Internal Audit Reports to Audit and Scrutiny Committee 2025-26
Argyll and Bute Council · 12 June 2025
Back to Audit and Scrutiny Committee — 12 June 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
LiveArgyll Internal Audit Report May 2025 FINAL High Medium Low VFM Number of Findings 0 1 1 0 Disclosure Checks – Protecting Vulnerable Groups Audit Opinion: Substantial
Page 2
2 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Key Dates ................................................................................................................................................ 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 5 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 11 Appendix 2 – Audit Opinion ................................................................................................................. 13 Contact Details Internal Auditor: Mhairi Weldon Telephone: 01546 604294 e-mail: Mhairi.weldon@argyll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 1. Executive Summary Introduction 1. As part of the 2024/25 internal audit plan, approved by the Audit & Scrutiny Committee in March 2024, we have undertaken an audit of LiveArgyll’s system of internal control and governance in relation to Disclosure Checks – Protecting Vulnerable Groups (PVG). 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with LiveArgyll officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to LiveArgyll. 3. The contents of this report have been agreed with the appropriate LiveArgyll and Argyll and Bute Council (The Council) officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. The PVG scheme is managed by Disclosure Scotland. It helps ensure people who are unsuitable to work with children and protected adults cannot undertake regulated roles with these vulnerable groups. 5. From 1 April 2025, it is a legal requirement for individuals to be a member of the PVG scheme when carrying out a regulated role with children, protected adults, or both. Organisations must ensure that individuals who are to carry out a regulated role (paid or voluntary) have PVG scheme membership from 1 April 2025 onwards. Failure to do so will be considered an offence. 6. It is also an offence for individuals to seek, agree to do or carry out a regulated role if they are barred from doing so or for organisations to offer a regulated role to someone who is barred from that specific type of regulated role. Penalties for these offences are up to five years imprisonment and/or a fine up to the statutory maximum. 7. Schedules 2 and 3 of the PVG Act 2007 provides listings of regulated roles in working with children and protected adults. The listings are comprehensive and roles that are relevant to services provided by LiveArgyll include: • Education and training – Teaching, instructing or delivering training • Leisure activities – Providing cultural, leisure, social or recreational activities • Sports activities – Coaching in relation to sports or physical activity 8. Any posts that fall within the scope of the PVG scheme requires the successful candidate to obtain membership of the scheme prior to any unconditional offer of appointment being made, additionally, any current employee changing to a regulated role must have the necessary membership in place. 9. The disclosure process includes a requirement for applicants to share a copy of their disclosure with the accredited body that countersigned the application from 1 April 2025, or to notify Disclosure Scotland that they will seek a review of the content of their disclosure result.
Page 4
4 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 10. Organisations should notify Disclosure Scotland when a PVG scheme member stops doing regulated work with them to ensure compliance with data protection legislation. 11. The Council operates as the lead signatory on the overarching account with Disclosure Scotland, including PVG requirements for LiveArgyll employees and volunteers. All correspondence on behalf of LiveArgyll, therefore, takes place through the Council’s Human Resources (HR) and Education services. Scope 12. The scope of the audit was to assess the systems in place for the processing of staff and volunteer Disclosure Checks for those working and volunteering with vulnerable individuals. This review covered staff employed and volunteers engaged by LiveArgyll in such roles as outlined in the Terms of Reference agreed with the Chief Officer on 01 May 2025. Key Dates 13. The Terms of Reference provided provisional timescales for the review to take place, the actual dates are noted below. Exhibit 1 – Key Dates Stage Actual Date Terms of Reference agreed 01 May 2025 Fieldwork Commencement 18 March 2025 Draft Report issued 16 May 2025 Management Comments received 29 May 2025 Final Report issued 29 May 2025 Audit and Scrutiny Committee 12 June 2025 Risks 14. The risks considered throughout the audit were: • LA RR People 3: Failure to ensure young people and vulnerable adults are safeguarded when engaging with LiveArgyll • Audit Risk 1: Failure to comply with requirements of the Protection of Vulnerable Groups (Scotland) Act 2007 Audit Opinion 15. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion are provided in Appendix 2 to this report. 16. Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of
Page 5
5 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Recommendations 17. We have highlighted one medium priority recommendations and one low priority recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: • Management should be reminded of the importance of ensuring that all documentation in support of employee PVG applications is checked and passed to the Council’s HR team in its entirety for retention purpose. • Version control should be added to the managers guide to recruitment and the Safeguarding policy should have existing errors corrected during review to update for new PVG legislation requirements. 18. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 19. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 2 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Policies, procedures and processes are in place to manage PVG requirements, are regularly reviewed and clearly guide management to identify regulated roles requiring PVG scheme membership All Risks Substantial LiveArgyll operates using the Council’s policies, processes and guidance in respect of recruitment and PVG requirements. These documents are available to all employees and are due to be updated to incorporate new legislation, however there is no version control on one document and some historic errors have not been corrected on another. Guidance is available and followed to identify roles requiring PVG membership and comprehensive information is provided to applicants during advertising and recruitment. 2 Job descriptions and volunteer roles clearly identify where PVG membership is required and mechanisms are in place to ensure membership is in place prior to All Risks Substantial Records of employee and volunteer applications and status are maintained. Regulated roles requiring PVG membership are clearly communicated at recruitment, and management are advised of relevant documentation required to support applications. PVG membership had been confirmed for all relevant employees and volunteers within the samples selected, however,
Page 6
6 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 Control Objective Link to Risk Assessment Summary Conclusion commencing these roles all supporting documentation could not be located for 2 employees. 3 Arrangements are in place to follow-up on allegations made, updates provided by Disclosure Scotland and to renew membership after 5 years All Risks Substantial Safeguarding training is provided at induction and periodically thereafter with records maintained at each LiveArgyll facility. A Safeguarding Lead and Officers have been appointed and are appropriately positioned within LiveArgyll to progress any reported matters regarding safeguarding. A robust disciplinary process is in place to progress any safeguarding concerns arising. Plans for routine renewal of PVG membership will be considered once the current exercise to process new PVGs as a result of changed legislation is complete. 4 Arrangements are in place to confirm that partner organisations have valid PVG membership and training in place All Risks Substantial Independent organisations are responsible for ensuring their own compliance with PVG legislation. To use LiveArgyll facilities, these organisations are required to indicate compliance on their registration and booking information and are subject to periodic sample checking for ongoing compliance. Any organisation indicating non-compliance will be refused use of the facility. 20. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings Policies, procedures and processes are in place to manage PVG requirements, are regularly reviewed and clearly guide management to identify regulated roles requiring PVG scheme membership 21. LiveArgyll has adopted the Council’s policies and processes in respect of recruitment and safeguarding with some adjustments made to accommodate local requirements. The Council’s suite of documentation is available via the HUB intranet site and MyCouncilWorks resource website and are accessible to management and employees with corporate email accounts. The LiveArgyll specific versions are available to relevant employees on a shared drive within the corporate server area. 22. Both the LiveArgyll specific Manager’s Guide to Recruitment and Safeguarding Policy are planned to be updated to incorporate new legislation. The Managers Guide is comprehensive, providing clear guidance on PVG requirements when recruiting, however, it has no version control applied to help ensure the most up-to-date guidance is being used. The Safeguarding
Page 7
7 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 Policy, is also comprehensive, however, it contains historic errors regarding page numbering and an incorrect reference to a PVG policy. The errors had previously been identified by the Senior Business Support Officer and amendments requested but these have not yet been completed and made available to the relevant employees. Action Plan 2 23. The need for PVG membership is most commonly identified during recruitment or transfer to regulated roles. The overarching recruitment process adopted by the Council and LiveArgyll is embedded within the MyJobScotland recruitment portal used by local authorities and other public sector bodies in Scotland. Within this portal, the need for PVG membership is communicated to all applicants alongside the specific role requirements to help guide the applicant through the recruitment process and provide the relevant supporting documentation. Where PVG membership is a requirement of a specific role, all applicants are advised at interview stage that no formal offer of employment is made pending PVG clearance. 24. Roles requiring PVG membership are identified by management in consideration of duties to be performed and who the employee is likely to interact with, additionally, guidance provided within the Disclosure Scotland website and details stated within the Protection of Vulnerable Groups (Scotland) Act 2007 and Disclosure (Scotland) Act 2020 are referred to. All job descriptions are currently under review to ensure compliance with updated legislative requirements which extends the necessity for PVG membership to roles where it may not have previously been required, this includes both frontline employees and their respective managers throughout the LiveArgyll hierarchy. 25. The Council is the “umbrella” organisation for progressing PVG scheme memberships on behalf of LiveArgyll, and as such, it submits all applications to Disclosure Scotland via an online portal and receives outcomes that are passed onto LiveArgyll via confirmation email. 26. The Council’s new HR system contains a user defined field to identify whether a post requires the holder to be a member of the PVG scheme and the supporting documentation is retained on the associated document management system. 27. Volunteer information is not retained on the HR system, instead, a database is maintained by the Council’s Education team to monitor PVG status. Documentation required in support of PVG applications for volunteers is not retained once confirmation of membership is received so as to comply with data protection requirements. Job descriptions and volunteer roles clearly identify where PVG membership is required and mechanisms are in place to ensure membership is in place prior to commencing these roles 28. LiveArgyll maintain a register of PVG applications sent to the Council for processing dating from January 2023. A full list of current post holders requiring membership of the PVG scheme was requested from the Council’s HR team and this was used to select a sample for review to assess if PVGs were in place and that the application process was followed correctly. 29. Job adverts are not retained in the individual’s HR file, these are posted on the MyJobScotland recruitment portal and can be viewed while active and for a period when recruitment has completed. Adverts state that applicants should note that the post requires PVG membership in relation to the specific protected groups for which the role covers i.e. children or vulnerable adults.
Page 8
8 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 30. Job descriptions do not routinely include details of whether the post is considered to be a regulated role or whether PVG membership is required, however, where the post does entail a regulated role, a separate information document is included within the portal advising this is the case and the additional information required to be provided to support the application process. 31. An additional pack of documents is provided to the recruiting manager to ensure all information required in support of a PVG application is gathered, verified and passed to their relevant colleagues for processing. 32. A sample of 15 LiveArgyll employees requiring PVG membership was selected for review to confirm that the appropriate supporting documentation had been provided to management for passing to HR to progress a PVG application. The appropriate documentation was located for all but 2 employees, one of whom was transferred from Education and one whose recruitment pre- dates information held on “Cryoserver” (email archive) for retrieval. We are advised that the appropriate documentation must have been provided to enable the application to progress, however, this could not be located at the time of the audit. Action Plan 1 33. Evidence of PVG membership was located for 13 of the 15 employees reviewed, one did not require a PVG and one was in progress due to updated legislation. 34. The same sample was reviewed to assess if the appointment commenced prior to confirmation of PVG membership and this was found to be satisfactory taking into account a brief supervised induction period, changes to roles and new legislation requirements. 35. A full list of current volunteers requiring membership of the PVG scheme was requested from the Council’s Education team and this was used to select a sample of 15 for review to assess if PVG memberships were in place and that the application process was followed correctly. 36. The LiveArgyll website provides a dedicated area for volunteering allowing interested parties to obtain information and apply for roles they are interested in, specific roles are not advertised as vacancies for filling. 37. A suite of documents was made available for review including a volunteer policy, agreement and forms for completion and were found to be comprehensive in providing the volunteer and management with relevant and useful information regarding PVG membership requirements. 38. As with employees, volunteers are required to provide 3 forms of ID to enable their PVG application to be processed. These documents along with the application form are passed to the Council’s Education team and deleted by both parties upon receipt of confirmation of PVG scheme membership so as to comply with data protection requirements. 39. Confirmation of PVG membership was provided for all 15 volunteers within the sample selected and whilst there is no evidence of volunteer start date, we are advised that roles do not commence prior to receipt of PVG confirmation in compliance with the Safeguarding Operating procedure. 40. The Council’s HR team routinely advise Disclosure Scotland when employees undertaking regulated roles leave the Council/LiveArgyll to remove the noted interest in the individual. The Council’s Education team also indicate that Disclosure Scotland are informed of leavers upon completion of their annual review of volunteers.
Page 9
9 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 Arrangements are in place to follow-up on allegations made, updates provided by Disclosure Scotland and to renew membership after 5 years 41. The Safeguarding Policy states that induction and ongoing training is provided to employees, safeguarding training is also included within employee conversations and refresher training provided every 3 years. Each LiveArgyll facility retains its own training records and these were reviewed for 2 facilities where safeguarding training was evidenced as having been completed between January 2024 and March 2025. 42. The Safeguarding Policy is available within the staff rooms of each facility and includes the named Designated Safeguarding Lead (DSL) and Officers (DSO) who are appropriately positioned within the organisation to take action regarding any reported matters. 43. LiveArgyll follows the Council’s disciplinary process, this is a robust process guided by the Council’s HR team and Disclosure Scotland would be notified if there were any reportable findings. Similarly, should the Council/LiveArgyll be notified of any concerns directly from Disclosure Scotland, an investigation would take place in accordance with the Disciplinary process. Results of any investigation would be assessed on an individual basis to arrive at a decision with the employee/volunteer placed on suspension in the intervening period. To date, there has been no requirement to follow this process for either employees or volunteers. 44. From 1 April 2026, lifetime membership of the PVG scheme will end and be replaced by a time- limited membership requiring to be renewed every 5 years. The Council’s HR system is under development to generate alerts when PVG renewals are due and will liaise with LiveArgyll in respect of their employees. In addition to this planned functionality of the HR system, LiveArgyll currently maintains a spreadsheet containing date fields that will enable identification of employees who are due for PVG renewal. LiveArgyll has commenced an exercise to identify employees whose PVG membership requires to be renewed in advance of the 1 April 2026 implementation date and will be progressed upon completion of the current exercise to arrange PVG membership for employees whose roles newly require PVG membership as a result of the recent legislative changes. 45. Initial discussions have taken place within the Education team regarding renewal requirements of PVG membership for volunteers. The PVG records maintained within the database contain the relevant date fields required to identify volunteers approaching their renewal dates and management will be informed using the same communication links as the annual review of volunteers. Arrangements are in place to confirm that partner organisations have valid PVG membership and training in place 46. Independent organisations using LiveArgyll facilities may opt for accreditation to demonstrate their commitment to being safe, well organised, inclusive and making a difference to their local community. Accreditation must be renewed annually and is encouraged, it also provides the additional benefits of discounts, recognition and support from LiveArgyll. As part of the accreditation requirement, organisations must have PVG processes and safeguarding policies in place unless they provide assurance that no under 18s or vulnerable adults participate. 47. The facility booking form includes a section advising that it is the responsibility of the independent organisation to ensure compliance with the PVG Act where relevant and a link to
Page 10
10 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 the national guidance is provided for further information. Any organisation indicating non- compliance will be refused use of the facility. 48. Independent organisations using LiveArgyll facilities are subject to a periodic sample check to ensure ongoing compliance with PVG requirements and other specific criteria.
Page 11
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Medium 1 PVG application Supporting ID documentation Finding: The appropriate supporting documentation to progress a PVG application was located for all but 2 employees, one of whom was transferred from a long- term role in Education and one whose recruitment pre- dates information held on “Cryoserver” for retrieval. Recommendation: Whilst these are exceptional and historical issues, it would be prudent to remind management of the importance of ensuring that all supporting documentation is checked and provided to HR for retention in support of employee’s PVG applications. PVG may be processed based on provision of insufficient/incorrect documentation Communication to all managers reminding them of the importance of ensuring that all supporting documentation is sent to LiveArgyll HR to be checked and documented. Services and Support Manager 02 June 2025 Low 2 Policies, Procedures & Guidance Finding: The Manager’s Guide to Recruitment lacks version control to help users ensure they are using the most current and up-to-date version and the Safeguarding Policy requires amendment to correct/remove errors. Recommendation: When updating documentation to incorporate new legislation, Management should ensure that version control is applied and all errors corrected/removed. Managers and employees may refer to and follow expired or erroneous guidance Document control protocols in relation to legislative updates will be reviewed and the process updated where needed. Services and Support Manager 31 July 2025
Page 12
12 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 13
13 LiveArgyll – Internal Audit Report – Disclosure Checks - PVG, May 2025 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.