be updated and recorded in Carefirst with any Direct Payment financial reviewing taking place off system and uploaded and recorded in CIVICA (there is nothing is updated in ECLIPSE, the replacement for Carefirst). Any updates to Direct Payment Care Plans are recorded and updated in CIVICA. ECLIPSE Finance Module (EFM) processes have not been embedded in the Council and EFM has not yet been adopted. Once live, this would allow for the linkage of referrals, assessments, reviews to care plans and care service agreements and financial reviews as the Finance Summary screens would have the relevant EFM worklists, forms and tasks populated. Action Plan 6
Page 12
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Medium 1 Direct Payment Agreement Everyone in receipt of a Direct Payment is required to sign a legally binding Direct Payment Agreement. The agreement places responsibility and obligations upon the supported person and the HSCP to ensure that appropriate funding is provided regularly to meet the needs of the individual and that they spend the funding they receive appropriately and in terms of their Care Plan. However, the Agreement is not clear enough what funds require to be returned in certain circumstances. Supported Persons may not be fully aware of the obligation to return funds The Direct Payment guidance relating to the section on unspent funds will be updated and the new guidance will be available on SharePoint and the website. Self-Directed Support Officer Date: 31 December 2025 Medium 2 Guidance Document Supported Persons are provided with a document ‘Option 1 Direct Payments Information – Supported Persons Guidance’. This document provides comprehensive information on Self-Directed Support and the management of payments. However, the Guidance document does not provide clear guidance on the circumstances which would give rise to the requirement to ‘top up’ the Direct Payment bank account or circumstances whereby accumulated funds require to be returned. Supported Person may not be aware that the Direct Payment bank account requires to be topped up or that accumulated funds would need to be returned The Direct Payment guidance relating to information on the topping up of funds will be updated to ensure clarity and the new guidance will be available on SharePoint and the website. Self-Directed Support Officer Date: 31 December 2025 Medium 3 Financial Reviews From a sample size of 205, testing was undertaken of thirteen Supported Person’s financial records and this highlighted that financial reviews had not been undertaken in accordance with the agreed timetable and there remains a significant backlog of case to review. Recovery of funds delayed, or Direct Payment bank accounts are not topped up as required Discussions to be held with Head of Finance about what extra resource can be provided to clear back log of cases. Since issuing the draft audit report an additional temporary member of staff has been appointed for one year. Social Work Amin Manager Date: Completed
Page 13
13 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 No Finding Risk Agreed Action Responsibility / Due Date Medium 4 Follow up Actions During the process of testing of records, it was noted that there was evidence that recommendations in Memos issued to the Care Mangers had not been followed up. Where recommendations or advice from practice leads/team managers are not followed there is a risk that inaccurate information is provided to individuals or actions not carried out which could result in the Legislation not being implemented placing the organisation at risk. This finding will be highlighted and shared with Service Managers and Team Managers to ensure that the message is communicated clearly to Social Work staff to take account of any advice and guidance in a complex area of practice and are fully aware of their responsibility to collaborate with practice leads and senior staff to ensure their practice is to the standard expected and achieves the best outcomes for the individual. Head of Hospitals and Community Care Date: 31 December 2025 Medium 5 Care Plans The Direct Payment Policy and Guidance document states that reviews will be undertaken to ensure that the supported person’s needs are being met. Of the records reviewed, four records were recently set up with up-to- date Care Plans, four records Care Plans had been reviewed in 2025, two records were due for review, and two records were overdue. Care Plans do not align with the Direct Payments A process of self-evaluation, through case file reviews, twice yearly, will be implemented by each locality to monitor performance and benchmark against other localities. Head of Hospitals and Community Care Date: 31 December 2025 Medium 6 Supported Persons Records We were unable to establish if all Direct Payment Care Plans had been reviewed and were up to date due to the multiple ways in which the Supported Persons’s records are maintained. Care Plans and financial reviews are at greater risk of not aligning, this can also result in excessive build-up of unused funds and greater risk of money not being used as intended. A process of self-evaluation, through case file reviews, twice yearly, will be implemented by each locality to monitor performance and benchmark against other localities. Head of Hospitals and Community Care Date: 31 December 2025
Page 14
14 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 15
15 Argyll and Bute Council – Internal Audit Report – Self-Directed Support, November 2025 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.