Internal Audit Reports to Audit and Scrutiny Committee 2024/2025
Argyll and Bute Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2024/2025 1. EXECUTIVE SUMMARY 1.1 There are two audits being reported to the Audit and Scrutiny Committee. 1.2 The table below provides a summary of the conclusions for the audits performed. The full reports are included as appendices to this report. Audit Name Level of Assurance High Actions Medium Actions Low Actions VFM Actions Oban Airport High 0 0 0 0 IT – Data Security and Information Security Substantial 0 1 0 0 1.3 Internal Audit provides a level of assurance upon completion of audit work. A definition for each assurance level is documented in each audit report. 2. RECOMMENDATIONS 2.1 Audit and Scrutiny Committee to review and endorse this summary report and the detail within each individual report. 3. DETAIL 3.1 A high level summary of each completed audit report is noted below: Oban Airport: Our overall audit opinion for this audit is that we can take a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. The audit covered 6 of the 24 airport operating instructions within the aerodrome operating manual and all were found to be satisfactory. The Manual is updated on an annual basis and no audit issues were raised. IT – Data Security and Information Security: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Contractual arrangements for the
Page 2
consultancy work are in place following a comprehensive procurement exercise and include suitable details in terms of security and access arrangements to both the platform and its data which is accessed on a read- only basis using an analysis and reporting tool. A data challenge proposal must be completed demonstrating a sound business need for adding data to the platform and this will only be uploaded upon approval of the Data Advisory Group, Data Protection Impact Assessments may also be required where personally identifiable information is included. There is sufficient data storage capacity to operate with large quantities of data and there are options for expansion, however, these options will be at a cost. There is provision to remove personally identifiable information in compliance with GDPR, however, removal of general data is not currently considered within the data challenge proposal to help manage capacity and minimise potential future costs. Well- established arrangements are in place to ensure business continuity and disaster recovery. 4. CONCLUSION 4.1 Management has accepted each of the reports submitted and have agreed responses and timescales in the respective action plans. 5. IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – The implementation of recommendations contained in audit reports may help mitigate the risk to the Council. 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 13 March 2025 For further information contact: Paul Macaskill, Chief Internal Auditor Tel: 01546 604108 Email: paul.macaskill@argyll-bute.gov.uk APPENDICES 1. Oban Airport 2. IT Data Security and Information Security