Internal Audit Plan ABC 25-26
Argyll and Bute Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL COMHAIRLE EARRA-GHÀIDHEAL AGUS BHÒID INTERNAL AUDIT PLAN 2025-26
Page 2
2 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Contents Purpose Statement of Internal Audit ............................................................................................................................................................................................. 1 Global Internal Audit Standards (GIAS) Requirements .................................................................................................................................................................. 1 Risk Assessment .............................................................................................................................................................................................................................. 2 Strategic Risks .................................................................................................................................................................................................................................. 4 Resourcing the Plan ......................................................................................................................................................................................................................... 4 Confirmation of Independence ....................................................................................................................................................................................................... 5 2025/26 Internal Audit Plan ............................................................................................................................................................................................................ 5 Monitoring the Plan ........................................................................................................................................................................................................................ 6 Quality Assurance and Improvement Programme ........................................................................................................................................................................ 6 Conclusions ...................................................................................................................................................................................................................................... 6 Appendix 1 – 2025/26 Internal Audit Plan ..................................................................................................................................................................................... 7 Appendix 2 – 2025/26 Internal Audit Plan by Council Directorate / Head of Service ..................................................................................................................... 10 Appendix 3 – Strategic Risk Register (Abridged) .......................................................................................................................................................................... 11 Contact Details Chief Internal Auditor: Paul Macaskill Telephone: 01546 604108 e-mail: paul.macaskill@argyll-bute.co.uk www.argyll-bute.gov.uk
Page 3
1 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Definition of Internal Audit 1. Internal auditing is an independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes. Source: Domain I - Glossary: Definition of Internal Auditing: Global Internal Audit Standards Purpose Statement of Internal Audit 2. The purpose of the internal audit function is to strengthen Argyll and Bute Council’s (the Council) ability to create, protect, and sustain value by providing the Council and management with independent, risk-based, and objective assurance, advice, insight, and foresight. In addition to this primary assurance role, internal audit will also: • support the S95 Officer and the Audit & Scrutiny Committee (the Committee) in the discharge of their duties • support the Council’s Monitoring Officer • support the Council’s anti-fraud and corruption arrangements • provide guidance on control implications for new or changed systems where appropriate • support the Council and the Strategic Management Team in the successful achievement of its objectives. Global Internal Audit Standards (GIAS) Requirements 3. GIAS, Code of Practice and Local Government Application note make provision for the following requirements : • Chief Internal Auditor (CIA) to prepare a risk-based audit plan which takes into account the Council’s strategic objectives, associated risks and the views of senior management and the Committee • CIA to review and adjust the plan as necessary in response to changes in the Council’s business, risks, operations and priorities • audit plan to incorporate or be linked to a strategic or high-level statement of how internal audit will be delivered and developed in accordance with the Internal Audit Charter and how it links to the organisational objectives and priorities.
Page 4
2 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Risk Assessment 4. Internal audit’s approach to annual audit planning is risk-based with all areas which may be subject to audit review contained within an audit universe which is subject to formal review, at least annually. This provides a layered approach to obtaining a sufficient profile of the organisation covering Core Assurance, Audit Needs Assessment and Audit Universe. The audit universe includes all significant activities and systems that contribute to the achievement of the Council’s priorities and objectives. This is displayed in the diagrams on page 3 of this report. 5. The audit universe is risk assessed each year to help determine the annual audit plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Note however, that that the audit universe, whilst a key factor, is not the only consideration when determining the audit plan. Senior management have been consulted on priority areas for review, and cognisance is taken of the plans of external audit and other statutory agencies, in order to avoid duplication, and increase potential for cross reliance. 6. The audit universe risk assessment is based upon a matrix taking account of scores for each potential audit area in respect of: • materiality (based on expenditure) • sensitivity (Control Environment, Management Concerns, Political Sensitivity, Regulatory Compliance, System Complexity and Extent of Changes – these help to provide a wide understanding of the risks and implications to the organisation in all of its functions) • time elapsed since it was last subject to review • overall audit assessment when it was last subject to review. 7. We employ a risk-based priority audit planning tool to identify those areas where audit resources can be most usefully targeted. This involves scoring a range of systems, services and functions across the whole Authority, known as the “Audit Universe” using a number of factors/criteria. The final score, or risk factor for each area, together with a priority ranking, then determines an initial schedule of priorities for audit attention. Furthermore, our reliance and successful operation is founded upon the need for strong Information Technology arrangements which support key systems across the Council, therefore, it is appropriate that sufficient audit coverage is scheduled in this area based on risk and discussions with management. There has been increased risk across business of cyber-attacks and the substantial implications this could have for those who have been affected by such attacks.
Page 5
3 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan 8. The matrix gives an overall “score” for each area that is used to prioritise audit reviews. The audit plan for the year has been created by: Risks •Consideration of risks identified in the Authority's strategic and operation risk registers Audit Universe •Review and update of the audit universe Senior Management •Discussions and liaison with Directors and Senior Officers regarding the risks which threaten the achievement of corporate or service objectives, including changes and/or the introduction of new systems, operations, programmes, and corporate initiatives Previous Reviews •Taking into account results of previous internal audit reviews Internal Audit Insights •Taking into account Internal Audit's knowledge and experience of the risks facing the Authority, including factors and systems that are key to successful achievement of the Council's delivery plans Collaboration •Requirements to provide a "collaborative audit" approach with external auditors
Page 6
4 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Strategic Risks 9. The Strategic Risk Register records the Council’s own assessment of the most potentially damaging risks including their likelihood and impact of occurrence. This document is used to inform the annual audit plan with identified reviews cross referenced to the strategic risk register. An abridged version of the strategic risk register is included in appendix 3 for reference. In addition, Operational Risk Registers are reviewed to identify high risk areas and which we take cognisance of in assessing and scoring the Audit Universe in terms of wider corporate risk which helps to provide a more comprehensive overview of the organisation. Resourcing the Plan 10. Internal audit has a core establishment of five members of staff, we are currently operating with four full time equivalent officers, one contracted and one casual member of staff, three of which are professionally qualified. Available audit days have been calculated as 758 days (including management and administration time), following the deduction of annual leave, training, a small provision for sickness, 50 days to deliver scrutiny work and 50 days to deliver the HSCP internal audit function. This 758 days total includes the CIA’s input to audit reviews, management of the internal audit team and a contingency in the event of unplanned work. We have taken on the internal audit work associated with the ‘Rural Growth Deal’ - this is new work and will require a reasonable level of input throughout the lifecycle of the fund which we understand to be ten years. We will closely monitor our input associated with our involvement in the provision of service and will escalate any concerns about resources should such an issue arise, together with advising the Committee in accordance with the GIAS. 11. Given the range and complexity of areas to be reviewed it is important that suitably qualified, experienced and trained individuals are appointed to internal audit positions. The CIA, in compliance with GIAS holds two appropriate professional qualifications (CIPFA and Institute of Internal Audit). Also within the internal audit section we have one contracted CIPFA qualified team member, one casual member of staff who is CIMA qualified, one AAT and Certified Internal Auditor who is studying for the Chartered Internal Auditor qualification, and one training for CIPFA. One member of the Counter Fraud Team is also undertaking professional training – It is anticipated that such training programs will result in formal qualifications which will address the interim staffing position. 12. Internal audit officers identify training needs as part of their annual appraisal process and are encouraged to undertake appropriate training, including in-house courses and external seminars as relevant to support their development. 13. Through an assessment of the mix of knowledge, skills and experience of the audit team, it is considered that the available resources are the minimum to achieve the work outlined in the plan and should this change, this will be escalated to management and the Committee in accordance with the GIAS.
Page 7
5 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Confirmation of Independence 14. GIAS requires internal audit to communicate, on a timely basis, all facts and matters that may have a bearing on our independence. We can confirm that the staff members identified to complete the reviews in the 2025/26 annual audit plan are independent and objectivity is not compromised. 2025/26 Internal Audit Plan 15. The engagements proposed for inclusion within the internal audit plan for 2025/26 and the associated risks are attached in the following appendices: • Appendix 1 presents the internal audit plan for 2025/26. • Appendix 2 presents the 2025/26 internal audit plan in a different format to provide assurance to the Committee that it provides appropriate coverage across all the Council’s directorates and head of service’s areas of service delivery. • Appendix 3 demonstrates the strategic risks that were subject to audit focus in 2024/25 and those we are projecting to cover in the periods 2025/26 and 2026/27. As our internal audit approach is informed by risks, where appropriate, the plan is cross-referenced to the strategic risk register contained at appendix 3. This provides assurance to the Committee that key strategic risks are subject to audit coverage over a three year cycle. Note that the projected timescales in appendix 3 are provisional as these may change to reflect changes in the Council’s risk environment. Paul Macaskill Chief Internal Auditor Moira Weatherstone Auditor Mhairi Weldon Trainee Auditor Annemarie McLean Trainee Auditor Leanne Rennie Audit Assistant
Page 8
6 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Monitoring the Plan 16. Internal audit reports on performance to the Committee on a quarterly basis including full copies of audit reports issued, progress implementing audit recommendations, performance against agreed performance indicators and a summary of all internal audit activity in the previous quarter. Quality Assurance and Improvement Programme 17. The GIAS require each internal audit service to maintain an ongoing quality assurance and improvement programme (QAIP) based on an annual self- assessment against the Standards, supplemented at least every five years by a full independent external assessment. 18. The Scottish Local Government Chief Internal Auditors’ Group (SLACIAG) has developed a framework for external assessments to be undertaken by member authorities of SLACIAG on a broadly reciprocal arrangement utilising a peer review option. The Council’s internal audit team has participated in this framework and an external validation of its own self-assessment took place during 2022/23 which concluded that we demonstrated full compliance with PSIAS in all 14 areas of the assessment. These requirements have been carried forward into the GIAS and as such, continuous compliance with the QAIP and any supplementary requirements will need to be met. The next scheduled external assessment is due to be undertaken in 2028. The internal audit service continues to identify ways of improvement in order that it contributes effectively to the governance of the Council and provides appropriate levels of assurance to those charged with governance, specifically, the Audit and Scrutiny Committee. 19. The internal audit team review their QAIP on a quarterly basis and report it to the Committee as part of the standard agenda item ‘Internal Audit Summary of Activities.’ The programme details all improvement activity being progressed by the team. Conclusions 20. The pressures, demands and expectations on Local Authorities in Scotland have increased year on year in the backdrop of challenging financial settlements in which to deliver key services to those across Scotland including Argyll and Bute. This Internal Audit Plan seeks to assist the Council’s Executive Leadership Team (ELT) and senior managers, together with those charged with governance, specifically, the Council’s Audit and Scrutiny Committee that assurance in our systems, approach and outcomes meet the needs of the communities we serve whilst achieving ‘Best Value’ in the use of our finite resources. 21. The resourcing of this plan is based on the existing staff levels and contractual input in order that a balance of qualified and experienced staff can be allocated to audit work which matches their skills base and experience. In addition, such resourcing is considered as the minimum essential in which to deliver this plan across the Council during 2025/26. We would also like to express our gratitude to the Council’s senior managers who have assisted us in the production of this plan.
Page 9
7 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Appendix 1 – 2025/26 Internal Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Cross Cutting Continuous Monitoring Programme Budgeting 15 Cyclical review of key controls over an 18 month programme of audit testing. Council Tax and NDR 20 Creditors 20 Debtors 15 General Ledger 15 Payroll 25 Treasury management 15 VAT 15 Follow–up 45 Compliance Douglas Hendry Education Process for School Residential Trips 20 The determine if the current processes are embedded prior to the expansion of residential trips which will be available to all children. Education Music Service 15 To assess the arrangements for the efficient delivery of music services and that funding requirements have been met in relation to this provision. Legal and Regulatory Support Reporting Concerns at Work - Whistleblowing Policy 15 To assess the arrangements in place within the Council in relation to the Public Interest Disclosure Act and 'Whistleblowing' arrangements comply with best practice and are operating as expected. Legal and Regulatory Support Strategic Procurement 20 The compliance of established procurement practices are followed by service areas and these are monitored by service management to ensure Best Value. Commercial Services Building Cleaning 20 Review and assess the arrangements for cleaning across the Council establishments. Commercial Services Project Management of key and major developments 15 Determine the arrangements in place for project management of key high risk developments and assess the measures in place for escalation of concerns, contract variations and staged reviews at specific milestones.
Page 10
8 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Kirsty Flanagan Roads and Infrastructure Services Street lighting (Public lighting) 15 To determine the charging mechanism for un-metered electricity supply to ensure charges are correctly and accurately applied to the Council. Roads and Infrastructure Services Roads Reconstruction Programme 25 The scope of the audit is to assess whether roles, responsibilities and procedures have been established for the Roads Reconstruction Programme (RRP) and are functioning effectively. SRR02 Development and Economic Growth Oban Airport 15 Annual review to provide assurance re compliance with the CAA operational manual and the Council’s aerodrome operating manual. Development and Economic Growth Rural Growth Deal 30 To review, assess and determine if expenditure is in accordance with the funding agreement and that appropriate records are kept to support claims. SRR01& SRR03 Customer Support Services Performance Management Arrangements and Reporting 20 Assess Performance Management Arrangements being progressed as part of the Performance Excellence Project. SRR06 Customer Support Services ICT Disaster Recovery 25 Assess the adequacy and effectiveness of the Council’s ICT disaster recovery arrangements. SRR08 Financial Services Payroll - iTrent 30 New System - Post Implementation Review - to determine if the system has been implemented in accordance with the agreed scope and is operating as expected post implementation. Financial Services Capital Programme - management and monitoring 20 To assess the governance and monitoring arrangements in relation to capital projects, determine the effectiveness of the Capital Investment Boards overview and challenge in relation to planned work and processes of escalation where required. Evan Beswick H&SCP Systems Eclipse System – Post Implementation Review 25 To assess the post implementation of the Eclipse system and determine whether the system is performing as expected, access controls are operating and that appropriate training has been provided to staff.
Page 11
9 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk H&SCP External Placements Directed Self Support (Direct Payments) 25 Assessment of processes in place for the checking of evidence, receipts and accounts for payment. SRR07 Kevin Anderson LiveArgyll Property and Building Maintenance Compliance 35 Assess the systems and processes in place for regular property and building maintenance and determine what arrangements are in place to monitor compliance. Verification Activity LGBF Accuracy 10 Accuracy of submission. SPT Annual Claim Accuracy 2 Accuracy of submission. Education Maintenance Allowance Accuracy 5 Accuracy of submission. Stores Stock count 5 Assess stock count procedures. Summary & Reconciliation of Days Directorate Contact Number of Days 2025/2026 Cross Cutting – Continuous Monitoring 185 Douglas Hendry 105 Kirsty Flanagan 180 Evan Beswick 50 LiveArgyll 35 Verification Activity 22 Contingency 81 Total Core Audit - Argyll and Bute Council 658 Scrutiny Work and HSCP Audits 100 Total Audit Resource 758
Page 12
10 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Appendix 2 – 2025/26 Internal Audit Plan by Council Directorate / Head of Service Douglas Hendry Kirsty Flanagan Evan Beswick Education Legal & Regulatory Support Commercial Services Financial Services Customer Support Roads & Infrastructure Development & Economic Growth Health & Social Care Partnership Process for School Residential Trips Music Service Delivery and Funding Education Maintenance Allowance Reporting Concerns at Work Strategic Procurement Building Cleaning Project Management of key Developments Payroll - iTrent Capital Programme – Management and Monitoring Disaster Recovery Performance Management and Reporting Roads Reconstruction Programme Street Lighting Rural Growth Deal Oban Airport Direct Payments Eclipse – Post Implementation Review Live Argyll Property and Building Maintenance Compliance Other Activity NFI – Counter Fraud Team Follow Up Local Government Benchmarking Framework
Page 13
11 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Appendix 3 – Strategic Risk Register (Abridged) No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 1 Population, External Infrastructure and Economic Decline Failure to identify relevant factors contributing to the decline and failure to develop strategies and actions targeting these factors. 20 1. Local outcome improvement plan targets population, infrastructure and economic recovery. 2. Maximise external funding opportunities. 3. New Economic Strategy approved at the June EDI Committee. 4. Rural Growth Deal reaching full deal status in September 2024. 5. UK Shared Prosperity Funding Investment Plan agreed covering 2022/23 to 2024/25. 6. AB Place to B/Promote and Market Argyll and Bute. 7. Taking a place based approach to regeneration including maximising social- eco benefits/community wellbeing via effective procurement strategy, development of the circular economy and partnership working across sectors. 8. Invest in Argyll and Bute website established. 16 Treat 1. Lobbying activity in pursuit of regional immigration policies and related strategies. 2. Rural Growth Deal Outline Business Cases and Final Business Cases being worked on and signing of Full Deal Agreement is expected in September 2024. 3.Levelling Up Partnership status confirmed - projects up to the value of £20m to be developed for delivery in 2025. 4. UK Shared Prosperity Funding Investment Plan is being actioned as per plan. 5. Preparation of a pipeline of projects across Argyll and Bute in order to be able to react to any other bid funding as and when it is announced. 6. Multi-agency approach to refugee settlement underway linking with national processes and agendas. 7. The council will continue as a partner of the Highlands and Islands Regional Economic Partnership and lobby for 2019/20 (Scrutiny) 2023/24 2024/25
Page 14
12 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage Government investment to realise economic opportunity and address barriers to future sustainable growth. 8. The council working with HIE will deliver a smart action plan for the new Economic Strategy. 2 Condition and suitability of Infrastructure & Asset Base Infrastructure and asset base does not meet current and future requirements and is not being used or managed efficiently and effectively. 25 1. Capital Investment Board oversight of implementation of Capital Investment Strategy. 2. Robust capital planning and monitoring. 3. Asset management work plan. 4. Business case modelling including sustainability, development and strategic change. 5. Intelligence and best practice sharing via Heads of Property Group. 6. Community Empowerment and Community Asset Transfer – Arrangements in place to evaluate and determine requests. 7. Roads Asset Management Plan and Status and Options Report. 8. RIS Review Project Board. 9. One Council Property Approach. 10. Continuing with successful bids for external funding. 12 Treat 1. Development of finalised capital strategy in 2023. 2. 'Modern Workspace Programme' will review, engage and rationalise property portfolio for future needs of the Council. Changes will take place on phased and town by town basis. Programme will be running for 3 years - April 2025 3. Project Manager from PPMS appointed to take forward development and implementation of programme. Lochgilphead, Islay and Dunoon identified as priorities. Interim solution for Lochgilphead will be in place in Q4 FY23/24 to provide maintenance facility for larger vehicles). 2020/21 2021/22 2022/23 2023/24 2024/25
Page 15
13 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 3 Financial Sustainability Insufficient resource to meet current and future service requirement. Budget not aligned / does not support business outcomes. Budget not aligned / does not support business outcomes 16 1. Longer term financial planning and financial strategy. 2. Income generation activity. 3. Robust budget preparation and budget monitoring protocols. 4. Maintaining adequate contingency with reserves. 5. Digital transformation. 6. Effective workforce planning model. 7. Business Outcomes. 8. Financial Services resilience building project including knowledge sharing and development of guidance notes. 12 Treat 1. Rural Growth Deal Outline Business Cases and Final Business Cases being worked on and signing of Full Deal Agreement is expected September 2024. 2. Investment in professional training through Grow Our Own Activity. 3. External reviews of major budget areas e.g. RIS, education. 4. Consider the implications and opportunities from the Visitor Levy (Scotland) Bill which could generate additional income from 2026/27. 5. Completion of external review of Roads and Infrastructure Services stages 2 - 4 should realise savings for future years. 6. A review of Education to commence on a similar basis as the RIS review. 2019/20 (Scrutiny) 2020/21 2022/23 2023/24 Ongoing via Continuous Monitoring
Page 16
14 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 4 Governance and Leadership Governance and leadership arrangements are not conducive to effective working and lead to a lack of strategic direction. 16 1. New Council Administration in place with working majority. 2. Development sessions for new Administration to cover areas such as being effective leaders, strategic thinking and working with officers. 3. Working with Policy Leads to provide support and development opportunities. 4. Continued programme of Member Seminars. 5. Progressing with programme of Member Development including 1:1 conversations. 6. New Administration working on an updated set of priorities to be agreed by Council. 7. Corporate Plan sets out objectives. 8. Performance Improvement Framework and Service Planning. 9. Leadership development programme. 10. Council constitution regularly reviewed and updated. 11. Established partnership governance arrangements. 12. Scrutiny arrangements in respect of Police, Fire and Health. 13. Governance arrangements for scrutiny established. 8 Treat 1. BV Action plan complete and remaining actions mainstreamed. 2. Connect for Success priorities now form the basis of new corporate improvements and are being delivered. 3. Pilot self-assessments have been completed and guidance is being updated to reflect learning. 4. The Performance Excellence Project Phase 1 is complete and phase 2 is reviewing the Performance and Improvement Framework. 5. Leadership Development Programme Commenced in March 24 with 360 degree assessments and initial coaching sessions now underway. 6. Review of governance arrangements being undertaken with new administration to consider ongoing suitability of arrangements. 2020/21 (Scrutiny)
Page 17
15 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 5 Engagement and Understanding the needs of the Community The Council fails to understand service user needs and emerging demographic trends and does not align service delivery to meet these 12 1. Community Planning partnership has agreed new Argyll and Bute Outcome Improvement Plan based on demographically representative consultation exercise and governance arrangements are currently being refreshed to ensure a focus on action with suitable representation from partner organisations and Area Community Planning Groups. 2. Community Engagement Strategy to be supported by clear framework and guidance as developed by the Community Engagement Group. 3. Customer Service Board. 4. Operation and development of panels and forums. Young people’s plan, citizens panel. 5. Budget Consultation. 6. Comprehensive Complaints Protocols. 7. Demographic and end user analysis. 9 Treat 1. A working group has been established to review our approach to Community Engagement and to develop a Framework. The group has developed a terms of reference and is in the process of carrying out a self-assessment to identify strengths and areas for improvement. Early indications are that we have areas of excellent practice, but a lack of consistency across services. A series of draft outcomes have been identified and an action plan is under development. A collaborative space for sharing engagement activity is being developed. Updates will be reported via Highlight Reports to the Change Programme and to SMT. 2. Approach to area plans currently being reviewed to reflect the priorities of the new administration. 3. Analysis of latest census data being undertaken to inform future strategic activity. Report to Council anticipated in September. 2022/23
Page 18
16 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 6 Service Delivery Insufficient resources to ensure effective service delivery 16 1. Performance Improvement Framework 2.Service Improvement plans 3.Argyll and Bute Manager programme 4. Customer needs analysis Protocols 5.Demographic and end user analysis 6.Workforce Planning 7.Internal and External Scrutiny Arrangements 8.Complaints process 12 Treat 1. Monitor progress of performance mgt project and implement recommendations - implementation in 2023/24. 2. Budget approach for 2023-24 looked at the longer term rather than 1 year focus. This has identified a number of areas for consideration which will be explored over the coming months for the budget setting process beyond 2023-24. 3. Carry out 3 service self- assessment pilots which should identify opportunities for service delivery in the future. 2021/22 2023/24 7 Health and Social Care Partnership Failure of the HSCP to deliver on its Strategic Priorities results in deteriorating health and wellbeing outcomes for the population and / or reduced access to appropriate health and social care 20 1. HSCP integration scheme approved by Scottish government. 2. Strategic Plan in place. 3. Performance and Financial reporting arrangements in place. 4. Independent audit arrangements in place. 5. Integrated Joint board with elected member representation including Council Leader. 6. Chief Officer member of ABC Senior Management Team with co-location of officers. 7. Tripartite leadership agreement. 8. Monitoring and improvement of HSCP financial position. 12 Treat 1. Develop options to deliver sustainability of future years budgets (ongoing). 2. Develop a longer term financial plan and implement the value for money strategy. 3. Assessment of the financial implications on the Council of services transferring to the NCS when plans are sufficiently developed to enable this. 4. Progression of Service Transformation work, Estates Strategy and long term strategic service development with Hub 2019/20 2020/21 2022/23 2023/24 Assurance also taken from IJB internal audit function 2024/25
Page 19
17 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage services. This could also result in financial and reputational risk to the Council. 9. Medium term Financial Plan in place. 10. Establishment of Strategic and Tactical Groups with links to HSCP, NHS and national/regional resilience groups. North. 5. Implementation of the workforce strategy. 6. Remobilisation of services post Covid and improved performance management and reporting processes. 8 Civil Contingency & Business continuity Arrangements are not effective. 8 1. Emergency Planning Test events. 2. Critical Activity Recovery Plans. 3. Roll out of Community resilience partnership programme. 4. Peer review of major exercises undertaken to provide external validation of planning process. 5. West of Scotland local resilience partnership. 6. Cross sector expertise and partnership working. 7. Emergency Management Support Team (EMST) meetings. 8. Training. 9. EU Withdrawal Tactical Working Group with arrangements for reporting to the West of Scotland Resilience Partnership. 6 Treat 1. The Council’s critical activity recovery plans (Carps) are reviewed annually. The project for the review of Business Continuity processes within the Council is underway and will include a review of the Council’s critical activities and the potential for a software solution which would automate processes and provide a more efficient an effective service and ensure greater resilience for the Council. When the project is completed in 23/24 it will include a programme of testing of the updated Carps. Date 31 March 2024. 2. Review of BC processes has resulted in introduction of new BCM system which will allow more automation and oversight of plans and review of critical 2021/22
Page 20
18 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage activities with an enhanced ability to test these. The new system is expected to be procured by 31 March 2024. The new BCM system has been procured and configured and a pilot project to test the system and the process is underway with 3 service areas, Procurement, Customer Engagement and Transformation Management and Residential (Care Home Services). Once the outputs form the pilot have been reviewed and the system goes live, all services will be required to complete a Business Impact Analysis, which will inform the basis for having a business continuity plan in place. This is expected to be completed by 31 March 2025. 9 Waste Management Unable to dispose of waste in landfill sites due to the implications of the biodegradable 20 1. Helensburgh and Lomond waste solution available via third party off-takers, higher rates have been accepted by the council and the contract is in place until the end of 2023 with the opportunity to extend 1+1 years. It is likely over the course of 2023 an alternative procurement process will be explored with a view to putting in place a 16 Treat 1. Confirmation received from the Scottish Government that £1.5m has been made available to support the compliance with the BMW Ban. 2. Transition process underway with Renewi to facilitate the end 2021/22 (Scrutiny) 2023/24
Page 21
19 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage municipal waste (BMW) landfill ban in 2025 BMW compliant solution at the earliest opportunity. 2. At the EDI committee in December agreement was reached to seek a derogation to continue operating the PPP contract until September 2026. This will be alongside BMW compliant solutions for island settings and Helensburgh and Lomond (i.e all areas out with the PPP contract). Post Sept 2026 it is envisaged that BMW complaint solutions will be in place for all council areas. With there being uncertainty around the derogation request officers are also progressing in tandem a possible contract variation which would change the MBT plants within the PPP contract to become waste transfer stations to facilitate material to be shipped to a suitable off-taker. 3. SEPA have advised they are unable to provide reassurance on enforcement approach beyond their stated policy. Further approach now being made to FM to seek a solution or required funding. of contract arrangements for Sept 2026. 3. Ongoing workshop sessions to scope out and design future disposal models across all the council area. These models to be in place from 01/01/2026 in line with the BMW requirements. 10 Service Delivery - Cyber Security Unable to deliver services to customers because of failure of ICT 20 1. ICT Security & compliance officer in post, producing weekly threat analyses, member of CiSP. 2. PSN and Cyber Essentials Plus accreditations for corporate network. 3. Regular patching regimes in place. 15 Treat 1. Review will be ongoing on all contingency plans with updated knowledge from SEPA, Western Isles Council and UHI Cyber Attacks. 2019/20 2022/23 2023/24
Page 22
20 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage systems following major cyber security breach 4. ICT Disaster recovery plans tested regularly. 5. All critical activities have recovery plans developed (CARP’s). 6. Mimecast monthly cyber security training videos for all staff. 7. Enforce password changes when found to be weak. 8. Technical cyber exercise completed and Business Continuity Planning exercise conducted with senior management and other staff. 9. Internal Audit on Cyber Security completed with the Audit Opinion as substantial. 2. Work with Scottish Government Cyber Resilience Team to test ICT response. 3. Continued close review of disaster recovery plan and associated tests, finalise and test incident response procedure, and review of mirroring between the 2 data centres (monthly at ITMT) and backup. 4. Review and progress requirements for Education Network to achieve CE+ accreditation (going to P&R in August). 5. Procure a Security Operations Centre service to improve our 24x7 security posture. 6. Mimecast has now been made mandatory across the Council and ELT will be monitoring the uptake from staff 11 Cost of Living Crisis The Council are unable to respond to the implications arising from the 'Cost of Living' crisis. 25 1. Financial stability and support to HSCP. 2. Social Welfare and Poverty Funding assistance. 3. Focused support and multi-agency approach where risk is highlighted. 4. Monitoring of trends in service use to highlight any significant change as a result of financial hardship. 12 Treat 1. Review and monitor changes in demand for key services which correlate to personal effects arising from financial distress. 2. Extend flexible food and fuel fund to March 2025. 3. Continue to support High and Medium priority spends in SWF which is continually monitored. 2019/20 2023/24 2024/25
Page 23
21 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage Implementation of welfare reform is not managed well resulting in increased poverty and deprivation or short term crisis. 5. Targeted measures - for example to those receiving Council Tax reductions - via Gift Cards and Flexible Food and Fuel Fund. 6. Financial Inclusion and Advice Group established. 7. Joint working with DWP, CPP and other agencies. 8. Flexible Food Fund created. Supporting householders in our area with funds and advice to address food and fuel insecurities. 9. Child Poverty Planning Group set up and active. 4. Deliver sustainable school clothing bank across the Argyll and Bute area by March 2025, with support from the UK Shared Prosperity Fund. 5. Provision of welfare rights advice services in GP Surgeries in MAKI area via funding from SG until March 2025. 6. Supporting the Poverty Alliance in their Tackling Rural Poverty project, observing its progress and considering outcomes as they emerge.1. Review and monitor changes in demand for key services which correlate to personal effects arising from financial distress. 2. Extend flexible food and fuel fund to March 2025, apply to Scottish Government for funding to expand the service provision to include outreach, September 2023. 12 Impact of Climate Change The Council or communities are overwhelmed by 20 1. Continued delivery of Council De- Carbonisation Plan. 2. Civil Contingencies Manager liaising/ collaborating with Regional Resilience Partnerships and other resilience partners in 12 Treat 1. Review of De-Carbonisation Plan December 2024. 2. Consideration of all Council Papers with climate change as consideration / implications - ongoing. 2021/22
Page 24
22 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage severe or more frequent flooding, landslides, rainfall, storms, sea level changes or hot weather events due to changes in global temperature caused by climate change terms of storm event, hot weather events, cut off communities, landslides etc. 3. Development and delivery of an integrated approach to decarbonisation and adaptation of Argyll and Bute as a Region via Community Planning Partnership. 4. Roads & Amenity Services continue to develop asset management plan and address strategic risks in terms of rising sea levels, bridge repairs, critical infrastructure vulnerability. 5. A review of all critical transport routes in light of October 2023 severe weather event to identify any additional mitigations needed to maintain resilient routes. 3. Review scoring of business cases and pipeline of strategic projects with enhanced climate change considerations. 13 Lack of Housing availability The Council, partner agencies and communities are unable to attract and retain working age people due to lack of housing and pricing. 20 1. Council has declared a Housing Emergency. 2. Housing Strategy and Investment Plan funded and implemented/new housing delivery group established. 3. Islands Programme Award of Funding for infrastructure for worker accommodation on Mull - this is for phase 1 site infrastructure to enable delivery of accommodation for workers and will meet clearly evidenced community need. 20 1. Explore and develop a series of options in response to the housing emergency. 2. Address key barriers to housing. 3. Consider radical delivery models. 4. Updates to the Local Housing Strategy will reflect the Council's Housing Action Plan and will report reported to Council in November 2024. 5. Housing summit held in November and Action Plan being continually monitored/updated.