Agenda reports pack
Argyll and Bute Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Comhairle Earra-Ghàidheal Agus Bhòid Customer Services Executive Director: Douglas Hendry Kilmory, Lochgilphead, PA31 8RT Tel: 01546 605522 DX 599700 LOCHGILPHEAD 6 March 2025 NOTICE OF MEETING A meeting of the AUDIT AND SCRUTINY COMMITTEE will be held BY MICROSOFT TEAMS on THURSDAY, 13 MARCH 2025 at 10:00 AM, which you are requested to attend. Douglas Hendry Executive Director BUSINESS 1. APOLOGIES FOR ABSENCE 2. DECLARATIONS OF INTEREST 3. MINUTES (Pages 3 - 8) Minutes of the Audit and Scrutiny Committee held on 17 December 2024 AUDIT ITEMS 4. INTERNAL AUDIT AND COUNTER FRAUD SUMMARY OF ACTIVITIES (Pages 9 - 18) Report by Chief Internal Auditor 5. INTERNAL AND EXTERNAL AUDIT REPORT FOLLOW UP 2024-25 (Pages 19 - 38) Report by Chief External Auditor 6. INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2024/2025 (Pages 39 - 62) Report by Chief Internal Auditor • Oban Airport • Data and Information Security – Data Platform SCRUTINY ITEMS 7. AUDIT PROGRESS REPORT (Pages 63 - 72) Report by Forvis Mazars Public Document Pack
Page 2
8. VERBAL UPDATE BY CHAIR OF SCRUTINY PANEL 9. SCRUTINY FRAMEWORK AND MANUAL ANNUAL REVIEW (Pages 73 - 96) Report by Chief Internal Auditor 10. SCRUTINY - IDENTIFICATION OF A TOPIC 2025-2026 (Pages 97 - 100) Report by Chief Internal Auditor 11. TREASURY MANAGEMENT UPDATE QUARTER ENDED 31 DECEMBER 2024 (Pages 101 - 110) Report by Head of Financial Services 12. TREASURY MANAGEMENT STRATEGY AND ANNUAL INVESTMENT STRATEGY (Pages 111 - 152) Report by Head of Financial Services 13. 2024/2025 UNAUDITED ANNUAL ACCOUNTS PREPARATIONS (Pages 153 - 156) Report by Head of Financial Services 14. INTERNAL AUDIT STRATEGY 2025-28 AND AUDIT PLAN 2025-26 (Pages 157 - 200) Report by Chief Internal Auditor 15. INTERNAL AUDIT CHARTER AND INTERNAL AUDIT MANUAL (Pages 201 - 264) Report by Chief Internal Auditor 16. INTERNAL AUDIT - GLOBAL INTERNAL AUDIT STANDARDS AND APPLICATION NOTE FOR UK PUBLIC SECTOR (Pages 265 - 270) Report by Chief Internal Auditor 17. RIPSA ANNUAL REPORT (Pages 271 - 272) Report by Governance and Risk Manager REPORT FOR NOTING 18. DRAFT AUDIT AND SCRUTINY COMMITTEE WORKPLAN (Pages 273 - 276) For noting and updating Audit and Scrutiny Committee Janice Wason Hall (Chair) Councillor Daniel Hampsey Councillor Graham Hardie Councillor Fiona Howard Councillor Reeni Kennedy-Boyle Councillor Gary Mulvaney (Vice-Chair) Councillor Andrew Vennard Contact: Shona Barton Tel: 01436 657605
Page 3
MINUTES of MEETING of AUDIT AND SCRUTINY COMMITTEE held BY MICROSOFT TEAMS on TUESDAY, 17 DECEMBER 2024 Present: Janice Wason Hall (Chair) Councillor Graham Hardie Councillor Fiona Howard Councillor Reeni Kennedy- Boyle Councillor Gary Mulvaney Councillor Andrew Vennard Attending: Paul MacAskill, Chief Internal Auditor Carolyn Earl, Interim Head of Financial Services Shona Barton, Governance Manager Robert Miller, Customer Engagement and Transformation Manager Carolyn Cairns, HR&OD Manager Mhairi Weldon, Senior Audit Assistant David Love, Audit Scotland Bernadette Milligan, Audit Scotland Mark Outterside, Forvis Mazars Gregory Oduor, Forvis Mazars Martin Caldwell, Chair of the Scrutiny Review Panel 1. APOLOGIES Apologies for absence were intimated on behalf of Councillor Daniel Hampsey. 2. DECLARATIONS OF INTEREST There were no declarations of interest intimated. 3. MINUTE OF PREVIOUS MEETING OF THE AUDIT AND SCRUTINY COMMITTEE HELD ON 5 SEPTEMBER 2024 The Minute of the previous meeting, held on 5 September 2024 was approved as a correct record. 4. AUDIT SCOTLAND DIGITAL EXCLUSION NATIONAL PERFORMANCE AUDIT The Committee gave consideration to a report presenting the Audit Scotland Digital Exclusion National Performance Audit which had been published on 22 August 2024. Audit Scotland were in attendance at the meeting to present their findings and recommendations. Decision The Audit and Scrutiny Committee:- 1. considered and noted the report and the presentation by Audit Scotland; 2. noted the specific issues facing Argyll and Bute in digital exclusion; and Page 3 Agenda Item 3
Page 4
3. noted the progress that the Council is making in tackling digital exclusion and that further work will be undertaken by officers to address recommendations in the report where appropriate. (Reference: Report and Presentation by Audit Scotland, submitted) 5. INTERNAL AUDIT AND COUNTER FRAUD SUMMARY OF ACTIVITIES Consideration was given to a report providing a summary of Internal Audit activity and progress during quarter three of 2024/25 against the following areas: Audits Completed • Non-Domestic Rates (NDR) • IR35 Off-Payroll Working and Compliance • IT Risk Register and Mitigation Processes • Community Education • Culture (HSCP) • Joint Strategic Planning (HSCP) • Information Governance (HSCP) Audits in Planning/in Progress • Asbestos Management • Bridges Asset Management Plan and Inspection Regime • Oban Airport • Trading Standards • Disclosure Checks – protecting vulnerable groups • Roads and Flood Prevention • Data Security and Information Security The report also provided information on the work carried out by the Counter Fraud Team; the continuous monitoring programme and the progress of work carried out as a result of information received from the National Fraud Initiative. Decision The Audit and Scrutiny Committee reviewed and endorsed the Summary of Activities report. (Reference: Report by Chief Internal Auditor, dated 17 December 2024, submitted) 6. INTERNAL AND EXTERNAL AUDIT REPORT FOLLOW UP 2024-25 The Committee gave consideration to a report which provided an update on all open actions as at 30 September 2024 including information on actions where the agreed implementation date had been rescheduled. Decision The Audit and Scrutiny Committee endorsed the contents of the report. (Reference: Report by Chief Internal Auditor, dated 17 December 2024, submitted) Page 4
Page 5
7. INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2024/2025 Consideration was given to a report containing the action plans in relation to the following seven audits:- • Non-Domestic Rates (NDR) • IR35 Off-Payroll Working and Compliance • IT Risk Register and Mitigation Processes • Community Education • Culture (HSCP) • Joint Strategic Planning (HSCP) • Information Governance (HSCP) Decision The Audit and Scrutiny Committee reviewed and endorsed the summary report and the detail within each individual report. (Reference: Report by Chief Internal Auditor, dated 17 December 2024, submitted) 8. VERBAL UPDATE BY CHAIR OF SCRUTINY PANEL Martin Caldwell, Chair of the Scrutiny Panel tasked with conducting a review of the Council’s complaints process advised that the first meeting of the Panel was held on 29 November 2024. He advised that during this meeting the Panel had agreed a scoping document and planned approach to collating evidence. He further advised that this work would be undertaken and once completed, a further meeting of the Panel would be held to discuss the results of the work and potential conclusions and recommendations. The Chair of the Committee, Janice Wason Hall advised that she was shadowing Mr Caldwell in this role, she advised that it was anticipated that the findings of the Scrutiny Review would be reported to the Committee at their meeting in March 2025, and took the opportunity to thank all Members of the Scrutiny Panel for the work undertaken so far. 9. PERFORMANCE UPDATE The Committee gave consideration to a report which provided an update on the progress of the review of the Council’s Performance Improvement Framework (PIF) that is being undertaken as part of the Performance Excellence Project. The report highlighted the work completed to date and set out the remaining planned activities in phase two of the project. Decision The Audit and Scrutiny Committee noted the progress to date of the Performance Excellence Project and the remaining activities for phase two. (Reference: Report by Executive Director with responsibility for Customer Support Services, dated 19 November 2024, submitted) 10. 2023/24 COUNCIL ANNUAL REPORT Page 5
Page 6
Consideration was given to a report which presented the 2023/24 Council Annual Report (CAR). The CAR is a key document for the Council’s statutory Public Performance Reporting (PPR) duties and is published on the Council website. Decision The Audit and Scrutiny Committee noted the content of the Council Annual Report. (Reference: Report by Executive Director with responsibility for Customer Support Services, dated 19 November 2024, submitted) 11. WORKFORCE INNOVATION - HOW COUNCILS ARE RESPONDING TO WORKFORCE CHALLENGES - BEST VALUE THEMATIC WORK IN ARGYLL AND BUTE COUNCIL 2023-24 Having noted that the Council had recently introduced a strategic Workforce Plan covering the period 2024-2028, consideration was given to a report which set out how the Council is responding to the current workforce challenges through building capacity and increasing productivity and innovation. Decision The Audit and Scrutiny Committee noted the contents of the report. (Reference: Report by Forvis Mazars, submitted) * 12. AUDITED ANNUAL ACCOUNTS FOR THE YEAR ENDED 31 MARCH 2024 (a) Annual Audit Report - Year Ended 31 March 2024 The Committee gave consideration to a report and a short verbal update outlining the unqualified opinion of the External Auditors, Forvis Mazars, on the audit of the financial statements. Decision The Audit and Scrutiny Committee agreed to note the findings of the report. (Reference: Report by Forvis Mazars, dated December 2024, submitted) (b) 2023-24 Argyll and Bute Council - ISA 580 Letter of Representation Consideration was given to the ISA 580 letter of representation on the audit of the annual accounts of Argyll and Bute Council for the year ended 31 March 2024. Decision The Audit and Scrutiny Committee:- 1. noted the contents of the ISA 580 letter of representation; and 2. agreed to recommend to Council that the ISA 580 letter of representation be approved for signing. Page 6
Page 7
(Reference: ISA 580 Letter of Representation by Section 95 Officer, dated December 2024, submitted) (c) Audited Annual Accounts for the year ended 31 March 2024 The Committee gave consideration to a report presenting the Audited Annual Accounts of the Council for the year ended 31 March 2024. The Interim Head of Financial Services advised of a presentational change which would be required to the accounts in respect of Cash and Cash Equivalents as at 31 March 2024, to be reflected within Current Liabilities in the Balance Sheets and the Management Commentary. Decision The Audit and Scrutiny Committee:- 1. noted that the audit is substantially complete and that Forvis Mazars have advised the Council that they are expecting to issue an unqualified opinion on the Council’s Accounts for the year ended 31 March 2024; 2. agreed to accept and endorse the Annual Accounts, and refer to the Council for approval, subject to a presentational change in respect of Cash and Cash Equivalents as at 31 March 2024, to be reflected within Current Liabilities in the Balance Sheets and the Management Commentary; 3. noted that if the Council receive a follow-up letter from Forvis Mazars confirming that there are no material changes to the Accounts, there would be no impediment to the Council signing off the Annual Accounts; and 4. noted that if the Council receive a follow-up letter from Forvis Mazars confirming there was a material change, it would be a matter for the Council to take forward the approval of the Accounts having regard to that. It was further noted that in this event, a further report would be submitted to the Audit and Scrutiny Committee for their information. (Reference: Report by Section 95 Officer, dated December 2024, submitted) * 13. TREASURY MANAGEMENT STRATEGY AND ANNUAL INVESTMENT STRATEGY - MID-YEAR REVIEW 2024/25 Having noted that the Local Government (Scotland) Act 2003, and supporting regulations, requires local authorities to have regard to the CIPFA Code of Practice on Treasury Management and that the code requires full Council to receive an annual Treasury Management Strategy Statement, including the Annual Investment Strategy for the year ahead, a Mid-year Review Report and an Annual Report following the year end, the Committee gave consideration to a report which provided the Mid-year Review for 2024/25. Decision The Audit and Scrutiny Committee agreed to recommend to Council:- Page 7
Page 8
1. that the report and the treasury activity during the period 1 April to 30 September 2024 be noted; and 2. that the changes to the prudential indicators as set out in paragraph 5.2 of the report are approved. (Reference: Report by Section 95 Officer, dated 29 November 2024, submitted) 14. WORKPLAN In order to facilitate forward planning of reports to the Audit and Scrutiny Committee, Members considered the outline Audit and Scrutiny Committee workplan. Decision The Audit and Scrutiny Committee agreed to note the outline workplan. (Reference: Workplan of the Audit and Scrutiny Committee, dated 17 December 2024, submitted) . The Chair took the opportunity to thank all Members and Officers for their support during her first term on the Committee and wished everyone a Merry Christmas and a Happy New Year. Page 8
Page 9
ARGYLL AND BUTE COUNCIL AUDIT & SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 INTERNAL AUDIT AND COUNTER FRAUD SUMMARY OF ACTIVITIES 1. SUMMARY 1.1 The objective of the report is to provide the Audit and Scrutiny Committee (the Committee) with a summary of Internal Audit activity and progress during quarter four of 2024/25. 1.2 Core activities together with a progress update statement are shown below: • 2024/25 Audit Plan progress: The plan is currently on track. In the event that this position was to change, we will flag it to the Committee as part of the quarterly updates. • 2024/25 Individual Audits undertaken: Two audits have been completed during the period, one has been assessed as providing high assurance and one substantial assurance. There were no reports concerning the HSCP or LiveArgyll issued since the last Committee. (Where HSCP and LiveArgyll Audits are included, these are provided for information only). • Scrutiny: Planned work for 2024/25 has commenced in relation to the Council’s Complaints processes. The first meeting of the Panel took place on 29th November 2024, arrangements are being made for the second with a date to be confirmed. • Counter Fraud: The Counter Fraud Team (CFT) is continuing to rebill council tax accounts and recovery of funds is underway. All other aspects and referrals are being considered, investigated and evaluated and the Counter Fraud Team remain vigilant to protect our public purse. The established CFT team member is on secondment to Housing for career and personal development for a two year period. The CFT have obtained a member of staff, again on secondment for the same time period who is progressing through the CIPFA Fraud Specialsit Course. The team lead is currently progressing through year 3 of a Master in Accountancy course. • Continuous Monitoring Programme Testing: A number of auditable units are subject to continuous testing. There have been no new issues which we have identified this quarter. • Performance indicators: Current status is green / on track. 2. RECOMMENDATIONS 2.1 To review and endorse the Summary of Activities report. Page 9 Agenda Item 4
Page 10
3. DETAIL 3.1 Two audits have been completed since the previous Committee in December 2024. In addition, visits were undertaken to Islay and Mull which are detailed in section 5 of the report, together with our work undertaken for the HSCP. Audits Completed • Oban Airport • Data Security & Information Security Audits in Planning / in Progress reported to a future meeting of the Committee. • Short-Term Lets • Bridges Asset Management Plan and Inspection Regime – In draft • Asbestos Management – In draft • External Placements • Trading Standards • Leasing – Estates • Stores • Disclosure Checks - protecting vulnerable groups 3.2 In addition to those already in progress, indicative audits planned for Q1 2025/26 are: • LGBF • SPT Annual Claim • Education Maintenane Allowance • Payroll – iTrent • Capital Programme 2024/25 Audit Plan 3.3 • Work is ongoing and is currently on track at this point in time. • A request has been made by senior management to cancel the planned review of ‘New Roads and Street Works Coordination’ as a recent exercise, as we understand, has been undertaken in this area. This will be noted as an amendment to the approved plan for 2024/25. • A request has been received from senior management to postpone the review of Eclipse post implementation review to the 2025-26 audit year and we have scheduled this into the draft 2025/26 audit plan. This will be noted as an amendment to the approved plan for 2024/25. Page 10
Page 11
• A Request has been received by senior management to cancel the planned review of Roads and Flood Prevention, due to what we are advised is a national overview of this area and that staff will need to focus the resources on this piece of work. This will be noted as an amendment to the approved plan for 2024/25. • A request has been made to add a review onto the HSCP Audit Plan in relation to Payroll Procedures which will be accommodated into our over all resource envelope. Scrutiny 3.4 It was agreed by the Committee that the chosen subject area for the 2024/25 scrutiny review would be on the Council’s complaints process. A report was submitted to the September 2024 Committee outlining the suggested approach and appointment of the Panel to undertake this work. The former Chairperson, Martin Caldwell has delivered a brief training session which was particularly useful for those new to the Committee but also increasing the resilience of the Committee to have suitably experienced Panel members. A Background and scoping document has been prepared and issued to the Panel members and it was agreed at a meeting on 29 November to progress the review. Officer input was provided to take forward outstanding issues and prepare a draft report. The draft report has now been issued for review and arrangements are being put in place to hold a meeting to discuss the content and reach final conclusions, a suitable date is to be confirmed. Counter Fraud 3.5 The CFT is progressing well with both team members fully CIPFA accredited fraud investigators. The current investigator has taken on a 2 year secondment to empty homes for further skills development. The investigator post was filled again on a secondment basis. The new member of staff has commenced the CIPFA Fraud specialist course with a view to finish by the middle of 2025. Both team members will revert to substantive post circa September 2025. Continued routine work is still progressing to track the full income recovered from the team’s work, however, based on the amount of additional billing, even accounting for a degree of non-recovery, the indications are that the team are still exceeding their target. In addition, the team are raising awareness of the Council’s zero tolerance to fraud and this will help act as a deterrent to fraud being perpetrated in the first place. Visits continue to play a vital role in the CFTs proactive and reactive work. Recent visits have taken place in Islay, Helensburgh, Campbeltown, Rosneath, Cove, Kilcreggan, and Arrochar. A review is to take place this year for Oban with both non-doemstic rates and Council tax to fall under this visit. Partnership working with the DWP has resulted in several rebillings and adjustments to Council tax reduction schemes. Page 11
Page 12
Both officers continue to be proactive and make visits when information is recieved via the online portal The CFT continue to link in with Internal Audit and Debt Recovery, and where necessary to assist, trace persons and open communication to long term debts for recovery. Several cases have resulted in large scale rebilling. Second homes and Non-Domestic Rates are playing larger roles in the CFT team’s investigations with several claims already adjusted. These will remain proactive areas. The CFT now have an established referral system in place from council tax teams and have already liaised with this team going forward into 2025 for the review of the second and holiday home tax changes. The information already shared in the short space of time has resulted in rebilling and adjustments of accounts. Together we aim to keep accurate records and update accounts where error or missing information is held. This approach will continue as the method of collaborative and interdepartmental working has been helpful. The CFT continue to work closely with the empty homes team to support each other in our remits. Work and communication between each department is key in identifying and finding appropriate solutions to enable empty homes to return to residency or open market. The NFI exercise continues to be a routine work area for the CFT. The 2022/23 exercise is now closed and the results are with Audit Scotland. The 2024/2025 exercise has commenced with matches already being progressed. Since the inception of the CFT a total of £1,289,068 has been rebilled and £915,286 has been recovered. A recovery percentage of 71% has been achieved at the last review of the figures. Due to other commitments this quarter’s recovery has still to be checked and updated. Additional Updates from Quarter Three 3.6 A series of visits to Customer Service Points, Schools and Roads and Amenity services was undertaken across Islay and Mull. The premises visited were assessed against our standard work programmes for facility responsibility, school funds and general service provisions, both good practice and issues were identified during these visits and discussed with the officers whilst on location. A number of issues were escalated to management as a result of these visits: • The Customer Service Points were found to be well managed in accordance with the Council’s Customer Service Charter, minor issues regarding absence of a health and safety poster in one area and no appointed first aider in the other, the facility responsible officer, however, is a retained firefighter who has completed extensive first aid training. • The Schools visited were assessed for compliance with Education Management Circular (EMC) 1.10 School Funds Procedures. All funds were found to be operating effectively with robust recording of transactions and supporting information retained, there were, however some issues identified Page 12
Page 13
around establishment of School Fund Committees and associated constitutions, and where a committee was in place, failure to hold regular meetings and formal elections to office bearers’ posts. There was limited formal training in managing school funds, with administrators learning from their predecessors in most instances, whilst accurate records are maintained, these are not always in the format provided in EMC 1.10. Insufficient bank account signatories were established in one instance, receipts are not always issued upon receipt of income, income received was not always banked intact and it was unclear how long records were being kept, in some instances this was in excess of the current plus five- years requirement. A reciprocal arrangement was in place for auditing accounts of two primary schools, however, both schools are managed by the same Headteacher and this arrangement is not considered to be sufficiently independent. Appropriate advice was given where required. • Roads and Amenity services office and depots were visited to assess general administrative and operational procedures. The general environment on both islands visited was found to be clean and tidy with grounds well maintained and no evidence of excess waste. The depots and waste amenity sites were maintained in an organised manner with appropriate signage in place. Work schedules were in place and timesheets were regularly prepared and submitted by employees. A number of issues were also highlighted as a result of visits undertaken, these include: depot security, diesel fuel accountability, purchase of petrol for machinery, absence of fuel and other inventory records, recording of driver hours, employee contractual arrangements, increased demand for service not acknowledged in work schedules, holiday records, overtime procedures and authorisation, access to burials system and usage of piers and harbours. 3.8 The Council has entered a ten-year programme to deliver the Rural Growth Deal (RGD) for Argyll and Bute. The Council, as the accountable body for this programme is required to allocate and account for distribution of the funding to partners, third parties and other bodies in accordance with the approved governance arrangements. The Council’s Chief Internal Auditor has been appointed to coordinate audit activity throughout the programme, this will include liaison with partner auditors to obtain annual confirmation of regular and planned reviews of grant funded activities and a specific review of RGD within the Council’s Annual Audit Plan at least every two years. Discussions regarding the audit input required have taken place and the first review will be included within the 2025/26 Internal Audit Plan. We will closely monitor the additional work associated with this appointment going forward and determine whether additional resources may be required. 3.09 Our work as the contracted Internal Auditors for the HSCP has been progressing well and priority has been given in this area given the availability of staff and work has now completed. We will continue to monitor progress to the HSCP’s Audit and Risk Committee in relation to the implementation of recommendations made in previous reports. 3.10 Internal Audit staff continue to increase their skills and ultimately aim to complete appropriate professional qualifications at the end of their training programmes. Page 13
Page 14
Internal Audit have two staff members who are undertaking formal professional training; training is at differing stages but is progressing as expected at this time. The aim is to develop and retain professional staff on the completion of the qualifications and increase resilience within the service. Continuous Monitoring 3.11 Our continuous monitoring programme is generally focused on transactional type activity. Standard audit tests are applied which are relevant to each auditable unit. Control design tests look at whether the controls in place adequately address the potential risk event. There have been no new findings within the quarter that require to be reported. Table 2: Continuous Monitoring Findings Auditable Area Areas Tested Issues Identified Management comment / action No issues identified. 3.12 A follow up process is in place whereby management are advised of continuous monitoring findings and, where appropriate, requested to take remedial action. There are currently no outstanding follow-up points arising from previous testing. Due to the volume of continuous monitoring tests carried out the decision was made to report by exception only. National Reports 3.13 A follow up process for national reports is in place whereby management are advised of national reports published and asked to confirm what, if any, action is planned as a result of the report. Table 2 details the national reports issued during quarters two and three of 2024/25 due to be reported in quarter three 2024/25. Table 3: National Reports National Report Issued To Detail Management response/ Action taken The 2023/24 audit of Aberdeen City Council Chief Internal Auditor All Scottish councils must learn from the weaknesses that allowed an Aberdeen City Council employee’s £1.1 million fraud go undetected over 17 years. The Chief Internal Aduitor has been liaising with the Revenues and Benefits Manager to assess the Council’s position. Findings indicate that internal controls are robust with strong segregation of duties and reconciliations in place, however, areas for improvement were also identified, including, improved pre-payment monitoring and reinforcement of the Counter- Page 14
Page 15
fraud message to employees. A report has been prepared and submitted to ELT by the Head of Financial Services. National Fraud Initiative (NFI) 3.14 NFI data matching involves comparing computer records held by one body against other computer records held by the same or another body to identify potentially fraudulent claims and payments to be identified. Note though that the inclusion of personal data within a data matching exercise does not mean that any specific individual is under suspicion. Where a match is found it indicates that there may be an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out. A reminder process is in place to ensure that matches are reviewed on a timely basis. 3.15 The previous NFI exercise has been completed and results are being compiled by Audit Scotland. Any follow up matches will be addressed if necessary. This exercise was conducted throughout the year by officers and matches checked and closed accordingly. NFI provided additional data releases over the course of the exercise and matches are addressed when these become available. Existing users have been reviewed and new users added where requested, all users have been and will continue to be informed that matches are available for review and progress will be monitored monthly by the Counter Fraud team and reported quarterly to the Audit and Scrutiny Committee. New HMRC data has been uploaded and released back to us, and teams have been contacted to start matching this data. 3.16 The new NFI exercise for 2024/25 has commenced with the data uploads so far submitted to the Cabinet office for review and therefore data matching when released. The new NFI matches will appear in the table below as and when they have been released and checked. Table 4: National Fraud Initiative Progress at 03/02/2025 Operational Area Total Matches Recommended/Very High / High/ Medium Risk Matches Matches Complete * WIP Match Description CT to Elect Register 2422 0 2 0 CT records to Electoral Register/ other data sets to ensure discount awarded to only those living alone aged over 18, taking into account disregarded occupants. (CT to other Datasets will not be progressed further due to poor quality data) CT rising 18s 85 0 0 0 CT to HMRC Household Composition 1112 0 0 0 Housing Benefits 10 TBC 0 0 HB records to records in other authorities / other datasets including student loans, payroll and pensions Page 15
Page 16
to identify undeclared income and capital. Payroll 298 TBC 0 0 Payroll records to other datasets including other payrolls and pensions to ensure employee is not receiving additional income. Blue Badges 200 TBC 0 0 Blue badge records to DWP data to identify deceased claimant with valid badge. Housing Waiting list 260 TBC 0 0 Housing waiting list records to other organisations HBCTR and tenant data to identify undisclosed changes in circs or false info. Council Tax Reduction 248 TBC 0 0 CTR records with records in other authorities / other datasets including; student loans, payroll and pensions to identify undeclared income and capital Creditors 2340 TBC 75 0 Analyses Creditors data to identify possible duplicate vendors and payments, VAT errors or fraud and multiple vendors sharing a bank account. Procurement 67 TBC 0 0 Payroll records to Companies House and creditors’ data to identify employees who appear to have a personal interest in a company that the authority has traded with. Business Rates 0 TBC 0 0 Business rates records within and between authorities to identify those fraudulently claiming small business bonus scheme and grants * Work in Progress Overall Summary of Matches Matches Complete Work In Progress Cleared Frauds Errors Total Value £ Recovering Recovering Value £ 77 0 77 0 0 0 0 0 Internal Audit Development 3.17 The table below details progress against the action points in our Internal Audit development plan. Page 16
Page 17
Table 5: Internal Audit Development Key Actions: updated 31/1/25. Area For Improvement Agreed Action Progress Update Timescale Review Continuous Monitoring Programme Continuous monitoring tests will be reviewed following audit of Debt recovery to assess value of existing tests carried out. Consider adding test to review date taken to process invoices from date of receipt within the Council (not at Creditors) In progress March 2025 3.18 Internal Audit scorecard data provided below are aligned to those for internal audit in the Financial Services service plan. All indicators are shown as currently being on track. Table 6: Internal Audit Team Scorecard Internal Audit Team Scorecard 2024– 25 – FQ3 24/25 (as at January 2025) BO115 We Are Efficient and Cost Effective Internal Audit Level of Satisfaction Actual 96% G Target 80% Review of Strategic Risk register Status Complete G Target Complete Percentage of audit plan completed Status 100% G Target 80% Percentage of audit recommendations accepted by management Actual 100% G Target 100% 4 CONCLUSION 4.1 The 2024/25 audit plan is progressing as anticipated at this stage in the year, together with the Counter Fraud Team continuing with visits and pro-active work throughout Argyll and Bute. 5 IMPLICATIONS 5.1 Policy – Internal Audit continues to adopt a risk based approach to activity 5.2 Financial –None 5.3 Legal –None 5.4 HR – None Page 17
Page 18
5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – None 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None For further information please contact Internal Audit (01546 604108) Paul Macaskill Chief Internal Auditor 13 March 2025 Page 18
Page 19
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 INTERNAL AND EXTERNAL AUDIT REPORT FOLLOW UP 2024-25 1.0 INTRODUCTION 1.1 Internal and external audit reports include an action plan with a management response establishing the agreed action, timescale and responsible officer. Internal Audit record these in a database and, on a monthly basis, follow them up to ensure they are being progressed. 1.2 This report updates the committee on all open actions as at 31 December 2024 including information on actions where the agreed implementation date has been rescheduled. 2.0 RECOMMENDATIONS 2.1 To endorse the contents of the report. 3.0 DETAIL 3.1 The two tables below provide a numerical summary of open audit actions with a split between actions due by and due after 31 December 2024. 3.2 Appendix 1 provides further detail on actions that have been delayed and rescheduled. Page 19 Agenda Item 5
Page 20
Table 1 - Actions Due by 31 December 2024 SMT/Service Complete Delayed/ Rescheduled Total Internal Audit DH – Commercial Services 1 1 2 DH – Education Performance & Improvement 1 0 1 DH – Education Wellbeing, Inclusion & Achievement 1 0 1 KF – Customer Support Services 8 2 10 KF – Development & Economic Growth 3 2 5 KF – Roads & Infrastructure Services 1 13 14 H&SCP (IJB) – Finance/Transformation 2 0 2 H&SCP (SW) – Finance/Transformation 2 0 2 H&SCP (IJB) – Strategic Planning & Performance 0 2 2 H&SCP (SW) – Strategic Planning & Performance 0 2 2 H&SCP (SW) – Adult Services (Mental Health Learning Disability, Addictions & Lifelong Conditions) 1 3 4 H&SCP (IJB) – Adult Services (Older Adults & Community Hospitals 0 1 1 H&SCP (SW) – Adult Services (Older Adults & Community Hospitals) 0 3 3 H&SCP (SW) – Children and Families and Criminal Justice 0 2 2 External Audit Nil TOTAL 20 31 51 Table 2 – Actions due after 31 December 2024 SMT/Service Complete Delayed/ Rescheduled On Course Total Internal Audit DH – Legal & Regulatory Support 0 0 2 2 DH – Education Performance & Improvement 2 0 4 6 KF – Financial Services 0 0 16 16 KF – Customer Support Services 0 1 0 1 KF – Development & Economic Growth 1 0 0 1 KF – Roads & Infrastructure Services 1 1 1 3 LiveArgyll 0 0 1 1 H&SCP (SW) – Adult Services (Mental Health Learning Disability, Addictions & Lifelong Conditions) 0 0 2 2 H&SCP (SW) – Finance/Transformation 0 2 0 2 H&SCP (IJB) – Strategic Planning & Performance 1 0 6 7 External Audit Nil TOTAL 5 4 32 41 Page 20
Page 21
4.0 CONCLUSION 4.1 Satisfactory progress continues to be made implementing audit actions. 5.0 IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – None 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Paul MacAskill Chief Internal Auditor 13 March 2025 For further information contact: Paul MacAskill, 01546 604108 Paul.macaskill@argyll-bute.gov.uk APPENDICES Appendix 1 – Action Plan Points Delayed & Rescheduled Page 21
Page 22
Appendix 1 - Action Plan Points - Delayed and Rescheduled Action Plan Points due by 31st December 2024 Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer LOW COMMERCIAL SERVICES Externally Funded Projects - Rothesay Pavilion 3. Resources Consideration should be given to reviewing the extensive use of outside contractors and consultants as opposed to investing in in-house resources in regard to major capital projects especially in light of the projected overspend on the project. As part of the End Project Report, Lessons Learned, a review of the decision pertaining to project resourcing will be undertaken, and recommendations made to Head of Service with respect to the on- going efficient resourcing of projects. In developing future projects the Council will continue to give consideration to the most efficient resourcing model. 30/06/2023 30/06/2024 31/12/2024 31 Jan 2027 At the Council meeting of 26- Sep-24 it was agreed to proceed with the implementation of the remainder of the adaptive restoration works, and to complete the project in its entirety. The formal Notice to Proceed with these works is programmed to be issued by 20 January 2025, and the works are programmed to achieve Practical Completion in December 2026. This means that the End Project Report, and Lessons Learnt will not be undertaken until January 2026 at the earliest (assuming that the construction programme is not subject to any revision). End of project report cannot be completed until works completed, of which there has been substantial delays. Delayed and Rescheduled Project Manager Medium CUSTOMER SUPPORT SERVICES Cloud Computing Services 5. Disaster Recovery Plans and Run books Finding; Disaster recovery plans/run books are not in place for all systems reviewed and ICT will prepare, update and finalise disaster recovery documentation and implement testing for those recently introduced cloud systems not already documented. 31/10/2024 31 /03/2025 DRP documentation is now in place and has been provided for review via SharePoint. Testing is planned for one system in July and another later in the year, however a testing schedule is not currently available. The ICT and Digital Manager Page 22
Page 23
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer therefore not tested to cover any potential disaster affecting the Council’s ability to access these systems. Recommendation; ICT services prepare, update or finalise disaster recovery documentation and implement testing. testing schedule should be provided for the next follow up exercise. Delayed and Rescheduled Low CUSTOMER SUPPORT SERVICES Equality and Socio-Economic Impact Assessment 4. Training EqSEIA guidance was issued to employees via a newsflash and presentations were made to managers, including a presentation on EqSEIA and for budget setting savings. Webinars and presentations on EqSEIAs will be run at key times in the year. 30/06/2023 31/12/2023 31/03/2024 30/06/2024 30/11/2024 31 Mar 2025 Build of the tool is complete. User testing is in progress. Presentation to SMT planned 20th January with expected launch by the end of January. Once the tool is launched a link to the live tool will be provided as evidence to close off this action. Delayed and Rescheduled Head of Customer Support Services Medium DEVELOPMENT & ECONOMIC GROWTH PLANNING 1. Staff Training Planning do not currently have in place a training schedule for 2023/24 for planning officers. Once the incorporation of the IDOX project is completed a training schedule will be introduced covering both the new system and other relevant areas such as the National planning for framework 4. 31/03/2024 31/12/2024 31 Mar 2025 A formalised training schedule has still to be completed however action has already been taken forward to deliver on a number of training themes identified by staff. This has included an event on considering the presence of protected species in the determination of planning applications (April 2024), and upcoming planned sessions during Feb and March 2025 relating to Trees and EIA development. It is confirmed that the most pressing training needs have been identified and are being delivered/progressed whilst a training plan that Process and Productivity Improvement Officer Page 23
Page 24
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer addresses wider requirements still remains under production. Delayed and Rescheduled Low DEVELOPMENT & ECONOMIC GROWTH Private Sector Housing Grants & Adaptions 3. Procedure Notes and Shared Documents While the vast majority of requirements are included, there would be benefit to updating these to reflect current working practices which have evolved due to hybrid working arrangements and the digitalisation of records. Consideration should be given to creating a checklist to ensure consistent application of processes. Procedures and documents will be reviewed and updated. Checklists to be drawn up and introduced when updating the procedures. 31/12/2022 30/06/2023 31/03/2024 30/09/2024 30/12/2024 30 Jun 2025 Although, the review of the Scheme of Assistance is complete it was delayed and will be presented for approval at the 24th April 2025 Council Meeting. The updated procedures will be completed by the 31st May 2025 for implementation of the revised Scheme of Assistance on 1st July 2025. Delayed and Rescheduled Team Lead - Housing Operations High ROADS & INFRASTRUCTURE SERVICES Burial Records 1. No Procedure for Records Management Finding: There is no consistent approach to updating and managing burial records across the Service. Finding: Private burials on home ground do not appear to be authorised or registered. Finding: Officers are printing documentation provided by funeral directors and applicants via email unnecessarily. Finding: Documentation was missing or could not be located at the time of the audit visit. Recommendation: A unified approach to records management should be adopted to establish consistency and provide resilience A unified approach to records management will be implemented and documented in a procedure note. This will include a requirement for periodic sample checking to take place. 30/06/2023 31/12/2023 31/03/2024 30/06/2024 30/09/2024 31/12/2024 31 Mar 2025 All areas are working to the same draft procedures, which are scheduled for implementation following final revision at team meeting to be held mid-February 2025. Delayed and Rescheduled Operations Manager, Roads and Infrastructure Services Page 24
Page 25
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer across the service. Additionally, a sample of burial records should be periodically checked for accuracy. This should be documented in a procedure note and issued to the relevant members of staff. Medium ROADS & INFRASTRUCTURE SERVICES Burial Records 2. Review of Policies and Procedures Finding: Policies and procedures provided to the auditor contained no evidence of recent review or were not dated. Recommendation: Policies and procedures should be subject to periodic review and updated as required. Updated documents should be promptly circulated to staff and published on the Council’s website where appropriate. Policies and procedures will be reviewed and updated if required. These will be re-issued to staff and published where appropriate. 30/06/2023 31/12/2023 31/03/2024 30/06/2024 30/09/2024 31/12/2024 31 Mar 2025 Area staff recently met to discuss processes and ensure all areas are working consistently. This process has seen additional information being requested from applicants/funeral directors for assistance in debt recovery. Debt recovery colleagues have been involved in discussions. It is expected that all processes will be in place by mid-February 2025. Delayed and Rescheduled Operations Manager, Roads and Infrastructure Services Low ROADS & INFRASTRUCTURE SERVICES Burial Records 5. Additional Functions within BACAS Finding: BACAS system has additional functionality that is not currently utilised to provide efficiencies. Recommendation: Liaise with system provider and other Local Authorities to establish which additional features would provide benefits to the service. The service will liaise with the system provider and other local authorities to identify useful additional system functionality and arrange training for implementation. 30/06/2023 31/12/2023 31/03/2024 30/06/2024 30/09/2024 31/12/2024 31 Mar 2025 Additional functions relating to the BACAS system relate mainly to the crematorium operations. The system is now being used to communicate the order of services for the working day and information around music, invoicing are also being captured. Further engagement with Inverclyde Council who are currently going through a similar process with BACAS is scheduled for February 2025. Delayed and Rescheduled Operations Manager, Roads and Infrastructure Services Page 25
Page 26
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer Low ROADS & INFRASTRUCTURE SERVICES Burial Records 6. Historical Register Information Finding: The Burial and Cremation (Scotland) Act 2016 (The Act) requires information to be retained electronically although this is not currently in force it will be at a future date. The BACAS system has been partially updated with historical information recorded in burial registers, it has not been possible to update with all information due to the volume of work involved. Recommendation: Source temporary additional resource to update historical burial records on BACAS. The service will source temporary assistance to update records during Summer 2024. 30/06/2023 31/12/2023 31/03/2024 30/06/2024 31/12/2024 30 Jun 2025 Still to successfully recruit to this position. The service will again look to recruit the temporary assistance to achieve this audit action. Delayed and Rescheduled Operations Manager, Roads and Infrastructure Services VFM ROADS & INFRASTRUCTURE SERVICES External Hire 3. External hires exceeding their expected return date Of the 124 current ongoing hires 101 of these have exceeded their expected return. In addition 29 items were over the return date by more than 1000 days. There is no document available that explains the reasons why these items have substantially exceeded their expected return date. Roads and infrastructure services are currently under a review of all services and the recommendation will be assessed as part of the review. 30/06/2023 31/12/2023 31/03/2024 31/08/2024 31/12/2024 31 Mar 2025 As per previous update there are a number of reasons for lengthy external hires. Given the nature of Operations works, there will always be a requirement for external hires to ensure the delivery of works programmes such as the roads reconstruction programme. A system has been developed to allow management to monitor external hires, the length of the hire and to have notification prior to end dates to manage all hires better. Details of this should have been sent as proof the action had been completed. The section's system employee has developed a spreadsheet to Operations Manager, Roads and Infrastructure Services Page 26
Page 27
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer highlight hires coming to an end to advise colleagues to arrange for the vehicles, plant, equipment to be off-hired or further approval sought to extend. Spreadsheet still to be updated and action should be complete by the next quarter. Delayed and Rescheduled VFM ROADS & INFRASTRUCTURE SERVICES External Hire 4. Evaluating whether long-term hires should be leased or purchased outright There is currently no mechanism that triggers an exercise where “finance” considers whether cheaper long term finance options are available such as an operating lease or for the Council to purchase an item outright. Roads and infrastructure services are currently under a review of all services and the recommendation will be assessed as part of the review. 31/03/2024 31/12/2024 31 Mar 2025 Meeting scheduled to bring in protocols for long-term hires to go through finance in order to close this action for March 2025. Delayed and Rescheduled Principal Accountant, Roads and Infrastructure Services Low ROADS & INFRASTRUCTURE SERVICES PIERS & HARBOURS 2. Calmac Charges Calmac, the main ferry operator uses the Council’s Piers and Harbours on a daily basis, with administratively intensive process in place for charging. Have an agreement (financial) in place by the end of the year. 31/12/2023 31/03/2024 30/06/2024 30/11/2024 30 Jun 2025 Renewal of CHIFS contract and new personnel have delayed this work. We do not have a new agreed deadline however it remains a priority for both bodies to progress. Delayed and Rescheduled Marine Operations Manager High ROADS & INFRASTRUCTURE SERVICES PIERS & HARBOURS 3. Any agreement must be supported by both parties and Argyll & Bute Council legal department. May tie in with No 2 above. Provide a 31/12/2023 31/03/2024 30/06/2024 30/11/2024 This will need more time to resource and implement across the various departments and external customers. Marine Operations Manager Page 27
Page 28
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer Service Level Agreements (SLA’s) A number of companies, including large fish farming businesses make use of our facilities on a regular basis, however, there are no SLA’s in place. We were advised that work is currently being undertaken to put Harbour Access Agreements in place. report to HoS and Director with options. 1. Identify potential partners 2. Negotiation period 3. Legal support in drafting agreement 30 Jun 2025 Delayed and Rescheduled Low ROADS & INFRASTRUCTURE SERVICES PIERS & HARBOURS 4. Remote Piers and Harbours Harbourmasters based at the main piers and harbours are able to record the use of the facilities where they are predominantly based, however, a number of piers, slipways and harbours are in remote locations and are difficult to manage in terms of use. In addition, there are no robust procedures in place to identify commercial tour vessels using our facilities potentially resulting in a loss of income for the Council. Actionable evidence and enforcement will continue to be an issue where there are no Argyll & Bute Council personnel on site. Investigate issues and possible solutions with Harbour Masters and provide options for consideration in report to DMT. 31/12/2023 31/03/2024 30/06/2024 30/09/2024 30/11/2024 30 Jun 2025 CCTV is in process of being installed. Next harbour is Port Askaig due Feb/March 2025. Delayed and Rescheduled Marine Operations Manager Low ROADS & INFRASTRUCTURE SERVICES PIERS & HARBOURS 5. Fishing Fleet Fees and charges for the fishing fleet within the Council area are managed by the fishing fleet whereby they advise us of the value of their landings once the catch has been sold. There is no back up information provided to substantiate the value and it is generally paid through cash receipting or by cheque. Investigate issues and possible solutions with Harbour Masters and provide options for consideration in report to DMT. 31/12/2023 31/03/2024 30/06/2024 30/09/2024 30/11/2024 30 Jun 2025 CCTV is being installed and is ongoing. Delayed and Rescheduled Marine Operations Manager Page 28
Page 29
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer Low ROADS & INFRASTRUCTURE SERVICES PIERS & HARBOURS 6. Management of Debt The outstanding debt owed to the Council at the end of June in respect of Piers and Harbours amounted to £143k. There are a number of long term outstanding debts and it was noted that in some instances there is continued use of our facilities by vessels who have outstanding debts dating back to 2019. Investigate with legal department recovery or right off options. Provide a report to HoS and Director with options. 31/12/2023 31/03/2024 30/06/2024 30/09/2024 30/11/2024 30 Jun 2025 On-going process. Delayed and Rescheduled Marine Operations Manager Low ROADS & INFRASTRUCTURE SERVICES PIERS & HARBOURS 7. Income Gaps We reviewed the fees and charges agreed by the Council and compared these to fees and charges applied in other piers and harbour throughout Scotland, including Clydeport. It was found that there were potential gaps. Complete a review of potential new charges for Harbour Board approval in Fees and charges report. 30/11/2024 28 Feb 2025 Increased ferry charges, including freight rates for Jura have been approved and implemented. Delayed and Rescheduled Marine Operations Manager Low ROADS & INFRASTRUCTURE SERVICES PIERS & HARBOURS 8. Published Pier and Harbour Dues and Fees Harbour fees and dues are published on the Council website on an annual basis following being agreed and set at the Council’s budget setting meeting, however, these are not in a format that can be easily downloaded. Produce a ‘Schedule of Harbour Charges’ for Harbour Board approval. 30/11/2024 30 Jun 2025 Schedule is in process with new fees and charges to be agreed following Council approval. Delayed and Rescheduled Marine Operations Manager Page 29
Page 30
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer Low ADULT SERVICES (OLDER ADULTS & COMMUNITY HOSPITALS) Adult Services - Adult Support & Protection (ASP) 1. Progress Whilst significant progress has been made to address the key areas identified within the report there remains challenges in terms of ensuring attendance by all relevant partners at case conferences, ensuring that chronologies and risk assessments are completed and ensuring that the ‘three point test’ is undertaken. Adult services will facilitate an ASP audit on a six monthly basis to determine practice and compliance with ASP legislation and KPIs. 30/09/2024 31/12/2024 31 Aug 2025 Multi-Agency Adult Protection Audit is planned although the frequency will be determined by the Adult Protection Committee. Meeting of Committee to take place in February 2025 to comprehensively discuss, plan, take forward and review. Delayed and Rescheduled Head of Adult Services (Mental Health, Acute and Complex Care) Medium STRATEGIC PLANNING AND PERFORMANCE Risk Management 1. Operational Risk Registers All key business activities within the partnership have an operational risk register in place as required per the Strategy document. A review of these risk registers noted that they have not been updated and formally reviewed. Recommendation accepted. All operational risk registers will be updated on smart sheet. 31/12/2024 31 Dec 2025 Managers supplied with existing Registers and 1-2-1 meetings with the BIM are being scheduled to verbally review the Registers, scope additional risk, and update. Smartsheet will be decommissioned by NHS Highland, in December 2025. A collective escalated operational risk is being collated at present for enhanced clinical and care risk management and to support the escalation route, as noted in the guidance. This will be led by the Interim Clinical and Care Governance Manager. Inphase will be deployed in approx. September 2025, by which point all updated Risk Registers will be moved to the new system, which offers an Business Improvement Manager Page 30
Page 31
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer easier system of review. Final date of completion including evaluation of improved governance anticipated September-end 2025. Delayed and Rescheduled Low STRATEGIC PLANNING AND PERFORMANCE Risk Management 3. Training It is noted that there is an outstanding audit action since June 2021 covering; · Training for new members of IJB and Audit Committee · training for Risk leads · maintenance of training records Recommendation accepted. A training programme based upon the use of the Smartsheet system is being developed. 31/12/2023 30/06/2024 31/12/2024 30 Sep 2025 A 4-week campaign was deployed on Risk awareness offering an opportunity for a baseline Risk Management module available across the NHS Highland footprint on TURAS. A Risk Management course has been sourced for IJB Members and is being reviewed for suitability and cost. Training records are reportable, through TURAS, and contact has been made with the TURAS Team to receive reports on the module circulated. So far, uptake has not been high, but we will now redirect this through Managers and Team leads. Training sourced but not delivered at the moment. Delayed and Rescheduled Business Improvement Manager Medium ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) CLIENT FUNDS PROGRESS REVIEW 2. Detail restricted 30/12/2024 31 Mar 2025 Delayed and Rescheduled SW Admin Manager Page 31
Page 32
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer Meeting service users’ financial needs Detail restricted Medium ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) CLIENT FUNDS PROGRESS REVIEW 3. Implementation of new working practices Detail restricted Detail restricted 31/08/2024 31/12/2024 31 Mar 2025 Delayed and Rescheduled SW Admin Manager Medium ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) Learning & Physical Disability Care Packages 3. Case Notes Case notes are maintained on Eclipse, the replacement client database for Carefirst. It was noted that case notes were not always maintained and up to date. · Record keeping session(s) to be delivered by professional lead · Senior Managers to implement case note audit within their respective services – this should be linked to individual practitioner supervision 30/06/2024 31/12/2024 31 Mar 2025 Interim HoS will seek assurance to regular audit cycles to be included in the monthly assurance reports received from Senior manager and team managers and report back by 31 March 2025 for MH and LD services. Delayed and Rescheduled Senior Managers (Adult Services) Medium ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) Learning & Physical Disability Care Packages 6. Allocation of Resources The large majority of Learning Disability services are commissioned under the Supported Living contract and Older People services are commissioned under Care at Home contract. There are a few anomalies where some providers of Care at Home services are Review the Care at Home contract as a matter of priority to ensure that there is personal care provision across the authority for those under the age of 65 with complex needs, who do not require more intensive care such as that provided via Supported Living. 30/06/2024 31/08/2024 31 Aug 2025 Due to absence at Head of Service level this recommendation has not been progressed to date. It is a significant piece of work with strategic implications for the service. A revised date and timetable will be established in due course. Delayed and Rescheduled Head of Adult Services - Acute & Complex Care Page 32
Page 33
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer commissioned to provide support outside of their normal client group, however it was found that priority was given to older peoples services with Learning Disability clients remaining on a waiting list for personal care services. Low ADULT SERVICES (OLDER ADULTS & COMMUNITY HOSPITALS) Scottish Social Services Council (SSSC) Registration 3. Service-user information Finding: Service-users and their family, friends and non-Council carers are advised that violence, threats or abuse towards them from Council employees will not be tolerated, however, only one handbook provided advised visitors on expected conduct regarding violence, threats or abuse towards employees. There was no documentation containing information regarding conduct of service users towards employees. Recommendation: Service-user documentation should be revised to advise that instances of violence, threats or abuse directed towards employees is not acceptable. Review all social work and social care service user documentation in adult services. 31/08/2024 31/12/2024 28 Feb 2025 All care home handbooks have been updated in the last 6 months to reflect the most up to date complaints information for residents/families and also contains information which informs that instances of V&A will not be tolerated. Delayed and Rescheduled Senior Manager - Resources/Professional Lead - Social Work Low ADULT SERVICES (OLDER ADULTS & COMMUNITY HOSPITALS) Scottish Social Services Council (SSSC) Registration 6. Care Home Handbook Finding; Details of how to communicate concerns/complaints were provided in two out Review all care home complaints/concerns processes. 31/07/2024 31/12/2024 28 Feb 2025 Managers have agreed to update all handbooks, this will be revisited at next meeting scheduled for February to ensure the action is fully completed. Delayed and Rescheduled Lead Nurse (Care Homes) Page 33
Page 34
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer of three handbooks provided. Recommendation; Review and update content of care home handbooks to ensure complaints contact details are consistently provided. Medium CHILDREN AND FAMILIES AND CRIMINAL JUSTICE Scottish Social Services Council (SSSC) Registration 4. Supervision Policy Finding: The Supervision Policy is dated November 2011 with no evidence of review or update, additionally, the requirements in terms of frequency and duration of supervision meetings are considered by mangers to be unrealistic in terms of current available resources. Recommendation: The Supervision Policy be reviewed and updated to ensure it incorporates up-to-date needs and requirements of service delivery. Develop a social work and social care supervision policy. 31/08/2024 30/09/2024 31/12/2024 30 Jun 2025 We are close to roll out – but with the competing priorities (and staffing issues) we are not quite there yet. Once rolled out we should be in a position to diligently work through the compliance documentation. Delayed and Rescheduled Professional Lead - Social Work High CHILDREN AND FAMILIES AND CRIMINAL JUSTICE Scottish Social Services Council (SSSC) Registration 5. Compliance with Supervision Policy Finding: evidence of compliance with the supervision policy was limited and embedded templates were not being consistently used. Recommendation: Following review of the Supervision Policy, Managers should be reminded of the need to schedule supervision Appropriate documentation will be provided following development of social work and social care supervision policy. 31/08/2024 31/10/2024 30 Jun 2025 We are close to roll out – but with the competing priorities (and staffing issues) we are not quite there yet. Once rolled out we should be in a position to diligently work through the compliance documentation. Delayed and Rescheduled Professional Lead - Social Work Page 34
Page 35
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer meetings with employees in advance and retain records in an appropriate and consistent format. Medium STRATEGIC PLANNING AND PERFORMANCE Learning & Physical Disability Care Packages 4. Client Records A previous audit report highlighted the fact that client records were stored in multiple locations, including on the Council’s network drive. Evidence obtained during the audit suggests that client records are still being maintained in several locations. A successful pilot project was run in Mid Argyll transferring all records onto CIVICA. A proposal has been submitted to roll this out across all other areas in Argyll. Ensure that a standardised and compliant electronic recording system is implemented across HSCP services – this should be achieved via the Eclipse Implementation Program. 30/06/2024 31/12/2024 31 Aug 2025 All previous Carefirst LD client records were migrated as part of the Eclipse Phase 1. Staff can currently access client records via the Eclipse Community Case Management System. The Eclipse Phase 2 development is currently ongoing with regards to the onboarding of Community Health Teams. A project plan is being developed with OLM to support the testing and delivery stages. An early indication for OLM at the Eclipse Board on 14/01/25 is that this will cover a 28 week timescale with completion for late August 2025. The CIVICA project continues with 3 delivery phases identified within the project plan. Stage 1- Adult Care, Stage 2- Children & Families and Stage 3- Health. As each of the teams are moved into the CIVICA system the access to external drives is terminated ensuring that all data is held within a single system. This work will continue across 2025/26 and 26/27. Delayed and Rescheduled Head of Strategic Planning, Performance and Technology Page 35
Page 36
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer Medium STRATEGIC PLANNING AND PERFORMANCE Learning & Physical Disability Care Packages 7. Unmet Need Unmet need for Older People Care at Home is collated by the resources team on a weekly basis, this is then submitted to Performance and Improvement Team, and is reported to Scottish Government. The data for Learning Disability is not currently recorded formally and not included in the above. Include the data re unmet need for those under 65 in the weekly reporting format already in place for Older People. 30/06/2024 30/09/2024 31 Aug 2025 The reporting of Unmet need from Eclipse for LD clients will be developed alongside the Phase 2 data reporting. Delayed and Rescheduled Head of Strategic Planning, Performance and Technology & Head of Adult Services (Health & Community Care) Action Plan Points due after 31st December 2024 Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer LOW CUSTOMER SUPPORT SERVICES Human Resources - Casual Staff 5. Recruitment process Discussions with operational managers found a preference for casual staff due to the simpler setup process compared to temporary posts, potentially prompting talks with trade unions and senior management to simplify recruitment, reducing incorrect usage and improving efficiency. HR should explore opportunities with key stakeholders to make it easier for managers to recruit into temporary posts. HR to initiate discussions with trade unions and senior management to explore opportunities for simplifying the recruitment process for temporary/casual posts, based on feedback from operational managers, with the aim of reducing incorrect usage and improving overall efficiency. 31/03/2025 30 Sep 2025 This action is dependent on progress with phase 2 of the itrent project which is currently on pause. A date has yet to be agreed for engagement around the recruitment and onboarding module as part of phase two planning. It is likely to have been completed by 30th September 2025 although this is dependent on progress being made with phase 2 of the itrent project. Delayed and Rescheduled Senior HR Business Partner/HR Manager Operations Medium FINANCE/TRANSFORMATION INFORMATION GOVERNANCE 2. Improvement Plan Develop and implement an action plan to address the Keeper of Scotland's improvement recommendations, ensuring that all aspects of records management 31/03/2025 30 Sep 2025 The RMP is now due for submission around August 2025. Delayed and Rescheduled Governance, Risk & Safety Manager Page 36
Page 37
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer A number of improvement recommendations made by the Keeper of Scotland were identified in the following areas: · Business Classification · Retention Schedule · Destruction Arrangements · Archiving and Transfer · Business Continuity and Vital Records · Audit Trail An action Plan to address these areas should be implemented are up-to-date, compliant, and effectively managed. Will be reviewed as part of RMP submission to Keeper. Medium FINANCE/TRANSFORMATION INFORMATION GOVERNANCE 1. Documentation Review Reviews are outstanding in regard to: · Records Management Plan · Information Governance policy framework A review of all relevant documents will be carried out. RMP will be reviewed and submitted to Keeper around February 2025. IG policy to be reviewed. 31/03/2025 30 Sep 2025 The RMP is now due for submission around August 2025. Delayed and Rescheduled Governance, Risk & Safety Manager High ROADS & INFRASTRUCTURE SERVICES – WARDEN SERVICES Second Bin Service Verification Wardens are expected to verify the veracity of applications from customers for a second domestic bin service. This requires the warden to confirm that information provided by the customer is accurate and meets the defined criteria. The information provided to substantiate an application can be very personal and sometimes of a sensitive medical nature. Wardens have been asked to provide this service but have received no formal training in how to ensure a customer’s dignity is maintained or to ensure Review the process for; Review the second bins that are in place and the process for rationalising. This review to also give consideration to composition and identify opportunity to increase recycling and reduce general waste. 31/03/2022 30/09/2022 31/12/2022 31/03/2023 30/09/2023 31/12/2023 31/03/2024 31/03/2025 30 Jun 2025 EDI committee approved the second general waste bin review, the process has currently been put on hold whilst a survey Is being carried out seeking views and feedback of the service and its future provision. Delayed and Rescheduled Operations Manager, Roads & Infrastructure Services Page 37
Page 38
Service, Report, Plan no. & Finding Agreed Action Dates Management Comment Responsible Officer they are aware of the requirements of General Data Protection Regulation (GDPR) in relation to personal data for this specific process. Due to the sensitivity of this process, and the potential risks associated with data protection it is recommended that the current verification process is reconsidered to determine if it is appropriate to maintain it in its current form. If it is decided it should be retained then there should be engagement with the Council’s Governance and Risk Manager to ensure it is being carried out in full compliance with GDPR. Page 38
Page 39
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2024/2025 1. EXECUTIVE SUMMARY 1.1 There are two audits being reported to the Audit and Scrutiny Committee. 1.2 The table below provides a summary of the conclusions for the audits performed. The full reports are included as appendices to this report. Audit Name Level of Assurance High Actions Medium Actions Low Actions VFM Actions Oban Airport High 0 0 0 0 IT – Data Security and Information Security Substantial 0 1 0 0 1.3 Internal Audit provides a level of assurance upon completion of audit work. A definition for each assurance level is documented in each audit report. 2. RECOMMENDATIONS 2.1 Audit and Scrutiny Committee to review and endorse this summary report and the detail within each individual report. 3. DETAIL 3.1 A high level summary of each completed audit report is noted below: Oban Airport: Our overall audit opinion for this audit is that we can take a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. The audit covered 6 of the 24 airport operating instructions within the aerodrome operating manual and all were found to be satisfactory. The Manual is updated on an annual basis and no audit issues were raised. IT – Data Security and Information Security: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Contractual arrangements for the Page 39 Agenda Item 6
Page 40
consultancy work are in place following a comprehensive procurement exercise and include suitable details in terms of security and access arrangements to both the platform and its data which is accessed on a read- only basis using an analysis and reporting tool. A data challenge proposal must be completed demonstrating a sound business need for adding data to the platform and this will only be uploaded upon approval of the Data Advisory Group, Data Protection Impact Assessments may also be required where personally identifiable information is included. There is sufficient data storage capacity to operate with large quantities of data and there are options for expansion, however, these options will be at a cost. There is provision to remove personally identifiable information in compliance with GDPR, however, removal of general data is not currently considered within the data challenge proposal to help manage capacity and minimise potential future costs. Well- established arrangements are in place to ensure business continuity and disaster recovery. 4. CONCLUSION 4.1 Management has accepted each of the reports submitted and have agreed responses and timescales in the respective action plans. 5. IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – The implementation of recommendations contained in audit reports may help mitigate the risk to the Council. 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 13 March 2025 For further information contact: Paul Macaskill, Chief Internal Auditor Tel: 01546 604108 Email: paul.macaskill@argyll-bute.gov.uk APPENDICES 1. Oban Airport 2. IT Data Security and Information Security Page 40
Page 41
Argyll and Bute Council Internal Audit Report February 2025 FINAL High Medium Low VFM Number of Findings 0 0 0 0 Oban Airport Audit Opinion: High Page 41
Page 42
2 Argyll and Bute Council – Internal Audit Report – Oban Airport, February 2025 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 2. Objectives and Summary Assessment ........................................................................................... 4 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Audit Opinion ................................................................................................................... 9 Contact Details Internal Auditor: Leanne Rennie Telephone: 01369 708516 e-mail: Leanne.rennie@argyll-bute.gov.uk www.argyll-bute.gov.uk Page 42
Page 43
3 Argyll and Bute Council – Internal Audit Report – Oban Airport, February 2025 1. Executive Summary Introduction 1. As part of the 2024/25 internal audit plan, approved by the Audit & Scrutiny Committee in March 2024, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Oban Airport. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. No actions were identified to strengthen internal control, however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. Oban Airport is one of three aerodromes operated by the Council, and licensed under Article 211 of the Air Navigation Order (ANO) 2009 by the Civil Aviation Authority (CAA). Deemed as a Public Service Obligation (PSO), scheduled services, and scholar flights for island school children, operate from Oban airport to Coll, Colonsay, Islay and Tiree. Additionally, the airport deals with chartered traffic and military flights as well as general aviation traffic such as medevacs, coastguard operations, training flights and scenic tours by private operators. 5. Prior to the grant of a licence and for continued licensing, the CAA requires the Aerodrome Operator to meet the minimum standards detailed in Civil Aviation Publication (CAP) 168 Licensing of Aerodromes. CAP 168 sets out the standards required at UK national licensed aerodromes relating to management systems, operational procedures, physical characteristics, assessment and treatment of obstacles, visual aids, rescue and fire-fighting services and medical services. 6. The Oban Airport Aerodrome Manual (the Manual) provides information about the airport, its systems for managing safety and the required operational procedures. The Airport Rescue & Fire Fighting Service (RFFS) manual provides guidance on the agreed policy and procedures designed to achieve an effective and efficient RFFS. Both manuals are derived from CAP168. 7. Oban Airport operate the ‘Redkite Equipment Management system’ which is used in all UK airports to help ensure they meet the requirements of the CAA in regard to RFFS personnel and equipment. 8. The overall remit of internal audit is to provide assurance over compliance with the 24 airport operating instructions (AOIs) established by the Manual and the further procedures established by the RFFS manual. Page 43
Page 44
4 Argyll and Bute Council – Internal Audit Report – Oban Airport, February 2025 Scope 9. The scope of the audit was to provide assurance over compliance with six of the airport operating instructions (AOIs) established by the Manual and the further procedures established by the RFFS manual as outlined in the Terms of Reference agreed with the Oban Airport Station Manager. The operating instructions audited in February 2025 were: • AOI 11 – Managing Airside Developments & Works • AOI 12 – Reduced Runway Length Operations • AOI 13 – Fuel Management • AOI 14 – Aeronautical Information • AOI 15 – Survey Data & Treatment of Obstacles • AOI 23 – Defect Reporting Risks 10. The risks considered throughout the audit were: • Audit Risk 1 - Failure to comply with operating instructions could result in increased risk of accidents and/or the airport losing its CAA licence Audit Opinion 11. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 1 to this report. 12. Our overall audit opinion for this audit is that we can take a HIGH level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. 2. Objectives and Summary Assessment 13. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion CO1 The Manual, setting out the operational procedures of the airport, is up to date, Audit Risk 1 High The Manual is updated annually and is available to appropriate officers and published on the Council’s intranet site, the Hub. The document Page 44
Page 45
5 Argyll and Bute Council – Internal Audit Report – Oban Airport, February 2025 Control Objective Link to Risk Assessment Summary Conclusion appropriate and accessible to all relevant staff. was found to be comprehensive with each section outlining the Council policy for compliance with regulations and procedures. CO2 AOI11 – Airside developments and works are conducted in accordance with CAA regulations. Audit Risk 1 High Airside developments are not a common occurrence. The last development, for the installation of a self-service fuel tank installation, occurred in 2019 and we have been provided with evidence of CAA permission for works. There are no minutes documented for the meeting that should have taken place at this time, however, there is a new Station Manager in post and going forward this will be recorded appropriately. CO3 AOI12 – Measures are in place to consider operational reasons for a re-declaration of the runway length. Audit Risk 1 High A re-declaration of the runway length would only happen in very exceptional circumstances. The runway length has not been reduced in the last 10 years. The Manual sets out the procedures which should be adopted in the event of this being required. CO4 AOI13 – The airport complies with refuelling, de-fuelling and fuel storage procedures. Audit Risk 1 High A copy of the refuelling procedures has been provided. Trading Standards carry out a petroleum inspection every 18 months and external company TotalEnergies check the stock and the equipment (visually) on an annual basis. CAA had also included fuel management checks in their own inspection in June 2024, no findings or observations were raised. CO5 AOI14 – There are appropriate measures to ensure aeronautical data is up to date and accurate. Audit Risk 1 High All amendments to aeronautical data are notified to pilots and other relevant personnel timeously, and unplanned changes of services, infrastructure and/or facilities at the airport are properly communicated. CO6 AOI15 – There are effective measures in place to ensure airport airspace is free from obstacles so aeroplane operations can be conducted safely. Audit Risk 1 High An aerodrome survey which contains runway data relating to airspace obstacles was conducted in October 2024 by an approved contractor and forwarded to the CAA. Page 45
Page 46
6 Argyll and Bute Council – Internal Audit Report – Oban Airport, February 2025 Control Objective Link to Risk Assessment Summary Conclusion CO7 AOI23 – The Airport complies with the operating instructions for all defects found. Audit Risk 1 High All defects, property and vehicle, are reported, recorded and dealt with appropriately. 14. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings The Manual, setting out the operational procedures of the airport, is up to date, appropriate and accessible to all relevant staff 15. The Manual is available to all relevant personnel on the Council’s intranet site, the ‘HUB’ with a hard copy held onsite at the airport. Each section within the Manual sets out: • the Council’s policy and established procedures to ensure compliance with relevant rules and/or regulations • appropriate monitoring arrangements (where applicable) • roles and responsibilities of relevant personnel. 16. The Manual is reviewed annually by the Station Manager, and was last updated in November 2024. The updated version is submitted to the CAA who have 28 days to highlight any queries on the Manual’s content. If no response is received in 28 days then the revised Manual is adopted. The current Manual is version 8.6. 17. The CAA document CAP 168 sets out the standards required at UK National licensed aerodromes relating to management systems, operational procedures, physical characteristics, assessment and treatment of obstacles, visual aids, rescue and fire-fighting services and medical services. 18. When updating the Manual, the Station Manager ensures that it reflects any updates or revisions as published by the CAA. A check of the CAA website found that there has been no alterations, other than formatting, to the CAP 168 document since January 2022. 19. The CAA carry out periodic on-site audits to verify continued compliance with national licensing requirements. The latest inspection was June 2024, we have been provided with findings and responses to date. There is one action that remains outstanding, paint marking has been delayed due to the weather and is due to be completed by the end of March 2025. Airside developments and works are conducted in accordance with CAA regulations 20. Airside developments/works are not a common occurrence and no developments have been undertaken in the past 12 months. The last development was for the installation of a self-service fuel tank installation in 2019 and we have been provided with evidence of CAA permission for works. Page 46
Page 47
7 Argyll and Bute Council – Internal Audit Report – Oban Airport, February 2025 Measures are in place to consider operational to consider operational reasons for a re- declaration of the runway length 21. There have been no changes to the runway length in the last 10 years. Should this happen, the Manual clearly sets out the procedures to follow. The airport complies with refuelling, de-fuelling and fuel storage procedures. 22. The Airport has a fuel operating manual. It was last updated in May 2024 and provides guidance on: • responsibilities • fuel ordering and receiving • daily sampling • fuel storage • incident reporting • cleaning and maintenance etc 23. The Manual requires the airport to be responsible for fuel operation, storage, distribution and that the quality complies with the Air Navigation Order and all regulatory requirements. On my visit to the airport I was able to ensure that fuelling is carried out in open areas, operating instructions are clear and that fuel is checked for grade, quantity and daily fuel sampling tests are carried out. 24. Trading Standards carry out a petroleum inspection on an 18 month basis and external company TotalEnergies perform a stock test along with visually checking the condition of the equipment on an annual basis. There were no findings raised as a result of visits that took place in March and November 2024. There are appropriate measures to ensure aeronautical data is up to date and accurate 25. The Manual requires the station manager and/or duty officer to ensure that all operators and pilots are in possession of current and accurate aeronautical information. For safety reasons any updates should be circulated immediately. We confirm that all planned amendments to aeronautical data are notified to pilots and other relevant personnel on the UK Aeronautical Information Publication (AIP) website and a hard copy of aeronautical updates are displayed in the crew room. For unplanned amendments, a Notice to Airmen (NOTAM) is issued as well as a hard copy displayed in the crew room for all aircrew to view 26. As stated in the Manual all staff are aware of their responsibilities involved in any changes/amendments. Duty Officers are aware that in the absence of the Station Manager it is their duty to issue a NOTAM. Page 47
Page 48
8 Argyll and Bute Council – Internal Audit Report – Oban Airport, February 2025 There are effective measures to ensure airport airspace is free from obstacles so aeroplane operations can be conducted safely. 27. The manual states that an annual aerodrome survey should be carried out with regards to runway data relating to distances and elevations. The last survey was conducted in October 2024 by an approved contractor and thereafter sent onto the CAA. 28. The airspace around the aerodromes should be maintained free of obstacles in order to permit intended aeroplane operations to be conducted safely. Where an obstruction occurs an Obstacle Limitation Surface (OLS) is prepared and details forwarded to the Civil Aviation Authority (CAA). As mentioned above, the last survey was carried out in October 2024 and we have been provided with details of the OLS submitted due to obtrusive trees. There are procedures to report and record defects in place 29. The Manual states that all staff have a responsibility to report any known defects within the appropriate systems. Safety Critical defects are required to be reported within 24/48 hours and reported immediately to the officer in charge and Flight Information Services Officer. 30. Vehicle, fire alarms, equipment and property defects are all reported accordingly. The vehicles each have a defect book, which is kept within the vehicle and details are recorded onto the Council’s system, ‘Tranman’. Property defects are reported to the Council’s helpdesk line. All defects are also recorded onto the airport database and equipment defects are automatically emailed to the Station Manager/Crew Commander by the Redkite system. No duplicate reporting of defects was found and evidence was provided of reported defects being completed. Page 48
Page 49
Appendix 1 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues. Page 49
Page 50
This page is intentionally left blank
Page 51
Argyll and Bute Council Internal Audit Report February 2025 FINAL High Medium Low VFM Number of Findings 0 1 0 0 Data and Information Security – Data Platform Audit Opinion: Substantial Page 51
Page 52
2 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Key Dates ................................................................................................................................................ 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 5 Recommendations ................................................................................................................................. 5 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 10 Appendix 2 – Audit Opinion ................................................................................................................. 12 Contact Details Internal Auditor: Mhairi Weldon Telephone: 01546 604294 e-mail: mhairi.weldon@argyll-bute.gov.uk www.argyll-bute.gov.uk Page 52
Page 53
3 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 1. Executive Summary Introduction 1. As part of the 2024/25 internal audit plan, approved by the Audit & Scrutiny Committee in March 2024, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to data and information security – data platform. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. The Council’s Data Strategy and Action Plan 2024-28 (the Strategy) was endorsed by the Policy and Resources Committee in August 2024 and, alongside Principle 4 of the Council’s “Connect for Success” programme, notes the importance of data in evidence driven decision-making. The Strategy notes that Council data combined with data from other reliable sources provides a solid foundation from which to assess the needs and demands of residents and communities and is reflected in the mission statement “Improving outcomes for our residents and communities through better combination and use of data”. 5. The Data Advisory Group (DAG) was established in March 2022 with representatives from across Council Services to create a one-council, service-led forum for data and delivery of the Strategy. Reporting to the DAG, the Data Technical Groups (DTGs) are multiple short-life working groups with service representation, each of which have been tasked to deliver the specific required outputs including bespoke reports and dashboards. 6. Towards the end of 2022, the Scottish Government’s Data Maturity Assessment Programme rated the Council as “developing” maturity, the Strategy seeks to drive change and progress to the “mastering” stage. 7. The Council collects, stores, uses and shares a large amount of data across various line of business systems to inform service delivery, monitor performance and provide essential business information, however, this data is split across multiple service areas within systems which no not readily interact with each other, resulting in significant challenge when analysis is required at an overarching strategic level of the Council. 8. The establishment of a data platform to help manage, store and analyse multiple data sets in a single centralised environment, with the intent to deliver real-time information and insights to develop and inform strategic objectives, is a key element within the Council’s data programme Page 53
Page 54
4 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 which has been prepared to advance data maturity. Services, working alongside the DAG and working groups, also intend to harness this data to build detailed reports to meet their specific service requirements. 9. The Council has appointed a consultancy partner to assist with the design and implementation of the data platform and support handover to the Council’s ICT Applications Team who will continue with its day-to-day support and maintenance, and future development. 10. Data is one of the council’s most important assets and should be protected accordingly, it is essential that a robust control framework is in place to ensure its confidentiality, integrity and ongoing availability, and as a large amount of this data is personal, the Council must also comply with data protection legislation. Scope 11. The scope of the audit was to assess the arrangements for the deployment of the data platform, paying particular attention to access permissions, controls and security as outlined in the Terms of Reference agreed with the ICT and Digital Manager on behalf of the Head of Customer and Support Services on 13 December 2024. Key Dates 12. The Terms of Reference provided provisional timescales for the review to take place, the actual dates are noted below. Exhibit 1 – Key Dates Stage Actual Date Terms of Reference agreed 13 December 2024 Fieldwork Commencement 8 January 2025 Draft Report issued 10 February 2025 Management Comments received 12 February 2025 Final Report issued 12 February 2025 Audit and Scrutiny Committee 13 March 2025 Risks 13. The risks considered throughout the audit were: • SRR10: Service Delivery – Cyber Security • KF ORR35: Cyber Security Breach and associated Cyber Attack • Audit Risk 1: failure to comply with requirements of the Data Protection Act 2018 and General Data Protection Regulation (GDPR) • Audit Risk 2: failure of consultancy partner to fulfil contractual obligations • Audit Risk 3: failure to continue development of data platform following completion of consultancy arrangement • Audit Risk 4: failure to maintain integrity of data from source systems • Audit Risk 5: data platform is unable to deliver intended information and insights Page 54
Page 55
5 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 Audit Opinion 14. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 15. Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that “internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale”. Recommendations 16. We have highlighted one medium priority recommendation which is summarised below: • The data challenge proposal document should include a requirement to identify how long datasets are to be held to inform capacity management. 17. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 18. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Contract/SLAs are in place and include security and performance monitoring arrangements. All risks Substantial A comprehensive business case and procurement exercise were followed to engage consultants for delivery of the data platform, however, they were not as responsive as anticipated in commencing work. Documentation reviewed contained detailed technical specifications as well as security and access arrangements. Arrangements for and progress in delivery receives sufficient management oversight from the ITMT, DMT and SMT. 2 Access to the data platform and its contents is properly authorised, managed and maintained. SRR10 KF ORR35 Audit Risks 1 & 2 High The data platform and its data are subject to robust physical, environmental and logical access controls and routine maintenance and update schedules. There is sufficient capacity to host current and proposed datasets with options available to expand in the future should it be required. Page 55
Page 56
6 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 3 Data uploaded retains its integrity and outputs are relevant, reliable and useful. Audit Risks 2 - 5 Substantial A business need must be demonstrated via an agreed Data Challenge Proposal prior to uploading to the data platform, a Data Protection Impact Assessment must also be carried out where personal information is included. Appropriate mechanisms are in place to transform data upon upload to the platform to ensure operability whilst preserving integrity. End-user access is on a read-only basis via appropriate analysis and reporting tools. The need to remove data for GDPR purposes is detailed, however, there is no evidence of consideration to remove general data once no longer useful to preserve capacity availability or minimise future expansion costs. 4 Business continuity/disaster recovery arrangements are in place. SRR10 KF ORR35 Audit Risk 5 Substantial Well-established processes are in place for the underlying technology in use to ensure data is backed up and available for disaster recovery purposes. Additional, specific details are planned to be documented alongside ongoing development of the platform. 19. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings Contract/SLAs are in place and include security and performance monitoring arrangements 20. A comprehensive Outline Business Case (OBC) was prepared and details of the preferred model submitted to the Department Management Team (DMT) and Strategic Management Team (SMT) in September 2022 and was approved. The Information and Communication Technology (ICT) service, experienced subsequent difficulty in recruiting an officer to take the project forward, and therefore, in collaboration with the Council’s procurement officers, launched a procurement exercise in November 2023 to identify a suitable consultancy partner to assist the applications team implement the solution. 21. An officer was successfully recruited in January 2024 and a working prototype of the data platform developed by the ICT applications team was demonstrated to the Data Advisory Group in March 2024. It became apparent, however, that there were significant complexities involved in further development and maintenance of the data platform and that there would be greater value achieved if the Council were to proceed with the consultancy arrangement and benefit from the knowledge and expertise of consultants with experience in implementing similar solutions. A further OBC, was therefore submitted to DMT and SMT in June 2024 reflecting on the updated position and was subsequently approved. Page 56
Page 57
7 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 22. The procurement process commenced with a formal Invitation to Quote (ITQ) in November 2023 which received ten responses, six of these met the minimum requirements and were evaluated in terms of quality and price by experienced officers to identify the preferred consultancy partner. The quotation from the preferred consultant was accepted on 23 July 2024 via a formal email from the Senior Procurement Officer noting that the Council’s general terms and conditions apply. 23. The contract was awarded following the Council’s robust procurement process including due diligence reviews of the preferred consultant’s financial standing, insurance cover and feedback from other clients who had completed a similar exercise with the consultant. No concerns were raised as a result of this review. 24. We understand that the appointed consultant has not been as responsive as had been anticipated, this is considered to have been an exceptional circumstance, due to them acquiring another company from where resources were subsequently allocated to fulfil the contract with the Council. A detailed statement of work to be completed has now been provided and discussions confirm that the delivery team are effective and professional. Weekly catchups are taking place to discuss progress and work planned for the week ahead with a firm commitment in place to complete delivery by the end of the financial year. The response to the ITQ stated that the engagement was expected to take place over 12 weeks, inclusive of 25 days technical support and 10 days project management. Dates to commence a consultancy arrangement are not provided at this stage as this will be agreed when the mobilisation meeting takes place and the programme of work is agreed. 25. The information provided within the ITQ response states that permissions to access the data platform and its contents will be linked to existing access and identity management controls operated within the Council. These controls have previously been reviewed by internal audit and found to be robust. Additional security measures are to be designed and implemented in the early stages of the data platform delivery to provide row and column level security in preparation for integration with analysis and reporting tools used within the Council. 26. Data held on the platform will be accessed on a read-only basis and is designed to comply with General Data Protection Regulation and other relevant security standards accreditations held by the Council. A draft security assessment has been completed by Council officers with detailed provision of information in terms of security arrangements, the consultants were asked to review and confirm the content of the assessment, and the consolidated responses from both the Council officers and the consultants have been incorporated within the agreed Project Plan and completed GDPR appendix. 27. Should any changes be required within the development of the data platform, provision for this has been included within the Council’s terms and conditions which form part of the agreed contract of work. Any technical changes required post implementation will be undertaken following the Council’s change management process where there are separate development, test and production environments for changes to transition through and undergo testing and quality control prior to being made available to users. 28. There is no specific project board assigned to provide oversight of the data platform development, however, there are regular update reports submitted to the Information Technology Management Team, DMT and SMT providing details of progress made and funding status. Page 57
Page 58
8 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 29. There is no specific reference to disaster recovery within the ITQ response provided by the consultant, however, it is noted within the security assessment and other planning documents that business continuity and disaster recovery arrangements are provided for within existing processes. Access to the data platform and its contents is properly authorised, managed and maintained 30. Physical access to the data platform is restricted to authorised personnel only. Environmental warnings and controls are in place to ensure that temperatures do not exceed acceptable levels for optimum operational requirements and provisions have been made for emergency power supply should it be required. 31. Logical access to the data platform and its contents is managed via the Council’s identity and access management controls, access to the platform itself is only achievable by ICT administrators. The data within the platform will be accessible on a needs-only basis via the Council’s analysis and reporting tools in accordance with user defined roles and requirements. A leavers process is in place to remove former employees from the network which also controls access to the data platform. 32. There is sufficient capacity available to store the information required to operate the data platform at this current time, it is difficult to define what the full capacity requirement may be in the longer term as this will depend on what datasets are added on a case-by-case basis. Should a need for expansion be identified in the future, there is potential for a secondary business case to be brought forward to consider options available at that time. 33. The data platform host environment is supported via maintenance schedules, application of appropriate software and regular security updates, there are also monitoring and alerting mechanisms in place to bring matters to the attention of designated officers should an issue arise. Data uploaded retains its integrity and outputs are relevant, reliable and useful 34. When a service identifies a business need for data to be uploaded to the platform, they will require to complete a data challenge proposal for submission to the DAG. Each proposal is evaluated on a case-by-case basis and where personally identifiable information is included a Data Protection Impact Assessment (DPIA) will also be required. 35. Data extracted from line of business systems is subject to some transformation to help datasets link with each other within the platform and provide desired results for the end-user, this has no detrimental effect on the integrity of the data and may include the following: • Data cleansing – removing duplicates, correcting errors/missing values • Normalising data – standardising data format for consistency e.g. date format • Enrichment – adding related data or calculated values in additional columns • Aggregation – summarisation of data from larger data sets to simplify usage 36. End-user access to the data platform is on a read-only basis using analysis and reporting tools. Data held in the platform cannot be edited using these tools and there is no transfer of information back into the main line of business systems from the platform. Page 58
Page 59
9 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 37. Training to enable ongoing operation and development of the data platform following delivery is a key requirement and is clearly stated within contract and planning documents. This knowledge transfer element of the consultancy arrangement is scheduled to take place in March 2025. 38. Training in the use of the Council’s analysis and reporting tools required to view information held on the data platform is beyond the scope of the contract, however, it is planned that appropriate training resources will be made available to support authorised users gain access to the content of the platform. 39. The quality of report content from the data platform is the responsibility of the end-user via their report writing criteria and output testing. Discussions with current report-builders confirmed that where unexpected results are returned, the report criteria are carefully checked and outputs verified against data in the relevant main line of business system. Once operational, the same process will be followed for users of the data platform, if, however, in the event of reporting criteria being accurate and incorrect results persist, the Council’s ICT Applications team, as part of their support and maintenance function for the data platform, will be able to confirm that data extracted from the line of business system has been uploaded correctly or reperform the task if necessary. 40. Throughout documentation reviewed, there is cognisance of the need to remove personally identifiable information when no longer required for GDPR purposes, however, there is no other reference to removal of general data once obsolete to preserve capacity availability and minimise any future costs in relation to data storage expansion. Action Plan 1 Business continuity/disaster recovery arrangements are in place 41. The data platform and the underlying data are backed up in accordance with existing well- established arrangements to facilitate restoration in the event of a disaster scenario. These arrangements have been subject to prior internal audit review with all actions completed. Additional documentation specific to the data platform will be prepared alongside the development of the solution, however, sufficient measures are currently in place covering the underlying technologies in use to manage disaster recovery efforts. 42. Back up and recovery testing takes place in accordance with an agreed schedule and includes the underlying technologies used to support the data platform. Testing results are recorded, signed off and comments noted for future reference where relevant. Page 59
Page 60
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Medium 1 Removal of general data once obsolete Finding: whilst there has been consideration for removal of personally identifiable information when no longer required for GDPR purposes, there has been no further documentation of the need to remove general data to preserve capacity availability/minimise potential future costs for expansion. Recommendation: include a section within the data challenge proposal to state how long the data should be retained within the platform. The data platform may be limited in terms of capacity to hold data or subject to increased costs for expansion. The data challenge form is due to be fully revised at the conclusion of the current consultancy and the form will include a section within the data challenge proposal for the service to state how long the data should be retained within the platform. Data Programme Manager Date 30/4/2025 Page 60
Page 61
11 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM). Page 61
Page 62
12 Argyll and Bute Council – Internal Audit Report – Data and Information Security – Data Platform, February 2025 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues. Page 62
Page 63
Audit Progress Report Argyll and Bute Council February 2025 Page 63 Agenda Item 7
Page 64
2 Contents Audit progress Publications and other updates 01 02 Page 64
Page 65
01Audit progress Page 65
Page 66
4 Audit progress Purpose of this report This report provides the Audit and Scrutiny Committee with updates on: • the 2023/24 and 2024/25 audits; and • recent reports and publications for information, as listed in Section 2. Argyll and Bute Council audit 2024/25 We are in the initial planning phase of the audit, and we are scheduling our audit planning work, including key business process documentation. Upon completion of our planning work, we plan to issue our Annual Audit Plan for the June 2025 Audit and Scrutiny Committee. We plan to complete interim audit work in May and commence the final accounts audit work in July. Controller of Audit Best Value Report - 2023/24 The Controller of Audit is in the process of drafting their Best Value Report for 2023/24. A draft version has been shared with the Council, and the final report will be presented at the Accounts Commission meeting in March 2025. Housing Benefits and Business Rates assurance work 2023/24 Our grants work is progressing, and we plan to report our work at the end of February. Pending final review, we do not anticipate reporting any major issues. Argyll and Bute OSCR Trusts 2023/24 We are finalising our audit work, and we plan to report our work at the end of February. Pending final review, we do not anticipate reporting any major issues. Page 66
Page 67
02Publications and other updates Page 67
Page 68
Publication/update Key points National Audit Office (NAO) 1 NAO Insight: Achieving environmental improvement and responding to climate change The NAO has published ‘’Achieving environmental improvement and responding to climate change’’ which draws out learning from past NAO reports to identify enablers that are seen as important for tackling the challenges government faces in its environment and climate change work. 2 NAO report: The impact of fraud and error on public funds 2023-24 The NAO has published its report ‘’The impact of fraud and error on public funds 2023-24’’ which introduces the impact of fraud and error on public funds, how public bodies can tackle fraud and error, and the NAO’s examination of the topic. Audit Scotland 3 Audit Scotland: Local government in Scotland: Financial bulletin 2023/24 Audit Scotland released its “Local Government in Scotland: Financial Bulletin 2023/24,” which offers a comprehensive overview of the financial and operational performance of Scotland’s local government sector. Scottish Government 4 Scottish Government: Scottish Local Government Finance Statistics 2023-24 The Scottish Government has published as overview of financial activity of Scottish local authorities in 2023-24 based on authorities' audited accounts. 5 Scottish Government: Building consensus on Council Tax reform - consultation As part of a joint programme of engagement by the Scottish Government and COSLA, independent analysis will be commissioned to examine the Council Tax system accounting for market changes, reforms, and improvements. National publications Page 68
Page 69
7 National publications and other updates 1. NAO Insight: Achieving environmental improvement and responding to climate change The NAO has published Achieving environmental improvement and responding to climate change which draws out learning from past NAO reports to identify enablers that are seen as important for tackling the challenges government faces in its environment and climate change work. Scope of the report In 2020, the NAO carried out two broad reviews of how the government is organised to achieve net zero and its wider environmental goals, including its goal to adapt to a changing climate. Since then, the NAO has examined many of the interventions that it has established to help meet these goals. This has covered individual projects and programmes, for example, on energy efficiency grants and tree-planting, as well as broader portfolios of government’s work such as those to decarbonise home heating or improve air quality. Concluding remarks Achieving the government’s legislative climate change and environmental targets requires sustained and coherent action over successive parliaments, and substantial progress over the next five years. This means that the leadership role of the centre of government and lead departments – the Department for Environment, Food & Rural Affairs (Defra) and the Department for Energy Security & Net Zero (DESNZ) – is critical. Strong leadership will ensure that the government develops a coherent set of interventions that together succeed in putting the UK on track to achieve its overall targets. Strong leadership also creates the conditions for securing most value from the public and private investment involved. The scale and complexity of improving the natural environment and responding to climate change means that the government’s approach to leadership on these issues needs continued focus and attention. Our work shows that this should include building its approach to culture, strategic direction and integration. https://www.nao.org.uk/insights/achieving-environmental-improvement-and-responding-to-climate-change/ Page 69
Page 70
8 National publications and other updates 2. NAO report: The impact of fraud and error on public funds 2023-24 The NAO has published its report The impact of fraud and error on public funds 2023-24 which provides an introduction to the impact of fraud and error on public funds, how public bodies can tackle fraud and error, and the NAO’s examination of the topic. This overview summarises the key information and insights from the NAO’s work. It includes: • what we mean by fraud and error, and how government is structured to tackle it • the fraud and error risk management cycle • fraud and error against government, including in benefits, taxes and COVID-19 fraud • emerging threats and opportunities • what to look out for when thinking about fraud and error https://www.nao.org.uk/overviews/the-impact-of-fraud-and-error-on-public-funds-2023-24/ 3. Audit Scotland Report: Local government in Scotland: Financial bulletin 2023/24 Audit Scotland published its Local government in Scotland: Financial bulletin 2023/24, the bulletin provides an overview of the financial and operational performance of Scotland’s local government sector. It provides useful insights across the following headings: • councils’ funding and budget-setting • councils’ financial performance • councils’ position at the end of 2023/24 and the financial outlook. https://audit.scot/uploads/2025-01/nr_250128_local_government_financial_bulletin.pdf 4. Scottish Government: Scottish Local Government Finance Statistics The Scottish Government published its Scottish Local Government Finance Statistics 2023-24. This is an annual publication providing a comprehensive overview of financial activity of Scottish local authorities in 2023-24 based on authorities' audited accounts (where available). https://www.gov.scot/publications/scottish-local-government-finance-statistics-2023-24/ Page 70
Page 71
9 National publications and other updates 5. Scottish Government: Building consensus on Council Tax reform - consultation Scottish Government is consulting the public on council tax reform to make the system fairer. They are seeking public opinions and working with COSLA to explore options and build a consensus. Additionally, they will commission independent analysis to review the system considering market changes and potential improvements. https://www.gov.scot/news/building-consensus-on-council-tax-reform/ Page 71
Page 72
Contact Forvis Mazars www.auditregister.org.uk The contents of this document are confidential and not for distribution to anyone other than the recipients. Disclosure to third parties cannot be made without the prior written consent of Forvis Mazars LLP. Forvis Mazars LLP is the UK firm of Forvis Mazars Global, a leading global professional services network. Forvis Mazars LLP is a limited liability partnership registered in England and Wales with registered number OC308299 and with its registered office at 30 Old Bailey, London, EC4M 7AU. Registered to carry on audit work in the UK by the Institute of Chartered Accountants in England and Wales. Details about our audit registration can be viewed at www.auditregister.org.uk under reference number C001139861. VAT number: GB 839 8356 73 © Forvis Mazars 2024. All rights reserved. Mark Outterside Director mark.outterside@mazars.com Bank Chambers 26 Mosley Street Newcastle-upon-Tyne NE1 1DF http://www.forvismazars.com/uk/en Page 72
Page 73
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 SCRUTINY FRAMEWORK AND MANUAL ANNUAL REVIEW 1. SUMMARY 1.1 This report concludes the annual review to determine whether any changes are required to the Council’s Scrutiny Framework and Manual. 2. RECOMMENDATIONS 2.1 To note the outcome of the annual review of the Scrutiny Framework and Manual (Appendix 1 & Appendix 2). 3.0 DETAIL 3.1 In March 2018 the Committee approved the Council’s Scrutiny Framework which incorporated the scrutiny prioritisation process. In June 2018 the Committee endorsed a Scrutiny Manual which provided more detailed guidance on how to carry out a scrutiny review. 3.2 In the seven years since those two governance documents were approved, we have continued to evolve our approach to scrutiny as we have reflected on what works well, where improvements can be made and alternative ways of performing scrutiny in addition to the current Scrutiny Panel approach. 3.3 In March 2020 the Committee considered a ‘Scrutiny- Lessons Learned’ report. The ‘Lessons Learned’ were those identified by: • Scrutiny Panel members • Scrutiny Panel witnesses (both internal and external to the Council) • the Chief Internal Auditor (CIA and scrutiny officers) 3.4 The Lessons learned report also reflected on discussions that had been held during Committees about whether there were different ways that the Committee could perform scrutiny that would complement the Scrutiny Panel approach. For example by inviting council officers to brief the Committees on topics of specific interest. 3.5 In April 2021 a development session was held to discuss potential scrutiny topics for review and consider amendments to the scrutiny process. Page 73 Agenda Item 9
Page 74
3.6 The scrutiny topic identification, prioritisation and overall approach adopted at that time was outlined to the Committee. The Committee were asked to consider some key questions and the responses are summarised below: • There needs to be a degree of flexibility to change topics and to be able to react quickly to an ever changing environment. • It is for the Committee to determine scrutiny topics • Depending on the number of emerging topics, the Committee may need to meet more often, however these could be less formal and held virtually • An annual Scrutiny Plan is not required, topics should be allowed to emerge • The prioritisation process is there as a tool if needed, but there is no need to assess every scrutiny topic • There has been value in having full panel meetings but these are resource intensive and scrutiny lite should be adopted where appropriate. 3.7 The Scrutiny Manual (Appendix 1) and Scrutiny Framework (Appendix 2) have been reviewed and a summary of minor changes have been noted within the tables below: 3.8 Scrutiny Manual Changes Page Para Summary of Change Reason for Change 1 n/a Change of date from 2024 to 2025 Change of date to reflect most recent review of the Manual 6 23 Removal of dates Removal of dates to reflect ongoing development of the Scrutiny process 9 & 11 Appe ndix 1 & 2 Update to meeting location sections Update to reflect that the location of any meetings will be determined at the discretion of the Chair of the appointed Panel and will normally take place virtually 10 Appe ndix 2 Change to composition of Committee Membership The number of committee members was reduced from 7 to 6 in 2022 following the Local Election 3.9 Scrutiny Framework Changes Page Para Summary of change Reason for Change 1 n/a Change of date from 2024 to 2025 Change of date to reflect most recent review of the Framework 4 9 Change to composition of Committee Membership The number of committee members was reduced from 7 to 6 in 2022 following the Local Election 4 10 Change of Appendix number 3 to number 1 Correction of error Page 74
Page 75
4.0 CONCLUSION 4.1 The CIA has updated the Scrutiny Framework and Scrutiny Manual to reflect minor changes that were identified as a result of the 2025 review. 5 IMPLICATIONS 5.1 Policy - None 5.2 Financial –None 5.3 Legal –None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands Duty – None 5.6 Climate Change - None 5.7 Risk – None 5.8 5.9 Customer Service – None The Rights of the Child (UNCRC) - None For further information please contact Internal Audit (01546 604108) Paul Macaskill Chief Internal Auditor 14 March 2024 Appendices Appendix 1 - Scrutiny Manual Appendix 2 - Scrutiny Framework Page 75
Page 76
This page is intentionally left blank
Page 77
Argyll and Bute Council Scrutiny Framework March 2025 Page 77
Page 78
2 Table of Contents Introduction ............................................................................................................................................ 3 What is Scrutiny? .................................................................................................................................... 3 Audit and Scrutiny Committee .............................................................................................................. 4 Principles of Good Scrutiny .................................................................................................................... 4 Scrutiny Support ..................................................................................................................................... 4 Developing the Scrutiny Work Programme ........................................................................................... 5 Scrutiny Reviews .................................................................................................................................... 5 Appendix 1 – Audit and Scrutiny Committee Terms of Reference (Scrutiny element only) ............... 6 Appendix 2 – Scrutiny Prioritisation Process Stages 1 and 2 ................................................................ 7 Appendix 3 – Scrutiny Prioritisation Process Stage 3............................................................................ 8 Page 78
Page 79
3 Introduction 1. The purpose of this document is to explain the framework for scrutiny at Argyll and Bute Council (the Council). It is for the use of anyone who has any involvement in the scrutiny process including: • members of the Audit and Scrutiny Committee • all elected members of the Council • staff involved in the scrutiny process and those who may be required to provide evidence as part of a scrutiny review • members of the public, partners and external organisations who may be invited to provide evidence as part of a scrutiny review. 2. In 2017 a decision was taken that the responsibility for the remit of scrutiny would move to a newly established Audit and Scrutiny Committee. The Committee approved a new Scrutiny Framework in March 2018 and this updated version was approved by the Committee in March 2022. What is Scrutiny? 3. Overview and scrutiny committees were established in England and Wales under the Local Government Act 2000 to provide the opportunity for members of the Council to examine services provided, ask questions on how decisions have been made and consider whether service improvements can be delivered. 4. In Scotland there is no requirement for scrutiny established by statute and consequently scrutiny committees in Scotland have no prescribed powers. This contrasts with the position in England and Wales where scrutiny committees have formal powers to require council officers and elected members to give evidence, require information from the council and require a response to any recommendation put to the council’s management team. 5. Whilst there is useful guidance available there is no definitive view on what the role and objectives of scrutiny are in Scotland. Consequently this provides the Council with the opportunity to frame the delivery of governance in the way it feels is most beneficial. The Council’s approach to scrutiny focuses on: • reviewing the council’s effectiveness in achieving policy objectives • assessing the impact of council policies • making suggestions for improvement. 6. As the primary focus of scrutiny is on council policy it is appropriate to provide a definition of policy. 'Policy – A policy is a formal, concise, accessible statement on how the council intends to conduct business and deliver services. Generally it will be a statement of intent with rules that influence and enable decision making. A policy statement will lessen the risk of conflict and remove the opportunity for unfair selective application of rules'. Page 79
Page 80
4 Audit and Scrutiny Committee 7. The Council is made up of 36 elected members representing the 11 wards of Argyll and Bute. Elected members play a key role in the Council through their involvement in full council meetings and their representation on the Council’s strategic and area committees. A degree of scrutiny is carried out at these committees through performance reporting, ongoing monitoring of service delivery and the consideration of the conclusions from the Council’s Performance Improvement Framework (PIF) which sets out the Council’s approach to continuous improvement and the agreed mechanism for achieving best value across all services. It is therefore important that the Audit and Scrutiny Committee do not replicate any of the existing scrutiny arrangements and focus its resources in an efficient manner which complements those arrangements. 8. In particular, when assessing potential topics for scrutiny, the Committee should ensure the topic is not already being considered by an existing committee (area or strategic). The Audit and Scrutiny Committee should not generally be seen as the first committee to contact in relation to a topic meriting potential review nor should it be seen as a committee to deal with complaints. 9. The Audit and Scrutiny Committee is a cross-party committee made up of six elected members, (three each from the opposition and the council administration) and an independent chair. This provides an appropriate political spread within its membership however it should be stressed that it is not a political committee and should always conduct itself impartially. 10. The terms of reference for the scrutiny element of the Audit and Scrutiny Committee are included in Appendix 1 to this framework however its overall remit is to ‘perform a scrutiny role through the provision and delivery of scrutiny work focused on improving the performance of the Council.’ The remit of the Audit and Scrutiny Committee would extend to those organisations with whom the Council have entered into any form of formal agreement with for the delivery of statutory services, this would include the Health & Social Care Partnership and Live Argyll. The Audit and Scrutiny Committee is required to meet at least four times every year. Principles of Good Scrutiny 11. To ensure scrutiny is effective the Centre for Public Scrutiny has put forward four key principles. They being that scrutiny should: • provide a ‘critical friend’ challenge to the council, council officers and agencies • reflect the voices and concerns of residents and communities • drive improvement in the delivery of public services • be delivered by independent minded members. 12. These principles underpin the work of the Council’s Audit and Scrutiny Committee. Scrutiny Support 13. The Audit and Scrutiny Committee is supported by the Chief Internal Auditor and staff from the internal audit section who will be responsible for carrying out scrutiny reviews and drafting the scrutiny reports for the Committee. This ensures impartiality and access to appropriate skills and experience to effectively investigate any aspect of council activity. Page 80
Page 81
5 Developing the Scrutiny Work Programme 14. The Audit and Scrutiny Committee will identify topics for scrutiny whilst maintaining a degree of flexibility to change these as new topics emerge in an ever changing environment. As there is only a finite amount of resource available to perform scrutiny a clear and transparent prioritisation process has been adopted for assessing multiple potential topics to determine those most likely to have a positive impact on council performance. The prioritisation process will only be required if there is insufficient resource to review all the topics identified by the Committee or if there is any question over whether reviewing the topic would be of material benefit. 15. Stage 1 asks five filtering questions to determine whether the topic passes to stage 2 or is rejected at stage 1. Stage 2 is used to determine whether the topic should be considered as a high or medium priority topic. Appendix 2 illustrates the two stage process. 16. Stage 3 of the prioritisation process applies a weighted scoring system to those topics that successfully progressed from stages 1 and 2. The topic is assessed against eight criteria with weighted scores allocated to each criteria. An overall score is then reached for the topic and this allows the topics with the highest overall score to be prioritised. The score allocated to each criteria will require an appropriate balance of subjective and objective analysis. Appendix 3 illustrates stage 3 of the prioritisation process. There may be circumstances where there is an emerging issue which cannot be fully assessed using the prioritisation process due to there being a lack of supporting evidence. In this circumstance the prioritisation process will still be completed with the selected answers based on a realistic expectation rather than historic evidence. This provides scope for the Audit and Scrutiny Committee to determine whether a topic should be scrutinised despite not being fully subject to the agreed process. Scrutiny Reviews 17. Scrutiny reviews are carried out by the scrutiny officer who reports to the Chief Internal Auditor. A review follows a five stage process as set out below: • Stage 1 – Scoping • Stage 2 – Identifying evidence required and key stakeholders • Stage 3 – Evidence gathering • Stage 4 – Conclusions and recommendations • Stage 5 – Submission of final report 18. Guidance on each of these stages will be developed and maintained by the Chief Internal Auditor. 19. Between 2018 and 2021 scrutiny activity has involved the ‘full panel’ approach which is appropriate for large scale reviews however may be less appropriate if the Committee want to review an emerging issue or where there may be an alternative way of performing scrutiny. Consequently the scrutiny process has evolved to consider alternative ways to perform scrutiny which complement the full panel approach. For example the Committee may wish to invite officers to prepare a formal report or a presentation on a particular topic for Committee to consider or invite them to attend a development session for a more informal discussion. Page 81
Page 82
6 Appendix 1 – Audit and Scrutiny Committee Terms of Reference (Scrutiny element only) • To oversee and co-ordinate the scrutiny function including approval of the scrutiny framework and associated policies or procedures. • To scrutinise the performance of the Council in relation to the achievement of policy objectives and performance targets in relation to all functions of the Council. • To identify topics for scrutiny work in relation to the performance of the Council and funded third party organisations. • To consider and make recommendations in respect of scrutiny reports brought to the Committee for consideration. • To monitor the implementation of scrutiny recommendations accepted by the Council. • To provide an annual report to the Council on the work of the scrutiny function. • To periodically review the scrutiny function to ensure it is operating effectively. • To receive the Council performance report. Note that the responsibility for scrutiny at service committee level will be incorporated into the service committee terms of reference. Page 82
Page 83
7 Appendix 2 – Scrutiny Prioritisation Process Stages 1 and 2 Page 83
Page 84
Appendix 3 – Scrutiny Prioritisation Process Stage 3 TOPIC TITLE: Increasing recycling rates SUBMITTED BY: AN Other DATE OF SUBMISSION: 08 November 2017 STAGE 2 ASSESSMENT OUTCOME: Medium Priority QUESTION OPTIONS SELECTION SCORE WEIGHTING TOTAL SCORE JUSTIFICATION FOR SELECTION 1 What is the current performance based on the council's performance scorecard? > 10% under target < 10% under target < 10% over target > 10% over target Not applicable < 10% over target 2 3 6 Business outcome BO24 - Waste is disposed of sustainbably has two performance measures. Reduction in waste to landfill of 21,500 and % of waste recycled, composted and recovered of 40%. Current performance is 9,932 and 49.3%. This means we are under target by 54% for target reduction but 23% over for % recycled. As the focus of the topic is increasing recycling the Committee decided to focus on the missed target for reduction. 2 To what extent does the issue contribute to a business outcome aligned to the Council's corporate plan? Major contribution Significant contribution Medium contribution Slight contribution No contribution Medium contribution 2 3 6 Whilst recycling is not specifically referenced in the corporate plan, business outcome BO24 ' features in the Roads & Amenity Services service plan. The plan references one of the challenges to the service as being 'Delivery of a revised waste strategy that is affordable and compliant' 3 To what extent is this issue being highlighted as a public concern? Widespread Significant Medium Slight Not applicable Slight 1 2 2 There has been a degree of interest and campaigning by local environmental groups however this is not considered to be Council wide and has been mainly isolated to two ward areas. 4 What is the revenue budget commitment to this area of service? >1m 500k-1m 250k-500k 100k-250k >1m 4 3 12 Business outcome BO24 has an allocated revenue budget of £11.7m 5 In the past three years what is the pattern of budget performance for this area? Major under/over spend Significant over/under spend Medium over/under spend Slight over/under spend Largely on budget Slight over/under spend 1 2 2 Outurns in the previous three financial years have been consistently over budget however in none of these occasions has the budget been exceeded by more than 1.5%. 6 What is the status of national legislation on the issue? Failure to implement = penalties Current legislation Definite future legislation Possible future legislation Not applicable Definite future legislation 2 2 4 The service plan established that there is future legislation which will impact upon the service however the full detail of that legislation is not currently clear. Discussion with the Head of Service confirmed that it is likely to involve financial penalties if recycling rates are missed. 7 How widespread is the impact of the issue? Council wide Multiple wards Single ward Small no of residents No impact Council wide 4 1 4 For the council to meet future recyling targets our reduction in land fill will need to be improved across all wards. Simply focusing on one or two areas will not deliver the required improvement in performance. 8 Does the issue feature in the Council's risk management registers? Yes - red risk Yes - amber risk Yes - green risk No Yes - amber risk 3 3 9 The ORR for D&I includes the following which are relevant to recycling. (RA06-01) Demand Risk - Failure to reduce environmental impact through minimisation of waste to landfill and increasing recycling rates – risk score 8 (RA06-02) Demand Risk – Recycling targets increase – risk score 8 WEIGHTED TOTAL 45 HIGH / MEDIUM FACTOR 1 TOTAL SCORE 45 Page 84
Page 85
Argyll and Bute Council Scrutiny Manual March 2025 Page 85
Page 86
2 Contents Introduction................................................................................................................................................ 3 Scrutiny Reviews ....................................................................................................................................... 3 Stage 1-2 – Scoping and Identifying Required Evidence .................................................................... 4 Stage 3 – Evidence Gathering .................................................................................................................. 4 Written and Secondary Evidence .............................................................................................................. 5 Oral Evidence ............................................................................................................................................. 5 Council Officers/Elected Members Providing Evidence ............................................................................ 5 External Experts Proving Evidence ............................................................................................................ 6 Stage 4-5 - Conclusions and Reporting .................................................................................................. 6 Appendix 1 – Guidelines for Officers Attending Scrutiny Committees ........................................... 8 Appendix 2 – Guidelines for External Experts Attending Scrutiny Committees ......................... 10 Page 86
Page 87
3 Introduction 1. In March 2021 the Audit and Scrutiny Committee (the Committee) approved Argyll and Bute Council’s (the Council) updated Scrutiny Framework (the Framework). This was first approved in March 2018 and it establishes the framework for scrutiny within the Council. It is for the use of anyone involved in the scrutiny process including: • members of the Audit and Scrutiny Committee • all elected members of the Council • staff involved in the scrutiny process and those who may be required to provide evidence as part of a scrutiny review • members of the public, partners and external organisations who may be invited to provide evidence as part of a scrutiny review. 2. The Framework sets out the process adopted to identify scrutiny topics and confirms that the Chief Internal Auditor (CIA) will develop and maintain guidance on the performance of scrutiny reviews. This manual, first approved by the Committee in 2018 and last updated in March 2022, provides that guidance and is designed to be a reference tool for officers carrying out scrutiny reviews, it is not intended to be prescriptive, but to help ensure the scrutiny review process is a more structured and informed one. Scrutiny Reviews 3. Scrutiny reviews can be broken down into five stages as illustrated in exhibit 1. The process is cyclical as it can be necessary to revisit earlier steps as the review progresses. Exhibit 1 – Five Stages of a Scrutiny Review Page 87
Page 88
4 Stage 1-2 – Scoping and Identifying Required Evidence 4. Initially the identified scrutiny topic may be quite loosely defined. If it is required to be assessed against the prioritisation process defined in the Framework there may already have been a need for it to be clarified. However, if chosen for scrutiny, further clarification may be required to help determine a precise focus. This should be carried out by the appointed scrutiny officer in consultation with the topic proposer and the appropriate council service. 5. Once the topic is clearly defined the scope of the review should be determined. In particular we need to establish the: • purpose and objectives • specific areas to be covered and any exclusions • approach to be adopted • evidence required • people to be interviewed or invited to give evidence • anticipated outputs • timescales. 6. Defining the scope of the review will normally happen during an initial panel briefing meeting which is attended by the three Scrutiny Panel members (a subset of the Audit and Scrutiny Committee), the CIA and the appointed scrutiny officer. 7. That initial panel should also agree indicative timescales for panels to allow a provisional plan for the key stages of the review to be created. 8. Once the Scrutiny Panel have agreed the scope and objectives they should be shared with all members of the Audit and Scrutiny Committee. This will be done by e-mail as waiting for the next meeting of the Committee might result in too much time elapsing. Stage 3 – Evidence Gathering 9. When considering how the evidence is to be gathered it is important to remember there is no definitive process. Every scrutiny review will be different and there are a range of different approaches that should be considered. These include: • public meetings • surveys • workshops / focus groups • site visits (internal and external) • sourcing data and reports • literature research • SWOT/PESTLE analysis • investigating good practice • reviewing performance and financial data including trends and comparisons • process mapping • investigating potential collaborators and/or alternative suppliers • interviewing experts • working with officers and elected members to research issues. 10. The evidence can be categorised as either ‘written and secondary evidence’ or ‘oral evidence’. Page 88
Page 89
5 Written and Secondary Evidence 11. This includes: • written evidence from internal and external individuals and organisations • notes taken by the scrutiny officer during interviews or site visits • existing council plans, policies, strategies, and reports relevant to the subject area • relevant national guidance, legislation and documentation • relevant guidance, good practice guides from national and regional bodies • good practice and innovative reports and plans from other councils. 12. All written evidence considered as part of the review should be kept on file and retained in a manner consistent with the requirements of the Council’s records management plan. These files be stored on a SharePoint site managed by Scrutiny Officers. Oral Evidence 13. The gathering of written evidence may identify a benefit in inviting internal and external individuals to provide oral evidence either to the scrutiny officer as part of the review, or directly to the Committee at an informal and private meeting. The scrutiny process should be inclusive and ensure that all those who wish to contribute whether as councillors, officers, external experts or members of the public feel valued and are able to speak freely and openly. 14. It is important that, all internal and external individuals invited to give evidence, are: • treated with courtesy and respect • given ample notice of the time, date and place of meeting • informed of the review scope • provided with questions, or the line of questioning, in advance with an explanation that this will not be a restrictive list • provided with copies of any relevant reports, papers and background information • given the opportunity to submit written evidence in advance of the meeting which is circulated to Committee members • given the opportunity to decline or to submit written evidence instead of appearing in person • introduced to the Committee chair prior to the meeting commencing. 15. Minutes from any scrutiny panels should be circulated to scrutiny panel members, and any council officer or external individuals that participated in the panel to enable them to comment on the factual accuracy of the minute before they are finalised. When these are issued a timescale for response should be provided with a statement that they will be accepted as correct if no response is received by the stated timescale. Council Officers/Elected Members Providing Evidence 16. Council officers invited to give evidence would normally be third tier managers or above (although this could extend to other elected members). The officers to be invited must be agreed with the relevant member of the Council’s Senior Management Team and/or relevant Head of Service to ensure they have the necessary knowledge of the topic. 17. The evidence giving process must be seen as being supportive of scrutiny and not an opportunity to be critical of any officer giving evidence. Questions asked of officers must be focused on reviewing the policies and performance of the Council in relation to the topic being scrutinised. Scrutiny should Page 89
Page 90
6 never be used to question the capability or competence of officers, or about matters of a disciplinary nature, and questions should never be asked in a way that may be considered confrontational. 18. ‘Guidelines for Officers Attending Scrutiny Committees’ are included at Appendix 1. A copy of these guidelines should always be provided to officers prior to them attending meetings. External Experts Proving Evidence 19. External experts can be an essential part of undertaking a scrutiny review and their evidence can be a valuable source of information. Providing information to a scrutiny review or attending a scrutiny committee may be a new experience to some and it should be remembered that external experts are attending on a voluntary basis. It is incumbent on the scrutiny team and Committee members to ensure their experience is positive and stress-free. 20. External experts can be drawn from a wide range of individuals and organisations, for example: • elected Members and officers from other councils • other external public sector bodies • voluntary sector organisations (local, regional and national) • professional associations • trade unions • private sector • user groups (local, regional and national) • community groups • experts in the subject area (academics, public or private sector managers). 21. ‘Guidelines for External Experts Attending Scrutiny Committees’ are included at Appendix 2. A copy of these guidelines should always be provided to witnesses prior to them attending meetings. Stage 4-5 - Conclusions and Reporting 22. At the end of a review a draft report should be produced which provides a full picture of the issues under consideration and contains key findings and learning points. The report must be evidence based and relate directly to the review scope. 23. Learning points should focus on delivering improvements in service delivery, policy or strategic direction. The scoping phase of the review will have identified the purpose and objectives of the review and the final report should be closely aligned to those objectives. A template for the report has evolved as the scrutiny process has developed, however, we should remain flexible about how we report on scrutiny work as there could be occasions where a different approach might be beneficial. However, as a minimum, the output should include: • executive summary • introduction (including the background, scope and approach) • findings • learning points • appendices (where required) 24. The draft report should be agreed with the Scrutiny Panel members before being discussed and cleared with the relevant council officers at a meeting attended by the Chair of the Scrutiny Panel, the CIA and possibly the appointed Scrutiny Officer. Page 90
Page 91
7 25. Once the Scrutiny Panel are satisfied the report can be finalised and submitted to the next scheduled Committee meeting for endorsement, the Committee will also determine at this meeting which, if any, of the other council committees the report should be submitted to for consideration. 26. All scrutiny reports are submitted in their entirety to the Committee which, through the transparent provision of committee papers, makes them public documents. In the event that the report contains sensitive information they may be restricted however this decision will only be taken in consultation with senior management and legal counsel as appropriate. Page 91
Page 92
8 Appendix 1 – Guidelines for Officers Attending Scrutiny Committees Giving Evidence to the Audit & Scrutiny Committee – A Guide for Council Officers Introduction This document provides guidance to Council staff who have been asked to provide written or oral evidence to the Audit and Scrutiny Committee (the Committee). Scrutiny is a key component of good governance which helps the Council improve our decision making, policy development & implementation and service delivery. What is the Committee? The Committee is a cross-party committee made up of seven elected members, (four from the opposition and three from the council administration) and an independent chair. This provides an appropriate political spread within its membership however it is not a political committee and should always conduct itself impartially. What does the Committee do? The overall remit of the scrutiny element of the Committee is to ‘perform a scrutiny role through the provision and delivery of scrutiny work focused on improving the performance of the Council.’ In summary it considers the performance of the Council, looking at the effectiveness of policies and service delivery and identifies areas for improvement with, wherever possible, a key focus on outcomes for the community rather than inputs. As such scrutiny adopts a ‘critical friend’ approach to help promote continuous improvement. The committee does not make policy and does not take decisions about the operation of council services, but it may make recommendations to Council on policy matters. Scrutiny Support The Committee is supported by the Chief Internal Auditor and staff from the internal audit section who will be responsible for carrying out scrutiny reviews and drafting the scrutiny reports for the Committee. The Chief Internal Auditor is responsible for ensuring that officers giving evidence are given good advance notice of any invitation to meet committee members, are properly briefed about the arrangements for the meeting and receive adequate notice of the questions to be discussed at the meeting. If you have any queries about scrutiny or your participation in it then please contact the Chief Internal Auditor (audit.internal@argyll-bute.gov.uk) Why have you been invited? You have been asked to meet the Committee because you have knowledge or expertise that is relevant to the topic being reviewed. The meeting also provides you with the opportunity to express your views on any strengths, weaknesses and possible areas for improvement. What are the arrangements for meeting members of the Committee? You will be contacted by phone or e-mail by an officer supporting the committee. The officer will explain: • why you have been invited • background information about the committee • background about the topic being investigated Page 92
Page 93
9 • arrangements for your attendance. Approximately two weeks before the meeting, you will be sent key themes which will form the basis of the discussion with the committee. This will allow you to come prepared and seek out any information that you may need in advance. You should inform your line manager that you have been invited to the meeting. If you have any problems or questions, please contact the Chief Internal Auditor. Meeting location Meeting location will be determined at the discretion of the Chair of the appointed Panel, however, this will normally take place virtually via Microsoft Teams. What happens at the meeting? The meetings are informal and are conducted in an open and friendly manner and usually last no longer than two hours. Officers who support the Committee and any independent external expert will also be present. The Chair or nominated lead will open the meeting by welcoming and introducing those present and outlining the process. The key themes will be discussed and you should be open and honest in your responses and feel free to raise additional issues related to the topic. Please be aware that your participation in the process is very much seen as being supportive of scrutiny and is appreciated by all the Committee members. The scrutiny process is designed to be inclusive and ensure that all those who wish to contribute whether as councillors, officers, external experts or members of the public feel valued and are able to speak freely and openly. It is not an opportunity for Committee members to be critical of any officer giving evidence or to question the competence of any officer. Questions will be focused on reviewing the policies and performance of the Council in relation to the topic being scrutinised. Notes will be taken of the discussion at the meeting. The meetings are held in private and notes of the evidence will not become record until you have agreed to them. What happens after the meeting? After the meeting, you will be sent a summary note of the discussion. You are entitled to make any additions, deletions or amendments to this note and these should be highlighted and the document returned. The note is confidential until it has been agreed by all witnesses. Once the Committee has heard all the evidence, and drawn its conclusions and recommendations, a briefing or report will be written and submitted to a formal meeting of the Committee. At this meeting the Committee will also determine which of the other council committees the report should be submitted to for consideration. This could be to full Council, to the Policy & Resources Committee or to one of the service committees. Scrutiny reports are submitted in their entirety to the Committee which, through the transparent provision of committee papers, makes them public documents. In the event that the report contains sensitive information they may be restricted. Page 93
Page 94
10 Appendix 2 – Guidelines for External Experts Attending Scrutiny Committees Giving Evidence to the Audit & Scrutiny Committee – A Guide for External Experts Introduction This document provides guidance to external witnesses who have been asked to provide written or oral evidence to the Audit and Scrutiny Committee (the Committee). Scrutiny is a key component of good governance which helps the Council improve its decision making, policy development & implementation and service delivery. What is the Committee? The Committee is a cross-party committee made up of six elected members, (three each from the opposition and from the council administration) and an independent chair. This provides an appropriate political spread within its membership however it is not a political committee and should always conduct itself impartially. What does the Committee do? The overall remit of the scrutiny element of the Committee is to ‘perform a scrutiny role through the provision and delivery of scrutiny work focused on improving the performance of the Council.’ In summary it considers the performance of the Council, looking at the effectiveness of policies and service delivery and identifies areas for improvement with, wherever possible, a key focus on outcomes for the community rather than inputs. As such scrutiny adopts a ‘critical friend’ approach to help promote continuous improvement. The Committee does not make policy and does not take decisions about the operation of council services, but it may make recommendations to Council on policy matters. How does the Committee work? The Committee collects evidence from a wide variety of sources including: • written evidence from a range of internal and external individuals and organisations • notes taken by the scrutiny team during interviews or site visits • existing council plans, policies, strategies, and reports relevant to the subject area • relevant national guidance, legislation and documentation • relevant guidance, good practice guides from national and regional bodies • good practice and innovative reports and plans from other councils. • questioning witnesses, experts and relevant community groups • surveys and questionnaires. Scrutiny Support The Committee is supported by the Chief Internal Auditor and staff from the internal audit section who will be responsible for supporting scrutiny reviews and drafting the scrutiny reports for the Committee. Page 94
Page 95
11 The Chief Internal Auditor is responsible for ensuring that external experts giving evidence are given good advance notice of any invitation to meet committee members, are properly briefed about the arrangements for the meeting and receive adequate notice of the themes to be discussed at the meeting. If you have any queries about scrutiny or your participation in it then please contact the Chief Internal Auditor (audit.internal@argyll-bute.gov.uk) Why have you been invited? You have been asked to meet the Committee because you have knowledge or expertise that is relevant to the topic being reviewed. The meeting also provides you with the opportunity to express your views on any strengths, weaknesses and possible areas for improvement. What are the arrangements for meeting members of the Committee? You will be contacted by phone or e-mail by an officer supporting the committee. The officer will explain: • why you have been invited • background information about the committee • background about the topic being investigated • arrangements for your attendance. Approximately two weeks before the meeting, you will be sent key themes which will form the basis of the discussion with the committee however the Committee may not restrict itself to these themes. This will allow you to come prepared and seek out any information that you may need in advance. You are welcome to send an initial written response to these themes before the meeting takes place however this is entirely optional. Meeting location Meeting location will be determined at the discretion of the Chair of the appointed Panel, however, this will normally take place virtually via Microsoft Teams. What happens at the meeting? The meetings are informal and are conducted in an open and friendly manner and usually last no longer than two hours. Officers who support the Committee and any internal or external experts may also be present. The Chair or nominated lead will open the meeting by welcoming and introducing those present and outlining the process. The key questions will be discussed, with supplementary questions being asked where appropriate. The scrutiny process is designed to be inclusive and ensure that all those who wish to contribute whether as councillors, officers, external experts or members of the public feel valued and are able to speak freely and openly. Notes will be taken of the discussion at the meeting. The meetings are held in private and notes of the evidence will not become record until you have agreed to them. What happens after the meeting? After the meeting, you will be sent a summary note of the discussion. You are entitled to make any additions, deletions or amendments to this note and these should be highlighted and the document returned. The note is confidential until it has been agreed by all witnesses. Once the Committee has heard all the evidence, and drawn its conclusions and recommendations, a briefing or report will be written and submitted to a formal meeting of the Committee. At this meeting the Committee will also determine which of the other council committees the report should be submitted to for consideration. This could be to full Council, to the Policy & Resources Committee or to one of the service committees. Page 95
Page 96
12 Scrutiny reports are submitted in their entirety to the Committee which, through the transparent provision of committee papers, makes them public documents. In the event that the report contains sensitive information they may be restricted. Am I obliged to attend? Whilst your participation in the process will be very much appreciated by all the Committee members you are, of course, under no obligation to attend. If you do not wish to be involved in the process or would prefer to just submit written evidence rather than attending to give oral evidence then you are perfectly entitled to make that choice. Expenses As you have been invited to attend a meeting the Council would reimburse you for any reasonable travelling expenses. Page 96
Page 97
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 SCRUTINY – IDENITIFICATION OF A TOPIC 2025-26 1. INTRODUCTION 1.1 The objective of the report is to provide the Audit and Scrutiny Committee (the Committee) with an update arising from the recent engagement on potential scrutiny options in order to identify a topic to take forward in the context of the Scrutiny Manual and Framework as part of the Committee’s scrutiny role for 2025-26. 2. RECOMMENDATIONS 2.1 The Audit and Scrutiny Committee is asked to: 2.1.2 Consider and determine whether the topic for 2025-26 will be a review of the Council’s readiness and preparation for compliance with the ‘Biodegradable Municipal Waste Landfill Ban’ both based on the responses provided to the Chief Internal Auditor as part of the recent communications with the Committee and the Committee’s previous wish to maintain overview of progress in this area and, in accordance with the agreed process of assessment which is detailed in the Scrutiny Framework and Manual. 2.1.3 In the event of the Committee being minded to approve the review of the Council’s ‘Biodegradable Municipal Waste Landfill Ban’ arrangements as the area identified for scrutiny in 2025-26, determine whether it should proceed on the basis of a bi-annual presentation from the Interim Head of Service and/or his staff spread throughout the year to the Committee sitting in its scrutiny role or seek to appoint a Panel Chair and two further Members to form a Scrutiny Panel for the review which will commence within financial year 2025-26. 3 DETAIL 3.1 The development of the scrutiny function has progressed successfully, and in in the new format, a total of three reviews have been undertaken. The Committee have found such reviews helpful in discharging their role in relation to scrutiny and at the last meeting sought to identify a topic for 2025/26 financial year which would be of benefit to the Council. It is also important to balance the Committees work in relation to scrutiny with its primary duty of which is to seek the successful delivery of the agreed Internal audit Plan. 3.2 There are no minimum or maximum number of scrutiny reviews that require to be undertaken, however, such reviews should flow from identifiable ‘issues’, and where there is a remit, taking cognisance of the limitations. A significant amount of resource can be expended on such reviews and as a section we need to balance this with available staff resources. In terms of balance in 2025/26 it would be helpful for the Committee to consider that one review will be undertaken during the financial year, allowing staff resources to be Page 97 Agenda Item 10
Page 98
3.3 3.4 balanced between this type of work, internal audit work and planned professional training for a member of staff normally involved in scrutiny work. In discussion with the Interim Head of Service Roads and Infrastructure, and given the limited capacity within his team, one option is to have two presentations from the Interim Head of Service and/or his staff spread throughout the year to the Committee sitting in its scrutiny role, with the options to ask questions and seek further information where that is required. This option would be preferential given the competing demands on the service and would fit in with the overall expectations of the Committee’s scrutiny duties. The Council’s Strategic Risk Register (SRR) makes specific reference of the ‘Biodegradable Municipal Waste Landfill Ban’ as a key area of risk for the Council and further sets out both the mitigating and ongoing actions being taken to address this risk. It would therefore be prudent of the Committee to consider this area, should it so wish, as the scrutiny topic for 2025/26. 3.5 In 2025/26 the Chief Internal Auditor (CIA) plans to engage with the Committee in identifying scrutiny work for 2026/27 and which can be agreed by the Committee before the start of that financial year. This process will give the opportunity for scrutiny work to be planned in sufficient time and before the start of the relevant financial year the review will be undertaken. Approach to Scrutiny previously agreed by the Committee– Context and Background 3.6 In order to provide further and more context to the development of ‘scrutiny reviews’; a Development Session was held to establish the process to be adopted by the Committee to identify and prioritise potential scrutiny topics and of the overall approach adopted to scrutiny topics which has been a combination of panel reviews and ‘scrutiny lite’ where relevant officers have been asked to present at Committee or at Development Sessions on topics of interest to the Committee. 3.7 In particular the CIA asked the Committee to consider some key questions. These, and the Committee responses, are summarised in the table below. 3.8 Question Committee Response Should Scrutiny topics originate from all members and senior officers or from Committee members? There needs to be a degree of flexibility to change topics and to be able to react quickly to an ever-changing environment. It is for the Committee to determine scrutiny topics. If topics originate from the committee should this be via discussions at Committee or development sessions? We may need to meet as a Committee more often however these could be less formal meetings and held virtually. Further thought can be given to this as to some extent it will depend on the number of emerging topics to be considered for scrutiny. Page 98
Page 99
Do we still need an annual scrutiny plan or should topics for scrutiny ‘emerge’ as the year goes by? We don’t need a plan we should allow items to emerge. Do we still need the detailed prioritisation process? The prioritisation process is there as a tool if we need it but we don’t need to use to assess every scrutiny topic. Do we have the right balance between ‘full blown’ panel approach vs Scrutiny Lite? There has been value in having the full panels but these are resource intensive and we should look to make use of a scrutiny lite approach where appropriate. Once a topic is decided then the Committee can decide what the best Scrutiny approach to adopt is. 3.9 The CIA has reviewed and updated, where identified, the Scrutiny Framework and Manual in 2024/25 and will do so on an annual basis in order that the approach to scrutiny work is both focused, appropriate and reflects the best approach taking cognisance of the Committee’s views. 4. CONCLUSION 4.1 The scrutiny process continues to evolve as each review is progressed. Members and officers continue to identify areas for improvement and these will be addressed as they are raised. It is planned one scrutiny topic will be taken forward for inclusion in the scrutiny work plan for 2025-26, specifically, the Council’s ‘Biodegradable Municipal Waste Landfill Ban’ arrangements. 5 IMPLICATIONS 5.1 Policy - None 5.2 Financial -None 5.3 Legal -None 5.4 HR - None 5.5 Fairer Scotland Duty - None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands - None 5.6 5.7 5.8 5.9 Climate Change Risk – None Customer Service - None The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 13 March 2025 For further information contact: Paul Macaskill, Chief Internal Auditor (01546 604108) Page 99
Page 100
This page is intentionally left blank
Page 101
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 TREASURY MANAGEMENT UPDATE – QUARTER ENDED 31 DECEMBER 2024 1.0 EXECUTIVE SUMMARY 1.1 The Local Government in Scotland Act 2003 requires the council to have regard to the CIPFA Code of Practice on Treasury Management (revised 2021), ‘the Code’. The Code recommends that members be updated on treasury management activities at least quarterly. This report demonstrates best practice in accordance with the Code. 1.2 The report provides an update on the council’s treasury management activity during the quarter 1 October to 31 December 2024 and the overall position as at 31 December 2024. This covers information on: • Economic background • Interest rate forecasts • Borrowing • Investments • Compliance with Treasury and Prudential Limits 1.3 The report concludes that: • All borrowing and investment activity during the quarter 1 October to 31 December 2024 has been undertaken in accordance with the approved 2024/25 Treasury Management Strategy and Annual Investment Strategy, and the authority has operated within the revised treasury and prudential limits approved by Council on 20 December 2024; and • Short term borrowing and investment activity has been undertaken to manage day to day cashflow requirements. No new long term borrowing has been undertaken during the period. Whilst there is an underlying requirement to borrow for capital purposes, the level of internal reserve fund balances has continued to allow this to be deferred. This borrowing strategy will require to be regularly reviewed to achieve optimum value and minimise risk exposure in the longer term. 1.4 The Audit and Scrutiny Committee is requested to note the contents of the report and the treasury activity during the period 1 October to 31 December 2024. Page 101 Agenda Item 11
Page 102
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 TREASURY MANAGEMENT UPDATE – QUARTER ENDED 31 DECEMBER 2024 2.0 INTRODUCTION 2.1 The CIPFA (Chartered Institute of Public Finance and Accountancy) Code of Practice for Treasury Management 2021, ‘the Code’ recommends that members be updated on treasury management activities at least quarterly. This report demonstrates best practice in accordance with the Code. 2.2 The report provides an update on the council’s treasury management activity during the quarter 1 October to 31 December 2024 and the overall position as at 31 December 2024. This covers information on: • Economic background • Interest rate forecasts • Borrowing • Investments • Compliance with Treasury and Prudential Limits 3.0 RECOMMENDATIONS 3.1 The Audit and Scrutiny Committee is requested to note the contents of the report and the treasury activity during the period 1 October to 31 December 2024. 4.0 DETAIL 4.1 Economic Background 4.1.1 During the quarter, there was a slight contraction in GDP growth, an increase in wage growth and an increase in CPI inflation to 2.6% in November. There has been an overall increase in gilt yields over the period, which underpin long term borrowing rates. During November, Bank Rate was cut from 5% to 4.75%, held during December, with the Monetary Policy Committee stating that a gradual approach to rate cuts remains appropriate, amidst continuing inflation concerns. A more detailed update on the economic position, provided by the council’s treasury advisors, is given within Appendix 1. 4.2 Interest Rate Forecasts 4.2.1 The interest rate forecasts, provided by the council’s treasury advisors, have been significantly revised following the October Budget, the outcome of the US Presidential election and the 25bps Bank Rate cut in November. These latest forecasts set out a view that both short and long term interest rates will start to fall, as inflation concerns ease. However, the Bank Rate forecast is now 50bps higher than was previously the case, whilst PWLB forecasts have also materially increased, to not only reflect increased Page 102
Page 103
concerns around the future path of inflation, but also the increased level of Government borrowing over the term of the current Parliament. Current forecast interest rates are set out in the table below, while details of the assumptions underpinning this view are outlined within Appendix 2. Note: The PWLB rate forecasts are based on the Certainty Rate (the standard rate minus 20 bps) which has been accessible to most authorities since 1st November 2012. Rate forecasts for 3, 6, 12 month investments are averages - rates offered by individual banks may differ significantly from these averages, reflecting their different needs for borrowing short-term cash at any point in time. 4.2.2 A comparison of current updated forecasts to the previous forecast position on Bank Rate and PWLB interest rates, included within the Mid-year Review report, is outlined in the table below. Rate Forecast March 2026 March 2027 Previous Current Previous Current Short term borrowing: Bank Rate 3.25% 3.75% 3.00% 3.50% Long term PWLB borrowing: 5 Year 3.9% 4.5% 3.8% 4.1% 10 Year 4.1% 4.7% 3.9% 4.3% 25 Year 4.4% 5.1% 4.3% 4.7% 50 Year 4.2% 4.9% 4.1% 4.5% 4.3 Borrowing 4.3.1 PWLB loan principal of £0.840m has been repaid during the quarter ended 31 December 2024. This repayment of principal relates to a 10 year PWLB loan (original principal £21m), which was taken on a fixed Equal Instalments of Principal (EIP) basis. All other PWLB loans will be repayable on maturity. 4.3.2 No Maturity PWLB loans have matured during the quarter. Similarly, no other debt repayments or rescheduling has been undertaken. Page 103
Page 104
4.3.3 The authority has one outstanding market or LOBO loan for £5.255m, with an interest rate of 4.75%, maturing 2048, with call dates every 6 months. This loan was not recalled at the 22 December 2024 call date. There is potential for this loan to be recalled before the end of the financial year, at the next call date of 22 June 2025. 4.3.4 No new long term borrowing has been undertaken during the period. Whilst there is an underlying need to borrow in respect of the Capital Financing Requirement, the level of internal reserve fund balances has continued to provide an opportunity to defer new external borrowing. Borrowing activity has been limited to short term borrowing, to manage day to day cashflow requirements. 4.3.5 As at 31 December 2024, the council’s debt totalled £112.767m, as summarised in the table below. Debt Amount £000 Annual Average Interest Rate Share of Total Debt Public Works Loans Board 107,197 4.42% 95.06% Market Loans (LOBO) 5,255 4.75% 4.66% Temporary Loans* 315 4.40% 0.28% Total Debt 112,767 4.44% 100.00% *Note: This represents short term borrowing from various institutions. 4.3.6 Given interest rate forecasts, it is anticipated that any new borrowing required before the end of the financial year will be taken on a short term basis, with current high long term interest rates forecast to fall over future years. This is a prudent and cost effective approach in the current economic climate but will require ongoing monitoring. The capital plan and our use of reserve balances continues to be kept under regular review, and as such, our borrowing strategy will also be regularly reviewed, to achieve optimum value and minimise risk exposure in the long term. 4.4 Investments Investment Strategy 4.4.1 In accordance with the CIPFA Treasury Management Code of Practice, the council’s approved Annual Investment Strategy sets out the council’s investment priorities as being: • Security of capital • Liquidity • Yield 4.4.2 The authority continues to aim to achieve the optimum return (yield) on its investments, commensurate with proper levels of security and liquidity and within the authority’s risk appetite. The risk appetite of the council is low, prioritising security and liquidity. In the current economic climate, it is considered appropriate to keep investments short term to cover cash flow needs, but also to seek out value available in longer periods with high credit quality financial institutions, using the Link suggested creditworthiness approach, including a minimum sovereign credit rating and Credit Default Swap (CDS) overlay information. Page 104
Page 105
4.4.3 As shown within the interest rate forecasts given at paragraph 4.2.1, investment rates have remained relatively elevated during the third quarter of 2024/25 but are expected to fall back in due course. Creditworthiness 4.4.4 There have been few changes to credit ratings over the quarter under review. However, officers continue to closely monitor these to ensure that only appropriate counterparties are considered for investment purposes. Investment counterparty criteria 4.4.5 The current investment counterparty criteria selection, approved within the Strategy, continues to meet the requirements of the treasury management function. Investment Activity 4.4.6 The council’s Section 95 Officer confirms that the principles of the investment strategy have been adhered to. During the period ended 31 December 2024, all investments have been made in line with the approved limits for specific investment instruments, and in accordance with the creditworthiness approach. 4.4.7 The limit of investments has reflected the level of available council reserve balances, together with provision for managing the council’s day to day cash flow requirements. Details of the council’s investments held as at 31 December 2024, totalling £30.016m, are summarised in the table below. Counterparty Maturity Amount £000 Interest Rate Rating S&P Clydesdale Bank Instant Access 5,016 4.65% Short Term A-1, Long Term A ANZ Fixed Deposit 02/01/2025 5,000 5.07% Short Term A-1+, Long Term AA- Money Market Fund (MMF) - Aberdeen Standard Call Account 8,000 4.78% AAA MMF - Legal and General Call Account 3,600 4.78% AAA MMF - Aviva Call 8,400 4.78% AAA Total 30,016 4.81% 4.4.8 The weighted average rate of return on the above is 4.805%, with an average investment duration of 16 days. This compares to an average benchmark SONIA rate of 4.802% over the quarter, while Bank Rate was lowered during the period from 5.00% to 4.75% in November. 4.5 Compliance with Prudential and Treasury Limits 4.5.1 It is a statutory duty for the council to determine and keep under review the affordable capital expenditure limits. The revised Prudential and Treasury Indicators for 2024-25, as approved by full Council on 20 December 2024, are attached as Appendix 2. During the quarter ended 31 December 2024, the council has operated within the treasury and Page 105
Page 106
prudential indicators. The council’s Section 95 Officer confirms that no difficulties are envisaged for the current or future years in complying with these indicators. 5.0 CONCLUSION 5.1 All borrowing and investment activity during the period 1 April to 30 September 2024 has been undertaken in accordance with the approved 2024/25 Treasury Management Strategy and Annual Investment Strategy, and the authority has operated within the revised treasury and prudential limits approved by Council on 20 December 2024. 5.2 Short term borrowing and investment activity has been undertaken to manage day to day cashflow requirements. No new long term borrowing has been undertaken during the period. Whilst there is an underlying requirement to borrow for capital purposes, the level of internal reserve fund balances has continued to allow this to be deferred. This borrowing strategy will require to be regularly reviewed to achieve optimum value and minimise risk exposure in the longer term. 6.0 IMPLICATIONS 6.1 Policy None 6.2 Financial Complies with Treasury Management Strategy 6.3 Legal None 6.4 HR None 6.5 Fairer Duty Scotland 6.5.1 Equalities – protected characteristics None 6.5.2 Socio-economic Duty None 6.5.3 Islands None 6.6 Climate Change None 6.7 Risk None 6.8 Customer Service None 6.9 The Rights of the Child (UNCRC) None Kirsty Flanagan Executive Director/Section 95 Officer 17 January 2025 Councillor Ross Moreland, Policy Lead for Finance and Commercial Services Appendix 1 - Economics Update Appendix 2 – Treasury and Prudential Indicators For further information contact Carolyn Earl, Interim Head of Financial Services carolyn.earl@argyll-bute.gov.uk Page 106
Page 107
Appendix 1 Economics Update • The third quarter of 2024/25 (October to December) saw: - GDP growth contracting by 0.1% m/m in October following no growth in the quarter ending September; - The 3myy rate of average earnings growth increase from 4.4% in September to 5.2% in October; - CPI inflation increase to 2.6% in November; - Core CPI inflation increase from 3.3% in October to 3.5% in November; - The Bank of England cut interest rates from 5.0% to 4.75% in November and hold them steady in December. - 10-year gilt yields starting October at 3.94% before finishing up at 4.57% at the end of December (peaking at 4.64%). • The 0.1% m/m fall in GDP in October was the second such decline in a row and meant that GDP would need to rise by 0.1% m/m or more in November and December, for the economy to grow in Q4 as a whole rather than contract. With on-going concern over the impact of the October budget and drags from higher interest rates and weak activity in the euro zone, our colleagues at Capital Economics have revised down their forecast for GDP growth in 2025 to 1.3% (it was initially 1.8% in the immediate wake of the Budget.) • This quarter saw the composite activity Purchasing Manager Index (PMI) dip below the level of 50 that separates expansion from contraction for the first time since October 2023. Although December’s composite PMI came in above this level, at 50.5, this was still consistent with the 0% rise in real GDP in Q3 being followed by a flat-lining, or potential contraction, in the final quarter of 2024. However, the economy is unlikely to be quite as weak as that given that the PMIs do not capture rises in government spending, but the data does underline the continued divergence in trends between the manufacturing and services sectors. The manufacturing PMI fell for its fourth consecutive month in December, from 48.0 in November to 47.3. That’s consistent with manufacturing output falling by 1.5% q/q in the final quarter of 2024 after flatlining through the summer months. This weakness in the manufacturing sector was offset by a rebound in the services sector. The services PMI rose from 50.8 in November to 51.4 in December, which is consistent with non-retail services output growth increasing from +0.1% q/q to +0.3% for October - December. This suggests that more of the recent slowdown in GDP is being driven by the weakness in activity overseas rather than just domestic factors. Additionally, the services output prices balance rose for the third consecutive month, from 55.4 in November to 56.9, showing signs that price pressures are reaccelerating. • After rising by 1.4% q/q in July - September, the retail sector had a difficult final quarter of the year. Indeed, the bigger- than-expected 0.7% m/m fall in retail sales in October (consensus forecast -0.3% m/m) suggested that households’ concerns about expected tax rises announced in the Budget on 30th October contributed to weaker retail spending at the start of the quarter. The monthly decline in retail sales volumes in October was reasonably broad based, with sales in five of the seven main sub sectors slipping. However, the potential for seasonally adjusted sales to rise in November - if October's figures were impacted by the timing of the school half term – combined with a rebound in consumer confidence and rising real incomes, points to some promise to the final quarter of 2024 • The Government’s October budget outlined plans for a significant £41.5bn (1.2% of GDP) increase in taxes by 2029/30, with £25bn derived from a 1.2% rise in employers’ national insurance contributions. The taxes are more than offset by a £47bn (1.4% of GDP) rise in current (day-to-day) spending by 2029/30 and a £24.6bn (0.7% of GDP) rise in public investment, with the latter being more than funded by a £32.5bn (1.0% of GDP) rise in public borrowing. The result is that the Budget loosens fiscal policy relative to the previous government’s plans - although fiscal policy is still being tightened over the next five years – and that GDP growth is somewhat stronger over the coming years than had previously been forecasted. By way of comparison, the Bank of England forecasts four-quarter GDP growth to pick up to almost 1¾% through 2025 (previously forecast to be 0.9%) before falling back to just over 1% in 2026. • December’s pay data showed a rebound in wage growth that will likely add to the Bank of England’s inflationary concerns. The 3myy rate of average earnings growth increased from 4.4% in September (revised up from 4.3%) to 5.2% in October (consensus forecast 4.6%) and was mainly due to a rebound in private sector pay growth from 4.6% to 5.4%. Excluding bonuses, public sector pay stagnated in October and the 3myy rate fell from 4.7% to 4.3%. • The number of job vacancies also fell again from 828,000 in the three months to October to 818,000 in the three months to November. This marks the first time it has dropped below its pre-pandemic February 2020 level of 819,000 since May 2021. Despite this, the Bank of England remains concerned about the inflationary influence of high wage settlements as well as the risk of a major slowdown in labour market activity. Page 107
Page 108
• CPI inflation has been on the rise this quarter, with the annual growth rate increasing from 1.7% in September to 2.3% in October, before rising further to 2.6% in November. Although services CPI inflation stayed at 5.0% in November, the Bank had expected a dip to 4.9%, while the timelier three-month annualised rate of services CPI rose from 5.0% to 5.1%. That shows that there currently isn’t much downward momentum. Moreover, the wider measure of core CPI inflation rose from 3.3% to 3.5% in November. Both services and core inflation are currently at rates well above those consistent with the 2.0% target and are moving in the wrong direction. Capital Economics forecast that after dipping to 2.5% in December, CPI inflation will rise further in January, perhaps to 2.8%. Although CPI inflation is expected to be back at close to the 2.0% target by the end of 2025, given that a lot of the rise in inflation in the coming months will be due to base effects that won’t persist, the potential for a broader set of tariffs to arise from the US as well as the constant threat of geo-political factors to impact energy and food prices suggest risks remain very much to the upside. • Throughout the quarter gilt yields have risen. The 10-year gilt yield increased from 3.94% at the start of October to 4.57% by the year end (and has subsequently risen to 4.64% early in 2025). As recently as mid-September 10-year gilt yields were at their low for the financial year, but since then, and specifically after the Budget at the end of October, yields have soared. Overall, the reaction to the UK Budget highlights how bond markets are both fragile and highly attentive to news about the fiscal outlook. • The FTSE 100 started off this quarter at 8,276, before finishing up at 8,121. In particular, UK markets have continued to fall further behind US equities, a trend which has accelerated since Trump’s election victory in November, partly due to the UK stock market being less exposed to AI hype, and it being weighed down by its relatively large exposure to the energy and materials sectors. MPC meetings: 7th November & 18th December 2024 • On 7 November, Bank Rate was cut by 0.25% to 4.75%. The vote was 8-1 in favour of the cut, but the language used by the MPC emphasised “gradual” reductions would be the way ahead with an emphasis on the inflation and employment data releases, as well as geo-political events. • At the 18 December meeting, another split vote arose. Members voted 6-3 to keep Bank Rate on hold at 4.75%, but dissenters (Dhingra, Ramsden and Taylor) were keen for rates to be cut further as concerns over the slowing down of the UK economy took root, despite near-term inflation fears remaining. • The MPC again stated that “a gradual approach” to rate cuts “remains appropriate” and that policy will “remain restrictive for sufficiently long”. Page 108
Page 109
Appendix 2 2024/25 Prudential and Treasury Indicators Prudential Indicators Revised Estimate £m Capital Expenditure 82 Capital Financing Requirement as at 31 March 366 brought forward 1 April 332 In year Capital Financing Requirement 34 In year borrowing requirement 34 Ratio of financing costs to net revenue stream 4.54% Treasury Indicators Revised Estimate £m Authorised limit for external debt 375 Operational boundary for external debt 367 Gross External Debt 236 Maturity Structure of Fixed Rate Borrowing Upper Limit Lower Limit Under 12 months 30% 0% 12 months to within 2 years 30% 0% 2 years to within 5 years 30% 0% 5 years to within 10 years 40% 0% 10 years and above 100% 0% Upper limit for total principal sums invested for over 364 days £20m Page 109
Page 110
This page is intentionally left blank
Page 111
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 TREASURY MANAGEMENT STRATEGY AND ANNUAL INVESTMENT STRATEGY 2025-26 1.0 EXECUTIVE SUMMARY 1.1 The Local Government in Scotland Act 2003 requires the council to have regard to the CIPFA Code of Practice on Treasury Management (revised 2021), the Code. The Treasury Management Strategy, including prudential and treasury Indicators, and the Annual Investment Strategy is a key reporting requirement, providing a comprehensive statement of treasury management policies and planned activity for the financial year ahead. 1.2 This report, prepared in compliance with the Code, covers the following: • Capital Expenditure and Financing; • An economic and interest rate update; • Borrowing Strategy; • Investment Strategy; and • Prudential and Treasury Indicators 2025-28. 1.3 The report concludes that: a) The Treasury Management Strategy provides a comprehensive statement of treasury management policies and planned activities, covering the relevant treasury and prudential indicators, the current and projected debt positions, and the Annual Investment Strategy for 2025- 26. b) A key driver of treasury management activity is the council’s capital investment plans. Prudential indicators reflect the output from these plans and are designed to ensure that the council’s capital investment plans are affordable, prudent and sustainable. Within the range of prudential indicators, there are several key indicators to ensure that the authority operates its activities within well defined limits. c) Whilst the Capital Financing Requirement represents an underlying need to borrow, the council is currently maintaining an under-borrowed position. This strategy is prudent while medium and longer dated borrowing rates are expected to fall from their current levels, albeit that considerable uncertainty remains around interest rate forecasts. d) The council’s revenue budget includes appropriate provision for financing costs of capital expenditure. The key principles of the Page 111 Agenda Item 12
Page 112
1.4 borrowing strategy will be to minimise debt interest costs over the medium term and to achieve a more even spread in the debt maturity profile. e) The council’s investment priorities will be security, liquidity and yield (return). A prudent approach to managing investment risk has been adopted. Exposure to credit risk will be limited by ensuring that all investments are placed with the higher rated bodies. A balanced view of risk against return will be taken in respect of all investments. It is anticipated that return on investments will be limited in 2025-26, as a result of Bank Rate forecasts and the over-riding principle of risk aversion. The Audit and Scrutiny Committee is requested to: a) Note that the report has been considered by the Policy and Resources Committee on 20 February 2025 and approved by full Council on 27 February 2025. Any recommendations arising from further scrutiny by the Audit and Scrutiny Committee will require to be presented to full Council at the earliest opportunity; and b) Consider and endorse the Treasury Management Strategy and Annual Investment Strategy for 2025-26, and the Prudential and Treasury Indicators for 2025-26 to 2027-28. Page 112
Page 113
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 TREASURY MANAGEMENT STRATEGY AND ANNUAL INVESTMENT STRATEGY 2025-26 2. INTRODUCTION 2.1 Background 2.1.1 The Chartered Institute of Public Finance and Accountancy (CIPFA) defines treasury management as ‘The management of the local authority’s borrowing, investments and cash flows, including its banking, money market and capital market transactions; the effective control of the risks associated with those activities; and the pursuit of optimum performance consistent with those risks.’ 2.1.2 The authority is required to operate a balanced revenue budget, which broadly means that cash raised during the year will meet cash expenditure. In addition, the authority’s capital plans indicate the borrowing and longer term cash flow planning, required to meet its capital spending obligations. The treasury management operation ensures that cash flow is adequately planned, with cash being available when it is needed. 2.1.3 Surplus monies are invested in low risk counterparties or instruments commensurate with the council’s low risk appetite, providing adequate liquidity initially before considering investment return. The management of longer term cash flow may involve arranging long or short term loans or using longer term cash flow surpluses. On occasion, when it is prudent and economic, any debt previously drawn may be restructured to meet risk or cost objectives. 2.1.4 The contribution the treasury management function makes to the authority is critical, as the balance of debt and investment operations ensure liquidity or the ability to meet spending commitments as they fall due, either on day to day revenue or for larger capital projects. The treasury operations will see a balance of the interest costs of debt and the investment income arising from cash deposits, impacting available resources. Since cash balances generally result from reserves and balances, it is paramount to ensure adequate security of the sums invested, as a loss of principal will in effect result in a loss to the General Fund balance. 2.2 Reporting Requirements 2.2.1 The authority is required to receive and approve, as a minimum, three main treasury reports each year: Page 113
Page 114
1) The Treasury Management Strategy, including prudential and treasury Indicators, and the Annual Investment Strategy (this report) – A forward looking report for the financial year ahead. 2) A Mid-year Treasury Management report – To update members on the capital and treasury position, amending prudential and treasury indicators, as necessary; and any required policy revisions. 3) An Annual Treasury Management report – A backward looking review, providing details of actual treasury activity, and prudential and treasury indicators, compared to the approved estimates. 2.2.2 The above reports require to be adequately scrutinised before being recommended to full Council for approval. This role will be undertaken by the Policy and Resources and Audit and Scrutiny Committees. In addition to the three major reports detailed above, quarterly reporting (end of June/end of December) is also required. These additional reports do not have to be reported to full Council but do require to be adequately scrutinised. This role will be undertaken by the Audit and Scrutiny Committee. 3. RECOMMENDATIONS 3.1 The Audit and Scrutiny Committee is requested to: a) Note that the report has been considered by the Policy and Resources Committee on 20 February 2025 and approved by full Council on 27 February 2025. Any recommendations arising from further scrutiny by the Audit and Scrutiny Committee will require to be presented to full Council at the earliest opportunity; and b) Consider and endorse the Treasury Management Strategy and Annual Investment Strategy for 2025-26, and the Prudential and Treasury Indicators for 2025-26 to 2027-28. 4. TREASURY MANAGEMENT STRATEGY 2025-26 4.1 Capital Expenditure and Financing 4.1.1 The authority’s capital expenditure plans are the key driver of treasury management activity. The output of the capital expenditure plans is reflected in the prudential indicators, which are designed to assist members’ overview and confirm capital expenditure plans are prudent, affordable and sustainable. 4.1.2 The Capital Expenditure prudential indicator is a summary of the authority’s capital expenditure plans, both those agreed previously, and those forming part of this budget cycle. The following table summarises the capital expenditure plans, as outlined within the proposed capital plan 2025-28. Page 114
Page 115
2025-26 Estimate £m 2026-27 Estimate £m 2027-28 Estimate £m Executive Directorate (Douglas Hendry) Education 2.946 1.988 1.988 Facility Services - Shared Offices 3.681 0.667 0.382 Major Projects/CHORD 10.865 10.018 0.000 Executive Directorate (Kirsty Flanagan) ICT 1.352 0.820 0.688 Roads and Infrastructure 48.500 39.110 33.979 Development and Economic Growth 1.104 0.000 0.000 Health and Social Care Partnership 2.084 0.000 0.382 Live Argyll 0.474 0.468 0.382 Total 71.006 53.071 37.801 Note: The above financing need excludes other long-term liabilities, such as PFI and leasing arrangements that already include borrowing instruments. 4.1.3 The table below summarises the above capital expenditure plans and how these plans are being financed by capital or revenue resources. Any shortfall of resources results in a funding borrowing need. 2025-26 £m 2026-27 £m 2027-28 £m Gross Capital Expenditure 71.006 53.071 37.801 Financing: Specific Project Income 8.302 5.000 0.000 General Capital Grant 11.178 8.633 8.633 Asset Sales 0.750 0.500 0.500 Earmarked Reserves/Revenue 5.577 5.030 0.000 Total 25.807 19.163 9.133 Net Financing Need 45.199 33.908 28.668 Page 115
Page 116
4.2 The Authority’s Borrowing Need (the Capital Financing Requirement) 4.2.1 The second prudential indicator is the authority’s Capital Financing Requirement (CFR). The CFR is simply the total historic outstanding capital expenditure which has not yet been paid for from either revenue or capital resources. It is essentially a measure of the authority’s indebtedness and so its underlying borrowing need. Any capital expenditure, which has not immediately been paid for through a revenue or capital resource, will increase the CFR. 4.2.2 The CFR does not increase indefinitely, as prudent annual repayments from revenue need to be made, which reflect the useful life of capital assets financed by borrowing. This authority has chosen to make debt repayments through scheduled debt amortisation (loans fund charges). 4.2.3 The CFR includes any other long term liabilities (e.g., PPP schemes, finance leases). Whilst these increase the CFR, and therefore the authority’s borrowing requirement, these types of schemes include a borrowing facility by the PPP or lease provider and so the authority is not required to separately borrow for these schemes. The council hold long term liabilities within its CFR in this respect totalling an estimated £106.346m as at 31 March 2025. 4.2.4 Council is asked to approve the CFR projections outlined in the table below. 2025/26 Estimate £m 2026/27 Estimate £m 2027/28 Estimate £m Opening CFR 360 394 415 Movement in CFR 34 21 16 Closing CFR 394 415 431 Net financing need for the year (above) 45 34 29 Less Loans Fund principal repayments and other financing movements including new PPP/ finance lease arrangements and principal repayments 11 13 13 Movement in CFR 34 21 16 4.2.5 In addition to the CFR, there will be a refinancing requirement in respect of the repayment of PWLB loan principal of £1.680m each year. These repayments of principal relate to a 10 year PWLB loan (original principal £21m), which was taken on a fixed Equal Instalments of Principal (EIP) basis. All other PWLB loans will be repayable on maturity, with no maturity loans due to mature in the period to 31 March 2028. 4.2.6 There is also a potential for market loans to be recalled. The council has one outstanding market or LOBO loan for £5.255m, maturing 2048, with call dates every 6 months. This loan could potentially be recalled at the 22 June or 22 December call dates in any year. Page 116
Page 117
4.2.7 Any PWLB or LOBO loans maturing during the year will ultimately require replacement borrowing to maintain the council’s cashflow position. In addition, the council will continue to actively monitor potential restructuring opportunities, in order to generate cash savings, at a minimum risk, and improve the balance of the loan debt maturity profile. 4.3 Liability Benchmark 4.3.1 The authority is required to estimate and measure the Liability Benchmark for the forthcoming financial year and the following two financial years, as a minimum. There are four components to the Liability Benchmark, also reflected in the graph below: 1. Existing loan debt outstanding: the authority’s existing loans that are still outstanding in future years. 2. Loans CFR: this is calculated in accordance with the loans CFR definition in the Prudential Code and projected into the future based on approved prudential borrowing and planned Loans Fund advances/Loans Fund principal repayments. 3. Net loans requirement: this will show the authority’s gross loan debt less treasury management investments at the last financial year-end, projected into the future and based on its approved prudential borrowing, planned Loans Fund principal repayments and any other major cash flows forecast. 4. Liability benchmark (or gross loans requirement): this equals net loans requirement plus short-term liquidity allowance. Any years where actual loans are less than the benchmark indicate a future borrowing requirement. Any years where actual loans outstanding exceed the benchmark represent an overborrowed position, which will result in excess cash requiring investment. Page 117
Page 118
4.4 Core Funds and Expected Investment Balances 4.4.1 The application of resources to either finance capital expenditure or to support the revenue budget will have an ongoing impact on cash balances available for investment. It is anticipated that treasury investments will be held to manage day to day cashflow requirements, with balances expected to fluctuate throughout the year. Whilst the council holds significant usable reserve balances, due to the strategy of internal borrowing, as outlined within the Borrowing Strategy section, investment balances are expected to be low throughout the year. 4.5 Statutory Repayment of Loans Fund Advances 4.5.1 The authority is required to set out its policy for the statutory repayment of loans fund advances prior to the start of the financial year. The repayment of loans fund advances ensures that the council makes a prudent provision each year to pay off an element of the accumulated loans fund advances made in previous financial years 4.5.2 A variety of options are provided to councils, so long as a prudent provision is made each year. A review of the council’s loan fund advances was undertaken during 2019-20 to ensure the council continues to make a prudent provision each year for the repayment of loans fund advances. 4.5.3 For all new loans fund advances the policy for repayment will be in accordance with the following methodology, as appropriate: 1. Asset life method – loans fund advances will be repaid with reference to the life of an asset using a 5.1% annuity rate; 2. Funding / Income profile method – loans fund advances will be repaid by reference to an associated income stream. 4.5.4 Using the asset life method, the council is required to ensure that the debt is repaid over a period that is reasonably commensurate with that over which the capital expenditure provides benefits. The following table details the repayment period applicable to each asset type. Page 118
Page 119
4.6 Current Treasury Portfolio Position 4.6.1 The overall treasury management portfolio as at 31.3.24 and for the position as at 31 December 2024 are shown below for both borrowing and investments. TREASURY PORTFOLIO Actual 31 March 2024 Actual 31 December 2024 Treasury investments £m % £m % Banks 18.133 55% 10.016 30% Local Authorities 10.000 30% 0.000 0% Money Market Funds 1.400 4% 20.000 60% Third Party Loans (RSLs) 3.543 11% 3.408 10% Total treasury investments 33.076 100% 33.424 100% Treasury external borrowing PWLB 108.877 92% 107.197 95% Market Loans (LOBO) 5.255 4% 5.255 5% Temporary Borrowing* 5.256 4% 0.297 0% Local Bonds 0.018 0% 0.018 0% Total external borrowing 119.406 100% 112.767 100% *Note: This represents short term borrowing from various institutions. 4.6.2 The council’s forward projections for borrowing are summarised in the following table. This table shows the actual external debt, against the underlying capital borrowing need, (the Capital Financing Requirement), highlighting any over or under borrowing. Asset Type Repayment Period (Years) Land (including cemeteries) 100 Road Structures - Bridges, Retaining Walls, Sea Walls, Flood Defences 60 Piers and Harbours - Major Structural Work 60 Piers and Harbours - Medium Term Works e.g painting/cathodic protection 20 Piers and Harbours - Limited Lifespan Improvements 10 Roads and Footways 20 Street Lighting 30 Vehicles & Plant 7 IT Equipment 5 Major Regeneration Works (Public Realm etc) 60 New Builds including Schools 60 Buildings - Electrical 40 Buildings - Plant 20 Buildings - Roofing 35 Buildings - Windows & External Doors 20 Buildings - Structural 25 Page 119
Page 120
2025/26 Estimate £m 2026/27 Estimate £m 2027/28 Estimate £m Debt at 1 April 153 220 275 Expected change in Debt 67 55 37 Other long-term liabilities (OLTL) 106 101 95 Expected change in OLTL (5) (6) (6) Actual Gross Debt at 31 March 321 370 401 The Capital Financing Requirement 394 415 431 Under / (over) borrowing 73 45 30 4.6.3 Within the range of prudential indicators there are several key indicators to ensure that the authority operates its activities within well defined limits. One of these is that the authority needs to ensure that its gross debt does not, except in the short- term, exceed the total of the CFR in the preceding year plus the estimates of any additional CFR for 2025/26 and the following two financial years. This allows some flexibility for limited early borrowing for future years but ensures that borrowing is not undertaken for revenue or speculative purposes. 4.6.4 The council’s Section 95 Officer reports that the council has complied with this prudential indicator in the current year and does not envisage difficulties for the future. This view takes account of current commitments, existing plans and the proposals in the 2025-26 Budget Pack in respect of the Capital Plan 2025-28. 4.7 Treasury Indicators: Limits to Borrowing Activity 4.7.1 The Operational Boundary. This is the limit beyond which external debt is not normally expected to exceed. In most cases, this would be a similar figure to the CFR but may be lower or higher depending on the levels of actual debt and the ability to fund under-borrowing by other cash resources. Operational Boundary 2025/26 Estimate £m 2026/27 Estimate £m 2027/28 Estimate £m Debt 293 320 341 Other long-term liabilities 101 95 90 Total 394 415 431 4.7.2 The Authorised Limit for external debt. This is a key prudential indicator and represents a control on the maximum level of borrowing. This represents a legal limit beyond which external debt is prohibited, and this limit needs to be set or revised by full Council. It reflects the level of external debt which, while not desired, could be afforded in the short term to manage day to day cashflow requirements but is not sustainable in the longer term. • This is the statutory limit determined under section 3 (1) of the Local Government Act 2003. The Government retains an option to control either the total of all local authority plans, or those of a specific authority, although this power has not yet been exercised. Page 120
Page 121
• Council is asked to approve the following Authorised Limit: Authorised Limit 2025/26 Estimate £m 2026/27 Estimate £m 2027/28 Estimate £m Debt 298 325 346 Other long-term liabilities 104 98 93 Total 402 423 439 4.8 Prospects for Interest Rates 4.8.1 The council’s treasury advisor has provided an update on the current economic position, given within Appendix 1. Part of this advisory service is also to assist the authority to formulate a view on interest rates. The following forecasts have been provided for short term (Bank Rate) and long term (PWLB certainty rates) borrowing. (a) Long term PWLB rates: PWLB rates Dec 2024 % March 2025 % March 2026 % March 2027 % Dec 2027 % 5 year 5.0 4.9 4.5 4.1 3.9 10 year 5.3 5.1 4.7 4.3 4.1 25 year 5.6 5.5 5.1 4.7 4.5 50 year 5.4 5.3 4.9 4.5 4.3 The current and expected interest rates for long term borrowing from the PWLB highlight a gradual decrease from the current position. The PWLB rates quoted (gilt yields plus 80 bps) take account of the application of a 0.2% certainty rate reduction, introduced by the government in return for council’s providing their borrowing forecast information. Argyll and Bute Council is able to access the certainty rate reduction. (b) Short term borrowing rates: Bank Rate Dec 2024 % March 2025 % March 2026 % March 2027 % Dec 2027 % 4.75 4.50 3.75 3.50 3.50 The ‘Bank Rate’ is the official Bank of England rate paid on commercial bank reserves. The current and Bank Rate forecasts also highlight an expected gradual decrease from the current position. Short term borrowing rates will generally fall in line with Bank Rate cuts. 4.8.2 Considerable uncertainty remains around interest rate forecasts. As all PWLB certainty rates are currently significantly above the longer term Bank Rate forecast (10 years 3.25%), borrowing strategies will need to be reviewed in Page 121
Page 122
that context. Overall, better value can be obtained at the shorter end. MUFG will continue to monitor economic and market developments as they unfold and advise the authority accordingly. Typically, forecasts are reviewed following the quarterly release of the Bank of England’s Monetary Policy Report but will be considered on an ad hoc basis, as required. 4.9 Borrowing Strategy 4.9.1 The council is currently maintaining an under borrowed position. This means that the capital borrowing need, (the Capital Financing Requirement), has not been fully funded with loan debt as cash supporting the authority’s reserve balances and cash flow has been used as a temporary measure (internal borrowing). This strategy is prudent while medium and longer dated borrowing rates are expected to fall from their current levels, albeit only once prevailing inflation concerns are addressed by restrictive near term monetary policy. 4.9.2 Short term borrowing from money markets or other local authorities is currently expected to be cheaper than long term borrowing and will therefore be attractive throughout the financial year. However, as with internal borrowing, short term savings by delaying new long term external borrowing requires to be balanced with potential additional long term costs. 4.9.3 Current PWLB rates are forecast to gradually decrease over the next couple of years. As a result, consideration will be given to the timing of any new fixed rate long term borrowing. Although more expensive in the short term, this may be more cost effective over the longer term and also provides an element of budget certainty in respect of future years. 4.9.4 The council’s annual revenue estimates include appropriate provision for financing costs of capital expenditure. The key principles of the strategy will be to minimise debt interest costs over the medium term and to achieve a more even spread in the debt maturity profile. It is anticipated that a range of solutions will be employed in order to mitigate against interest rate risk, and to provide longer term cost certainty, as outlined above. 4.9.5 Against the economic background and the risks within interest rate forecasts, caution will be adopted with the 2025-26 treasury operations. The Section 95 Officer, in conjunction with the treasury advisors, will monitor interest rate forecasts and adopt a pragmatic approach to changing circumstances, with any new borrowing reported to committee at the next available opportunity. 4.10 Policy on Borrowing in Advance of Need 4.10.1 The authority will not borrow more than or in advance of its needs purely in order to profit from the investment of the extra sums borrowed. Any decision to borrow in advance will be within forward approved Capital Financing Requirement estimates and will be considered carefully to ensure that value for money can be demonstrated and that the authority can ensure the security of such funds. Risks associated with any borrowing in advance activity will be subject to prior appraisal and subsequent reporting through the mid-year or annual reporting mechanism. Page 122
Page 123
4.11 Rescheduling 4.11.1 The principle reasons for debt rescheduling include: • The generation of cash savings; and • To enhance the balance of the debt maturity profile, mitigating the risk of refinancing at a higher rate of interest in any year in the future. 4.11.2 Opportunities for debt rescheduling within the current debt portfolio will be monitored on an ongoing basis throughout the year. There may be potential opportunities to generate savings and enhance the balance of the debt maturity profile by switching from long term debt to short term debt. However, these options would need careful consideration in light of the short term nature of potential savings and the likely cost of re-financing those short term loans on maturity, if required, together with any debt repayment premiums that may be incurred. Whilst premature redemption rates remain elevated, rescheduling opportunities to generate savings are not expected to be available. This would only expect to be undertaken, where a rebalancing of the portfolio, to provide more certainty, is considered appropriate. Any rescheduling undertaken will be reported to Council, at the earliest opportunity. 4.12 New Financial Institutions as a Source of Borrowing 4.12.1 Currently the PWLB Certainty Rate is set at gilts + 80 basis points. However, consideration may still need to be given to sourcing funding from the following sources: • Local authorities (primarily shorter dated maturities out to 3 years or so – generally still cheaper than the Certainty Rate). • Financial institutions (primarily insurance companies and pension funds but also some banks, out of forward dates where the objective is to avoid a “cost of carry” or to achieve refinancing certainty over the next few years). Our advisors will keep us informed as to the relative merits of each of these alternative funding sources. 4.13 Approved Sources of Long and Short Term Borrowing 4.13.1 A summary of the council’s approved sources and types of borrowing are set out within Appendix 2. 4.14 Treasury and Prudential Indicators 2025-28 4.14.1 A key driver of treasury management activity is the council’s capital investment plans. The treasury management function ensures that sufficient cash is available to meet capital spending commitments. Prudential indicators reflect the output from these plans and are designed to ensure that the council’s capital investment plans are affordable, prudent and sustainable. Required updates to the prudential and treasury indicators for 2024-25 were Page 123
Page 124
outlined within the Treasury Management Strategy Mid-year Review Report, approved by Council on 20 December 2024. The prudential and treasury indicators for 2025-26 to 2027-28 are outlined in Appendix 3 and reflect the proposed Capital Plan 2025-28. These indicators are relevant for the purpose of setting an integrated treasury management strategy. 5. ANNUAL INVESTMENT STRATEGY 5.1 Investment Policy 5.1.1 The council’s investment policy implements the requirements of the following: • Local Government Investments (Scotland) Regulations 2010, (and accompanying Finance Circular 5/2010), • CIPFA Treasury Management in Public Services Code of Practice and Cross Sectoral Guidance Notes 2021 (“the Code”) 5.1.2 The council’s investment priorities, in order of importance, will be security, minimising the risk of any loss on the principal sum invested; portfolio liquidity, ensuring that cash is available when required; and yield (return), the rate of interest earned from the investment. The authority will aim to achieve the optimum return on its investments, commensurate with proper levels of security and liquidity, and with regard to the authority’s risk appetite. The risk appetite of the council will be low, with security of investments the key priority. 5.1.3 In the current economic climate, it is considered appropriate to maintain a degree of liquidity to cover cash flow needs but to also consider opportunities for ‘laddering’ investments for periods up to 12 months with high credit rated financial institutions, whilst investment rates remain elevated. 5.1.4 The borrowing of monies purely to invest or on-lend and make a return is not permitted and the council will not engage in such activity. The limit of investments will reflect the level of available council reserve fund balances and borrowing in advance to meet capital financing requirements, in line with the borrowing strategy, together with provision for managing the council’s day to day cash flow requirements. 5.1.5 The guidance from the Scottish Government and CIPFA places a high priority on the management of risk. This authority has adopted a prudent approach to managing risk and defines its risk appetite by the following means: 1. Minimum acceptable credit criteria are applied in order to generate a list of highly creditworthy counterparties. This also enables diversification and thus avoidance of concentration risk. The key ratings used to monitor counterparties are the short term and long term ratings. 2. Other information: ratings will not be the sole determinant of the quality of an institution; it is important to continually assess and monitor the financial sector on both a micro and macro basis and in relation to the economic and political environments in which institutions operate. The assessment will also take account of information that reflects the opinion of the markets. To achieve this consideration the council will engage with its Page 124
Page 125
advisors to maintain a monitor on market pricing such as ‘credit default swaps’ (CDS) and overlay that information on top of the credit ratings. 3. Other information sources used will include the financial press, share price and other such information pertaining to the financial sector, in order to establish the most robust scrutiny process on the suitability of potential investment counterparties. 4. This council has defined the list of types of investment instruments that the treasury management team are authorised to use and lending limits (amounts and maturity). A limit for the amount of its investments which are invested for longer than 365 days has also been set. 5. Investments will only be placed with counterparties from countries with a specified minimum sovereign rating and all investments will be denominated in sterling. However, the council will also pursue value for money in treasury management and will monitor the yield from investment income against appropriate benchmarks for investment performance throughout the year. 5.1.6 5.1.7 Investment instruments identified for potential use during the year, together with associated treasury risk mitigations and monetary limits, are outlined in Appendix 4. Information on Environmental, Social and Governance (ESG) considerations is also provided. Within the constraints of the policy, due consideration will be given to the diversification of investments, in order to limit a concentration of investments with too few counterparties or countries, and to ESG factors. There has been considerable change in the types of investment instrument brought to the market in recent years. Given the fluidity of this area, members will be kept informed and requested to approve the use of any new instruments, as appropriate, in order to allow maximum flexibility. 5.2 Creditworthiness Policy 5.2.1 The council applies the creditworthiness service provided by MUFG (formerly Link Group). This service employs a sophisticated modelling approach utilising credit ratings from the three main credit rating agencies - Fitch, Moody’s and Standard & Poor’s. The credit ratings of counterparties are supplemented with the following overlays: - 1. “watches” and “outlooks” from credit rating agencies; 2. CDS spreads that may give early warning of changes in credit ratings; 3. sovereign ratings to select counterparties from only the most creditworthy countries. 5.2.2 This modelling approach combines credit ratings, and any assigned Watches and Outlooks, in a weighted scoring system, which is then combined with an overlay of CDS spreads. The end product of this is a series of colour coded bands, which indicate the relative creditworthiness of counterparties. These colour codes are used by the authority to determine the suggested duration for investments. Page 125
Page 126
5.2.3 All credit ratings will be monitored on an ongoing basis throughout the year. Through its use of the MUFG creditworthiness service, the council is alerted to changes to ratings of all three agencies and will also be advised of information in movements in Credit Default Swap spreads and other market data on a daily basis. If a downgrade results in the counterparty / investment scheme no longer meeting the authority’s minimum criteria, its further use as a new investment will be withdrawn immediately. Sole reliance will not be placed on the use of this external service. All available information will be considered when making investment decisions. 5.2.4 5.2.5 The council will continue to limit exposure to credit risk by ensuring that all investments are placed with the higher rated bodies from a weekly credit list of worldwide potential counterparties. For illustration purposes, a snapshot of this counterparty list as at 7 February 2025 is provided in Appendix 5. The council essentially adopts a hybrid approach in formulating its creditworthiness policy. In addition to the MUFG creditworthiness service, which provides details of the most highly credit rated institutions (counterparties) and suggested investment durations, the council also places a monetary limit on each type of investment or counterparty, as outlined within Appendix 4. These investment criteria will be kept under review throughout the year and amended, if required, to ensure that they continue to be fit for purpose. 5.3 Investment Strategy 5.3.1 Investments will be made with reference to the core balance and cash flow requirements and the outlook for short term interest rates (i.e., rates for investments up to 12 months). Greater returns are usually obtainable by investing for longer periods. Accordingly, while most cash balances are required in order to manage the ups and downs of cash flow, where cash sums can be identified that could be invested for longer periods, the value to be obtained from longer term investments will be carefully assessed. 5.3.2 The current forecast shown in paragraph 4.8.1 includes a forecast for Bank Rate to fall to a low of 3.5%. However, as there are so many variables at this time, caution must be exercised in respect of all interest rate forecasts. The suggested budgeted investment earnings rates for returns on investments placed for periods up to about three months during each financial year are as follows: Average earnings in each year % 2025/26 4.10% 2026/27 3.70% 2027/28 3.50% Page 126
Page 127
5.3.3 For its cash flow generated balances, the authority will seek to utilise its business reserve instant access accounts, Money Market Funds and short- dated deposits, (overnight to 100 days), in order to benefit from the compounding of interest. 5.3.4 An investment treasury indicator and limit requires to be set in respect of total principal funds invested for greater than 365 days. These limits are set with regard to the authority’s liquidity requirements and to reduce the need for early sale of an investment and are based on the availability of funds after each year end. The council is asked to approve the following Treasury Indicator and limit: Upper limit for principal sums invested for longer than 365 days 2025/26 £m 2026/27 £m 2027/28 £m Principal sums invested for longer than 365 days 20 20 20 Current investments in excess of 1 year maturing in each year 0 0 0 5.4 Investment Performance / Risk Benchmarking 5.4.1 The Section 95 Officer will continue to monitor the economic environment and adopt a pragmatic approach to changing circumstances. A balanced view of risk against return will be taken in respect of all investments. The authority may use an investment benchmark to assess the investment performance of its investment portfolio of overnight, 7 day, 1, 3, 6 or 12 month compounded SONIA (Sterling Overnight Index Average), as appropriate. However, it is anticipated that return on investments will be limited in 2025-26, as a result of Bank Rate forecasts and the over-riding principal of risk aversion. Investment activity will be reported at the end of the financial year, as part of the Annual Treasury Report. 5.5 Non-treasury investments 5.5.1 Non-treasury investments are defined as the following categories: • All shareholding, unit holding and bond holding, including those in a local authority owned company; • Loans to a local authority company or other entity formed by a local authority to deliver services; • Loans made to third parties; and • Investment property. 5.5.2 Any such finance arrangements or loans would be subject to specific committee approval. The authority may make loans to third parties, where this is consistent with meeting the service objectives of the council and for which, specific statutory provision exists. For service reasons, loans to third parties may be offered at an interest rate below the market rate. Where the loan is advanced at less than a market interest rate, there is an associated loss of investment return, which would Page 127
Page 128
otherwise have been earned on these resources. Any cost to the council in this respect will be reflected in the authority’s annual accounts. All loans to third parties will be recognised as investments and detailed within the Annual Investment Report. 6. Capital Strategy 6.1 The CIPFA 2021 Prudential and Treasury Management Codes places a requirement on local authorities to prepare a Capital Strategy. The Capital Strategy demonstrates how capital expenditure, capital financing and treasury management activity contribute to the provision of services and longer term policy objectives of the council. It also provides an overview of how associated risk is managed and the implications for future financial sustainability. An updated Capital Investment Strategy was approved by Policy and Resources Committee in August 2023. This will be reviewed and updated, as appropriate, as part of a planned review of capital arrangements, to be undertaken during the 2025-26. 7. Training 7.1 The CIPFA Code requires the proper officer to ensure that members with responsibility for treasury management receive adequate training. This especially applies to Members responsible for scrutiny. Members of the Audit and Scutiny Committee received training from the council’s treasury advisors, Link Group in October 2024, to assist with this scrutiny role. Members are advised to notify Financial Services as/when they feel further training sessions would be beneficial. Furthermore, the training needs of treasury management officers are periodically reviewed to ensure appropriate treasury management knowledge and skills for those responsible for management, delivery, governance and decision making. 8. Policy on Use of External Service Providers 8.1 The authority uses MUFG (formerly Link Group), as its external treasury management advisors, to acquire access to specialist skills and resources. However, it is recognised that responsibility for treasury management decisions remains with the council. All decisions will be undertaken with due regard to all available information, including from our treasury advisers. For short term market borrowing and investments, the council utilises a number of brokers to access sterling cash markets. This ensures that the council ensures best value in daily cash flow management. 9. Scheme of Delegation and Role of the Section 95 Officer 9.1 The treasury management scheme of delegation, together with the treasury management role of the Section 95 officer and nominated Member, are outlined in Appendix 6. 10. CONCLUSION 10.1 The Treasury Management Strategy provides a comprehensive statement of treasury management policies and planned activities, covering the relevant treasury and prudential indicators, the current and projected debt positions, and the Annual Investment Strategy for 2025-26. Page 128
Page 129
10.2 10.3 10.4 10.5 A key driver of treasury management activity is the council’s capital investment plans. Prudential indicators reflect the output from these plans and are designed to ensure that the council’s capital investment plans are affordable, prudent and sustainable. Within the range of prudential indicators, there are several key indicators to ensure that the authority operates its activities within well defined limits. Whilst the Capital Financing Requirement represents an underlying need to borrow, the council is currently maintaining an under-borrowed position. This strategy is prudent while medium and longer dated borrowing rates are expected to fall from their current levels, albeit that considerable uncertainty remains around interest rate forecasts. The council’s revenue budget includes appropriate provision for financing costs of capital expenditure. The key principles of the borrowing strategy will be to minimise debt interest costs over the medium term and to achieve a more even spread in the debt maturity profile. The council’s investment priorities will be security, liquidity and yield (return). A prudent approach to managing investment risk has been adopted. Exposure to credit risk will be limited by ensuring that all investments are placed with the higher rated bodies. A balanced view of risk against return will be taken in respect of all investments. It is anticipated that return on investments will be limited in 2025-26, as a result of Bank Rate forecasts and the over-riding principal of risk aversion. 11. IMPLICATIONS 11.1 Policy Sets the policy for borrowing and investment decisions. 11.2 Financial Provides the Treasury Management Strategy for 2025-26, including the Annual Investment Strategy. 11.3 Legal None 11.4 HR None 11.5 Fairer Duty Scotland: 10.5.1 Equalities – protected characteristics None 10.5.2 Socio-economic Duty None 10.5.3 Islands None 11.6 Climate Change None 11.7 Risk Provides an overview of treasury management and investment risk, and how these risks are managed. 11.8 Customer Service - None None 11.9 The Rights of the Child (UNCRC) None Page 129
Page 130
Kirsty Flanagan Executive Director/S95 Officer 13 February 2025 Councillor Ross Moreland, Policy Lead for Finance and Commercial Services APPENDICES: Appendix 1 – Economic Background Appendix 2 - Approved Sources and Types of Borrowing Appendix 3 – Treasury and Prudential Indicators 2025-28 Appendix 4 – Permitted Investments Appendix 5 – Example Weekly Counterparty List Appendix 6 – Scheme of Delegation; Section 95 Officer and Nominated Member Roles For further information contact: Carolyn Earl, Acting Head of Financial Services Carolyn.Earl@argyll-bute.gov.uk Page 130
Page 131
APPENDIX 1 ECONOMIC BACKGROUND (to 12th December 2024) The third quarter of 2024 (July to September) saw: • GDP growth stagnating in July following downwardly revised Q2 figures (0.5% q/q) • A further easing in wage growth as the headline 3myy rate (including bonuses) fell from 4.6% in June to 4.0% in July; • CPI inflation hitting its target in June before edging above it to 2.2% in July and August; • Core CPI inflation increasing from 3.3% in July to 3.6% in August; • The Bank of England initiating its easing cycle by lowering interest rates from 5.25% to 5.0% in August and holding them steady in its September meeting; • 10-year gilt yields falling to 4.0% in September. Over the aforementioned period, the economy’s stagnation in June and July pointed more to a mild slowdown in UK GDP growth than a sudden drop back into a recession. However, in the interim period, to 12 December, arguably the biggest impact on the economy’s performance has been the negative market sentiment in respect of the fallout from the Chancellor’s Budget on 30 October. If we reflect on the 30 October Budget, our central case is that those policy announcements will prove to be inflationary, at least in the near-term. The Office for Budgetary Responsibility and the Bank of England concur with that view. The latter have the CPI measure of inflation hitting 2.5% y/y by the end of 2024 and staying sticky until at least 2026. The Bank forecasts CPI to be elevated at 2.7% y/y (Q4 2025) before dropping back to sub-2% in 2027. Nonetheless, since the Budget, the October inflation print has shown the CPI measure of inflation bouncing up to 2.3% y/y with the prospect that it will be close to 3% by the end of the year before falling back slowly through 2025. The RPI measure has also increased significantly to 3.4% y/y. How high inflation goes will primarily be determined by several key factors. First amongst those is that the major investment in the public sector, according to the Bank of England, will lift UK real GDP to 1.7% in 2025 before growth moderates in 2026 and 2027. The debate around whether the Government’s policies lead to a material uptick in growth primarily focus on the logistics of fast-tracking planning permissions, identifying sufficient skilled labour to undertake a resurgence in building, and an increase in the employee participation rate within the economy. There are inherent risks to all the above. The worst-case scenario would see systemic blockages of planning permissions and the inability to identify and resource the additional workforce required to deliver large-scale IT, housing and infrastructure projects. This would lead to upside risks to inflation, an increased prospect of further Government borrowing & tax rises in the June Page 131
Page 132
2025 Spending Review (pushed back from the end of March), and a tepid GDP performance. Regarding having a sufficiently large pool of flexible and healthy workers, the initial outlook does not look bright. Research from Capital Economics has alluded to an increase of some 500,000 construction workers being needed to provide any chance of the Government hitting its target of 300,000 new homes being built in each of the next five years (234,000 net additional dwellings in England in 2022/23). But the last time such an increase was needed, and construction employment is currently at a nine-year low, it took 12 years to get there (1996 to 2008). Also note, as of October 2024, job vacancies in the construction sector were still higher than at any time in the 20 years preceding the pandemic. Currently, it also seems likely that net inward migration is set to fall, so there is likely to be a smaller pool of migrant workers available who, in the past, have filled the requirement for construction worker demand. The Government plans to heavily promote training schemes, particularly to the one million 16- to 24- year-olds who are neither in education nor work. But it is arguable as to whether the employee shortfall can be made up from this source in the requisite time, even if more do enter the workforce. Against, this backdrop, there may be a near-term boost to inflation caused by a wave of public sector cash chasing the same construction providers over the course of the next year or so, whilst wages remain higher than the Bank currently forecasts because of general labour shortages, including in social care where Government accepts there is a 150,000 shortfall at present. Unemployment stands at a low 4.3% (September), whilst wages are rising at 4.3% y/y (including bonuses) and 4.8% (excluding bonuses). The Bank would ideally like to see further wage moderation to underpin any further gradual relaxing of monetary policy. Indeed, over the next six months, the market is currently only pricing in Bank Rate reductions in February and May – which would see Bank Rate fall to 4.25% - but further cuts, thereafter, are highly likely to be even more data-dependent. If we focus on borrowing, a term we are likely to hear throughout 2025 is “bond vigilante”. Essentially, this represents a generic term for when the market is ill at ease with the level of government borrowing and demands a higher return for holding debt issuance. In the UK, we do not need to go back too far to recall the negative market reaction to the Truss/Kwarteng budget of 2022. But long- term borrowing rates have already gradually moved back to those levels since their recent low point in the middle of September 2024. Of course, the UK is not alone in this respect. Concerns prevail as to what the size of the budget deficit will be in the US, following the election of Donald Trump as President, and in France there are on-going struggles to form a government to address a large budget deficit problem too. Throw into the mix the uncertain outcome to German elections, and there is plenty of bond investor concern to be seen. Staying with the US, Donald Trump’s victory paves the way for the introduction/extension of tariffs that could prove inflationary whilst the same Page 132
Page 133
could be said of further tax cuts. Invariably the direction of US Treasury yields in reaction to his core policies will, in all probability, impact UK gilt yields. So, there are domestic and international factors that could impact PWLB rates whilst, as a general comment, geo-political risks continue to abound in Europe, the Middle East and Asia. In the past month, the US Core CPI measure of inflation has indicated that inflation is still a concern (3.3% y/y, 0.3% m/m), as has the November Producer Prices Data (up 3.0 y/y v a market estimate of 2.6% y/y, 0.4% m/m v an estimate of 0.2% m/m) albeit probably insufficient to deter the FOMC from cutting US rates a further 0.25% at its December meeting. However, with Trump’s inauguration as President being held on 20 January, further rate reductions and their timing will very much be determined by his policy announcements and their implications for both inflation and Treasury issuance. Looking at gilt movements in the first half of 2024/25, and you will note the 10- year gilt yield declined from 4.32% in May to 4.02% in August as the Bank’s August rate cut signalled the start of its loosening cycle. More recently, however, 10 year gilt yields have spiked back up to 4.35%. The FTSE 100 reached a peak of 8,380 in the third quarter of 2024 (currently 8.304), but its performance is firmly in the shade of the US S&P500, which has breached the 6,000 threshold on several occasions recently, delivering returns upwards of 25% y/y. The catalyst for any further rally (or not) is likely to be the breadth of AI’s impact on business growth and performance. MPC meetings: 9 May, 20 June, 1 August, 19 September, 7 November 2024 • On 9 May, the Bank of England’s Monetary Policy Committee (MPC) voted 7-2 to keep Bank Rate at 5.25%. This outcome was repeated on 20th June. • However, by the time of the August meeting, there was a 5-4 vote in place for rates to be cut by 25bps to 5%. However, subsequent speeches from MPC members have supported Governor Bailey’s tone with its emphasis on “gradual” reductions over time. • Markets thought there may be an outside chance of a further Bank Rate reduction in September, following the 50bps cut by the FOMC, but this came to nothing. • On 7 November, Bank Rate was cut by 0.25% to 4.75%. The vote was 8-1 in favour of the cut but the language used by the MPC emphasised “gradual” reductions would be the way ahead with an emphasis on the inflation and employment data releases, as well as geo-political events. In the following chart, despite a considerable gilt market rally in mid-September, rates started and finished the six-month period under review in broadly the same position. Page 133
Page 134
PWLB RATES 02.04.24 - 30.09.24 HIGH/LOW/AVERAGE PWLB RATES FOR 02.04.24 – 30.09.24 3.00 3.40 3.80 4.20 4.60 5.00 5.40 5.80 6.20 6.60 7.00 PWLB Certainty Rate Variations 2.4.24 to 30.9.24 2-Apr-24 30-Sep-24 Average 1 Year 5 Year 10 Year 25 Year 50 Year 02/04/2024 5.39% 4.72% 4.80% 5.28% 5.07% 30/09/2024 4.95% 4.55% 4.79% 5.33% 5.13% Low 4.78% 4.31% 4.52% 5.08% 4.88% Low date 17/09/2024 17/09/2024 17/09/2024 17/09/2024 17/09/2024 High 5.61% 5.14% 5.18% 5.61% 5.40% High date 29/05/2024 01/05/2024 01/05/2024 01/05/2024 01/05/2024 Average 5.21% 4.76% 4.88% 5.35% 5.14% Spread 0.83% 0.83% 0.66% 0.53% 0.52% Page 134
Page 135
APPENDIX 2 Approved Sources of Long and Short-term Borrowing On Balance Sheet Fixed Variable PWLB • • UK Municipal Bond Agency • • Local Authorities • • Banks • • Pension Funds • • Insurance Companies • • UK National Wealth Fund • • Market (long-term) • • Market (temporary) • • Market (LOBOs) • • Stock Issues • • Local Temporary • • Local Bonds • Local Authority Bills • • Overdraft • Negotiable Bonds • • Internal (capital receipts & revenue balances) • • Commercial Paper • Medium Term Notes • Finance Leases • • Page 135
Page 136
Prudential and Treasury Indicators - 2025-28 Estimates Prudential indicators for prudence 1) Capital expenditure Gross capital expenditure Less Financing Net financing need (in year borrowing requirement) 2) Capital financing requirement (CFR) Total CFR at 1 April Total CFR 31 March Movement in CFR Represented by: Net in year borrowing requirement (above) Less Principal repayments and other financing movements Total 3) Authorised limit for borrowing Authorised limit for long-term liabilities Authorised limit for external debt 4) Operational boundary for borrowing Operational boundary for long-term liabilities Operational boundary for external debt 5) Gross debt and the CFR Gross debt at 31 March Total CFR at 31 March Gross debt less the CFR at 31 March Prudential indicators for affordability 6) Ratio of financing costs to net revenue stream Treasury indicators - borrowing limits 7) Maturity structure of fixed rate borrowing Upper Lower Upper Lower Upper Lower a) Under 12 months 30% 0% 30% 0% 30% 0% b) 12 months and within 24 months 30% 0% 30% 0% 30% 0% c) 24 months and within 5 years 30% 0% 30% 0% 30% 0% d) 5 years and within 10 years 40% 0% 40% 0% 40% 0% e) 10 years and above 100% 0% 100% 0% 100% 0% 8) Limits on fixed and variable rate borrowing Upper Lower Upper Lower Upper Lower a) Fixed rate 100% 0% 100% 0% 100% 0% b) Variable rate 60% 0% 60% 0% 60% 0% Treasury indicator - investment 9) Upper limit on principal sums invested for over 365 days £m £m £m 71 53 38 26 19 9 45 34 29 APPENDIX 3 2025-26 2026-27 2027-28 Estimate Estimate Estimate 21 £m £m £m 360 394 415 34 16 394 415 431 101 95 90 394 415 431 £m £m £m 293 320 341 104 98 93 402 423 439 £m £m £m 298 325 346 20 £m £m £m 321 370 401 394 415 431 -73 -45 -30 1634 21 % % % 4.9% 5.2% 5.6% £m £m £m 20 20 45 34 29 11 13 13 Page 136
Page 137
APPENDIX 3 Notes to Prudential and Treasury Indicators Prudential Indicators - Prudence Affordability Prudential Indicators Ratio of Financing Costs to Net Revenue Stream Maturity Structure of Borrowing This indicator identifies the trend in the cost of capital (borrowing and other long term obligation costs), against the net revenue stream. The estimates of financing costs include current commitments and the proposals in the 2025-26 Budget Pack. These gross limits are set to reduce the authority’s exposure to large, fixed rate sums falling due for refinancing, and are required for upper and lower limits. Indicators 1 - 5 above cover the overall capital and control of borrowing prudential indicators. The authority’s capital expenditure plans are the key driver of treasury management activity. The output of the capital expenditure plans is reflected in the prudential indicators, which are designed to assist members’ overview and confirm capital expenditure plans. Within the overall framework, prudential indicators are required to assess the affordability of the capital investment plans. These provide an indication of the impact of the capital investment plans on the authority’s overall finances. Page 137
Page 138
APPENDIX 4 Permitted Treasury Investments Note: Limits are given as a monetary value in £ or as a percentage of the overall investment portfolio. Type of Investment Treasury Risks Mitigating Controls Council Limits Common Good Limits Cash type instruments a. Deposits with the Debt Management Account Facility (UK Government) (Very low risk) This is a deposit with the UK Government and as such counterparty and liquidity risk is very low, and there is no risk to value. Deposits can be between overnight and 6 months. Little mitigating controls required. As this is a UK Government investment the monetary limit is unlimited to allow for a safe haven for investments. £unlimited, maximum 6 months. £unlimited, maximum 6 months. b. Deposits with other local authorities or public bodies (Very low risk) These are considered quasi UK Government debt and as such counterparty risk is very low, and there is no risk to value. Liquidity may present a problem as deposits can only be broken with the agreement of the counterparty, and penalties can apply. Little mitigating controls required for local authority deposits, as this is a quasi UK Government investment. Non-local authority deposits will follow the approved credit rating criteria. £unlimited, maximum 2 year. Limit of £10m per local Authority or public body £unlimited, maximum 2 years. Page 138
Page 139
Type of Investment Treasury Risks Mitigating Controls Council Limits Common Good Limits Deposits with other non-local authority bodies will be restricted to the overall credit rating criteria. c. Money Market Funds (MMFs) – CNAV/LVNAV/VNAV(Low to very low risk) Pooled cash investment vehicle which provides very low counterparty, liquidity and market risk. These will primarily be used as liquidity instruments. Funds will only be used where the MMFs has a “AAA” rated status from either Fitch, Moody’s or Standard and Poor’s. £15m per fund 100% d. Ultra short dated bond funds (low risk) Pooled cash investment vehicle which provides very low counterparty, liquidity and market risk. These will primarily be used as liquidity instruments. Funds will only be used where the have a “AAA” rated status from either Fitch, Moody’s or Standard and Poor’s. £15m per fund 100% e.Call account deposit accounts with financial institutions (banks and building societies) (Low risk depending on credit rating) These tend to be low risk investments, but will exhibit higher risks than categories (a), (b) and (c) above. Whilst there is no risk to value with these types of investments, liquidity is high and investments can be returned at short notice. The counterparty selection criteria restricts lending only to high quality counterparties, utilising MUFG creditworthiness service. £20m per UK banking group; £15m per non-UK banking group 100% f. Term deposits with financial institutions (banks and building societies) (Low to These tend to be low risk investments, but will exhibit higher risks than categories (a), (b) and (c) above. Whilst there is The counterparty selection criteria restricts lending only to high quality counterparties, utilising MUFG creditworthiness service. £20m per UK banking group; 100% Page 139
Page 140
Type of Investment Treasury Risks Mitigating Controls Council Limits Common Good Limits medium risk depending on period & credit rating) no risk to value with these types of investments, liquidity is low and term deposits can only be broken with the agreement of the counterparty, and penalties may apply. £15m per non-UK banking group g.Government Gilts and Treasury Bills (Very low risk) These are marketable securities issued by the UK Government and as such counterparty and liquidity risk is very low, although there is potential risk to value arising from an adverse movement in interest rates (no loss if these are held to maturity. Little counterparty mitigating controls are required, as this is a UK Government investment. The potential for capital loss will be reduced by limiting the maximum monetary and time exposures. £10m maximum 1 year. 100% maximum 1 year. h.Certificates of deposits with financial institutions (Low risk) These are short dated marketable securities issued by financial institutions and as such counterparty risk is low, but will exhibit higher risks than categories (a), (b) and (c) above. There is risk to value of capital loss arising from selling ahead of maturity if combined with an adverse movement in interest rates (no loss if these are held to The counterparty selection criteria restricts lending only to high quality counterparties, utilising MUFG creditworthiness service. £10m per counterparty maximum 1 year. 20% maximum 1 year. Page 140
Page 141
Type of Investment Treasury Risks Mitigating Controls Council Limits Common Good Limits maturity). Liquidity risk will normally be low. i. Structured deposit facilities with banks and building societies (escalating rates, de- escalating rates etc.) (Low to medium risk depending on period & credit rating) These tend to be medium to low risk investments, but will exhibit higher risks than categories (a), (b) and (c) above. Whilst there is no risk to value with these types of investments, liquidity is very low and investments can only be broken with the agreement of the counterparty (penalties may apply). The counterparty selection criteria restricts lending only to high quality counterparties, utilising MUFG creditworthiness service. £20m per UK banking group; £15m per non-UK banking group 50% j. Corporate bonds (Medium to high risk depending on period & credit rating) These are marketable securities issued by financial and corporate institutions. Counterparty risk will vary and there is risk to value of capital loss arising from selling ahead of maturity if combined with an adverse movement in interest rates. Liquidity risk will be low. The counterparty selection criteria restricts lending only to high quality counterparties, utilising MUFG creditworthiness service. £5m and maximum 1 year. 20% and maximum 1 year. Other types of investments a. Investment properties These are non-service properties which are being held pending disposal or for a longer term In larger investment portfolios some small allocation of property based investment may £10m 20%. Page 141
Page 142
Type of Investment Treasury Risks Mitigating Controls Council Limits Common Good Limits rental income stream. These are highly illiquid assets with high risk to value (the potential for property prices to fall or for rental voids). counterbalance/compliment the wider cash portfolio. Property holding will be re-valued regularly and reported annually with gross and net rental streams. b. Loans to third parties, including soft loans These are service investments either at market rates of interest or below market rates (soft loans). These types of investments may exhibit credit risk and are likely to be highly illiquid. Each third party loan requires Member approval and each application is supported by the service rational behind the loan and the likelihood of partial or full default. £10m and maximum 5 years. 10% and maximum 5 years. c. Shareholdings in a local authority company These are service investments which may exhibit market risk and are likely to be highly illiquid. Each equity investment in a local authority company requires Member approval and each application will be supported by the service rational behind the investment and the likelihood of loss. 50% 20% d. Non-local authority shareholdings These are non-service investments which may exhibit market risk, be only considered for longer term investments and will be likely to be liquid. Any non-service equity investment will require separate Member approval and each application will be supported by the service rational behind the investment and the likelihood of loss. 5% 100% Page 142
Page 143
Type of Investment Treasury Risks Mitigating Controls Council Limits Common Good Limits e. Loans to third parties as part of the Council’s Empty Homes Strategy These are service investments either at market rates of interest or below market rates (soft loans). These types of investments may exhibit credit risk and are likely to be highly illiquid. Each third party loan requires Section 95 Officer approval and each application is supported by the service rational behind the loan and the likelihood of partial or full default. Each funding request will be accompanied by financial projections and be subject to an assessment of the project and borrower. £1.5m and a maximum of 10 years. N/A f. Loans to third parties as part of the Council’s SHF Front Funding Facility These are service investments either at market rates of interest or below market rates (soft loans). These types of investments may exhibit credit risk and are likely to be highly illiquid. Each third party loan requires Section 95 Officer approval and each application is supported by the service rational behind the loan and the likelihood of partial or full default. Each funding request will be accompanied by financial projections and be subject to an assessment of the project and borrower. £5m and a maximum of 3 years. N/A g. Loans to third parties as part of the Council’s Long Term Loan Funding to RSL’s These are service investments either at market rates of interest or below market rates (soft loans). These types of investments may exhibit credit risk and are likely to be highly illiquid. Each third party loan requires Section 95 Officer approval and each application is supported by the service rational behind the loan and the likelihood of partial or full default. Each funding request will be accompanied by financial projections £5m and a maximum of 30 years. N/A Page 143
Page 144
Type of Investment Treasury Risks Mitigating Controls Council Limits Common Good Limits and be subject to an assessment of the project and borrower. h. Hub Co sub debt These are non-service investments which may exhibit market risk, be only considered for longer term investments and will be likely to be highly illiquid. Any non-service equity investment will require separate Member approval and each application will be supported by the service rational behind the investment and the likelihood of loss. £10m N/A i. Investment in a project run by a Local Authority or Local Authority Joint Committee These are investments which may exhibit market risks and will only be considered for medium to longer term investments Each investment requires approval by the Section 95 Officer up to £250,000, and, above this level, member approval. Each application will be supported by the service rationale behind the investment and the likelihood of loss. £10m N/A Page 144
Page 145
Treasury Risks All of the specific investment instruments outlined above are subject to the following risks: 1. Credit and counterparty risk This is the risk of failure by a counterparty (bank or building society) to meet its contractual obligations to the organisation particularly as a result of the counterparty’s diminished creditworthiness, and the resulting detrimental effect on the organisation’s finances. There are no counterparties where this risk is zero although AAA rated organisations have a very high level of creditworthiness. 2. Liquidity risk This is the risk that instant access to cash will not be available when it is needed. Investments can range from being instant access to term, that is, money is locked in until an agreed maturity date. However, some forms of investment, for example, gilts can usually be sold immediately if the need arises. 3. Market risk This is the risk that, through adverse market fluctuations in the value of the principal sums an organisation borrows and invests, its stated treasury management policies and objectives are compromised, against which effects it has failed to protect itself adequately. However, in certain circumstances, exposure to market risk may be sought, with a view to obtaining a long term increase in value. 4. Interest rate risk This is the risk that fluctuations in the levels of interest rates create an unexpected or unbudgeted burden on the organisation’s finances, against which the organisation has failed to protect itself adequately. This authority has set limits for its fixed and variable rate exposure in the Prudential Indicators within this report. 5. Legal and regulatory risk This is the risk that the organisation itself, or an organisation with which it is dealing in its treasury management activities, fails to act in accordance with its legal powers or regulatory requirements, and that the organisation suffers losses accordingly. The level of both risk exposure and liquidity influences the rate of return on investments. Generally, the lower the risk or the higher the liquidity, the lower the rate of return. Controls on Treasury Risks 1. Credit and counterparty risk The council utilises the creditworthiness service provided by its treasury advisors to determine which counterparties and countries are of high creditworthiness to enable investments to be made safely. 2. Liquidity risk The council has a cash flow forecasting model to enable it to determine how long investments can be made for and how much can be invested. 3. Market risk The council generally does not purchase investment instruments which are subject to market risk in terms of fluctuation in their value. The authority may purchase treasury bills as their value does not vary much during their short life. 4. Interest rate risk The council manages this risk by having a view of the future course of interest rates and formulates a treasury management strategy accordingly. The strategy aims to minimise net interest costs, consistent with control of risk. Page 145
Page 146
5. Legal and regulatory risk The council will not undertake any form of investing until it has ensured that it has necessary powers and also complied with all regulations. Unlimited investments Regulation 24 states that an investment can be shown in tables 1 & 2 as being ‘unlimited’ in terms of the maximum amount or percentage of the total portfolio that can be put into that type of investment. However, it also requires that an explanation must be given for using that category. The authority has given the following types of investments an unlimited category: 1. Debt Management Agency Deposit Facility. This is considered to be the lowest risk form of investment available to local authorities as it is operated by the Debt Management Office which is part of H.M. Treasury i.e., the UK Government’s sovereign rating stands behind the DMADF. It is also a deposit account and avoids the complications of buying and holding Government issued treasury bills or gilts. 2. High creditworthiness banks and building societies. While an unlimited amount of the investment portfolio may be put into banks and building societies with high creditworthiness, the council will ensure diversification of its portfolio by ensuring that no more than £20m of the total portfolio can be placed with any one institution or group at any one time. Environmental, Social and Governance (ESG) Considerations The Treasury Management Code states that “The organisation's credit and counterparty policies should set out its policy and practices relating to environmental, social and governance (ESG) investment considerations. This is a developing area, and it is not implied that the organisation’s ESG policy will currently include ESG scoring or other real- time ESG criteria at individual investment level.” ESG investment considerations are about understanding the ESG risks that an entity is exposed to and evaluating how well it manages these risks. It is not the same as Socially Responsible Investing, (typically where you apply negative screens), and equally, it is not the same as Sustainable Investing, (investing in products / companies based on expected sustainable and beneficial societal impact, alongside a financial return). The council is supportive of the Principles for Responsible Investment (www.unpri.org) and will seek to bring ESG factors into the decision making process for investments. Within this, the council is also appreciative of the Statement on ESG in Credit Risk and Ratings, which commits signatories to incorporating ESG into credit ratings and analysis in a systemic and transparent way. Each of the mainstream credit rating agencies are signatories to this statement. All the main rating agencies now incorporate ESG risks, alongside more traditional financial risk metrics, when assessing counterparty ratings. As such, their incorporation is already being done, to an extent, by the council’s use of the creditworthiness service provided by the council’s treasury advisors. In addition, our treasury advisors continue to Page 146
Page 147
look at ways in which these factors can be incorporated into their creditworthiness assessment service. Whilst the council is supportive of responsible investment, it should be noted that ESG information will still be secondary to the requirement for the council to adhere to the Code priorities of Security, Liquidity and Yield. Ethical principles must play a subordinate role to these priorities. Furthermore, limiting the potential counterparty options could reduce diversification and increase risk, therefore, these considerations need to be carefully balanced. Page 147
Page 148
APPENDIX 5 MUFG Weekly Credit List 07/02/2026 Long Term Short Term Long Term Short Term Long Term Short Term Suggested Duration Suggested Duration (Watch/Outloo k Adjusted) Suggested Duration (CDS Adjusted with manual override) Australia AAA Aaa AAA Not Applicable Not Applicable Not Applicable Australia and New Zealand Banking Group Ltd. AA- F1+ Aa2 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths Commonwealth Bank of Australia AA- F1+ Aa2 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths Macquarie Bank Ltd. A+ F1 Aa2 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths National Australia Bank Ltd. AA- F1+ Aa2 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths Westpac Banking Corp. AA- F1+ Aa2 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths Belgium AA- Aa3 AA Not Applicable Not Applicable Not Applicable BNP Paribas Fortis A+ F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths KBC Bank N.V. A+ F1 Aa3 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Canada AA+ Aaa AAA Not Applicable Not Applicable Not Applicable Bank of Montreal AA- F1+ Aa2 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Bank of Nova Scotia AA- F1+ Aa2 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Canadian Imperial Bank of Commerce AA- F1+ Aa2 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths National Bank of Canada A+ F1 Aa2 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Royal Bank of Canada AA- F1+ Aa1 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths Toronto-Dominion Bank AA- F1+ Aa2 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Denmark AAA Aaa AAA Not Applicable Not Applicable Not Applicable Danske A/S A+ F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths Finland AA+ Aa1 AA+ Not Applicable Not Applicable Not Applicable Nordea Bank Abp AA- F1+ Aa3 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths OP Corporate Bank plc WD WD Aa3 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths France AA- Aa3 AA- Not Applicable Not Applicable Not Applicable BNP Paribas A+ F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths Credit Agricole Corporate and Investment Bank A+ F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths Credit Agricole S.A. A+ F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths Credit Industriel et Commercial A+ F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths Societe Generale A- F1 A1 P-1 A A-1 R - 6 mths R - 6 mths R - 6 mths Germany AAA Aaa AAA Not Applicable Not Applicable Not Applicable Bayerische Landesbank A+ F1+ Aa2 P-1 NR NR O - 12 mths O - 12 mths O - 12 mths Commerzbank AG WD WD A1 P-1 A A-1 R - 6 mths R - 6 mths R - 6 mths Deutsche Bank AG A- F2 A1 P-1 A A-1 R - 6 mths R - 6 mths R - 6 mths DZ BANK AG Deutsche Zentral- Genossenschaftsbank AA- F1+ Aa2 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Landesbank Baden-Wuerttemberg A+ F1+ Aa2 P-1 NR NR O - 12 mths O - 12 mths O - 12 mths Landesbank Berlin AG Aa3 P-1 O - 12 mths O - 12 mths O - 12 mths Landesbank Hessen-Thueringen Girozentrale A+ F1+ Aa2 P-1 NR NR O - 12 mths O - 12 mths O - 12 mths Landwirtschaftliche Rentenbank AAA F1+ Aaa P-1 AAA A-1+ P - 24 mths P - 24 mths P - 24 mths Norddeutsche Landesbank Girozentrale A+ F1+ Aa2 P-1 NR NR O - 12 mths O - 12 mths O - 12 mths NRW.BANK AAA F1+ Aa1 P-1 AA A-1+ P - 24 mths P - 24 mths P - 24 mths Netherlands AAA Aaa AAA Not Applicable Not Applicable Not Applicable ABN AMRO Bank N.V. A F1 Aa3 P-1 A A-1 R - 6 mths R - 6 mths R - 6 mths BNG Bank N.V. AAA F1+ Aaa P-1 AAA A-1+ P - 24 mths P - 24 mths P - 24 mths Cooperatieve Rabobank U.A. A+ F1 Aa2 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths ING Bank N.V. AA- F1+ Aa3 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Nederlandse Waterschapsbank N.V. Aaa P-1 AAA A-1+ P - 24 mths P - 24 mths P - 24 mths Norway AAA Aaa AAA Not Applicable Not Applicable Not Applicable DNB Bank ASA Aa1 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths Qatar AA Aa2 AA Not Applicable Not Applicable Not Applicable Fitch Rating Moody's Ratings S&P Ratings Page 148
Page 149
Qatar National Bank A+ F1 Aa3 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Singapore AAA Aaa AAA Not Applicable Not Applicable Not Applicable DBS Bank Ltd. AA- F1+ Aa1 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths Oversea-Chinese Banking Corp. Ltd. AA- F1+ Aa1 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths United Overseas Bank Ltd. AA- F1+ Aa1 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths Sweden AAA Aaa AAA Not Applicable Not Applicable Not Applicable Skandinaviska Enskilda Banken AB AA- F1+ Aa3 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Svenska Handelsbanken AB AA F1+ Aa2 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths Swedbank AB AA- F1+ Aa3 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Switzerland AAA Aaa AAA Not Applicable Not Applicable Not Applicable UBS AG A+ F1 Aa2 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths United Arab Emirates AA Aa2 AA Not Applicable Not Applicable Not Applicable First Abu Dhabi Bank PJSC AA- F1+ Aa3 P-1 AA- A-1+ O - 12 mths O - 12 mths O - 12 mths United Kingdom AA- Aa3 AA Not Applicable Not Applicable Not Applicable Collateralised LA Deposit* Y - 60 mths Y - 60 mths Y - 60 mths Debt Management Office Y - 60 mths Y - 60 mths Y - 60 mths Multilateral Development Banks Y - 60 mths Y - 60 mths Y - 60 mths Supranationals Y - 60 mths Y - 60 mths Y - 60 mths UK Gilts Y - 60 mths Y - 60 mths Y - 60 mths Al Rayan Bank Plc A2 P-1 R - 6 mths R - 6 mths R - 6 mths Bank of Scotland PLC (RFB) AA- F1+ A1 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Barclays Bank PLC (NRFB) A+ F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths Barclays Bank UK PLC (RFB) A+ F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths Clydesdale Bank PLC A- F1 A1 P-1 A A-1 R - 6 mths R - 6 mths R - 6 mths Co-operative Bank PLC (The) BBB+ F1 A3 P-2 G - 100 days G - 100 days G - 100 days Goldman Sachs International Bank A+ F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths Handelsbanken Plc AA F1+ AA- A-1+ O - 12 mths O - 12 mths O - 12 mths HSBC Bank PLC (NRFB) AA- F1+ A1 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths HSBC UK Bank Plc (RFB) AA- F1+ A1 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Lloyds Bank Corporate Markets Plc (NRFB) AA- F1+ A1 P-1 A A-1 O - 12 mths O - 12 mths O - 12 mths Lloyds Bank Plc (RFB) AA- F1+ A1 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths National Bank Of Kuwait (International) PLC A+ F1 A A-1 R - 6 mths R - 6 mths R - 6 mths National Westminster Bank PLC (RFB) A+ F1 A1 P-1 A+ A-1 R - 6 mths O - 12 mths O - 12 mths NatWest Markets Plc (NRFB) A+ F1 A1 P-1 A A-1 R - 6 mths R - 6 mths R - 6 mths Santander Financial Services plc (NRFB) A+ F1 A1 P-1 A- A-2 R - 6 mths R - 6 mths R - 6 mths Santander UK PLC A+ F1 A1 P-1 A A-1 R - 6 mths R - 6 mths R - 6 mths SMBC Bank International Plc A- F1 A1 P-1 A A-1 R - 6 mths R - 6 mths R - 6 mths Standard Chartered Bank A+ F1 A1 P-1 A+ A-1 R - 6 mths O - 12 mths O - 12 mths The Royal Bank of Scotland Plc (RFB) A+ F1 A1 P-1 A+ A-1 R - 6 mths O - 12 mths O - 12 mths Coventry Building Society A- F1 A3 P-2 G - 100 days G - 100 days G - 100 days Leeds Building Society A- F1 A3 P-2 G - 100 days G - 100 days G - 100 days Nationwide Building Society A F1 A1 P-1 A+ A-1 R - 6 mths R - 6 mths R - 6 mths Principality Building Society BBB+ F2 Baa1 P-2 N/C - 0 mths N/C - 0 mths N/C - 0 mths Skipton Building Society A- F1 A2 P-1 R - 6 mths R - 6 mths R - 6 mths Yorkshire Building Society A- F1 A2 P-1 R - 6 mths R - 6 mths R - 6 mths United States AA+ Aaa AA+ Not Applicable Not Applicable Not Applicable Bank of America N.A. AA F1+ Aa1 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Bank of New York Mellon, The AA F1+ Aa1 P-1 AA- A-1+ P - 24 mths P - 24 mths P - 24 mths Citibank N.A. A+ F1 Aa3 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths JPMorgan Chase Bank N.A. AA F1+ Aa1 P-1 AA- A-1+ P - 24 mths P - 24 mths P - 24 mths Wells Fargo Bank, NA AA- F1+ Aa1 P-1 A+ A-1 O - 12 mths O - 12 mths O - 12 mths Page 149
Page 150
APPENDIX 6 TREASURY MANAGEMENT SCHEME OF DELEGATION SECTION 95 OFFICER AND NOMINATED MEMBER ROLES Council • Overall responsibility for Treasury Management Strategy. • Adoption of Treasury Policy Statements. • Receive an Annual Report and other reports on the Treasury Management Operation and on the exercise of delegated treasury management powers. Policy and Resources Committee • Responsibility for the overall investment of money under the control of the Council. • Keeping under review the level of borrowing. • Approval of Annual Strategy Statement. • Receiving and reviewing reports on treasury management policies, practices and activities. • Approval of Treasury Policy Statements. • Implementation and monitoring of Treasury Management Policies and Practices. Audit and Scrutiny Committee • Review the overall internal and management control framework related to the treasury function. • Review internal and external audit reports related to treasury management. • Review provision in the internal and external audit plans to ensure there is adequate audit coverage of treasury management. • Monitor progress with implementing recommendations in internal and external audit reports. • Reviewing the treasury management policy and procedures and making recommendations to the responsible body. Role of the nominated Elected Member (Policy Lead for Finance and Commercial Services): • Acting as spokesperson for treasury management. • Taking a lead for elected Members in overseeing the operation of the treasury function. • Review the treasury management policy, strategy and reports. • Support and challenge the development of treasury management. Role of the Section 95 Officer: • Recommending clauses, treasury management policy/practices for approval, reviewing the same regularly, and monitoring compliance. Page 150
Page 151
• Submitting regular treasury management policy reports. • Suubmitting budgets and budget variations. • Receiving and reviewing management information reports. • Reviewing the performance of the treasury management function. • Ensuring the adequacy of treasury management resources and skills, and the effective division of responsibilities within the treasury management function. • Ensuring the adequacy of internal audit, and liaising with external audit. • Recommending the appointment of external service providers. • Reviewing and considering risk management in terms of treasury activities. • preparation of a capital strategy to include capital expenditure, capital financing, non- financial investments and treasury management, with a long term timeframe • ensuring that the capital strategy is prudent, sustainable, affordable and prudent in the long term and provides value for money • ensuring that due diligence has been carried out on all treasury and non-financial investments and is in accordance with the risk appetite of the authority • ensure that the authority has appropriate legal powers to undertake expenditure on non-financial assets and their financing • ensuring the proportionality of all investments so that the authority does not undertake a level of investing which exposes the authority to an excessive level of risk compared to its financial resources • ensuring that an adequate governance process is in place for the approval, monitoring and ongoing risk management of all non-financial investments and long term liabilities • provision to members of a schedule of all non-treasury investments including material investments in subsidiaries, joint ventures, loans and financial guarantees ensuring that members are adequately informed and understand the risk exposures taken on by an authority • ensuring that the authority has adequate expertise, either in house or externally provided, to carry out the above • creation of Treasury Management Practices which specifically deal with how non- treasury investments will be carried out and managed, to include the following: - o Risk management (TMP1 and schedules), including investment and risk management criteria for any material non-treasury investment portfolios; o Performance measurement and management (TMP2 and schedules), including methodology and criteria for assessing the performance and success of non-treasury investments; o Decision making, governance and organisation (TMP5 and schedules), including a statement of the governance requirements for decision making in relation to non-treasury investments; and arrangements to ensure that appropriate professional due diligence is carried out to support decision making; Page 151
Page 152
o Reporting and management information (TMP6 and schedules), including where and how often monitoring reports are taken; o Training and qualifications (TMP10 and schedules), including how the relevant knowledge and skills in relation to non-treasury investments will be arranged. The nominated Elected Member (Policy Lead for Finance and Commercial Services) • Acting as spokesperson for treasury management. • Taking a lead for elected Members in overseeing the operation of the treasury function. • Review the treasury management policy, strategy and reports. • Support and challenge the development of treasury management. Page 152
Page 153
ARGYLL AND BUTE COUNCIL FINANCIAL SERVICES AUDIT AND SCRUTINY COMMITTEE 13 MARCH 2025 2024-25 UNAUDITED ANNUAL ACCOUNTS PREPARATIONS 1 EXECUTIVE SUMMARY 1.1 This report advises the Audit and Scrutiny Committee of the plans in place for the preparation of the council’s Unaudited Annual Accounts for the year ending 31 March 2025. 1.2 The Section 95 Officer confirms that the accounts will be prepared in accordance with proper accounting practice, as required by legislation and as set out within the Code of Practice on Local Authority Accounting in the United Kingdom 2024-25 (the Code). 1.3 The Audit and Scrutiny Committee is requested to note that plans are in place to prepare the council’s Unaudited Annual Accounts for the year ending 31 March 2025, in accordance with proper accounting practice, and by the statutory deadline of 30 June 2025. Page 153 Agenda Item 13
Page 154
ARGYLL AND BUTE COUNCIL FINANCIAL SERVICES AUDIT AND SCRUTINY COMMITTEE 13 MARCH 2025 2024-25 UNAUDITED ANNUAL ACCOUNTS PREPARATIONS 2. INTRODUCTION 2.1 ‘An Audit Committees – Practical Guidance for Local Authorities’ has been issued by the Chartered Institute of Public Finance and Accountancy (CIPFA). This suggests that Audit Committees should have an overview of the plans made for the preparation of the council’s Annual Accounts. This report is therefore considered good practice in advising the Audit and Scrutiny Committee of the plans in place for the preparation of the council’s Unaudited Annual Accounts for the year ending 31 March 2025. 3 RECOMMENDATIONS 3.1 The Audit and Scrutiny Committee is requested to note that plans are in place to prepare the council’s Unaudited Annual Accounts for the year ending 31 March 2025, consistent with proper accounting practice and by the statutory deadline of 30 June 2025. 4 DETAIL 4.1 4.1.1 4.1.2 4.1.3 4.1.4 Section 95 Officer Responsibilities The Section 95 Officer is responsible for the preparation of the council's Annual Accounts in accordance with proper accounting practices, as required by legislation, and as set out in the CIPFA Code of Practice on Local Authority Accounting in the United Kingdom (the Code). In preparing the Annual Accounts, the Section 95 Officer will: • Select suitable accounting policies and apply them consistently; • Make judgements and estimates on a reasonable basis; • Comply with legislation; and • Comply with the Local Authority Accounting Code of Practice 2024-25 (in so far as it is compatible with legislation). The Section 95 Officer will also: • Keep adequate accounting records, which are up to date; and • Take reasonable steps for the prevention and detection of fraud and other irregularities. The Section 95 Officer confirms that adequate resources and arrangements are in place to discharge these responsibilities effectively. Page 154
Page 155
4.2 4.2.1 4.2.2 4.2.3 Completion of Accounts Project Plan and Guidance Processes and procedures have been established to ensure that the Annual Accounts are prepared in accordance with proper accounting practice, as required by legislation and as set out within the Code of Practice on Local Authority Accounting in the United Kingdom 2024-25 (the Code). The Code is based on International Financial Reporting Standards (IFRS), with interpretation appropriate to the public sector. There is one major change to the Code from the previous year, with the adoption of IFRS 16 Leases from 1 April 2024. The project plan has been updated, and arrangements have been put in place, to ensure compliance with the new requirement in respect of accounting for leases and lease type arrangements. Cognisance has also been taken of the Annual Audit Report in respect of the Audited Annual Accounts for the year ending 31 March 2024 in order to further enhance existing processes and arrangements, where appropriate. In keeping with previous years’ arrangements, a project plan has been developed, with resources adequately allocated, to ensure completion in accordance with proper accounting practice and within the required completion timescale. A clear set of instructions for the end of the financial year will be clearly communicated to all stakeholders. These sit alongside the project plan and cover year-end close down of the council’s financial systems and the preparation of a set of statutory accounts. In addition, progress on delivery of the project plan will be closely monitored on an ongoing basis through to completion of the Unaudited Annual Accounts by the statutory deadline of 30 June 2025. 4.2.4 The detailed project plan includes the following key milestones: • Revenue expenditure, creditors, debtors, accruals and prepayments completed by 17 April 2025; • Capital expenditure and treasury management revenue accounts completed by 25 April 2025; • Agreement of inter-group balances with Live Argyll and associated journals processed by 25 April 2025; • Council Tax and NDR entries completed by 9 May 2025; • Review and adjustments to ledger and central department cost allocations completed by 21 May 2025; • Preparation of Unaudited Annual Accounts including report by Section 95 Officer by 30 May 2025; • Unaudited Annual Accounts considered by a meeting of the Audit and Scrutiny Committee on 12 June 2025; • Unaudited Annual Accounts considered by a meeting of the full Council on 26 June 2025; and • Submission of Unaudited Annual Accounts to Accounts Commission by the statutory deadline of 30 June 2025. 4.2.5 External auditors have been satisfied with the quality of working papers and general Page 155
Page 156
arrangements for the preparation of the Unaudited Annual Accounts in previous years. The plan is designed to ensure completion of the Unaudited Annual Accounts by the required deadline of 30 June 2025, together with supporting documentation, prepared to a suitable standard, to enable completion of the audit by 30 September 2025. 5. CONCLUSION 5.1 The Section 95 Officer has appropriate arrangements in place to ensure completion of the Unaudited Annual Accounts for the year ending 31 March 2025, in accordance with proper accounting practice and by the statutory deadline of 30 June 2025. 6 IMPLICATIONS 6.1 Policy None 6.2 Financial None 6.3 Legal Ensures compliance with statutory deadline 6.4 HR None – delivered within existing resources 6.5 Fairer Duty Scotland: 6.5.1 Equalities None 6.5.2 Socio-Economic Duty None 6.5.3 Islands Duty None 6.6 Climate Change None 6.7 Risk Mitigates the risk of non-compliance with required accounting standards and statutory deadline 6.8 Customer Service None 6.9 The Rights of the Child (UNCRC) None Kirsty Flanagan Executive Director / Section 95 Officer 19 February 2025 Policy Lead for Financial and Commercial Services - Councillor Ross Moreland For further information please contact Carolyn Earl, Interim Head of Financial Services, carolyn.earl@argyll-bute.gov.uk Page 156
Page 157
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 INTERNAL AUDIT STRATEGY 2025-28 AND AUDIT PLAN 2025-26 1. INTRODUCTION 1.1 This report introduces the new Internal Audit Strategy covering 2025–28 and the Internal Audit Plan 2025-26. 2. RECOMMENDATIONS 2.1 To agree and endorse the Internal Audit Strategy 2025-28 (Appendix 1). 2.2 To agree and endorse the Internal Audit Plan 2025-26 (Appendix 2). 3. DETAIL 3.1 The Global Internal Audit Standards (GIAS), specifically Standard 9.2 ‘Internal Audit Strategy’ stipulates that the Chief Internal Auditor (CIA) must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organisation. A new Internal Audit Strategy has been developed which aligns the key priorities, objectives and strategic risks faced by the Council into the work of the internal audit function over the next three years. This helps to provide strategic direction to the internal audit function and support the Council in its approach to delivering its key objectives and allocates internal audit resources appropriately. Whilst the Strategy provides a good overview over the next three years, there are options to make adjustments where that is required or where new risks and alternative needs require to be accommodated. The key elements of the strategy include: • Audit Environment • Strategic Objectives • Delivering the Strategy • Delivering our Plans 3.2 The strategy further allows clear overview of how each of the three years link into providing the basis of each operational plan over the same period. The Audit Strategy for 2025 – 2028 is shown in Appendix 1. 3.3 The GIAS, specifically Standard 9.4 Internal Audit Plan further requires that the Council has an internal audit plan which must be risk based and focused on governance, risk and controls to allow the Chief Internal Auditor (CIA) to provide an annual opinion on the Council’s internal control framework, based on the work undertaken during the year. This annual opinion informs the Annual Governance Statement. 3.4 The Annual Audit Plan is shown at Appendix 2. The creation of the plan gave consideration to a number of factors including: Page 157 Agenda Item 14
Page 158
• the audit universe risk assessment which is based upon a matrix taking account of scores for each potential audit area in respect of materiality, sensitivity, time elapsed since it was last subject to audit and the overall audit assessment when it was last reviewed • the Council’s strategic risk register and operational risk registers • input from Executive Directors, the Health and Social Care Partnership (HSCP) Chief Officer, Heads of Service and Audit and Scrutiny Committee members • a consideration of the need to provide audit coverage across all Heads of Service, the HSCP and LiveArgyll • significant changes within the Council (i.e. new systems, new policies) • wider issues in the public sector environment • an internal audit team meeting to discuss possible areas of focus based on cumulative audit knowledge • Culture, technological governance, controls in operation and fraud risk 3.5 The Audit plan is broken down into 3 main areas which are: • Service department reviews • Continuous monitoring programme • Other Activity 3.6 Service department reviews include auditable units within the audit universe which are specific to an individual department. Our continuous monitoring programme includes a number of auditable units which were historically subject to individual annual audits. These areas are now tested on a regular recurring basis with control weaknesses reported by exception. Internal Audit also undertake other activities during the year including verification work and following up on previous internal audit recommendations for improvement. 3.7 An indicative outline scope is given for each of the audit reviews. Full terms of reference will be discussed and agreed with the relevant Head of Service as part of the planning process for each audit. 3.8 The plan is based on an estimated available 658 audit days with suitable contingency factored in. The plan remains fully flexible, to accommodate changes in the Council’s risk profile and /or emerging risks. 3.9 Feedback on the draft plan has been obtained from the Heads of Service, the Chief Officer of the HSCP and the Live Argyll General Manager. This has been incorporated into the plan included as appendix 2 to this paper 4. CONCLUSION 4.1 The annual audit plan is risk based and is aligned to the Council’s long-term outcomes, corporate objectives and strategic risk register. The plan also incorporates continuous monitoring and verification activity. 5. IMPLICATIONS 5.1 Policy - None 5.2 Financial - None Page 158
Page 159
5.3 Legal - None 5.4 HR - None 5.5 Fairer Scotland Duty - None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change - None 5.7 Risk – Delivery of an effective internal audit function and plan should help reduce the Council’s risk exposure 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) - None Paul Macaskill, Chief Internal Auditor 13 March 2025 For further information contact: Paul Macaskill, Chief Internal Auditor (01436 604108) APPENDICES Appendix 1 – Internal Audit Strategy 2025-28 Appendix 2 – Internal Audit Plan 2025-26 Page 159
Page 160
This page is intentionally left blank
Page 161
Bute • Helensburgh • Islay • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … . 2025/26 – 2027/28 INTERNAL AUDIT STRATEGY Page 161
Page 162
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Foreword Internal audit should provide independent and objective assurance to the Council’s senior management that their systems and controls are fit for purpose. That assurance should cover the controls over core systems, governance and risk management processes including financial and operational controls. At the heart of this governance work is assurance on management’s controls over the quality of the information which senior management and elected members use to make decisions and monitor performance. As local government adapts to new strategic-level ambitions, responds to challenging financial pressures and redefines its operating models, internal audit needs to recognise these changes and have the capability to respond. A good internal audit service gets to the heart of the issues facing the organisation. By having direct reporting lines to the Chief Executive, Section 95 Officer and the Council’s Audit and Scrutiny Committee, internal audit is able to give honest and clear information without being influenced by other senior staff seeking to manage the message. In doing this work, internal audit has the responsibility to act as the ‘eyes and ears’ of the Chief Executive, Section 95 Officer and the Audit and Scrutiny Committee in the organisation providing an independent view of where better management of risk can improve organisational performance We are pleased to present the Internal Audit Strategy which lays the foundation for the delivery of an effective internal audit function focused on helping to support senior management and the Council in delivering the key priorities of Argyll and Bute Council and promoting its ambition to make Argyll and Bute a place where people want to come to live, to work and to do business. Janice Wason-Hall Paul Macaskill Chair of Audit and Chief Internal Auditor Scrutiny Committee 1. Introduction In this document, we set out our strategy for 2025-26 to 2027-28. This remains a very uncertain and challenging time for the Council and the local government sector generally and this strategy reflects how we intend to support the Council’s senior management and elected members in responding to the challenges facing the Council. Our audit environment continues to evolve. The Council has recently approved key priorities which sets out an ambitious agenda, this, and the impacts of ongoing financial restraint means that the Council will increasingly look to deliver services in new ways, with fewer resources and with digital technology. These key priorities are summarrised below and further detail on each of these priorities are availbale using the link below: Priorities of Argyll and Bute Council | Argyll and Bute Council (argyll-bute.gov.uk) Page 162
Page 163
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … In this context, the role of Internal Audit has never been more important. Our independence and commitment to high-quality work will provide senior management and the Audit and Scrutiny Committee with appropriate assurance and insights into the use of public funds and on the adequacy and effectiveness of the Council’s corporate governance, risk management and internal control arrangements Our aim is to add real value through our support to senior management and elected members, our wider influence as we focus on the issues of greatest priority, and by having the capacity and resources to support accountability and drive corporate and service improvement. 2. Our Audit Environment Our audit environment continues to evolve at a rapid pace, particulalrly with the new Global Internal Audit standards (GIAS) and the development of supporting guidance for internal audit teams working in the public sector to support these changes. The Council has recently approved ambitious priorities and also has key development programmes of work and continues to face a challenging financial environment. Councils across Scotland, including Argyll and Bute are trying to balance the provision of key services with difficulties in recruiting staff to particular posts, particularly in areas of health and social care and a number of professional posts. Senior management has committed in the Council’s business plan and in a series of reports setting out future ambitions, to a challenging agenda which requires to be underpinned by sound leadership, effective financial management and robust governance arrangements. These arrangements will require to be supported by effective performance and risk management arrangements and are likely to lead to an increased emphasis on project and programme management, service redesign, contract management, commissioning and contracting and how best to secure the benefits of new digital technology and transformation. The financial challenges mean that the Council will continue to face difficult decisions around services and significant on-going pressure to ensure that those which remain are delivered in a cost-effective manner. At the same time, the demands on Council services are increasing and the expectations of the public in terms of the range and quality of services offered by the Council will remain high. The public also increasingly expects services to be provided in a way that is more visibly integrated and joined-up for people who use them. The Council, therefore, faces significant challenges balancing the day-to-day delivery of services with achieving its wider strategic priorities, whilst delivering efficiencies, driving service improvements and managing and delivering transformational change. Page 163
Page 164
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … 3. Our Strategic Objectives In this environment, Internal Audit will need to continually reflect and adapt what it does and how it does it in order to ensure that it can continue to operate efficiently and effectively and to demonstrate relevance and value to the Council. Our strategic aim is to provide a high quality and customer focused internal audit service which is responsive, flexible and consistent with best professional practice. We aim to focus on areas that matter, to use resources efficiently and effectively, and to be seen by stakeholders as adding value, providing valuable insights and making a vibrant and relevant contribution to the Council. We will do this by: • supporting elected members and senior management in undertaking their respective roles by providing an independent, objective assurance and consulting activity designed to add value and improve the effectiveness of the Council’s operations. • delivering an internal audit service which fulfils the role and responsibilities given to it formally by the Council as laid out in the Internal Audit Charter approved by the Audit and Scrutiny Committee, the Chief Executive and the Council’s s95 officer. • providing an internal audit service consistent with best professional practice in accordance with the GIAS, Code of Practice for the Governance of Internal Audit in the United Kingdom (Code) and the associated Application Note issued by the Relevant Internal Audit Standard Setters (RIASS). • helping to drive improvements in the Council’s risk management, internal control, governance and service delivery arrangements in order to make a positive contribution to the overall management and operation of the authority; and • focusing our resources on providing assurance on the management of the Council’s core governance processes, strategic priorities and key corporate risks. 4. Delivering our Strategy Providing assurance and adding value We will deliver our strategy through a range of assurance outputs for senior management and the Audit and Scrutiny Committee focused on cyclical coverage of core corporate governance processes, key strategic priorities and programmes of work, corporate risks and key financial systems. Our work will include in-depth assessments of how well key risks, priorities, projects and programmes of work are being managed and by examining and reporting on the adequacy, efficiency and effectiveness of relevant management arrangements, we will add value by highlighting scope for improvements and providing those we audit with better insight into how they manage and use public money. We will seek to contribute to the Council’s achievement of best value and value for money by providing independent assurance on relevant management arrangements and by constantly being aware of the need to highlight where scope for improved efficiency may exist. Page 164
Page 165
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Independence and objectivity Although part of the Council, independence and objectivity are important attributes for us, not only in complying with best professional practice, but in ensuring that we can contribute most effectively to the Council’s governance arrangements. We greatly value our independence and objectivity and are committed to demonstrating these attributes in all that we do. Continuing to develop our Counter Fraud Team capability We will continue to develop our investigative capability where there is a need to establish facts concerning potential evidence of irregularity and we will work with management to continually improve the Council’s anti-fraud arrangements to ensure that key fraud risks are identified and appropriately managed. We will respond appropriately and in a timely manner to relevant issues drawn to our attention by elected members, management and members of the public Support for the Audit and Scrutiny Committee We will seek to work closely with the Audit and Scrutiny Committee which takes assurance from Internal Audit reports and will continue to help the Committee discharge its responsibilities and to respond more quickly to emerging issues. We will develop an effective working relationship with the Chair and Vice-Chair of Audit and Scrutiny Committee to help them shape the work of the Committee. Securing influence We want Services to view Internal Audit as a valuable resource that can help them to achieve corporate and service objectives. We will seek, where appropriate and without compromising our primary function and independence, to become involved in relevant emerging issues at an early stage and to provide advice and guidance to prevent problems or weaknesses from arising and to ensure effective and efficient use of Council resources. Developing our people to make sure we have the right skills The environment within which we and the Council are operating continues to change and this will need to be reflected in our staff. As well as continuing to invest in our core internal audit skills, we will continue to enhance the range of other skills within Internal Audit needed to focus our work on the key governance processes and strategic risks and priorities faced by the Council. Investing in our people is critical to our success. We want to embed a culture of continuous learning and development, whereby we help our people to keep their skills at the desired level. To achieve this, we need to support them to further develop their skills across relevant areas including technological and methodological skills, digital skills, sector and cross-government knowledge and personal effectiveness skills. Page 165
Page 166
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … External audit We will seek to ensure that the Council’s appointed external auditor is, where appropriate, able to place reliance on our work. We will work closely with external audit to ensure that the external audit process is conducted appropriately and that due consideration is given to matters arising. Resource requirements Internal Audit services are to be provided by an in-house team covered by this strategy. The Chief Internal Auditor will continue to annually assess the level and capacity of internal audit resources and will report to the Audit and Scrutiny Committee on the adequacy, or otherwise, of the resources available to them in accordance with GIAS, Application Note and the Code. Delivering high performance We will seek to measure the success of this strategy and will set out a performance management framework against which we will report regularly. We will also continue to challenge ourselves to work as efficiently as possible by seeking to ensure that our own use of resources is cost-effective and to seek continuous improvements in our audit methodologies and other internal processes. Page 166
Page 167
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … 5. Delivering our Plans These plans provide a comprehensive approach linking our Strategic Risk Register, key developmental changes and commitments in relation to major capital programmes. However, these plans are indicative and not set in stone, they are based on a number of assumptions including, but not limited to, static level of continuous internal audit resources at the approapriate skill level, budget resources being suffcicent to allow visits to establishments across the wide geographial and island areas, no significant risk profile changes. The overview of the work planned over the next three financial years which is covered by this document is outlined in each of the Internal Audit Plans for 2025/26, 2026/27 and 2027/28. A separate document covering each year of the plan will be submitted annually to the Audit and Scrutiny Committee. Internal Audit Plan for 2025/26 – Appendix 1 Internal Audit Plan for 2026/27 – Appendix 2 Internal Audit Plan for 2027/28 – Appendix 3 Cross Referencing with Key Risks and Priorities – Appendix 4 Page 167
Page 168
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Appendix 1 – 2025/26 Internal Audit Plan by Council Directorate / Head of Service Douglas Hendry Kirsty Flanagan Evan Beswick Education Legal & Regulatory Support Commercial Services Financial Services Customer Support Roads & Infrastructure Development & Economic Growth Health & Social Care Partnership Process for School Residential Trips Music Service Delivery and Funding Education Maintenance Allowance Reporting Concerns at Work Strategic Procurement Building Cleaning Project Management of key Developments Payroll - iTrent Capital Programme – Management and Monitoring ICT Disaster Recovery Performance Management and Reporting Roads Reconstruction Programme Street Lighting Rural Growth Deal Oban Airport Direct Payments Eclipse – Post Implementation Review Live Argyll Property and Building Maintenance Compliance Other Activity NFI – Counter Fraud Team Follow Up Local Government Benchmarking Framework Page 168
Page 169
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Appendix 2 – 2026/27 Internal Audit Plan by Council Directorate / Head of Service Douglas Hendry Kirsty Flanagan Evan Beswick Education Legal & Regulatory Support Commercial Services Financial Services Customer Support Roads & Infrastructure Development & Economic Growth Health & Social Care Partnership Supply Teaching Home Education Education Maintenance Allowance Business Continuity Arrangements Civil Contingencies and Emergency Planning Estate Planning and Rationalisation Catering Staff and Member Expenses Risk Management IT Strategy and Governance Workforce Planning Fleet Management and Replacement Waste Disposal Rural Growth Deal Housing Emergency Action Plan Oban Airport Adult External Care Packages Respite Care Live Argyll Charging Policy – Compliance, Purchasing and Performance Monitoring Other Activity NFI – Counter Fraud Team Follow Up Local Government Benchmarking Framework Page 169
Page 170
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Appendix 3 – 2027/28 Internal Audit Plan by Council Directorate / Head of Service Douglas Hendry Kirsty Flanagan Evan Beswick Education Legal & Regulatory Support Commercial Services Financial Services Customer Support Roads & Infrastructure Development & Economic Growth Health & Social Care Partnership Strategic Planning- School Rolls ASN – Allocation of Assistance Education Maintenance Allowance Records Management Records Storage and Digitalisation Processes Carbon Management and Reduction Planning Energy Control, Management and Reduction Housing Benefit Council Tax Cyber Security Digital Transformation and Connectivity Recycling Traffic Regulation Orders Rural Growth Deal Oban Airport Children’s Homes Adult Protection Live Argyll HR/Payroll & Establishment Visits Other Activity NFI – Counter Fraud Team Follow Up Local Government Benchmarking Framework Page 170
Page 171
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Appendix 4 – Cross Reference of Strategic Audit Plan to Strategic Risks and Council Key Priorities Planned Internal Audit Review Year of Review Council Service Area Cross Referenced to Strategic Risk Register Cross Referenced to Council Key Priorities Process for School Residential Trips 2025/26 Education Children and Young People Music Service Delivery and Funding 2025/26 Education Children and Young People Education Maintenance Allowance 2025/26 Education Children and Young People Supply Teaching 2026/27 Education Children and Young People Home Education 2026/27 Education Children and Young People Education Maintenance Allowance 2026/27 Education Children and Young People Strategic Planning- School Rolls 2027/28 Education Children and Young People ASN – Allocation of Assistance 2027/28 Education Children and Young People Education Maintenance Allowance 2027/28 Education Children and Young People Reporting Concerns at Work 2025/26 Legal & Regulatory Support Strategic Procurement 2025/26 Legal & Regulatory Support Page 171
Page 172
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Planned Internal Audit Review Year of Review Council Service Area Cross Referenced to Strategic Risk Register Cross Referenced to Council Key Priorities Business Continuity Arrangements 2026/27 Legal & Regulatory Support SR-8 Civil Contingencies and Emergency Planning 2026/27 Legal & Regulatory Support SR-8 Records Management 2027/28 Legal & Regulatory Support Records Storage and Digitalisation Processes 2027/28 Legal & Regulatory Support Building Cleaning 2025/26 Commercial Services Project Management of key Developments 2025/26 Commercial Services Estate Planning and Rationalisation 2026/27 Commercial Services SR-2 Catering 2026/27 Commercial Services Carbon Management and Reduction Planning 2027/28 Commercial Services SR-12 Energy Control, Management and Reduction 2027/28 Commercial Services SR-12 Payroll - iTrent 2025/26 Financial Services Capital Programme – Management and Monitoring 2025/26 Financial Services SR-2 Sustainable Service Delivery Page 172
Page 173
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Planned Internal Audit Review Year of Review Council Service Area Cross Referenced to Strategic Risk Register Cross Referenced to Council Key Priorities Staff and Member Expenses 2026/27 Financial Services Risk Management 2026/27 Financial Services Housing Benefit 2027/28 Financial Services Council Tax 2027/28 Financial Services Sustainable Service Delivery Disaster Recovery 2025/26 Customer Support SR-8 Performance Management and Reporting 2025/26 Customer Support SR-6 IT Strategy and Governance 2026/27 Customer Support Transport Infrastructure and Digital Connectivity Workforce Planning 2026/27 Customer Support SR-6 Cyber Security 2027/28 Customer Support SR-10 Transport Infrastructure and Digital Connectivity Digital Transformation and Connectivity 2027/28 Customer Support SR-3 Transport Infrastructure and Digital Connectivity Page 173
Page 174
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Planned Internal Audit Review Year of Review Council Service Area Cross Referenced to Strategic Risk Register Cross Referenced to Council Key Priorities Roads Reconstruction Programme 2025/26 Roads & Infrastructure SR-2 Transport Infrastructure and Digital Connectivity Street Lighting 2025/26 Roads & Infrastructure Environment Fleet Management and Replacement 2026/27 Roads & Infrastructure Sustainable Service Delivery & Environment Waste Disposal 2026/27 Roads & Infrastructure SR-9 Environment Recycling 2027/28 Roads & Infrastructure SR-9 Environment Traffic Regulation Orders 2027/28 Roads & Infrastructure Transport Infrastructure and Digital Connectivity Rural Growth Deal 2025/26 Development & Economic Growth SR-1 & SR-3 Housing, Economic Growth and Population Oban Airport 2025/26 Development & Economic Growth Rural Growth Deal 2026/27 Development & Economic Growth SR-1 & SR-3 Housing, Economic Growth and Population Page 174
Page 175
Bute • Helensburgh • Islay • Tarbet • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Seil … Planned Internal Audit Review Year of Review Council Service Area Cross Referenced to Strategic Risk Register Cross Referenced to Council Key Priorities Oban Airport 2026/27 Development & Economic Growth Housing Emergency Action Plan 2026/27 Development & Economic Growth SR-13 Housing, Economic Growth and Population Rural Growth Deal 2027/28 Development & Economic Growth SR-1 & SR-3 Housing, Economic Growth and Population Oban Airport 2027/28 Development & Economic Growth Direct Payments 2025/26 Health & Social Care Partnership SR - 7 Eclipse – Post Implementation Review 2025/26 Health & Social Care Partnership Adult External Care Packages 2026/27 Health & Social Care Partnership SR - 7 Respite Care 2026/27 Health & Social Care Partnership SR - 7 Children’s Homes 2027/28 Health & Social Care Partnership Children and Young People Adult Protection 2027/28 Health & Social Care Partnership Page 175
Page 176
This page is intentionally left blank
Page 177
ARGYLL AND BUTE COUNCIL COMHAIRLE EARRA-GHÀIDHEAL AGUS BHÒID INTERNAL AUDIT PLAN 2025-26 Page 177
Page 178
2 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Contents Purpose Statement of Internal Audit ............................................................................................................................................................................................. 1 Global Internal Audit Standards (GIAS) Requirements .................................................................................................................................................................. 1 Risk Assessment .............................................................................................................................................................................................................................. 2 Strategic Risks .................................................................................................................................................................................................................................. 4 Resourcing the Plan ......................................................................................................................................................................................................................... 4 Confirmation of Independence ....................................................................................................................................................................................................... 5 2025/26 Internal Audit Plan ............................................................................................................................................................................................................ 5 Monitoring the Plan ........................................................................................................................................................................................................................ 6 Quality Assurance and Improvement Programme ........................................................................................................................................................................ 6 Conclusions ...................................................................................................................................................................................................................................... 6 Appendix 1 – 2025/26 Internal Audit Plan ..................................................................................................................................................................................... 7 Appendix 2 – 2025/26 Internal Audit Plan by Council Directorate / Head of Service ..................................................................................................................... 10 Appendix 3 – Strategic Risk Register (Abridged) .......................................................................................................................................................................... 11 Contact Details Chief Internal Auditor: Paul Macaskill Telephone: 01546 604108 e-mail: paul.macaskill@argyll-bute.co.uk www.argyll-bute.gov.uk Page 178
Page 179
1 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Definition of Internal Audit 1. Internal auditing is an independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes. Source: Domain I - Glossary: Definition of Internal Auditing: Global Internal Audit Standards Purpose Statement of Internal Audit 2. The purpose of the internal audit function is to strengthen Argyll and Bute Council’s (the Council) ability to create, protect, and sustain value by providing the Council and management with independent, risk-based, and objective assurance, advice, insight, and foresight. In addition to this primary assurance role, internal audit will also: • support the S95 Officer and the Audit & Scrutiny Committee (the Committee) in the discharge of their duties • support the Council’s Monitoring Officer • support the Council’s anti-fraud and corruption arrangements • provide guidance on control implications for new or changed systems where appropriate • support the Council and the Strategic Management Team in the successful achievement of its objectives. Global Internal Audit Standards (GIAS) Requirements 3. GIAS, Code of Practice and Local Government Application note make provision for the following requirements : • Chief Internal Auditor (CIA) to prepare a risk-based audit plan which takes into account the Council’s strategic objectives, associated risks and the views of senior management and the Committee • CIA to review and adjust the plan as necessary in response to changes in the Council’s business, risks, operations and priorities • audit plan to incorporate or be linked to a strategic or high-level statement of how internal audit will be delivered and developed in accordance with the Internal Audit Charter and how it links to the organisational objectives and priorities. Page 179
Page 180
2 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Risk Assessment 4. Internal audit’s approach to annual audit planning is risk-based with all areas which may be subject to audit review contained within an audit universe which is subject to formal review, at least annually. This provides a layered approach to obtaining a sufficient profile of the organisation covering Core Assurance, Audit Needs Assessment and Audit Universe. The audit universe includes all significant activities and systems that contribute to the achievement of the Council’s priorities and objectives. This is displayed in the diagrams on page 3 of this report. 5. The audit universe is risk assessed each year to help determine the annual audit plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Note however, that that the audit universe, whilst a key factor, is not the only consideration when determining the audit plan. Senior management have been consulted on priority areas for review, and cognisance is taken of the plans of external audit and other statutory agencies, in order to avoid duplication, and increase potential for cross reliance. 6. The audit universe risk assessment is based upon a matrix taking account of scores for each potential audit area in respect of: • materiality (based on expenditure) • sensitivity (Control Environment, Management Concerns, Political Sensitivity, Regulatory Compliance, System Complexity and Extent of Changes – these help to provide a wide understanding of the risks and implications to the organisation in all of its functions) • time elapsed since it was last subject to review • overall audit assessment when it was last subject to review. 7. We employ a risk-based priority audit planning tool to identify those areas where audit resources can be most usefully targeted. This involves scoring a range of systems, services and functions across the whole Authority, known as the “Audit Universe” using a number of factors/criteria. The final score, or risk factor for each area, together with a priority ranking, then determines an initial schedule of priorities for audit attention. Furthermore, our reliance and successful operation is founded upon the need for strong Information Technology arrangements which support key systems across the Council, therefore, it is appropriate that sufficient audit coverage is scheduled in this area based on risk and discussions with management. There has been increased risk across business of cyber-attacks and the substantial implications this could have for those who have been affected by such attacks. Page 180
Page 181
3 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan 8. The matrix gives an overall “score” for each area that is used to prioritise audit reviews. The audit plan for the year has been created by: Risks •Consideration of risks identified in the Authority's strategic and operation risk registers Audit Universe •Review and update of the audit universe Senior Management •Discussions and liaison with Directors and Senior Officers regarding the risks which threaten the achievement of corporate or service objectives, including changes and/or the introduction of new systems, operations, programmes, and corporate initiatives Previous Reviews •Taking into account results of previous internal audit reviews Internal Audit Insights •Taking into account Internal Audit's knowledge and experience of the risks facing the Authority, including factors and systems that are key to successful achievement of the Council's delivery plans Collaboration •Requirements to provide a "collaborative audit" approach with external auditors Page 181
Page 182
4 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Strategic Risks 9. The Strategic Risk Register records the Council’s own assessment of the most potentially damaging risks including their likelihood and impact of occurrence. This document is used to inform the annual audit plan with identified reviews cross referenced to the strategic risk register. An abridged version of the strategic risk register is included in appendix 3 for reference. In addition, Operational Risk Registers are reviewed to identify high risk areas and which we take cognisance of in assessing and scoring the Audit Universe in terms of wider corporate risk which helps to provide a more comprehensive overview of the organisation. Resourcing the Plan 10. Internal audit has a core establishment of five members of staff, we are currently operating with four full time equivalent officers, one contracted and one casual member of staff, three of which are professionally qualified. Available audit days have been calculated as 758 days (including management and administration time), following the deduction of annual leave, training, a small provision for sickness, 50 days to deliver scrutiny work and 50 days to deliver the HSCP internal audit function. This 758 days total includes the CIA’s input to audit reviews, management of the internal audit team and a contingency in the event of unplanned work. We have taken on the internal audit work associated with the ‘Rural Growth Deal’ - this is new work and will require a reasonable level of input throughout the lifecycle of the fund which we understand to be ten years. We will closely monitor our input associated with our involvement in the provision of service and will escalate any concerns about resources should such an issue arise, together with advising the Committee in accordance with the GIAS. 11. Given the range and complexity of areas to be reviewed it is important that suitably qualified, experienced and trained individuals are appointed to internal audit positions. The CIA, in compliance with GIAS holds two appropriate professional qualifications (CIPFA and Institute of Internal Audit). Also within the internal audit section we have one contracted CIPFA qualified team member, one casual member of staff who is CIMA qualified, one AAT and Certified Internal Auditor who is studying for the Chartered Internal Auditor qualification, and one training for CIPFA. One member of the Counter Fraud Team is also undertaking professional training – It is anticipated that such training programs will result in formal qualifications which will address the interim staffing position. 12. Internal audit officers identify training needs as part of their annual appraisal process and are encouraged to undertake appropriate training, including in-house courses and external seminars as relevant to support their development. 13. Through an assessment of the mix of knowledge, skills and experience of the audit team, it is considered that the available resources are the minimum to achieve the work outlined in the plan and should this change, this will be escalated to management and the Committee in accordance with the GIAS. Page 182
Page 183
5 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Confirmation of Independence 14. GIAS requires internal audit to communicate, on a timely basis, all facts and matters that may have a bearing on our independence. We can confirm that the staff members identified to complete the reviews in the 2025/26 annual audit plan are independent and objectivity is not compromised. 2025/26 Internal Audit Plan 15. The engagements proposed for inclusion within the internal audit plan for 2025/26 and the associated risks are attached in the following appendices: • Appendix 1 presents the internal audit plan for 2025/26. • Appendix 2 presents the 2025/26 internal audit plan in a different format to provide assurance to the Committee that it provides appropriate coverage across all the Council’s directorates and head of service’s areas of service delivery. • Appendix 3 demonstrates the strategic risks that were subject to audit focus in 2024/25 and those we are projecting to cover in the periods 2025/26 and 2026/27. As our internal audit approach is informed by risks, where appropriate, the plan is cross-referenced to the strategic risk register contained at appendix 3. This provides assurance to the Committee that key strategic risks are subject to audit coverage over a three year cycle. Note that the projected timescales in appendix 3 are provisional as these may change to reflect changes in the Council’s risk environment. Paul Macaskill Chief Internal Auditor Moira Weatherstone Auditor Mhairi Weldon Trainee Auditor Annemarie McLean Trainee Auditor Leanne Rennie Audit Assistant Page 183
Page 184
6 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Monitoring the Plan 16. Internal audit reports on performance to the Committee on a quarterly basis including full copies of audit reports issued, progress implementing audit recommendations, performance against agreed performance indicators and a summary of all internal audit activity in the previous quarter. Quality Assurance and Improvement Programme 17. The GIAS require each internal audit service to maintain an ongoing quality assurance and improvement programme (QAIP) based on an annual self- assessment against the Standards, supplemented at least every five years by a full independent external assessment. 18. The Scottish Local Government Chief Internal Auditors’ Group (SLACIAG) has developed a framework for external assessments to be undertaken by member authorities of SLACIAG on a broadly reciprocal arrangement utilising a peer review option. The Council’s internal audit team has participated in this framework and an external validation of its own self-assessment took place during 2022/23 which concluded that we demonstrated full compliance with PSIAS in all 14 areas of the assessment. These requirements have been carried forward into the GIAS and as such, continuous compliance with the QAIP and any supplementary requirements will need to be met. The next scheduled external assessment is due to be undertaken in 2028. The internal audit service continues to identify ways of improvement in order that it contributes effectively to the governance of the Council and provides appropriate levels of assurance to those charged with governance, specifically, the Audit and Scrutiny Committee. 19. The internal audit team review their QAIP on a quarterly basis and report it to the Committee as part of the standard agenda item ‘Internal Audit Summary of Activities.’ The programme details all improvement activity being progressed by the team. Conclusions 20. The pressures, demands and expectations on Local Authorities in Scotland have increased year on year in the backdrop of challenging financial settlements in which to deliver key services to those across Scotland including Argyll and Bute. This Internal Audit Plan seeks to assist the Council’s Executive Leadership Team (ELT) and senior managers, together with those charged with governance, specifically, the Council’s Audit and Scrutiny Committee that assurance in our systems, approach and outcomes meet the needs of the communities we serve whilst achieving ‘Best Value’ in the use of our finite resources. 21. The resourcing of this plan is based on the existing staff levels and contractual input in order that a balance of qualified and experienced staff can be allocated to audit work which matches their skills base and experience. In addition, such resourcing is considered as the minimum essential in which to deliver this plan across the Council during 2025/26. We would also like to express our gratitude to the Council’s senior managers who have assisted us in the production of this plan. Page 184
Page 185
7 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Appendix 1 – 2025/26 Internal Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Cross Cutting Continuous Monitoring Programme Budgeting 15 Cyclical review of key controls over an 18 month programme of audit testing. Council Tax and NDR 20 Creditors 20 Debtors 15 General Ledger 15 Payroll 25 Treasury management 15 VAT 15 Follow–up 45 Compliance Douglas Hendry Education Process for School Residential Trips 20 The determine if the current processes are embedded prior to the expansion of residential trips which will be available to all children. Education Music Service 15 To assess the arrangements for the efficient delivery of music services and that funding requirements have been met in relation to this provision. Legal and Regulatory Support Reporting Concerns at Work - Whistleblowing Policy 15 To assess the arrangements in place within the Council in relation to the Public Interest Disclosure Act and 'Whistleblowing' arrangements comply with best practice and are operating as expected. Legal and Regulatory Support Strategic Procurement 20 The compliance of established procurement practices are followed by service areas and these are monitored by service management to ensure Best Value. Commercial Services Building Cleaning 20 Review and assess the arrangements for cleaning across the Council establishments. Commercial Services Project Management of key and major developments 15 Determine the arrangements in place for project management of key high risk developments and assess the measures in place for escalation of concerns, contract variations and staged reviews at specific milestones. Page 185
Page 186
8 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Kirsty Flanagan Roads and Infrastructure Services Street lighting (Public lighting) 15 To determine the charging mechanism for un-metered electricity supply to ensure charges are correctly and accurately applied to the Council. Roads and Infrastructure Services Roads Reconstruction Programme 25 The scope of the audit is to assess whether roles, responsibilities and procedures have been established for the Roads Reconstruction Programme (RRP) and are functioning effectively. SRR02 Development and Economic Growth Oban Airport 15 Annual review to provide assurance re compliance with the CAA operational manual and the Council’s aerodrome operating manual. Development and Economic Growth Rural Growth Deal 30 To review, assess and determine if expenditure is in accordance with the funding agreement and that appropriate records are kept to support claims. SRR01& SRR03 Customer Support Services Performance Management Arrangements and Reporting 20 Assess Performance Management Arrangements being progressed as part of the Performance Excellence Project. SRR06 Customer Support Services ICT Disaster Recovery 25 Assess the adequacy and effectiveness of the Council’s ICT disaster recovery arrangements. SRR08 Financial Services Payroll - iTrent 30 New System - Post Implementation Review - to determine if the system has been implemented in accordance with the agreed scope and is operating as expected post implementation. Financial Services Capital Programme - management and monitoring 20 To assess the governance and monitoring arrangements in relation to capital projects, determine the effectiveness of the Capital Investment Boards overview and challenge in relation to planned work and processes of escalation where required. Evan Beswick H&SCP Systems Eclipse System – Post Implementation Review 25 To assess the post implementation of the Eclipse system and determine whether the system is performing as expected, access controls are operating and that appropriate training has been provided to staff. Page 186
Page 187
9 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk H&SCP External Placements Directed Self Support (Direct Payments) 25 Assessment of processes in place for the checking of evidence, receipts and accounts for payment. SRR07 Kevin Anderson LiveArgyll Property and Building Maintenance Compliance 35 Assess the systems and processes in place for regular property and building maintenance and determine what arrangements are in place to monitor compliance. Verification Activity LGBF Accuracy 10 Accuracy of submission. SPT Annual Claim Accuracy 2 Accuracy of submission. Education Maintenance Allowance Accuracy 5 Accuracy of submission. Stores Stock count 5 Assess stock count procedures. Summary & Reconciliation of Days Directorate Contact Number of Days 2025/2026 Cross Cutting – Continuous Monitoring 185 Douglas Hendry 105 Kirsty Flanagan 180 Evan Beswick 50 LiveArgyll 35 Verification Activity 22 Contingency 81 Total Core Audit - Argyll and Bute Council 658 Scrutiny Work and HSCP Audits 100 Total Audit Resource 758 Page 187
Page 188
10 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Appendix 2 – 2025/26 Internal Audit Plan by Council Directorate / Head of Service Douglas Hendry Kirsty Flanagan Evan Beswick Education Legal & Regulatory Support Commercial Services Financial Services Customer Support Roads & Infrastructure Development & Economic Growth Health & Social Care Partnership Process for School Residential Trips Music Service Delivery and Funding Education Maintenance Allowance Reporting Concerns at Work Strategic Procurement Building Cleaning Project Management of key Developments Payroll - iTrent Capital Programme – Management and Monitoring Disaster Recovery Performance Management and Reporting Roads Reconstruction Programme Street Lighting Rural Growth Deal Oban Airport Direct Payments Eclipse – Post Implementation Review Live Argyll Property and Building Maintenance Compliance Other Activity NFI – Counter Fraud Team Follow Up Local Government Benchmarking Framework Page 188
Page 189
11 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan Appendix 3 – Strategic Risk Register (Abridged) No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 1 Population, External Infrastructure and Economic Decline Failure to identify relevant factors contributing to the decline and failure to develop strategies and actions targeting these factors. 20 1. Local outcome improvement plan targets population, infrastructure and economic recovery. 2. Maximise external funding opportunities. 3. New Economic Strategy approved at the June EDI Committee. 4. Rural Growth Deal reaching full deal status in September 2024. 5. UK Shared Prosperity Funding Investment Plan agreed covering 2022/23 to 2024/25. 6. AB Place to B/Promote and Market Argyll and Bute. 7. Taking a place based approach to regeneration including maximising social- eco benefits/community wellbeing via effective procurement strategy, development of the circular economy and partnership working across sectors. 8. Invest in Argyll and Bute website established. 16 Treat 1. Lobbying activity in pursuit of regional immigration policies and related strategies. 2. Rural Growth Deal Outline Business Cases and Final Business Cases being worked on and signing of Full Deal Agreement is expected in September 2024. 3.Levelling Up Partnership status confirmed - projects up to the value of £20m to be developed for delivery in 2025. 4. UK Shared Prosperity Funding Investment Plan is being actioned as per plan. 5. Preparation of a pipeline of projects across Argyll and Bute in order to be able to react to any other bid funding as and when it is announced. 6. Multi-agency approach to refugee settlement underway linking with national processes and agendas. 7. The council will continue as a partner of the Highlands and Islands Regional Economic Partnership and lobby for 2019/20 (Scrutiny) 2023/24 2024/25 Page 189
Page 190
12 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage Government investment to realise economic opportunity and address barriers to future sustainable growth. 8. The council working with HIE will deliver a smart action plan for the new Economic Strategy. 2 Condition and suitability of Infrastructure & Asset Base Infrastructure and asset base does not meet current and future requirements and is not being used or managed efficiently and effectively. 25 1. Capital Investment Board oversight of implementation of Capital Investment Strategy. 2. Robust capital planning and monitoring. 3. Asset management work plan. 4. Business case modelling including sustainability, development and strategic change. 5. Intelligence and best practice sharing via Heads of Property Group. 6. Community Empowerment and Community Asset Transfer – Arrangements in place to evaluate and determine requests. 7. Roads Asset Management Plan and Status and Options Report. 8. RIS Review Project Board. 9. One Council Property Approach. 10. Continuing with successful bids for external funding. 12 Treat 1. Development of finalised capital strategy in 2023. 2. 'Modern Workspace Programme' will review, engage and rationalise property portfolio for future needs of the Council. Changes will take place on phased and town by town basis. Programme will be running for 3 years - April 2025 3. Project Manager from PPMS appointed to take forward development and implementation of programme. Lochgilphead, Islay and Dunoon identified as priorities. Interim solution for Lochgilphead will be in place in Q4 FY23/24 to provide maintenance facility for larger vehicles). 2020/21 2021/22 2022/23 2023/24 2024/25 Page 190
Page 191
13 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 3 Financial Sustainability Insufficient resource to meet current and future service requirement. Budget not aligned / does not support business outcomes. Budget not aligned / does not support business outcomes 16 1. Longer term financial planning and financial strategy. 2. Income generation activity. 3. Robust budget preparation and budget monitoring protocols. 4. Maintaining adequate contingency with reserves. 5. Digital transformation. 6. Effective workforce planning model. 7. Business Outcomes. 8. Financial Services resilience building project including knowledge sharing and development of guidance notes. 12 Treat 1. Rural Growth Deal Outline Business Cases and Final Business Cases being worked on and signing of Full Deal Agreement is expected September 2024. 2. Investment in professional training through Grow Our Own Activity. 3. External reviews of major budget areas e.g. RIS, education. 4. Consider the implications and opportunities from the Visitor Levy (Scotland) Bill which could generate additional income from 2026/27. 5. Completion of external review of Roads and Infrastructure Services stages 2 - 4 should realise savings for future years. 6. A review of Education to commence on a similar basis as the RIS review. 2019/20 (Scrutiny) 2020/21 2022/23 2023/24 Ongoing via Continuous Monitoring Page 191
Page 192
14 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 4 Governance and Leadership Governance and leadership arrangements are not conducive to effective working and lead to a lack of strategic direction. 16 1. New Council Administration in place with working majority. 2. Development sessions for new Administration to cover areas such as being effective leaders, strategic thinking and working with officers. 3. Working with Policy Leads to provide support and development opportunities. 4. Continued programme of Member Seminars. 5. Progressing with programme of Member Development including 1:1 conversations. 6. New Administration working on an updated set of priorities to be agreed by Council. 7. Corporate Plan sets out objectives. 8. Performance Improvement Framework and Service Planning. 9. Leadership development programme. 10. Council constitution regularly reviewed and updated. 11. Established partnership governance arrangements. 12. Scrutiny arrangements in respect of Police, Fire and Health. 13. Governance arrangements for scrutiny established. 8 Treat 1. BV Action plan complete and remaining actions mainstreamed. 2. Connect for Success priorities now form the basis of new corporate improvements and are being delivered. 3. Pilot self-assessments have been completed and guidance is being updated to reflect learning. 4. The Performance Excellence Project Phase 1 is complete and phase 2 is reviewing the Performance and Improvement Framework. 5. Leadership Development Programme Commenced in March 24 with 360 degree assessments and initial coaching sessions now underway. 6. Review of governance arrangements being undertaken with new administration to consider ongoing suitability of arrangements. 2020/21 (Scrutiny) Page 192
Page 193
15 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 5 Engagement and Understanding the needs of the Community The Council fails to understand service user needs and emerging demographic trends and does not align service delivery to meet these 12 1. Community Planning partnership has agreed new Argyll and Bute Outcome Improvement Plan based on demographically representative consultation exercise and governance arrangements are currently being refreshed to ensure a focus on action with suitable representation from partner organisations and Area Community Planning Groups. 2. Community Engagement Strategy to be supported by clear framework and guidance as developed by the Community Engagement Group. 3. Customer Service Board. 4. Operation and development of panels and forums. Young people’s plan, citizens panel. 5. Budget Consultation. 6. Comprehensive Complaints Protocols. 7. Demographic and end user analysis. 9 Treat 1. A working group has been established to review our approach to Community Engagement and to develop a Framework. The group has developed a terms of reference and is in the process of carrying out a self-assessment to identify strengths and areas for improvement. Early indications are that we have areas of excellent practice, but a lack of consistency across services. A series of draft outcomes have been identified and an action plan is under development. A collaborative space for sharing engagement activity is being developed. Updates will be reported via Highlight Reports to the Change Programme and to SMT. 2. Approach to area plans currently being reviewed to reflect the priorities of the new administration. 3. Analysis of latest census data being undertaken to inform future strategic activity. Report to Council anticipated in September. 2022/23 Page 193
Page 194
16 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 6 Service Delivery Insufficient resources to ensure effective service delivery 16 1. Performance Improvement Framework 2.Service Improvement plans 3.Argyll and Bute Manager programme 4. Customer needs analysis Protocols 5.Demographic and end user analysis 6.Workforce Planning 7.Internal and External Scrutiny Arrangements 8.Complaints process 12 Treat 1. Monitor progress of performance mgt project and implement recommendations - implementation in 2023/24. 2. Budget approach for 2023-24 looked at the longer term rather than 1 year focus. This has identified a number of areas for consideration which will be explored over the coming months for the budget setting process beyond 2023-24. 3. Carry out 3 service self- assessment pilots which should identify opportunities for service delivery in the future. 2021/22 2023/24 7 Health and Social Care Partnership Failure of the HSCP to deliver on its Strategic Priorities results in deteriorating health and wellbeing outcomes for the population and / or reduced access to appropriate health and social care 20 1. HSCP integration scheme approved by Scottish government. 2. Strategic Plan in place. 3. Performance and Financial reporting arrangements in place. 4. Independent audit arrangements in place. 5. Integrated Joint board with elected member representation including Council Leader. 6. Chief Officer member of ABC Senior Management Team with co-location of officers. 7. Tripartite leadership agreement. 8. Monitoring and improvement of HSCP financial position. 12 Treat 1. Develop options to deliver sustainability of future years budgets (ongoing). 2. Develop a longer term financial plan and implement the value for money strategy. 3. Assessment of the financial implications on the Council of services transferring to the NCS when plans are sufficiently developed to enable this. 4. Progression of Service Transformation work, Estates Strategy and long term strategic service development with Hub 2019/20 2020/21 2022/23 2023/24 Assurance also taken from IJB internal audit function 2024/25 Page 194
Page 195
17 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage services. This could also result in financial and reputational risk to the Council. 9. Medium term Financial Plan in place. 10. Establishment of Strategic and Tactical Groups with links to HSCP, NHS and national/regional resilience groups. North. 5. Implementation of the workforce strategy. 6. Remobilisation of services post Covid and improved performance management and reporting processes. 8 Civil Contingency & Business continuity Arrangements are not effective. 8 1. Emergency Planning Test events. 2. Critical Activity Recovery Plans. 3. Roll out of Community resilience partnership programme. 4. Peer review of major exercises undertaken to provide external validation of planning process. 5. West of Scotland local resilience partnership. 6. Cross sector expertise and partnership working. 7. Emergency Management Support Team (EMST) meetings. 8. Training. 9. EU Withdrawal Tactical Working Group with arrangements for reporting to the West of Scotland Resilience Partnership. 6 Treat 1. The Council’s critical activity recovery plans (Carps) are reviewed annually. The project for the review of Business Continuity processes within the Council is underway and will include a review of the Council’s critical activities and the potential for a software solution which would automate processes and provide a more efficient an effective service and ensure greater resilience for the Council. When the project is completed in 23/24 it will include a programme of testing of the updated Carps. Date 31 March 2024. 2. Review of BC processes has resulted in introduction of new BCM system which will allow more automation and oversight of plans and review of critical 2021/22 Page 195
Page 196
18 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage activities with an enhanced ability to test these. The new system is expected to be procured by 31 March 2024. The new BCM system has been procured and configured and a pilot project to test the system and the process is underway with 3 service areas, Procurement, Customer Engagement and Transformation Management and Residential (Care Home Services). Once the outputs form the pilot have been reviewed and the system goes live, all services will be required to complete a Business Impact Analysis, which will inform the basis for having a business continuity plan in place. This is expected to be completed by 31 March 2025. 9 Waste Management Unable to dispose of waste in landfill sites due to the implications of the biodegradable 20 1. Helensburgh and Lomond waste solution available via third party off-takers, higher rates have been accepted by the council and the contract is in place until the end of 2023 with the opportunity to extend 1+1 years. It is likely over the course of 2023 an alternative procurement process will be explored with a view to putting in place a 16 Treat 1. Confirmation received from the Scottish Government that £1.5m has been made available to support the compliance with the BMW Ban. 2. Transition process underway with Renewi to facilitate the end 2021/22 (Scrutiny) 2023/24 Page 196
Page 197
19 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage municipal waste (BMW) landfill ban in 2025 BMW compliant solution at the earliest opportunity. 2. At the EDI committee in December agreement was reached to seek a derogation to continue operating the PPP contract until September 2026. This will be alongside BMW compliant solutions for island settings and Helensburgh and Lomond (i.e all areas out with the PPP contract). Post Sept 2026 it is envisaged that BMW complaint solutions will be in place for all council areas. With there being uncertainty around the derogation request officers are also progressing in tandem a possible contract variation which would change the MBT plants within the PPP contract to become waste transfer stations to facilitate material to be shipped to a suitable off-taker. 3. SEPA have advised they are unable to provide reassurance on enforcement approach beyond their stated policy. Further approach now being made to FM to seek a solution or required funding. of contract arrangements for Sept 2026. 3. Ongoing workshop sessions to scope out and design future disposal models across all the council area. These models to be in place from 01/01/2026 in line with the BMW requirements. 10 Service Delivery - Cyber Security Unable to deliver services to customers because of failure of ICT 20 1. ICT Security & compliance officer in post, producing weekly threat analyses, member of CiSP. 2. PSN and Cyber Essentials Plus accreditations for corporate network. 3. Regular patching regimes in place. 15 Treat 1. Review will be ongoing on all contingency plans with updated knowledge from SEPA, Western Isles Council and UHI Cyber Attacks. 2019/20 2022/23 2023/24 Page 197
Page 198
20 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage systems following major cyber security breach 4. ICT Disaster recovery plans tested regularly. 5. All critical activities have recovery plans developed (CARP’s). 6. Mimecast monthly cyber security training videos for all staff. 7. Enforce password changes when found to be weak. 8. Technical cyber exercise completed and Business Continuity Planning exercise conducted with senior management and other staff. 9. Internal Audit on Cyber Security completed with the Audit Opinion as substantial. 2. Work with Scottish Government Cyber Resilience Team to test ICT response. 3. Continued close review of disaster recovery plan and associated tests, finalise and test incident response procedure, and review of mirroring between the 2 data centres (monthly at ITMT) and backup. 4. Review and progress requirements for Education Network to achieve CE+ accreditation (going to P&R in August). 5. Procure a Security Operations Centre service to improve our 24x7 security posture. 6. Mimecast has now been made mandatory across the Council and ELT will be monitoring the uptake from staff 11 Cost of Living Crisis The Council are unable to respond to the implications arising from the 'Cost of Living' crisis. 25 1. Financial stability and support to HSCP. 2. Social Welfare and Poverty Funding assistance. 3. Focused support and multi-agency approach where risk is highlighted. 4. Monitoring of trends in service use to highlight any significant change as a result of financial hardship. 12 Treat 1. Review and monitor changes in demand for key services which correlate to personal effects arising from financial distress. 2. Extend flexible food and fuel fund to March 2025. 3. Continue to support High and Medium priority spends in SWF which is continually monitored. 2019/20 2023/24 2024/25 Page 198
Page 199
21 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage Implementation of welfare reform is not managed well resulting in increased poverty and deprivation or short term crisis. 5. Targeted measures - for example to those receiving Council Tax reductions - via Gift Cards and Flexible Food and Fuel Fund. 6. Financial Inclusion and Advice Group established. 7. Joint working with DWP, CPP and other agencies. 8. Flexible Food Fund created. Supporting householders in our area with funds and advice to address food and fuel insecurities. 9. Child Poverty Planning Group set up and active. 4. Deliver sustainable school clothing bank across the Argyll and Bute area by March 2025, with support from the UK Shared Prosperity Fund. 5. Provision of welfare rights advice services in GP Surgeries in MAKI area via funding from SG until March 2025. 6. Supporting the Poverty Alliance in their Tackling Rural Poverty project, observing its progress and considering outcomes as they emerge.1. Review and monitor changes in demand for key services which correlate to personal effects arising from financial distress. 2. Extend flexible food and fuel fund to March 2025, apply to Scottish Government for funding to expand the service provision to include outreach, September 2023. 12 Impact of Climate Change The Council or communities are overwhelmed by 20 1. Continued delivery of Council De- Carbonisation Plan. 2. Civil Contingencies Manager liaising/ collaborating with Regional Resilience Partnerships and other resilience partners in 12 Treat 1. Review of De-Carbonisation Plan December 2024. 2. Consideration of all Council Papers with climate change as consideration / implications - ongoing. 2021/22 Page 199
Page 200
22 Argyll and Bute Council – Internal Audit 2025/26 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage severe or more frequent flooding, landslides, rainfall, storms, sea level changes or hot weather events due to changes in global temperature caused by climate change terms of storm event, hot weather events, cut off communities, landslides etc. 3. Development and delivery of an integrated approach to decarbonisation and adaptation of Argyll and Bute as a Region via Community Planning Partnership. 4. Roads & Amenity Services continue to develop asset management plan and address strategic risks in terms of rising sea levels, bridge repairs, critical infrastructure vulnerability. 5. A review of all critical transport routes in light of October 2023 severe weather event to identify any additional mitigations needed to maintain resilient routes. 3. Review scoring of business cases and pipeline of strategic projects with enhanced climate change considerations. 13 Lack of Housing availability The Council, partner agencies and communities are unable to attract and retain working age people due to lack of housing and pricing. 20 1. Council has declared a Housing Emergency. 2. Housing Strategy and Investment Plan funded and implemented/new housing delivery group established. 3. Islands Programme Award of Funding for infrastructure for worker accommodation on Mull - this is for phase 1 site infrastructure to enable delivery of accommodation for workers and will meet clearly evidenced community need. 20 1. Explore and develop a series of options in response to the housing emergency. 2. Address key barriers to housing. 3. Consider radical delivery models. 4. Updates to the Local Housing Strategy will reflect the Council's Housing Action Plan and will report reported to Council in November 2024. 5. Housing summit held in November and Action Plan being continually monitored/updated. Page 200
Page 201
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 INTERNAL AUDIT CHARTER AND INTERNAL AUDIT MANUAL 1. SUMMARY 1.1 This report outlines the proposed changes to the Internal Audit Charter and Internal Audit Manual. A comprehensive review and update has been required to meet the requirements of new Global Internal Audit Standards. 2. RECOMMENDATIONS 2.1 To agree and approve the amended Internal Audit Charter (Appendix 1). 2.2 To agree and approve the amended Internal Audit Manual (Appendix 2). 3.0 DETAIL. 3.1 Under the new Global Internal Audit Standards (GIAS) Internal Audit is required to prepare an Internal Audit Charter, consistent with the ‘Purpose Statement’ of Internal Audit that defines internal audit’s purpose, mandate, authority and responsibility. In addition, requires the commitment of the Council’s internal audit function to adhere to the requirements of the GIAS. 3.2 However, just having a Charter is not sufficient to comply with the requirements of GIAS. The requirement for a Charter is just one element of GIAS. Full compliance requires the adoption of a range of principles and working practices which are closely aligned to the requirements as set out in GIAS. 3.3 Whilst there is no written requirement, within GIAS, for an Internal Audit Manual to be created, in general, it is considered good practice to develop a manual to help guide the overall management and administration of the function and the audit approach adopted. Given the mandatory nature of GIAS it also makes sense for that manual to be consistent with the requirements of GIAS. 3.4 Whilst both the Charter and Audit Manual have been updated to reflect the requirements of the GIAS as far as possible, these documents will require annual review and updates to reflect further changes and fine tuning of our approach to the new GIAS. 4.0 CONCLUSION 4.1 The Internal Audit Team have comprehensively updated the Internal Audit Charter and Internal Audit Manual in line with the requirements of the GIAS. Page 201 Agenda Item 15
Page 202
This will both demonstrate compliance but also provide appropriate guidance to Internal Audit staff in the application of the Standards within their day to day duties. 5.0 IMPLICATIONS 5.1 Policy – Internal Audit continues to adopt a risk based approach to activity 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change - None 5.7 Risk – A consistent audit approach helps reduce the Council’s risk exposure 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 13 March 2025 For further information please contact: Internal Audit (01546 604108) Appendices: 1. Internal Audit Charter 2. Internal Audit Manual Page 202
Page 203
Bute • Helensburgh • Islay • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Sel … INTERNAL AUDIT CHARTER April 2025 Page 203
Page 204
2 Contents Introduction .................................................................................................................................................. 4 Purpose Statement of Internal Auditing– Domain I ............................................................................... 5 Definition of Internal Auditing (Glossary – Domain I) ........................................................................ 6 Commitment to Adhering to the Global Internal Audit Standards ................................................... 6 Mandate ................................................................................................................................................... 6 Authority, Reporting Relationships and Positioning ...................................................................... 6 Ethics & Professionalism– Domain II ...................................................................................................... 7 Demonstrate Integrity ............................................................................................................................ 7 Maintain Objectivity ................................................................................................................................ 8 Demonstrate Competency .................................................................................................................... 9 Exercise Due Professional Care .......................................................................................................... 9 Maintain Confidentiality ....................................................................................................................... 10 Governing the Internal Audit Function & Audit and Scrutiny Committee Oversight – Domain III (Included specifics from approved Uk public sector document approved ....................................... 10 Mandate ................................................................................................................................................. 11 Authority ............................................................................................................................................. 11 Changes to the Mandate and Charter ........................................................................................... 11 Positioned Independently – The Boad establishes and protects the internal audit function’s independence and qualifications........................................................................................................ 11 Overseen by the Board (Audit and Scrutiny Committee) – The Board oversees the internal audit function to ensure the functions effectiveness. ...................................................................... 12 Managing the Internal Audit Function – Domain IV ............................................................................ 13 Plan Strategically .................................................................................................................................. 13 Manage Resources .............................................................................................................................. 13 Communicate effectively ..................................................................................................................... 14 Communication with the Audit and Scrutiny Committee and Senior Management within the Council ............................................................................................................................................... 14 Enhance quality .................................................................................................................................... 15 Quality Assurance and Improvement Program with the Council for Internal Audit ................ 15 Performing Internal Audit Services - – Domain V ................................................................................ 16 Plan Engagement Effectively & Conduct Engagement Work ........................................................ 16 Communicate Engagement Conclusion & Monitoring Action Plans ............................................. 18 Fraud and Corruption ........................................................................................................................... 18 Page 204
Page 205
3 Glossary Board - refers to the Council’s Audit and Scrutiny Committee (the Committee) which has delegated responsibility for overseeing the work of Internal Audit Senior Management - is defined as the Chief Executive and members of the Council’s Strategic Management Team (SMT) Chief Audit Executive - refers to the Chief Internal Auditor (CIA) Links 1. GIAS - IIA 2. Code of Practice for the Governance of Internal Audit in Local Government - CiPFA 3. GlAS in the UK Public Sector - CiPFA Document Version Control 1. Comprehensive review and update to take reflect the new Global Internal Audit Standards – Effective from 1st April 2025 Page 205
Page 206
4 Internal Audit Charter for Argyll and Bute Council Introduction 1. The Local Authority Accounts (Scotland) Regulations 2014 introduced a statutory requirement for all Scottish Local Authorities to have in place and to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the UK for all public sector internal audit providers, in-house, shared or outsourced, are the Global Internal Audit Standards (GIAS). The GIAS, in the applicability to the public sector, must be considered along with the Application Note: Global Internal Audit Standards in the UK Public Sector which have been produced to assist with the interpretation of the GIAS. 2. The GIAS contain requirements to support 15 guiding principles associated with and expected to be operating within the Internal Audit function across 5 key domains, Purpose, Ethics and Professionalism, Governing, Managing and Performing, these domains and the 15 guiding principles are outlined in the images below. Page 206
Page 207
5 3. The GIAS require Argyll and Bute Council (Council) to have an Internal Audit Charter (the Charter), which must be consistent with the ‘purpose statement’ which is intended to assist internal auditors and internal audit stakeholders in understanding and articulating the value of internal auditing. Purpose Statement of Internal Auditing– Domain I 4. The purpose of the internal audit function is to strengthen Argyll and Bute Council’s ability to create, protect, and sustain value by providing the Council and management with independent, risk-based, and objective assurance, advice, insight, and foresight. 5. The internal audit function enhances the Council’s: • Successful achievement of its objectives. • Governance, risk management, and control processes. • Decision-making and oversight. • Reputation and credibility with its stakeholders. • Ability to serve the public interest. • Anti-fraud and corruption arrangements. • Section 95 Officer and Monitoring Officer roles. Page 207
Page 208
6 Definition of Internal Auditing (Glossary – Domain I) 6. An independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes. 7. Argyll and Bute Council’s internal audit function is most effective when: • Internal auditing is performed by competent professionals in conformance with the IIA’s Global Internal Audit Standards, which are set in the public interest. • The internal audit function is independently positioned with direct accountability to the Senior Management and the Audit and Scrutiny Committee. • Internal auditors are free from undue influence and committed to making objective assessments. Commitment to Adhering to the Global Internal Audit Standards 8. Argyll and Bute Council’s internal audit function will adhere to the GIAS and Topical Requirements. The Chief Audit Executive (Chief Internal Auditor within Argyll and Bute Council) will report annually to the Audit and Scrutiny Committee and senior management regarding the internal audit function’s conformance with the GIAS, which will be assessed through a quality assurance and improvement program. Mandate Authority, Reporting Relationships and Positioning 9. Argyll and Bute Council’s internal audit function mandate is found in the Council Constitution and in particular, Appendix 1 to the Financial and Security Regulations. 10. The internal audit function’s authority is created by its direct reporting relationship to senior management and the Audit and Scrutiny Committee. Such authority allows for unrestricted access to the Chair and Vice-Chair of the Audit and Scrutiny Committee. 11. Internal audit, with strict accountability for confidentiality and safeguarding records and information, has authorised full, free, and unrestricted access to any and all of the Council’s records, physical properties, and personnel pertinent to carrying out any engagement. All employees are requested to assist Internal Audit in fulfilling its roles and responsibilities. Internal Audit, through the CIA, will also have free and unrestricted access to the Committee. The Council authorises the internal audit function, without necessarily giving prior notice, to require and receive: Page 208
Page 209
7 • access to all records, documents and correspondence relating to any financial or other relevant transactions, including documents of a confidential nature. • access at all reasonable times to any land, premises, officers and members of the Council. • the production of any cash, stores or other property of the Council under an officer’s and member’s control. • explanations concerning any matter under investigation. Ethics & Professionalism– Domain II Demonstrate Integrity 12. The CIA will ensure that internal auditors: • Conform with the GIAS, including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, and confidentiality. • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the organisation and be able to recognise conduct that is contrary to those expectations. • Encourage and promote an ethics-based culture in the organisation. • Report organisational behaviour that is inconsistent with the organisation’s ethical expectations, as described in applicable policies and procedures. 13. The GIAS generally and GIAS 1.2 (Organisation’s Ethical Expectations) specifically describe the importance of internal auditors encouraging and promoting an ethics-based culture alongside personal adherence to the ethical expectations of their organisation. This need for ethical behaviour is especially relevant in the UK public sector where those delivering public services are both servants of the public and stewards of public resources. To this end all staff within the Council’s Internal audit function will adhere to the GIAS and have due regard to the need to make a balanced assessment of all the relevant circumstances and not be unduly influenced by their own interests or by others in forming judgments, as detailed in the 7 Principles of Public Life (the ‘Nolan principles’) 14. Internal Audit will adhere to the GIAS, which update and replace the former mandatory guidance including the Definition of Internal Auditing, the Code of Ethics, and the International Standards for the Professional Practice of Internal Auditing. The GIAS provides fundamental requirements for the professional practice of Internal Auditing and for evaluating the effectiveness of the Internal Audit’s performance 15. Each member of the Internal Audit team completes a register of interest and updates it, at a minimum, on an annual basis. 16. Internal auditors must exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined, as detailed in the GIAS. Page 209
Page 210
8 Maintain Objectivity 17. The CIA will ensure that the internal audit function remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication. If the CIA determines that objectivity may be impaired in fact or appearance, the details of the impairment will be disclosed to appropriate parties. 18. Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality, and do not subordinate their judgment on audit matters to others, either in fact or appearance. 19. Internal auditors will have no direct operational responsibility or authority over any of the activities they review. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including: • Assessing specific operations for which they had responsibility within the previous year. • Performing operational duties for Argyll and Bute Council or its affiliates. • Initiating or approving transactions external to the internal audit function. • Directing the activities of any Argyll and Bute Council employee that is not employed by the internal audit function, except to the extent that such employees have been appropriately assigned to internal audit teams or to assist internal auditors. Internal auditors will: • Disclose impairments of independence or objectivity, in fact or appearance, to appropriate parties and at least annually, such as the CIA, Audit and Scrutiny committee, management, or others. • Exhibit professional objectivity in gathering, evaluating, and communicating information. • Make balanced assessments of all available and relevant facts and circumstances. • Take necessary precautions to avoid conflicts of interest, bias, and undue influence. 20. The Chief Internal Auditor (CIA) will be positioned at a level in the organisation that enables internal audit services and responsibilities to be performed without interference from management, thereby establishing the independence of the internal audit function. (See “Mandate” section.) The CIA will report to the Audit and Scrutiny Committee and to the Executive Director with responsibility as the Section 95 Officer of the Council and, in their absence to the Chief Executive. The CIA will also report to the Head of Financial Services for administrative purposes. This positioning provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Audit and Scrutiny Committee, when necessary, without interference and supports the internal auditors’ ability to maintain objectivity. Page 210
Page 211
9 21. The CIA will confirm to the Audit and Scrutiny Committee, at least annually, the organisational independence of the internal audit function. If the governance structure does not support organisational independence, the CIA will document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. 22. The CIA will disclose to the Audit and Scrutiny Committee any interference internal auditors encounter related to the scope, performance, or communication of internal audit work and results. The disclosure will include communicating the implications of such interference on the internal audit function’s effectiveness and ability to fulfil its mandate Demonstrate Competency 23. The Chief Audit Executive will hold an appropriate professional qualification along side relevant experience. Therefore, in considering whether a Chief Audit Executive is suitably qualified, an organisation must be looking for: • CMIIA, or a CCAB qualification, or an equivalent professional qualification which includes training on the practice of internal audit, and • suitable internal audit experience 24. In addition, all staff who are on professional training programs must comply with their terms and conditions of practice and maintain the standards expected of the professional institute they belong to and other relevant requirements as outlined in this Charter. 25. All staff must maintain their continued professional development in accordance with their professional body on an annual basis and make the appropriate declaration where required. Exercise Due Professional Care 26. In completing planning activities and subsequent audit work internal auditors shall consider the: • extent of work needed to achieve the engagement’s objectives. • relative complexity, materiality or significance of matters to which assurance procedures are applied. • adequacy and effectiveness of governance, risk management and control processes • probability of significant errors, fraud, or non-compliance. • cost of assurance in relation to potential benefits. 27. In addition, internal auditors exercise due professional care during a consulting engagement by considering the: Page 211
Page 212
10 • needs and expectations of clients, including the nature, timing and communication of engagement results • relative complexity and extent of work needed to achieve the engagement’s objectives • cost of the consulting engagement in relation to potential benefits. 28. The CIA will ensure that regular conversations take place about performance, behaviours and career/development aspirations in line with the Council’s -approach to the annual appraisal process, this will be undertaken on a yearly basis. Maintain Confidentiality 29. The GIAS set out the duty on internal auditors to be faithful custodians of the information they gather, sharing only in limited, defined and controlled ways. GIAS 5.2 (Protection of Information) describes the need for awareness of responsibilities in protecting information and demonstrating respect for the confidentiality, privacy and ownership of information. 30. While the duties under GIAS mainly relate to restricting the sharing of information, auditors working in the UK public sector must also be aware of circumstances under which sharing or publication of information will be required. They must be aware of their organisation’s policies and procedures for routine publication of certain information and where there are statutory obligations to share or publish information. 31. In Argyll and Bute Council, internal audit staff will be required to adhere to the GIAS but also the GDPR and Data Protection legislation, together with the requirements for document retention and disposal in accordance with Council policy and guidance. Governing the Internal Audit Function & Audit and Scrutiny Committee Oversight – Domain III (Included specifics from approved Uk public sector document approved 32. Appropriate governance arrangements are essential to enable the internal audit function to be effective. This domain outlines the requirements for the CIA to work closely with the Board to establish the internal audit function, position it independently and oversee its performance. 33. In the United Kingdom, such arrangements are highly developed, particularly within local government and is further supplemented by the CiPFA in the ‘Practical Guidance for Audit Committees for Local Authorities and Police 2022 edition’ which is used as the Page 212
Page 213
11 basis for the induction process of all members on the Audit and Scrutiny Committee and review of performance of the Committee on a periodic basis, where required. 34. Authorised by the Board (Audit and Scrutiny Committee) – the Board establishes, approves and supports the mandate of the internal audit function. Mandate Authority 35. This is defined under Domain I and can be viewed at paragraphs 9 – 11 above. Changes to the Mandate and Charter 36. Circumstances may justify a follow-up discussion between the CIA, Audit and Scrutiny Committee, and senior management on the internal audit mandate or other aspects of the internal audit charter. Such circumstances may include but are not limited to: • A significant change in the GIAS • A significant reorganisation within the Council • Significant changes in the CIA, Council, and/or senior management. • Significant changes to the organisation’s strategies, objectives, risk profile, or the environment in which the organisation operates • New laws or regulations that may affect the nature and/or scope of internal audit services. Positioned Independently – The Boad establishes and protects the internal audit function’s independence and qualifications 37. The Board is responsible for enabling the independence of the internal audit function. Independence is defined as the freedom from conditions that impair the internal audit function’s ability to carry out its responsibilities in an unbiased manner. 38. In Argyll and Bute Council, the CIA reports in his/her name to the Council’s Audit and Scrutiny Committee directly, is appropriately qualified and experienced and reports directly to the Section 95 Officer and has access to the Chief Executive and Monitoring Officer. This both maintains independence and positions the CIA within the organisation to discharge the function of internal audit and its responsibilities without interference. 39. The Board provides input to senior management on the CIA’s performance as required. Page 213
Page 214
12 Overseen by the Board (Audit and Scrutiny Committee) – The Board oversees the internal audit function to ensure the functions effectiveness. 40. Board oversight is essential to enable the overall effectiveness of the internal audit function. Achieving this principle requires collaboration and interactive communication between the Board and the CIA as well as the Board’s support in ensuring the internal audit function obtain sufficient resources to fulfil the internal audit mandate. 41. To establish, maintain, and ensure that Argyll and Bute Council’s internal audit function has sufficient authority to fulfil its duties, the Audit and Scrutiny Committee will: • Discuss with the CIA and senior management the appropriate authority, role, responsibilities, scope, and services (assurance and/or advisory) of the internal audit function. • Ensure the CIA has unrestricted access to and communicates and interacts directly with the Audit and Scrutiny Committee, including in private meetings without senior management present, where that is required. • Discuss with the CIA and senior management other topics that should be included in the internal audit charter, where appropriate. • Participate in discussions with the CIA and senior management about the “essential conditions,” described in the GIAS, which establish the foundation that enables an effective internal audit function. • Approve the internal audit function’s charter, which includes the internal audit mandate and the scope and types of internal audit services. • Review the internal audit charter periodically with the CIA to consider changes affecting the organisation, such as the employment of a new CIA or changes in the type, severity, and interdependencies of risks to the organisation; and approve the internal audit charter on an annual basis. • Approve the risk-based internal audit plan and any strategy on which it is based and monitor completion of the plan, in accordance with any performance indicators set annually. • Through discussion with the CIA be satisfied that the internal audit function’s human resources, administration and budgets are sufficient to complete the Audit Plan and provide an annual opinion. • Through discussion with the CIA determine if he/she is satisfied that the service has appropriate levels of skills to fulfil its ability to complete the Audit Plan. • Ensure that the CIA has adequate competencies and qualifications in conformance with the GIAS. • Receive communications from the CIA about the internal audit function including its performance relative to its plan. These will be in accordance with the Committee’s scheduled timetabling of meetings as outlined in the Council’s meetings calendar. • Ensure a quality assurance and improvement program has been established and review the results annually and every five years for the external review to ensure that any deficiencies identified and opportunities for improvement contain an action plan and timeline for addressing these issues, together with monitoring progress. Page 214
Page 215
13 • Make appropriate inquiries of senior management and the CIA to determine whether scope or resource limitations are inappropriate. Managing the Internal Audit Function – Domain IV 42. The CIA is responsible for managing the internal audit function in compliance with the internal audit charter and GIAS. This responsibility includes strategic planning, obtaining and deploying resources, building relationships, communicating with stakeholders, and ensuring and enhancing the performance of the function. 43. The CIA is expected to conform with the GIAS, whilst the CIA may delegate appropriate responsibilities to other qualified professionals in the internal audit function, he/she retains ultimate accountability. Plan Strategically 44. Planning strategically requires the CIA to understand the internal audit mandate and organisational governance, risk management and control processes. A properly resourced and positioned internal audit function helps develop and implement a strategy to support the organisations success. 45. The CIA must develop and implement a strategy for the internal function that supports strategic objectives and success of the organisation and aligns with the expectations of the Board. An internal audit strategy must include a vision, strategic objectives and supporting initiatives for the internal audit function. 46. The CIA will develop and produce a three year Internal Audit Strategy to support the requirements of the GIAS and an annual operational plan will flow from the strategy in each of these three years. The strategy and resulting operational plan will be subject to ongoing monitoring, reviewed annually and updated where deemed appropriate. 47. The Council’s internal audit function will have appropriate supporting methodologies (processes and procedures) in place via the Internal Audit Manual to provide clear directions to staff on expected practices which must be followed to achieve the wider requirements within the GIAS and UK applications. Manage Resources 48. The CIA manages resources to implement the internal audit function’s strategy and achieve its plan and mandate. The CIA must develop a budget that enables the successful implementation of the plan, this will include training, technology and day-to- day activities. Page 215
Page 216
14 49. The Council has an established and documented process for the development of budgets and resources which will be needed to cover the work of the internal audit function. As part of the annual budget planning process the internal audit function will submit its needs which will include, but not limited to, staffing, technology, training, travel and other associated costs. 50. Appropriately qualified staff will be engaged to provide services within the internal audit function, together with appropriate training and continued professional development. Communicate effectively 51. The CIA guides the internal audit function to communicate effectively with its stakeholders, building relationships, establishing trust and enabling stakeholders to benefit from the results of the internal audit services. 52. The Council’s internal audit function has clear and documented processes for engagement with its stakeholders and are documented in its internal audit manual. This process includes but is not limited to, accurate, objective, clear, concise, constructive, complete and timely reporting of its fundings. 53. The Council’s internal audit function through the CIA, will inform the Board where there is inability to agree a recommendation with management, and where the function believes it is critical or high risk in relation to a control weakness which will put the Council at risk. In the event that other risks are identified which do not meet the threshold of being critical or high risk, acceptance of the risk will be noted in the action plan contained within the report. Communication with the Audit and Scrutiny Committee and Senior Management within the Council 54. The CIA will report periodically to the Audit and Scrutiny Committee and senior management regarding: • The internal audit function’s mandate. • The internal audit plan and performance relative to its plan. • Internal audit budget. • Significant revisions to the internal audit plan and budget. • Potential impairments to independence, including relevant disclosures as applicable. • Results from the quality assurance and improvement program, which include the internal audit function’s conformance with The IIA’s GIAS and action plans to address the internal audit function’s deficiencies, where identified and opportunities for improvement. • Significant risk exposures and control issues, including fraud risks, governance issues, and other areas of focus for the Audit and Scrutiny Committee, that could interfere with the achievement of Argyll and Bute Council’s strategic objectives. • Results of assurance services. • Resource requirements. Page 216
Page 217
15 • Management’s responses to risk that the internal audit function determines may be unacceptable or acceptance of a risk that is beyond Argyll and Bute Council’s risk appetite. Enhance quality 55. The CIA is responsible for the internal audit function’s conformance with the GIAS and continuous performance improvement where that is required. Appropriate and independent internal quality assessments will be required by self-assessment annually and externally every five years. Quality Assurance and Improvement Program with the Council for Internal Audit 56. The CIA will develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function. The program will include external and internal assessments of the internal audit function’s conformance with the GIAS, as well as performance measurement to assess the internal audit function’s progress toward the achievement of its objectives and promotion of continuous improvement. The program also will assess, if applicable, compliance with laws and/or regulations relevant to internal auditing. Also, if applicable, the assessment will include plans to address the internal audit function’s deficiencies, where identified and opportunities for improvement. 57. Annually, the CIA will communicate with the Audit and Scrutiny Committee and senior management about the internal audit function’s quality assurance and improvement program, including the results of internal assessments (ongoing monitoring and periodic self-assessments) and external assessments. External assessments will be conducted at least once every five years by a qualified, independent assessor or assessment team from outside Argyll and Bute Council. 58. The Council participates as part of the Scottish Local Authority Chief Auditors Group who have a team of independent assessors who undertake the five year external assessments. All those involved in the independent external assessment must be both appropriately qualified and have suitable audit experience at a senior level. 59. In general and applicability to this Domain of the GIAS, the CIA has the responsibility to: • Develop a strategy and risk-based internal audit plan that considers the input of the Audit and Scrutiny Committee and senior management. Discuss the plan with the senior management and submit the plan to the Audit and Scrutiny Committee for review and approval. • Communicate the impact of resource limitations on the internal audit plan to the Audit and Scrutiny Committee and senior management. • Review and adjust the internal audit plan, as necessary, in response to changes in Argyll and Bute Council’s business, risks, operations, programs, systems, and controls. Page 217
Page 218
16 • Communicate with the Audit and Scrutiny Committee and senior management if there are significant interim changes to the internal audit plan. • Ensure internal audit engagements are performed, documented, and communicated in accordance with the GIAS and laws and/or regulations. • Follow up on engagement findings and confirm the implementation of recommendations or action plans and communicate the results of internal audit services to Argyll and Bute Council and senior management periodically and for each engagement as appropriate. • Ensure the internal audit function collectively possesses or obtains the knowledge, skills, and other competencies and qualifications needed to meet the requirements of the GIAS and fulfil the internal audit mandate. • Identify and consider trends and emerging issues that could impact Argyll and Bute Council and communicate to the Audit and Scrutiny Committee and senior management as appropriate. • Consider emerging trends and successful practices in internal auditing. • Establish and ensure adherence to methodologies designed to guide the internal audit function. • Ensure adherence to Argyll and Bute Council’s relevant policies and procedures unless such policies and procedures conflict with the internal audit charter or the GIAS and any supplementary UK application note. Any such conflicts will be resolved or documented and communicated to the Audit and Scrutiny Committee and senior management. • Coordinate activities and consider relying upon the work of other internal and external providers of assurance and advisory services. If the CIA cannot achieve an appropriate level of coordination, the issue must be communicated to senior management and if necessary escalated to the Audit and Scrutiny Committee. Performing Internal Audit Services - – Domain V Plan Engagement Effectively & Conduct Engagement Work 60. The scope of internal audit services covers the entire breadth of the organisation, including all of Argyll and Bute Council’s activities, assets, and personnel. The internal audit function has an ‘Audit Universe’ which documents the breadth of services across the Council for this purpose. 61. The scope of internal audit activities also encompasses but is not limited to objective examinations of evidence to provide independent assurance and advisory services to the Audit and Scrutiny Committee and management on the adequacy and effectiveness of governance, risk management, and control processes for Argyll and Bute Council. 62. The CIA must consider the effect on the opinion work before accepting consultancy work or management requests over and above the contingency allowed for in the internal audit plan. Such consultancy work will only be undertaken where resources permit without impacting on the annual assurance process and where there is no direct or Page 218
Page 219
17 perceived conflict of interest or eroding of our independence and objectivity. Approval will be sought from the Audit and Scrutiny Committee before any significant unplanned consultancy work is accepted. 63. The nature, objectives and scope of advisory services may be agreed with the party requesting the service, provided the internal audit function does not assume management responsibility. Opportunities for improving the efficiency of governance, risk management, and control processes may be identified during advisory engagements. These opportunities will be communicated to the appropriate level of management. 64. Internal audit engagements may include but are not limited to evaluating whether: • Risks relating to the achievement of Argyll and Bute Council’s strategic objectives are appropriately identified and managed. • The actions of Argyll and Bute Council’s officers, directors, management, employees, and contractors or other relevant parties comply with Argyll and Bute Council’s policies, procedures, and applicable laws, regulations, and governance standards. • The results of operations and work programs are consistent with established goals and objectives. • Operations and work programs are being carried out effectively, efficiently, ethically, and equitably. • Established processes and systems enable compliance with the policies, procedures, laws, and regulations that could significantly impact Argyll and Bute Council. • The integrity of information and the means used to identify, measure, analyse, classify, and report such information is reliable. • Resources and assets are acquired economically, used efficiently and sustainably, and protected adequately. 65. Where the Council works in partnership with other organisations, the role of internal audit will be defined on an individual basis. Where Internal Audit undertakes work on behalf of any other organisation, this will be determined in conjunction with the Committee and in consultation with the SMT to ensure that appropriate audit resources are available to provide assurance over the Council’s activities. Internal Audit currently provide audit services to LiveArgyll, the arrangements for internal audit have been agreed with LiveArgyll’s General Manager who reports to LiveArgyll’s Finance and Audit Sub-Committee. Since 1 April 2021 Internal Audit have been providing audit services to the Argyll and Bute Health and Social Care Partnership (HSCP). Arrangements for that service have been agreed with the HSCP’s Head of Finance and Transformation and report directly to the Audit and Risk Committee 66. The CIA co-ordinates and manages the Strategic Risk Register updates, however, there are certain safeguards whereby any audit review of this area requires to be undertaken, a senior qualified member of internal audit staff would complete the work and would report any serious direct findings to senior management. Page 219
Page 220
18 Communicate Engagement Conclusion & Monitoring Action Plans 67. Findings are communicated effectively, along with the significance and prioritisation, including limitations of scope, where appliable and conclusions in relation to governance, risk management and internal controls. The Council’s internal audit function will make all such communications in line with the GIAS and will be reflected in the Internal Audit Manual. 68. Appropriate follow up and monitoring of recommendations will be undertaken by the internal audit function and in the Council this will be reported to the Strategic Management Team (SMT) and the Audit and Scrutiny Committee. Fraud and Corruption 69. Managing the risk of fraud and corruption is the responsibility of the SMT. Management is also responsible for developing, implementing and maintaining systems of internal control to guard against fraud or irregularity and ensure probity in systems and operations. Internal Audit will assist management by reviewing the controls and procedures in place. 70. Audit procedures alone cannot guarantee that fraud and corruption will be detected, nor does Internal Audit have the responsibility for prevention and detection of fraud. However, individual auditors will be alert in their work to risks and exposures that could allow a fraud, irregularity or corrupt practice to take place. 71. Where any matter arises which involves, or is thought to involve, a fraud, corruption or irregularity, the relevant Head of Service / Executive Director will notify the Council’s Monitoring Officer, Head of Financial Services and the CIA for consideration of appropriate action. Further guidance can be found in the Council’s Anti-Fraud strategy and Public Interest Disclosure Policy. The Council’s Counter Fraud Team reports directly to the CIA so the CIA will be involved in overseeing any investigation and will liaise with the Council’s Monitoring Officer during the investigation of the alleged fraud and in particular: • examine current Council policies, procedures and financial controls, their current working and effectiveness in relation to the alleged fraud. • report to the SMT in relation to the adequacy of current Council policies, procedures and financial controls in relation to the alleged fraud and make recommendations for their revision. • provide advice and assistance to the Monitoring Officer in relation to Council policies, procedures and financial controls and other control issues relevant to the investigation of the alleged fraud. Page 220
Page 221
Bute • Helensburgh • Islay • Oban • Mull • Campbeltown • Iona • Dunoon • Tiree • Lochgilphead • Sel … INTERNAL AUDIT MANUAL April 2025 Page 221
Page 222
Contents Introduction .................................................................................................................................................. 5 Purpose of Internal Audit – Domain I .......................................................................................................... 6 Definition of Internal Auditing (Glossary) ................................................................................................. 6 Purpose Statement .................................................................................................................................... 6 Internal Audit Mandate and Authority ...................................................................................................... 6 Ethics and Professionalism – Domain II ....................................................................................................... 7 Principle 1 – Demonstrate Integrity .......................................................................................................... 7 Honesty and Professional Courage – Standard 1.1 ............................................................................... 8 Organisational Ethical Expectations – Standard 1.2 .............................................................................. 8 Legal and Ethical Behaviour – Standard 1.3 .......................................................................................... 8 Principle 2 – Maintain Objectivity ............................................................................................................. 9 Individual Objectivity – Standard 2.1 .................................................................................................... 9 Safeguarding Objectivity – Standard 2.2 ............................................................................................... 9 Disclosing Impairments to Objectivity – Standard 2.3 ........................................................................ 10 Principle 3 – Demonstrate Competency.................................................................................................. 11 Competency – Standard 3.1 ................................................................................................................ 11 Continuing Professional Development – Standard 3.2 ....................................................................... 11 Principle 4 – Exercise Due Professional Care........................................................................................... 12 Conformance with the Global Internal Audit Standards – Standard 4.1............................................. 13 Due Professional Care – Standard 4.2 ................................................................................................. 13 Professional Scepticism – Standard 4.3 ............................................................................................... 13 Principle 5 – Maintain Confidentiality ..................................................................................................... 14 Use of Information – Standard 5.1 ...................................................................................................... 15 Protection of Information – Standard 5.2 ........................................................................................... 15 Governing the Internal Audit Function – Domain III ................................................................................. 16 Principle 6 – Authorised by the Board ..................................................................................................... 16 Internal Audit Mandate – Standard 6.1 ............................................................................................... 16 Internal Audit Charter – Standard 6.2 ................................................................................................. 16 Board and Senior Management Support – Standard 6.3 .................................................................... 17 Principle 7 – Positioned Independently................................................................................................... 17 Organisational Independence – Standard 7.1 ..................................................................................... 17 Chief Audit Executive (CIA) Qualifications – Standard 7.2 .................................................................. 18 Principle 8 – Overseen by the Board ....................................................................................................... 18 Page 222
Page 223
3 Board Interaction – Standard 8.1 ........................................................................................................ 19 Resources – Standard 8.2 .................................................................................................................... 20 Quality – Standard 8.3 ......................................................................................................................... 20 External Quality Assessment – Standard 8.4 ....................................................................................... 20 Managing the Internal Audit Function – Domain IV .................................................................................. 21 Principle 9 – Plan Strategically ................................................................................................................ 21 Understanding Governance, Risk Management and Control Processes – Standard 9.1 .................... 21 Internal Audit Strategy - Standard 9.2 ................................................................................................. 22 Methodologies - Standard 9.3 ............................................................................................................. 23 Internal Audit Plan - Standard 9.4 ....................................................................................................... 23 Coordination and Reliance - Standard 9.5 ........................................................................................... 24 Principle 10 – Managing Resources ......................................................................................................... 24 Financial Resource Management - Standard 10.1 .............................................................................. 24 Human Resource Management - Standard 10.2 ................................................................................. 25 Technological Resources - Standard 10.3 ............................................................................................ 26 Principle 11 – Communicate Effectively .................................................................................................. 27 Building Relationships and Communicating with stakeholders - Standard 11.1 ................................. 27 Effective Communication - Standard 11.2 ........................................................................................... 27 Communicating Results - Standard 11.3 ............................................................................................. 28 Errors and Omissions - Standard 11.4 ................................................................................................. 29 Communicating the Acceptance of Risk - Standard 11.5 .................................................................... 29 Principle 12 – Enhance Quality ................................................................................................................ 30 Internal Quality Assessment - Standard 12.1 ...................................................................................... 30 Performance Measurement - Standard 12.2 ...................................................................................... 31 Oversee and Improve engagement Performance - Standard 12.3 ..................................................... 31 Performing Internal Audit Services – Domain V ........................................................................................ 32 Principle 13 – Plan Engagements Effectively ........................................................................................... 32 Engagement Communication - Standard 13.1 .................................................................................... 33 Engagement Risk Assessment - Standard 13.2 .................................................................................... 34 Engagement Objectives and Scope - Standard 13.3 ............................................................................ 35 Evaluation Criteria - Standard 13.4 ..................................................................................................... 36 Engagement Resources - Standard 13.5 .............................................................................................. 36 Work Program - Standard 13.6 ............................................................................................................ 37 Principle 14 – Conduct Engagement Work .............................................................................................. 37 Gathering Information for Analyses and Evaluation - Standard 14.1 ................................................. 38 Page 223
Page 224
4 Analyses and Potential Engagement Findings - Standard 14.2 ........................................................... 38 Evaluation of Findings - Standard 14.3 ................................................................................................ 39 Recommendations and Action Plans - Standard 14.4 ......................................................................... 40 Engagement Conclusions - Standard 14.5 ........................................................................................... 41 Engagement Documentation - Standard 14.6 ..................................................................................... 41 Principle 15 – Communicate Engagement Results and Monitor Action Plans ........................................ 42 Final Engagement Communication - Standard 15.1 ............................................................................ 42 Confirming the Implementation of Recommendations or Action Plans - Standard 15.2 ................... 44 Page 224
Page 225
5 Introduction 1. The Local Authority Accounts (Scotland) Regulations 2014 introduced a requirement for all Scottish Local Authorities to operate a professional and objective internal auditing service, which must be delivered in accordance with recognised standards. The standards and practices applied in the UK for all public sector internal audit providers, in-house, shared or outsourced, are the Global Internal Audit Standards (GIAS). The GIAS, in the applicability to the public sector, must be considered along with the Code of Practice for the Governance of Internal Audit in the United Kingdom (Code) and the Local Government Application Note (Application Note) which have been produced to assist with the interpretation of the GIAS. 2. This Internal Audit Manual (the Manual) has been created to provide guidance to the Internal Audit function of Argyll and Bute Council (the Council) on its administration and audit approach to be adopted. The contents are guided by the requirement of the GIAS, the Code and the Application Note which provide further guidance on interpretation within the context of local government. The key areas are cross referenced to the appropriate section(s) in the GIAS, Code and Application Note. 3. The GIAS contain requirements to support 15 guiding principles associated with and expected to be operating within the Internal Audit function across 5 key domains; Purpose, Ethics and Professionalism, Governing, Managing and Performing, these domains and the 15 guiding principles are outlined in the images below. Page 225
Page 226
6 Purpose of Internal Audit – Domain I Definition of Internal Auditing (Glossary) 4. An independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes. Purpose Statement 5. The purpose of the internal audit function is to strengthen Argyll and Bute Council’s ability to create, protect, and sustain value by providing the Council and management with independent, risk- based, and objective assurance, advice, insight, and foresight. The internal audit function enhances the Council’s: • Successful achievement of its objectives. • Governance, risk management, and control processes. • Decision-making and oversight. • Reputation and credibility with its stakeholders. • Ability to serve the public interest. • Anti-fraud and corruption arrangements. • Section 95 Officer and Monitoring Officer roles. Internal Audit Mandate and Authority 6. Argyll and Bute Council’s internal audit function’s mandate is found in the Council Constitution at Appendix 1 to the Financial and Security Regulations. Page 226
Page 227
7 7. The internal audit function’s authority is created by its direct reporting relationship to senior management and the Audit and Scrutiny Committee. Such authority allows for unrestricted access to the Chair and Vice-Chair of the Audit and Scrutiny Committee. 8. Internal audit, with strict accountability for confidentiality and safeguarding records and information, has authorised full, free, and unrestricted access to any, and all of the Council’s records, physical properties, and personnel pertinent to carrying out any engagement. All employees are requested to assist Internal Audit in fulfilling its roles and responsibilities. Internal Audit, through the CIA, will also have free and unrestricted access to the Committee. 9. The Council authorises the internal audit function and designated auditors to require and receive, without necessarily giving prior notice: • access to all records, documents and correspondence relating to any financial or other relevant transactions, including documents of a confidential nature • access at all reasonable times to any land, premises, officers and members of the Council • the production of any cash, stores or other property of the Council under an officer’s and member’s control • explanations concerning any matter under investigation. Ethics and Professionalism – Domain II Principle 1 – Demonstrate Integrity Overview 10. The purpose of a ‘Code of Ethics’ is to promote an ethical culture within the profession of internal auditing. A code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about risk management, governance and control. A ‘Code of Ethics’ extends beyond the definition of internal auditing to include two essential components: • principles that are relevant to the profession and practice of internal auditing • rules of conduct that describe behaviour norms expected of internal auditors. Applicability and Enforcement 11. A ‘Code of Ethics’ applies to all of those who are commissioned to provide internal audit services to the Council. Suspected or known breaches of the ‘Code of Ethics’ should be referred to at least one of the following, as considered appropriate: • Chief Internal Auditor (CIA) • Executive Director Kirsty Flanagan (Section 95 Officer) • Executive Director Douglas Hendry (Monitoring Officer) • Audit and Scrutiny Committee (the Committee). Conformance 12. The CIA will ensure that internal auditors: Page 227
Page 228
8 • Conform with the GIAS, including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, and confidentiality. • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the organisation and be able to recognise conduct that is contrary to those expectations. • Encourage and promote a supportive ethics-based culture in the organisation. • Report organisational behaviour that is inconsistent with the organisation’s ethical expectations, as described in applicable policies and procedures. Honesty and Professional Courage – Standard 1.1 13. All internal audit staff must act with honesty, integrity and professional courage due to the privileges and expectations of the role they carry out within the Council. Internal auditors must be truthful, accurate, clear, open and respectful in all professional relationships and communications, even when expressing scepticism or offering an opposing view point. Internal auditors must exhibit professional courage by communicating truthfully and taking appropriate action, even when confronted by dilemmas and difficult situations. 14. In the event that any internal audit staff feel pressurised or conflicted with any matter which they feel that they cannot deal with, they must escalate this to the CIA. The CIA will assess the situation and where appropriate intervene to address any concerns raised by internal audit staff. Organisational Ethical Expectations – Standard 1.2 15. All internal audit staff must understand, respect, meet and contribute to the legitimate and ethical expectations of the Council and must be able to recognise conduct that is contrary to those expectations. Furthermore, internal auditors must encourage and promote an ethics based culture in the organisation. If internal auditors identify behaviour within the organisation that is inconsistent with the organisations ethical expectations, they must report the concern according to the Council’s applicable policies and procedures. 16. The fact that a particular piece of ‘behaviour’ which has been identified as being possibly inappropriate is not specifically covered by, or mentioned within, the Council’s own ‘Code of Conduct’, does not necessarily prevent it from being unacceptable, discreditable or indeed unprofessional. 17. For members of the Chartered Institute of Internal Auditors, breaches of the ‘Code of Ethics’ will be evaluated and administered in line with the Institute’s disciplinary procedures. If individual internal auditors have membership of another professional body then he or she must also comply with the relevant requirements of that organisation. Such procedures are without prejudice to the Council’s own disciplinary procedures. 18. Qualified internal auditors could be members of one or more of the following institutions: Chartered Institute of Public Finance & Accountancy (CIPFA), the Chartered Institute of Management Accountants (CIMA), the Chartered Institute of Internal Auditors (CIIA) and the Association of Chartered Certified Accountants (ACCA). Each of these bodies have their own Code of Ethics which members are expected to comply with. Legal and Ethical Behaviour – Standard 1.3 19. Internal Auditors must not engage in or be party to any activity that is illegal or discreditable to the organisation or the profession of internal auditing or that may harm the Council or its employees. Page 228
Page 229
9 20. Internal auditors must understand and abide by the laws and/or regulations relevant to the Council, local government and the jurisdictions in which the Council operates, including making disclosures as required. Principle 2 – Maintain Objectivity 21. Internal auditors maintain an impartial and unbiased attitude when performing internal audit services and making decisions. 22. Objectivity is an unbiased mental attitude that allows internal auditors to make professional judgements, fulfil their responsibilities, and achieve the ‘Purpose of Internal auditing’ without compromise. An independently positioned internal audit function supports internal auditors’ ability to maintain objectivity. Individual Objectivity – Standard 2.1 23. Internal Auditors must maintain professional objectivity when performing all aspects of internal audit services. Professional objectivity requires internal auditors to apply an impartial and unbiased mindset and make judgements based on balanced assessment of all relevant circumstances. Safeguarding Objectivity – Standard 2.2 24. Internal Auditors must recognise and avoid or mitigate actual, potential and perceived impairments to objectivity. 25. Internal Auditors must not accept any tangible or intangible item, such as a gift, reward, favour, that may impair or be presumed to impair objectivity. 26. Internal Auditors must avoid conflicts of interest and must not be unduly influenced by their own interests or interests of others, including senior management or others in a position of authority, or by the political environment or other aspects of their surroundings. 27. When performing internal audit services: • Internal auditors must refrain from assessing specific activities for which they were previously responsible. Objectivity is presumed to be impaired if an auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous 12 months. • If the internal audit function is to provide assurance services where it previously performed advisory services, the CIA must confirm that the nature of the advisory services does not impair objectivity and must assign resources such as individual objectivity is managed. Assurance engagements for functions over which the CIA has responsibility must be overseen by an independent party outside the internal audit function. • If internal auditors are to provide advisory services relating to activities for which they had previous responsibilities, they must disclose potential impairments to the party requesting the services before accepting the engagement. Page 229
Page 230
10 Disclosing Impairments to Objectivity – Standard 2.3 28. If objectivity is impaired in fact or appearance, the details of the impairment must be disclosed promptly to the appropriate parties. 29. If internal auditors become aware of an impairment that may affect their objectivity, they must disclose the impairment to the CIA or a designated supervisor. If the CIA determines that an impairment is affecting an internal auditor’s ability to perform duties objectively, the CIA must discuss the impairment with the management of the activity under review, the board, and/or senior management and determine the appropriate action to resolve the situation. 30. If an impairment that affects the reliability or perceived reliability of the engagement findings, recommendations, and/or conclusions is discovered after an engagement has been completed, the CIA must discuss the concerns with the management of activity under review, the board, senior management, and/or other affected stakeholders and determine the appropriate actions to resolve the situations. (See also Standard 11.4 Errors and Omissions). Implementation of these requirements within Argyll and Bute Council will be as follows: 31. The CIA will ensure that the internal audit function remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication. If the CIA determines that objectivity may be impaired, in fact or appearance, the details of the impairment will be disclosed to appropriate parties. 32. Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality, and do not subordinate their judgment on audit matters to others, either in fact or appearance. 33. Internal auditors will have no direct operational responsibility or authority over any of the activities they review. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including: • Assessing specific operations for which they had responsibility within the previous year. • Performing operational duties for Argyll and Bute Council or its affiliates. • Initiating or approving transactions external to the internal audit function. • Directing the activities of any Argyll and Bute Council employee that is not employed by the internal audit function, except to the extent that such employees have been appropriately assigned to internal audit teams or to assist internal auditors. 34. Internal auditors will: • Disclose impairments of independence or objectivity, in fact or appearance, to appropriate parties and at least annually, such as the CIA, Audit and Scrutiny committee, management, or others. • Exhibit professional objectivity in gathering, evaluating, and communicating information. • Make balanced assessments of all available and relevant facts and circumstances. • Take necessary precautions to avoid conflicts of interest, bias, and undue influence. 35. The Chief Internal Auditor (CIA) will be positioned at a level in the organisation that enables internal audit services and responsibilities to be performed without interference from management, thereby establishing the independence of the internal audit function. (See “Mandate” section.) The Page 230
Page 231
11 CIA will report to the Audit and Scrutiny Committee and to the Executive Director with responsibility as the Section 95 Officer of the Council and, in their absence to the Chief Executive. The CIA will also report to the Head of Financial Services for administrative purposes. This positioning provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Audit and Scrutiny Committee, when necessary, without interference and supports the internal auditors’ ability to maintain objectivity. 36. The CIA will confirm to the Audit and Scrutiny Committee, at least annually, the organisational independence of the internal audit function. If the governance structure does not support organisational independence, the CIA will document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. 37. The CIA will disclose to the Audit and Scrutiny Committee any interference internal auditors encounter related to the scope, performance, or communication of internal audit work and results. The disclosure will include communicating the implications of such interference on the internal audit function’s effectiveness and ability to fulfil its mandate. Principle 3 – Demonstrate Competency 38. Internal Auditors apply knowledge, skills and abilities to fulfil their roles and responsibilities successfully. 39. Demonstrating competency requires developing and applying the knowledge, skills and abilities to provide internal audit services. Because internal auditors provide a diverse array of services, the competencies needed by each internal auditor vary. In addition to possessing or obtaining the competencies needed to perform services, internal auditors improve the effectiveness and quality of services by pursing professional development. Competency – Standard 3.1 40. Internal Auditors must possess or obtain the competencies to perform their responsibilities successfully. The required competencies include the knowledge, skills, and abilities suitable for one’s job position and responsibilities commensurate with their level of experience. Internal Auditors must possess or develop knowledge pf the IIA’s GIAS. 41. Internal Auditors must engage only in those services for which they have or can attain the necessary competencies. 42. Each internal auditor is responsible for continually developing and applying the competencies necessary to fulfil their professional responsibilities. The CIA must ensure that the internal audit function collectively possesses the competencies to perform the internal audit services described in the Internal Audit Charter or must obtain the necessary competencies. Continuing Professional Development – Standard 3.2 43. Internal Auditors must maintain and continually develop their competencies to improve the effectiveness and quality of internal audit services. Internal auditors must pursue continuing professional development including education and training. Practicing Internal Auditors who have attained professional internal audit certification must follow the continuing professional education policies and fulfil the requirements applicable to their certifications. Page 231
Page 232
12 Implementation of these requirements within Argyll and Bute Council will be as follows: 44. The Internal Audit team will work with proficiency and due professional care. The CIA shall be a CCAB accountant or CMIIA internal auditor with suitable internal audit experience. 45. The CIA is responsible for recruiting appropriate internal audit staff in accordance with the Council’s recruitment processes. As part of the role the CIA shall: • ensure that internal audit collectively possess or obtain the skills, knowledge and other competencies required to perform its responsibilities • obtain competent advice and assistance where internal audit does not possess the skills, knowledge and other competencies required to perform its responsibilities • ensure that internal auditors have sufficient knowledge to evaluate the risk of fraud and anti-fraud arrangements in the organisation • ensure that internal auditors have sufficient knowledge of key information technology risks and controls • ensure that internal auditors have sufficient knowledge of the appropriate computer- assisted audit techniques that are available to them to perform their work. 46. In addition, all staff who are on professional training programs must comply with their terms and conditions of practice and maintain the standards expected of the professional institute they belong to and other relevant requirements as outlined in this document. 47. All staff must maintain their continued professional development in accordance with their professional body on an annual basis and make the appropriate declaration where required. 48. All staff must view and attend professional webinars which are relevant to their professional institutes and which are deemed mandatory and which serves to allow professional reflection in future work or audit assignments. In addition, all professional members must undertake mandatory minimum training in ethics, this may differ between relevant professional bodies. 49. Argyll and Bute Council will assist with appropriate training and courses to allow staff to maintain and develop knowledge and competencies in the areas which they are required to audit now and in the future. 50. Internal Audit staff as part of their annual performance review, as part of the ‘Staff Conversation’ approach, will have a development plan consistent with their specific role within the function. Principle 4 – Exercise Due Professional Care 51. Internal Auditors apply due professional care in planning and performing internal audit services. 52. The Standards that embody exercising due professional care require: • Conformance with the GIAS. • Consideration of the nature, circumstances, and requirements of the work to be performed. • Application of professional scepticism to critically assess and evaluate information. 53. Due professional care requires planning and performing internal audit services with the diligence, judgement, and scepticism possessed by prudent and competent internal auditors. When Page 232
Page 233
13 exercising due professional care, internal auditors perform in the best interests of those receiving internal audit services but are not expected to be infallible. Conformance with the Global Internal Audit Standards – Standard 4.1 54. Internal Auditors must plan and perform internal audit services in accordance with the GIAS. 55. The internal audit function’s methodologies must be established. Documented and maintained in alignment with the GIAS. Internal Auditors must follow the GIAS and the internal audit function’s methodologies when planning and performing internal audit services and communicating results. 56. If the GIAS are used in conjunction with the requirements issued by other authoritative bodies, internal audit communication must also cite the use of the other requirements, as appropriate. 57. If laws or regulations prohibit internal auditors or internal audit functions from conforming with any part of the GIAS, conformance with all other parts of the GIAS is required and appropriate disclosures must be made. 58. When internal audits are unable to conform with a requirement, the CIA must document and communicate a description of the circumstance, alternative actions taken, the impact of the actions, and the rationale. Requirements related to disclosing non-conformance with the GIAS are described in Standards 8.3 Quality, 12.1 Internal Quality Assessment, and 15.1 Final Engagement Communications. Due Professional Care – Standard 4.2 59. Internal Auditors must exercise due professional care by assessing the nature, circumstances, and requirements of the services to be provided, including: • The organisations strategy and objectives • The interests of those for whom internal audit services are provided and the interests of other stakeholders • Adequacy and effectiveness of governance, risk management and control processes • Cost relative to potential benefits of the internal audit services to be performed • Extent and timeliness of work needed to achieve the engagement’s objectives • Relative complexity, materiality, or significance of risks to the activity under review • Probability of significant errors, fraud, non-compliance, and other risks that might affect objectives, operations and resources • Use of appropriate techniques, tools and technology. Professional Scepticism – Standard 4.3 60. Internal Auditors must exercise professional scepticism when planning and performing internal audit services. 61. To exercise professional scepticism, internal auditors must: • Maintain an attitude that includes inquisitiveness • Critically assess the reliability of information • Be straightforward and honest when raising concerns and asking questions about inconsistent information Page 233
Page 234
14 • Seek additional evidence to make a judgement about information and statements that might be incomplete, inconsistent, false or misleading. Implementation of these requirements within Argyll and Bute Council will be as follows: 62. All staff will approach their work taking full cognisance of the GIAS and those within Argyll and Bute Council’s Constitution, together with any other relevant requirements or guidance deemed appropriate. 63. In completing planning activities and subsequent audit work internal auditors shall consider the: • extent of work needed to achieve the engagement’s objectives • relative complexity, materiality or significance of matters to which assurance procedures are applied • adequacy and effectiveness of governance, risk management and control processes • probability of significant errors, fraud, or non-compliance • cost of assurance in relation to potential benefits. 64. Internal auditors will exercise due professional care during a consulting engagement by considering the: • needs and expectations of clients, including the nature, timing and communication of engagement results • relative complexity and extent of work needed to achieve the engagement’s objectives • cost of the consulting engagement in relation to potential benefits. 65. The CIA will ensure that regular conversations take place about performance, behaviours and career/development aspirations in line with the Council’s -approach to the PRD process, ‘Staff Conversations’, this will be undertaken on an annual basis. 66. Internal Auditors must approach their work with appropriate professional scepticism, taking cognisance of the need to take that independent thought process, to critically assess and validate information provided, seeking further evidence or alternative external evidence where required and have the mindset to challenge information from clients which is deemed inconsistent, unreliable and raise questions, queries and seek clarification where that is required. In Argyll and Bute Council and consistent with all public bodies, there is a need to be open, honest and transparent in the workings of the Council and its staff and there is an expectation of challenge and verification through the audit process. 67. In the event that evidence is provided to internal audit staff which is deemed to be misleading or false, this must be reported to the CIA who will further assess the circumstances and where appropriate escalate the matter with relevant senior management. Principle 5 – Maintain Confidentiality 68. Internal Auditors use and protect information appropriately. 69. Because internal auditors have unrestricted access to the data, records, and other information necessary to fulfil the internal audit mandate, they often receive information that is confidential, Page 234
Page 235
15 proprietary, and/or personally identifiable. This includes information in physical and digital form as well as information derived from oral communication, such as formal or informal meeting discussions. Internal auditors must respect the value and ownership of information they receive by using it only for professional purposes and protecting it from unauthorised access or disclosure, internally and externally. Use of Information – Standard 5.1 70. Internal Auditors must follow relevant policies, procedures, laws, and regulations when using information. The information must not be used for personal gain or in a manner contrary or detrimental to the organisation’s legitimate and ethical objectives. Protection of Information – Standard 5.2 71. Internal Auditors must be aware of their responsibilities for protecting information and demonstrate respect for the confidentiality, privacy, and ownership of information acquired when performing internal audit services or as the result of professional relationships. 72. Internal auditors must understand and abide by the laws, regulations, policies, and procedures related to confidentiality, information privacy, and information security that apply to the organisation and internal audit function. 73. Considerations specifically relevant to the internal audit function include: • Custody, retention, and disposal of engagement records • Release of engagement records to internal and external parties • Handling of, access to, or copies of confidential information when it is no longer needed. 74. Internal Auditors must not disclose confidential information to unauthorized parties unless there is a legal or professional responsibility to do so. 75. Internal Auditors must manage the risk of exposing or disclosing information inadvertently. 76. The CIA must ensure that the internal audit function and individuals assisting the internal audit function adhere to the same protection requirements. Implementation of these requirements within Argyll and Bute Council will be as follows: 77. Internal auditors must: • act prudently when using information acquired in the course of their duties and protect that information • not disclose or misuse information obtained during the course of their work • take cognisance of the Council’s documentation retention and handling policy • secure all and any information they have and store it in an appropriate audit directory; printed or manual records must be secured at all times, particularly when not in a controlled environment • not use information for any personal gain or in any manner that would be contrary to the law or detrimental to the legitimate and ethical objectives of the Council • inform the CIA should they have any concerns about non-compliance with these requirements as soon as practicably possible. Page 235
Page 236
16 Governing the Internal Audit Function – Domain III Principle 6 – Authorised by the Board 78. The Board establishes, approves, and supports the mandate of the internal audit function. 79. The internal audit function receives its mandate from the Board (or applicable law in certain public sector environments). The mandate specifies the authority, role, and responsibilities of the internal audit function and is documented in the Internal Audit Charter. The mandate empowers the internal audit function to provide the Board and senior management with objective assurance, advice, insight, and foresight. The internal audit function carries out the mandate by bring a systematic, disciplined approach to evaluating and improving the effectiveness of governance, risk management, and control processes throughout the organisation. Internal Audit Mandate – Standard 6.1 80. The CIA must provide the Board and senior management with information necessary to establish the internal audit mandate. In those jurisdictions and industries where the internal audit function’s mandate is prescribed wholly or partially in laws or regulations, the Internal Audit Charter must include the legal requirements of the mandate. 81. To help the Board and senior management determine the scope and types of internal audit services, the CIA must co-ordinate with other internal and external assurance providers to gain an understanding of each other’s roles and responsibilities. (Other references – Standard 9.5 Co- ordination and Reliance) 82. The CIA must document or reference the mandate in the Internal Audit Charter, which is approved by the Board. 83. Periodically, the CIA must assess whether changes in circumstances justify a discussion with the Board and senior management about the Internal Audit Mandate. If so, the CIA must discuss the Internal Audit Mandate with the Board and senior management to assess whether the authority, role, and responsibilities continue to enable the internal audit function to achieve its strategy and accomplish its objectives. Internal Audit Charter – Standard 6.2 84. The CIA must develop and maintain an Internal Audit Charter that specifies, at a minimum, the internal audit function’s: • Purpose of Internal Auditing. • Commitment to adhering to the GIAS. • Mandate, including scope and types of services to be provided, and the Board’s responsibilities and expectations regarding management’s support to the internal audit function. • Organisational position and reporting relationships. Page 236
Page 237
17 85. The CIA must discuss the proposed Charter with the Board and Senior Management to confirm that it accurately reflects their understanding and expectations of the internal audit function. Board and Senior Management Support – Standard 6.3 86. The CIA must provide the Board and senior management with information needed to support and promote the recognition of the internal audit function throughout the organisation. 87. The CIA must coordinate the internal audit function’s Board communications with senior management to support the Boards ability to fulfil its requirements. Implementation of these requirements within Argyll and Bute Council will be as follows: 88. The CIA will as a minimum will comply with the requirements outlined in Principle 6 and its constituent Standards 6.1-6.3. The primary mandate in relation to Scottish Local Authorities is outlined in the Local Authority Accounts (Scotland) Regulations 2014 and the Constitutional Documents of the Council. 89. A Charter and Audit Manual will be produced and reviewed annually in order to maintain a level of documented and routine overview of these core documents. Any changes will be discussed with management and through presentation with the Board on any such changes that may be considered or required. 90. The CIA and management will keep the Audit and Scrutiny Committee informed and updated of any change where it is considered to impact the role and discharge of the internal audit function within the Council or required to promote the internal audit function throughout the organisation as required. Principle 7 – Positioned Independently 91. The Board establishes and protects the internal audit function’s independence and qualifications. 92. The Board is responsible for enabling the independence of the internal audit function. Independence is defined as the freedom from conditions that impair the internal audit function’s ability to carry out its responsibilities in an unbiased manner. The internal audit function is only able to fulfil the ‘Purpose of Internal Auditing’ when the CIA reports directly to the Board, is qualified, and is positioned at a level within the organisation that enables the internal audit function to discharge its services and responsibilities without interference. Organisational Independence – Standard 7.1 93. The CIA must confirm to the Board the organisational independence of the internal audit function at least annually. This includes communicating incidents where independence may have been impaired and the actions or safeguards employed to address the impairment. 94. The CIA must document in the Internal Audit Charter the reporting relationships and organisational positioning of the internal audit function, as determined by the Board. 95. The CIA must discuss with the Board and senior management any current or proposed roles and responsibilities that have the potential to impair the internal audit function’s independence, either Page 237
Page 238
18 in fact or appearance. The CIA must advise the Board and senior management of the types of safeguards to manage actual, potential or perceived impairments. 96. When the CIA has one or more ongoing roles beyond internal auditing, the responsibilities, nature of work, and established safeguards must be documented in the Internal Audit Charter. If those areas of responsibility are subject to internal auditing, alternative processes to obtain assurance must be established, such as contracting with an objective, competent external assurance provider that reports independently to the Board. 97. When the CIA’s non audit responsibilities are temporary, assurance for those areas must be provided by an independent third party during the temporary assignment and for the subsequent 12 months. Also the CIA must establish a plan to transition those responsibilities to management. Implementation of these requirements within Argyll and Bute Council will be as follows: 98. The CIA will as part of his/her annual report outline the status of its organisational objectivity, together with outlining any concerns regarding any incidents where independence may have been impaired and the actions or safeguards employed to address the impairment, where applicable. 99. In Argyll and Bute Council, the CIA reports in his/her name to the Council’s Audit and Scrutiny Committee directly, is appropriately qualified and experienced and reports directly to the Section 95 Officer and has access to the Chief Executive and Monitoring Officer. This both maintains independence and positions the CIA within the organisation to discharge the function of internal audit and its responsibilities without interference. Chief Audit Executive (CIA) Qualifications – Standard 7.2 100. The CIA must help the Board understand the qualifications and competencies of a CIA that are necessary to manage the internal audit function. The CIA facilitates this understanding by providing information and examples of common and leading qualifications and competencies. 101. The CIA must maintain and enhance the qualifications and competencies necessary to fulfil the roles and responsibilities expected by the Board. Implementation of these requirements within Argyll and Bute Council will be as follows: 102. In Argyll and Bute Council there will be a strict requirement to comply with Standard 7.2. and this is achieved by; • The CIA, as part of the annual reporting and self assessment section and that which requires compliance with the GIAS will confirm the qualifications that are acceptable for the holding of a CIA post, specifically, CCAB or Charted Internal Auditor • The CIA maintains these qualifications and that appropriate competencies have been maintained and that continued professional development has been achieved. Principle 8 – Overseen by the Board 103. Board oversight is essential to enable the overall effectiveness of the internal audit function. Achieving this principle requires collaboration and interactive communications between the Board Page 238
Page 239
19 and the CIA as well as the Board’s support in ensuring the internal audit function obtains sufficient resources to fulfil then internal audit mandate. Additionally, the Board receives assurance about the quality of performance of the CIA and the internal audit function through the quality assessment and improvement program, including the Board’s direct review of the results of the external quality assessment. Board Interaction – Standard 8.1 104. The CIA must provide the Board with the information needed to conduct its oversight responsibilities. This information may be specifically requested by the Board or may be, in the judgement of the CIA, valuable for the Board to exercise its oversight responsibilities. 105. The CIA must report to the Board and Senior Management: • The internal audit plan, budget and subsequent significant revisions to them • Changes potentially affecting the mandate or charter • Potential impairments to independence • Results of internal services, including conclusions, themes, assurance, advice, insights, and monitoring results • Engagement conclusions and confirming the implementation of recommendations or actions plans • Results from the quality assurance and improvement program. 106. There may be instances when the CIA disagrees with senior management or stakeholders on the scope, findings, or other aspects of an engagement that may affect the ability of the internal audit function to execute its responsibilities. In such cases, the CIA must provide the Board with the facts and circumstances to allow the Board to consider whether, in its oversight role, it should intervene with senior management or other stakeholders. Implementation of these requirements within Argyll and Bute Council will be as follows: 107. In Argyll and Bute Council the CIA will prepare an annual audit plan which will outline the minimum resources required to achieve the plan, this will confirm that there are appropriate staffing and budget to enable fulfilment of the plan. 108. The Internal Audit Charter and Internal Audit Manual are reviewed annually and presented to the audit and Scrutiny Committee outlining changes required to maintain compliance with best practice and where required minor updates due to changes within the Council. Any changes affecting the mandate or charter will be specifically outlined to allow discussion, consideration and decision by the Committee. 109. In Argyll and Bute Council, the CIA will produce quarterly reports for the Audit and Scrutiny Committee, this will include any variations to the plan, in addition, all audit work completed is formally reported to the Audit and Scrutiny Committee, including findings, conclusions and recommendations along with agreed action plans. 110. All quality assurance assessments both internal and external are and will continue to be reported to the Audit and Scrutiny Committee as a matter of routine. Internally, on an annual basis as part of the annual reporting and externally every five years by the report issued from the independent assessor. Page 239
Page 240
20 Resources – Standard 8.2 111. The CIA must evaluate whether internal audit resources are sufficient to fulfil the internal audit mandate and achieve the internal audit plan. If not, the CIA must develop a strategy to obtain sufficient resources and inform the Board about the impact of insufficient resources and how any shortfalls will be addressed. Implementation of these requirements within Argyll and Bute Council will be as follows: 112. The CIA will as part of the draft Audit Plan provide commentary regarding the resources required to deliver the plan and whether there has been sufficient budgetary provision. Any concerns or deficiencies identified by the CIA, where applicable will be communicated. Quality – Standard 8.3 113. The CIA must develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function. The program includes two types of assessments: • External Assessments • Internal Assessments 114. At least annually, the CIA must communicate the results of the internal quality assessment to the Board and senior management. The results of the external quality assessments must be reported when completed. In both cases such communications include: • The internal audit function’s conformance with the GIAS and achievement of performance objectives • If applicable, compliance with laws and/or regulations relevant to internal auditing • If applicable, plans to address the internal audit function’s deficiencies and opportunities for improvement. Implementation of these requirements within Argyll and Bute Council will be as follows: 115. In Argyll and Bute Council, the CIA will, as part of the annual report to Committee, confirm whether conformance to the GIAS has been achieved and where not, the reasons why and any remedial action required going forward as part of an action plan. In relation to External assessments, these will be reported to the next scheduled meeting of the Committee on receipt of the final report, this will include all findings and an action plan to address all such issues, where applicable. External Quality Assessment – Standard 8.4 116. The CIA must develop a plan for an external quality assessment and discuss the plan with the Board. The external assessment must be performed at least once every five years by a qualified, independent assessor or assessment team. The requirement for an external quality assessment may also be met through a self-assessment with independent validation. Implementation of these requirements within Argyll and Bute Council will be as follows: 117. The Council have agreed to participate in the Scottish Local Authority Chief Internal Auditors (SLACIAG) external assessment review process. A qualified and experienced CIA from another local authority will undertake a comprehensive review in accordance with the GIAS and report their Page 240
Page 241
21 findings to the CIA of Argyll and Bute Council, the Audit and Scrutiny Committee, the Section 95 Officer and Chief Executive. 118. The qualifications and experience of the assessor will be made clear in the assessment report produced for the Committee and other appropriate senior management. Managing the Internal Audit Function – Domain IV Principle 9 – Plan Strategically 119. The CIA plans strategically to position the internal audit function to fulfil its mandate and achieve long-term success. 120. Planning strategically requires the CIA to understand the internal audit mandate and organisational governance, risk and control processes. A properly resourced and positioned internal audit function develops and implements a strategy to support the organisation success. In addition, the CIA creates and implements methodologies to guide the internal audit function and develop the internal audit plan. Understanding Governance, Risk Management and Control Processes – Standard 9.1 121. To develop an effective internal audit strategy and plan, the CIA must understand the organisation’s governance, risk management and control processes. 122. To understand governance processes, the CIA must consider how the organisation: • Establishes strategic objectives and makes strategic and operational decisions • Oversees risk management and control • Promotes an ethical culture • Delivers effective performance management and accountability • Structures its management and operating functions • Communicates risk and control information throughout the organisation • Coordinates activities and communications among the Board, internal and external providers of assurance services, and management. 123. To understand risk management and control processes, the CIA must consider how the organisation identifies and assesses significant risks and selects appropriate control processes. This includes understanding how the organisation identifies and manages the following key risk areas: • Reliability and integrity of financial and operational information • Effectiveness and efficiency of operations and programs • Safeguarding of assets • Compliance with laws and/or regulations. Implementation of these requirements within Argyll and Bute Council will be as follows: Page 241
Page 242
22 124. The Council has a strong and well developed governance system in place which is supported by appropriate policies, procedures and expected practice. Systems of governance are reviewed periodically and where appropriate updated within the Council. As expected, local government is highly controlled within the context of openness and accountability and requires that appropriate oversight is in place. 125. The CIA is an integral part of the risk management process and co-ordinates the updates of the Council’s Strategic Risk Register (SRR), this allows insight to the reasoning and rationale of senior management in the developing horizon of risk. The CIA liaises with senior management and prepares a paper for the Council’s Senior Management Team (SMT) on these draft updates which are challenged before being agreed/approved. 126. The Audit and Scrutiny Committee receive an annual update of the SRR and outline of the key risks, treatment of the risks and mitigations in place to reduce risk where appropriate and the residual risk score, such information is usually presented to Committee in September of each year. 127. As part of the understanding the control processes, a number of approaches are taken by the CIA, these include but are not limited to the review of Council agendas and minutes, the review of Council strategies and objectives, reports of regulators’ discussions with senior management and any outstanding legal or regulatory matters which may pose a risk to the Council. In addition, the process for recording, monitoring and assessing asset management, reliability of core financial systems are among the other areas considered. Internal Audit Strategy - Standard 9.2 128. The CIA must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organisation and aligns with the expectations of the Board, senior management, and other key stakeholders. 129. An internal audit strategy is a plan of action designed to achieve long-term or overall objective. The internal audit strategy must include vision, objectives, and supporting initiatives for the internal audit function. An internal audit strategy helps guide the internal audit function towards fulfilment of the internal audit mandate. 130. The CIA must review the internal audit strategy with the Board and senior management periodically. Implementation of these requirements within Argyll and Bute Council will be as follows: 131. An Internal Audit Strategy will be developed for a three year period, with each year supported by an annual audit plan. The Internal Audit Strategy will be linked and cross referenced to key risks contained within the SRR and the Council’s organisational objectives which have been set and agreed. This will allow a complete picture of the visions, objectives and outcomes which the Council are planning to achieve but also how internal audit are aligning its resources for that purpose taking cognisance of the risk based approach. 132. The Internal Audit Strategy will be discussed with senior management and considered by each of the relevant Department Management Teams (DMT) to allow discussions and comment. Similarly, Page 242
Page 243
23 then presented to the Audit and Scrutiny Committee along with the relevant annual plan in order that there is opportunity for review, comment and decision. Methodologies - Standard 9.3 133. The CIA must establish methodologies to guide the internal audit function in a systematic and disciplined manner to implement the internal audit strategy, develop the internal audit plan, and conform with the GIAS. The CIA must evaluate the effectiveness of the methodologies and update them as necessary to improve the internal audit function and respond to significant changes that affect the function. The CIA must provide internal auditors with training methodologies. Implementation of these requirements within Argyll and Bute Council will be as follows: 134. There are specific process and procedures in place within the internal audit function which require auditors to assess, plan and undertake their work in a coordinated and systematic way which allows consistency of approach, documented collection of appropriate data and information, checking and assessing the risk profile of each review, liaising with other stakeholders such as external audit and use statistical information and techniques as required. These are some of the processes used in our standard operating practice which allow reviews to be undertaken, which will help to form conclusions and recommendations where that is appropriate. Internal Audit Plan - Standard 9.4 135. The CIA must create an internal audit plan that supports the achievement of the organisation’s objectives. 136. The CIA must base the internal audit plan on a documented assessment of the organisation’s strategies, objectives and risks. This assessment must be informed by input from the Board and senior management as well as the CIA’s understanding of the organisation’s governance, risk management, and control processes. The assessment must be performed at least annually. 137. The internal audit plan must: • Consider the internal audit mandate and the full range of agreed internal audit services • Specify internal audit services that support the evaluation and improvement of the organisation’s governance, risk management and control processes • Consider the coverage of information technology governance, fraud risk, the effectiveness of the organisation’s compliance and ethics programs, and other high risk areas • Identify the necessary human, financial and technological resources necessary to complete the plan • Be dynamic and update timely in responses to the organisation’s business, risk operations, programs, systems, controls, and organisational culture. Implementation of these requirements within Argyll and Bute Council will be as follows: 138. The CIA will produce an annual internal audit plan which will flow from the internal audit strategy which covers the key objectives of the Council, its strategies and consider risk profiles from the SRR. The strategy and subsequent plans will cover the assessment of governance arrangements, risk management and controls. The focus on control improvement will also be undertaken when reviewing information technology, fraud risk and consideration of ethics and organisation culture. Page 243
Page 244
24 139. The plan will outline the services that will be provided, the resources required to deliver the plan both in terms of time but also the skills mix required to provide the added assurance that the work meets the highest standards and quality. 140. The CIA will review the proposed plan with relevant senior staff and seek approval through the relevant Departmental Management Team (DMT), together with seeking views from stakeholders and Members of the Audit and Scrutiny Committee. Any changes which are deemed significant and will be required to be addressed will be redelivered through a small contingency within the limited resources envelope of the internal audit function. Coordination and Reliance - Standard 9.5 141. The CIA must coordinate with internal and external providers of assurance services and consider relying upon their work. Coordination of services minimises duplication of effort, highlight gaps in coverage of key risks, and enhances the overall value added by providers. 142. If unable to achieve appropriate level of coordination, the CIA must raise any concerns with senior management and, if necessary, the Board. 143. When the internal audit function relies on the work of other assurance service providers, the CIA must document the basis for the reliance and is still responsible for the conclusions reached by the internal audit function. Implementation of these requirements within Argyll and Bute Council will be as follows: 144. The CIA will liaise with the appointed External Auditor to assess and determine the coordination of our respective roles and responsibilities in relation to the delivery of audit services. Where possible and in accordance with established practices reliance and/or reference will be made to our respective coverage to minimise repetition of work. 145. Any issues that cannot be resolved would be escalated to the appropriate officer within the Council and relevant senior manager/partner within the provider of our external audit services. 146. There is a duty of care and risk when relying on the work of other bodies, assurance providers and sources and these will be assessed by the relevant auditor when he/she determines if that source of information can be relied upon or merely made reference to as required. Principle 10 – Managing Resources 147. The CIA manages resources to implement the internal audit function’s strategy and achieve its plan and mandate. 148. Managing resources requires obtaining and deploying financial, human, and technological resources effectively. The CIA needs to obtain the resources required to perform internal audit responsibilities and deploy resources according to the methodologies established for the internal audit function. Financial Resource Management - Standard 10.1 149. The CIA must manage the internal audit function’s financial resources. Page 244
Page 245
25 150. The CIA must develop a budget that enables the successful implementation of the internal audit strategy and achievement of the plan. The budget includes the resources necessary for the function’s operation, including training and acquisition of technology and tools. The CIA must manage the day to day activities of the internal audit function effectively and efficiently, in alignment with the budget. 151. The CIA must seek budget approval from the Board. The CIA must communicate promptly the impact of insufficient financial resources to the Board and senior management. Implementation of these requirements within Argyll and Bute Council will be as follows: 152. The application if this Standard within the context of the public sector will follow the supplementary guidance issued by the Chartered Institute of Public Finance and Accountancy, called ‘ Application Note: Global Internal Audit Standards in the UK Public Sector’ and which is effective from the 1st April 2025. This allows variations which are necessary for the UK public sector and which can be accommodated in terms of our approach to implementation. (The Audit Committee do not normally approve the financial budget of the internal audit function in UK Local Authorities). 153. In local government, in general, a formal budget process forms an integral part of the assessment of costs associated with the provision of a service, including internal audit. Internal audit will follow this process as will other sections within the Council. However, both the CIA and Board should be satisfied that there is appropriate budget to allow the delivery of the plan in order that appropriate assurance can be provided to inform those charged with governance, and an opinion in relation to the arrangements for governance, risk management and internal control each year by the CIA. It is therefore important that when the plan is being presented to the Board, the CIA makes reference to any specific concerns he/she may have in relation to financial resources in order that the Board can, in the event that there are any concerns about budgetary provision regarding internal audit, be escalated. 154. It would be normal that such agreement between management and the CIA on the provision of budgetary resource would have been agreed in advance. Human Resource Management - Standard 10.2 155. The CIA must establish an approach to recruit, develop, and retain internal auditors who are qualified to successfully implement the internal audit strategy and achieve the internal audit plan. 156. The CIA must strive to ensure that human resources are appropriate, sufficient, and effectively deployed to achieve the approved internal audit plan. Appropriate refers to the mix of knowledge, skills and abilities; sufficient refers to the quantity of resources; and effective deployment refers to assigning resources in a way that optimizes the achievement of the internal audit plan. 157. The CIA must communicate with the Board and senior management regarding the appropriateness and sufficiency of the internal audit function’s human resources. If the function lacks appropriate and sufficient human resources to achieve the internal audit plan, the CIA must determine how to obtain the resources or communicate timely to the Board and senior management the impact of the limitations. Implementation of these requirements within Argyll and Bute Council will be as follows: Page 245
Page 246
26 158. Professional staff will have an appropriate qualification such as Chartered Internal Auditor or CCAB qualified, other staff will either be part of a formal training programme to achieve a professional qualification or have a specific development plan relevant to the post. Staff will have appropriate Job Descriptions and Specifications. 159. Staff will be supported and allocated to internal audit work where they have the necessary skills and abilities or where they can be supervised in order to gain these skills as part of the professional training programme. 160. Specific competency frameworks will be used to assess staff, particularly at a professional level in order that skills and knowledge can be maintained so that added value can be provided when undertaking reviews. 161. In the public sector the ability of staff to develop and learn tend to be good, particularly in areas where there are key shortages of professional staff within the general market, such as Internal Audit. Argyll and Bute Council have well established routes for staff to learn and succeed such as ‘Growing our Own’ 162. The CIA will inform senior management and the Board of any concerns or developing issues relating to staffing within the internal audit function which would put at risk the delivery of the plan. The CIA outlines the staff and skills mix as part of the annual internal audit plan. In addition, a well developed training program is in place for the development of staff in order to achieve a relevant professional qualification. 163. Staff will be supported and a comprehensive set of human resource policies and procedures are in place within the Council to facilitate that which is expected of a well-regarded and ethical employer. Technological Resources - Standard 10.3 164. The CIA must strive to ensure that the internal audit function has technology to support the internal audit process. The CIA must regularly evaluate the technology used by the internal audit function and pursue opportunities to improve effectiveness and efficiency. 165. When implementing new technology, the CIA must implement appropriate training for internal auditors in the effective use of technological resources. The CIA must collaborate with the organisation’s information technology and information security functions to implement technological resources properly. 166. The CIA must communicate the impact of technology limitations on the effectiveness or efficiency of the internal audit function to the Board and senior management. Implementation of these requirements within Argyll and Bute Council will be as follows: 167. The Council has implemented a process where appropriate IT resources are provided based on needs and requirements to deliver the service. The Council’s internal audit function works largely remotely from home and are reliant on the IT infrastructure and support which is well developed within the Council. 168. Internal Audit staff will receive support and training on any new systems as required and currently receive regular training and updates in IT security as part of the corporate IT strategy. Page 246
Page 247
27 169. Where appropriate the Internal Audit function will use IT based technology for data extraction, sampling and validation. All and any support for IT will be made through the Council’s IT service. Principle 11 – Communicate Effectively 170. The CIA guides the internal audit function to communicate effectively with stakeholders. 171. Effective communication requires building relationships, establishing trust, and enabling stakeholders to benefit from the results of internal audit services. The CIA is responsible for helping the internal audit function establish ongoing communication with stakeholders to build trust and foster relationships. Additionally, the CIA oversees the internal audit function’s formal communications with the Board and senior management to enable quality and provide insights based on the results of the internal audit services. Building Relationships and Communicating with stakeholders - Standard 11.1 172. The CIA must develop an approach for the internal audit function to build relationships and trust with key stakeholders, including the Board, senior management, operational management, regulators, and internal and external assurance providers and other consultants. 173. The CIA must promote formal and informal communication between the internal audit function and stakeholders, contributing to the mutual understanding of: • Organisational interests • Approaches for identifying and managing risks and providing assurance • Roles and responsibilities of relevant parties and opportunities for collaboration • Relevant regulatory requirements • Significant organisational processes, Including financial reporting. Implementation of these requirements within Argyll and Bute Council will be as follows: 174. The CIA and Internal Audit function acknowledge the importance of good and appropriate relationships and communications with all relevant stakeholders. In addition, there are numerous opportunities of engagement with the CIA through regular contact both formal and informal as part of the role. 175. Appropriate training and induction of Members of the Committee which covers a wide programme of subject areas, to help build up knowledge and key skills expected of those charged with governance duties. This is further supported by development topics, presentations from key stakeholders such as Audit Scotland, Treasury Management providers and other events as deemed required. Effective Communication - Standard 11.2 176. The CIA must establish and implement methodologies to promote accurate, objective, clear, concise, constructive, complete, and timely internal audit communications. Implementation of these requirements within Argyll and Bute Council will be as follows: Page 247
Page 248
28 177. Communicating the results of our internal audit work is a crucial aspect of the audit process and is the key link to our stakeholders including the SMT, Heads of Service, Elected Members, the Committee and (where appropriate) the public. Criteria for Communicating 178. All audit reports are to be drafted using the template developed by the CIA. This template requires, as a minimum, the overall audit opinion, executive summary, objectives and summary assessment, detailed findings, and an action plan. This provides a clear, concise, logical and easily referenced and understood format for stakeholders. Any deviation from the template report requires approval by the CIA. 179. Prior to issuing the draft report internal auditors are required to discuss the draft findings with the appropriate officers to confirm factual accuracy and in a constructive manner which will help the Council. This will generally be carried out at a clearance meeting and a template has been created to facilitate and document that meeting. 180. Where auditors make recommendations and include an action plan, such recommendations are graded to allow the significance of findings to be ascertained. 181. Action plans will include a management response that sets out the agreed action and timescales for the completion of improvement actions. Internal Audit will enter the agreed actions and timescales in the internal audit follow up database. 182. Where there are any areas of disagreement between the internal auditors and management, which cannot be resolved by discussion, such disagreements should be recorded in the action plan and the residual risk highlighted. As all audit reports are reported to the Committee in their entirety, this disagreement will be reported to the Committee as and when the report is presented. 183. In completing internal audit activities, auditors are required to include and disclose all material facts identified as part of their objective audit work and subsequent reports which, if not disclosed, could distort their reports or conceal unlawful practice. Such disclosures should be made with reference to confidentiality requirements or other considerations that may preclude the release of information into the public domain which are primarily outlined in Schedule 7A Exempt Information – Local Government (Scotland) Act 1973 or as amended. 184. The work of Internal Audit should always seek to ensure that communications are accurate, objective, clear, concise, constructive, complete, and timely. Communicating Results - Standard 11.3 185. The CIA must communicate the results of internal audit services to the Board and senior management periodically and for each engagement as appropriate. The CIA must understand the expectations of the Board and senior management regarding the nature and timing of communications. 186. The results of internal audit services can include: • Engagement conclusions • Themes such as effective practices or root causes Page 248
Page 249
29 • Conclusions at the level of the business unit or organisation. Implementation of these requirements within Argyll and Bute Council will be as follows: 187. The CIA will make arrangements to communicate and clear reports with relevant senior managers, thereafter make arrangements for reports to be placed on the next scheduled meeting of the Committee unless there are specific matters which require to be concluded, for example legal and/or disciplinary matters. The Committee have a pre-agreed set of scheduled meetings within the Council meeting calendar and which are well communicated. 188. The CIA will brief the Chair and Vice/Chair as part of the Pre-Agenda meetings so that specific matters can be focused on within the Committee where there is a specific need or where there could be particular concern(s). 189. As part of the Committee’s annual report to Council, an overview of all audits undertaken over the relevant financial year are outlined to identify trends in levels of assurance and/or identify areas of particular concern or control weakness, where applicable. Errors and Omissions - Standard 11.4 190. If a final engagement communication contains a significant error or omission, the CIA must communicate corrected information promptly to all parties who received the original communication. 191. Significance is determined according to criteria agreed by the Board. Implementation of these requirements within Argyll and Bute Council will be as follows: 192. It is the CIA’s responsibility to ensure that where a final report contains a significant error or omission, subsequent changes, revisions or corrections are communicated to all parties who received the original communication. Communicating the Acceptance of Risk - Standard 11.5 193. The CIA must communicate unacceptable levels of risk. 194. When the CIA concludes that management has accepted a level of risk that exceeds the organisation’s risk appetite or risk tolerance, the matter must be discussed with senior management. If the CIA determines that the matter has not been resolved by senior management, the matter must be escalated to the Board. It is not the responsibility of the CIA to resolve the risk. Implementation of these requirements within Argyll and Bute Council will be as follows: 195. Where there are any areas of disagreement between the internal auditors and management, which cannot be resolved by discussion, such disagreements should be recorded in the action plan and the residual risk highlighted. As all audit reports are reported to the Committee in their entirety, this disagreement will be reported to the Committee as and when the report is presented. 196. It will not be the duty of the CIA to resolve the risk. Page 249
Page 250
30 Principle 12 – Enhance Quality 197. The CIA is responsible for the internal audit function’s performance with the GIAS and continuous performance improvement. 198. Quality is a combined measure of conformance with the GIAS and the achievement of the internal audit’s function’s performance objectives. Therefore, a quality assurance and improvement program is designed to evaluate and promote the internal audit functions’ conformance with the GIAS, achievement of performance objectives, and pursuit of continuous improvement. The program includes internal and external assessment. 199. The CIA is responsible for ensuring that the internal audit function is continuously seeking improvement. This requires developing measures to assess the performance of internal audit engagements, internal auditors, and the internal audit function. These measures form the basis for evaluating progress towards performance objectives including continuous improvement. Internal Quality Assessment - Standard 12.1 200. The CIA must develop and conduct internal assessments of the internal audit function’s conformance with the GIAS and progress towards performance objectives. 201. The CIA must establish a methodology for internal assessments, as described in Standard 8.3 Quality, that includes: • Ongoing monitoring of the internal audit function’s conformance with the GIAS and progress towards performance objectives • Periodic self-assessments or assessments by other persons within the organisation with sufficient knowledge of internal audit practices to evaluate conformance with the GIAS • Communication with the Board and senior management about the results of internal assessments. 202. Based on the results of periodic self-assessments, the CIA must develop action plans to address instances of non-conformance with the GIAS and opportunities for improvement, including a proposed timeline for actions. The CIA must communicate the results of the periodic self- assessment and action plans to the Board and senior management. 203. Internal assessments must be documented in the evaluation conducted by an independent third party as part of the organisation’s external quality assessment. 204. If non-conformance with the GIAS affects the overall scope of the operation of the internal audit function, the CIA must disclose to the Board and senior management the non-conformance and its impact. Implementation of these requirements within Argyll and Bute Council will be as follows: 205. The CIA uses the methodology for the internal quality assessment by use of ‘Local Government Application Note’ assessment tool. This allows cross referencing of the requirements contained within the GIAS, together with any subsequent adjustments for the UK public sector internal audit providers. This assessment is reported annually to the Audit and Scrutiny Committee, and where appropriate, any action plan that would need to be implemented to address any gaps identified, along with an appropriate timeline. Page 250
Page 251
31 206. All assessments are documented and retained. Performance Measurement - Standard 12.2 207. The CIA must develop objectives to evaluate the internal audit function’s performance. The CIA must consider the input and expectations of the Board and senior management when developing the performance objectives. 208. The CIA must develop a performance measurement methodology to progress towards achieving the function’s objectives and to promote the continuous improvement of the internal audit function. 209. When assessing the internal audit function’s performance, the CIA must solicit feedback from the Board and senior management as appropriate. 210. The CIA must develop an action plan to address issues and opportunities for improvement. Implementation of these requirements within Argyll and Bute Council will be as follows: 211. Performance measures are aligned to the objectives contained in within the Charter, Audit Strategy and Annual Operational Internal Audit plan. These objectives have been derived from agreed Council objectives and also cross referenced to the SRR. 212. It is important to note that local performance targets are also set out in in the quarterly update and monitoring report provided to the Audit and Scrutiny Committee on a frequent basis, these updates outline the targets set and the previous quarter performance. Oversee and Improve engagement Performance - Standard 12.3 213. The CIA must establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies. • The CIA or an engagement supervisor must provide internal auditors with guidance throughout the engagement, verify work programs are complete, and confirm engagement working papers adequately support findings, conclusions, and recommendations. • To assume quality, the CIA must verify whether engagements are performed in conformance with the GIAS and the internal audit function’s methodologies. • To develop competencies, the CIA must provide internal auditors with feedback about their performance and opportunities for improvement. 214. The extent of supervision required depends on the maturity of the internal audit function, the proficiency about their performance and opportunities for improvement. 215. The CIA is responsible for supervising engagements, the engagement work is performed by the internal audit staff or by other service providers. Supervisory responsibilities may be delegated to appropriate and qualified individuals, but the CIA retains ultimate responsibility. 216. The CIA must ensure that evidence of supervision is documented and retained according to the internal audit function’s established methodologies. Implementation of these requirements within Argyll and Bute Council will be as follows: Page 251
Page 252
32 217. The work of Internal Audit is specified to deliver upon the requirements of the Annual Internal Audit Plan in accordance with the Charter and this Manual. 218. Internal audit activities are reviewed as part of each audit assignment prior to the issuing of reports. This is to ensure that the work continues to reflect the definitions per the Charter and the Manual. The Manual in this iteration has been specified to reflect the requirements of the GIAS effective from January 2025. 219. Internal auditors should: • only carry out services for which they have the necessary knowledge, skills and experience • perform services in accordance with the GIAS • continually improve the proficiency, effectiveness and quality of their services, for example through on going meetings and engagement with the CIA. 220. At an audit function level written policies and procedures, covering both technical and administrative matters are formally documented to guide audit staff in consistent conformance with GIAS. This is demonstrated by: • an annual assessment is undertaken, which is reported to the Committee, in order to determine the extent to which Internal Audit conforms to the GIAS • maintenance of the Charter, setting out the purpose, authority and responsibility of Internal Audit • maintenance of the Manual, providing guidance on working practices. 221. Audit engagement work conforms to written policies and procedures. This is demonstrated by: • all audit working papers being subject to formal review by the CIA • draft and final reports are checked and approved by the CIA and appropriate officers • this Manual setting out the various processes to ensure consistent conformance with GIAS. 222. Post-engagement client surveys to inform lessons learned, self-assessments, and other mechanisms to support continuous improvement are completed. These are issued at the end of each audit engagement with results acted upon and reported to the Committee. Performing Internal Audit Services – Domain V Principle 13 – Plan Engagements Effectively 223. Internal auditors plan each engagement using a systematic, disciplined approach. 224. The GIAS, along with methodologies established by the CIA, form the foundation of internal auditors’ systematic, disciplined approach to planning engagements. Internal auditors are responsible for effectively communicating at all stages of the engagement. 225. Engagement planning starts with understanding the initial expectations for the engagement and the reason the engagement was included in the internal audit plan. When planning engagements, internal auditors gather the information that enables them to understand the organisation and the Page 252
Page 253
33 activity under review and to assess the risks relevant to that activity. The engagement risk assessment allows internal auditors to identify and prioritize the risks to determine the engagement objectives and scope. Internal auditors also identify the criteria and resources needed to perform the engagement and develop an engagement work program, which describes the specific engagement steps to be performed. Engagement Communication - Standard 13.1 226. Internal auditors must communicate effectively throughout the engagement. 227. Internal auditors must communicate the objectives, scope, and timing of the engagement with management. Subsequent changes must be communicated with management timely. 228. At the end of the engagement, if internal auditors and management do not agree on the engagement results, internal auditors must discuss and try to reach a mutual understanding of the issue with management of the activity under review. If a mutual understanding cannot be reached, internal auditors must not be obliged to change any portion of the engagement results to allow both parties to express their positions regarding the context of the final engagement communication and the reasons for any differences of opinion regarding the engagement results. Implementation of these requirements within Argyll and Bute Council will be as follows: 229. The scope of the audit work should be established so that it is sufficient to satisfy the engagement’s objectives. The engagement scope should consider the following relevant areas of the Council (this should also consider relevant areas under the controls of outside parties): • systems • records • personnel • physical properties. 230. Where significant consulting opportunities have arisen during an assurance engagement, a specific written understanding as to the objectives, scope, respective responsibilities and other expectations should be developed and agreed with the CIA. 231. It is accepted that not all areas of a process will be reviewed at each audit, which might include geographical areas; the scope should be sufficient to satisfy the engagement objectives, but should also state, where appropriate, which areas are not covered. 232. For a consulting engagement, the scope of the engagement should be sufficient to address any agreed-upon objectives. If the internal auditors develop any reservations about the scope of a consulting engagement while undertaking that engagement, they are required to discuss those reservations with the relevant officer and the CIA to determine whether to continue with the engagement. 233. During consulting engagements, internal auditors are required to address the controls that are consistent with the objectives of those engagements. Page 253
Page 254
34 Engagement Risk Assessment - Standard 13.2 234. Internal auditors must develop an understanding of the activity under review to assess the relevant risks. For advisory services, a formal, documented risk assessment may not be necessary, depending on the agreement with stakeholders. 235. To develop an adequate understanding, internal auditors must identify and gather reliable, relevant and sufficient information regarding: • The organisation’s strategies, objectives, and risks relevant to the activity under review • The organisation's risk tolerance • The risk assessment supporting the internal audit plan • The governance, risk management, and other criteria that can be used to evaluate the effectiveness of those processes. 236. Internal auditors must review the gathered information to understand how processes are intended to operate. 237. Internal auditors must identify the risks to review by: • Identifying the potentially significant risks to the objectives of the activity under review • Considering specific risk related to fraud • Evaluating the significance of the risks and prioritizing them for review. 238. Internal auditors must identify the criteria that management uses to measure whether the activity is achieving its objectives. 239. When internal auditors have identified the relevant risks for an activity under review in past engagements, only a review and update of the previous engagement risk assessment is required. Implementation of these requirements within Argyll and Bute Council will be as follows: 240. The Annual Internal Audit Plan is based on a documented risk assessment process. The Internal Audit plan will be developed based on a prioritisation of those key risks facing the Council including input of the SMT and the Committee. The plan will be flexible in nature, can be updated to reflect the changing risks and priorities of the Council, and will take into account: • the Council’s risk registers and risk management framework • a balance of coverage across all operational areas (this constitutes the assurance nature of the plan ensuring an adequate level of internal audit review annually within each service) • experience gained from previous Internal Audit engagements • the impact of national issues (e.g. economic factors, the introduction of new legislation) • the impact of local issues (e.g. Corporate Objectives) • periodic review of core financial and operational systems • the available audit resource and skills • staff development and training • time needed for the management of the internal audit function • contingency set aside for consultancy, reviews or investigations • liaison with other assurance providers such as the External Auditor and other scrutiny bodies. Page 254
Page 255
35 Engagement Objectives and Scope - Standard 13.3 241. Internal auditors must establish and document the objectives and scope of each engagement. 242. The engagement objectives must articulate the purpose of the engagement and describe the specific goals to be achieved, including those mandated by laws and/or regulations. 243. The scope must establish the engagement’s focus and boundaries by specifying the activities, locations, processes, systems, components, time period to be covered in the engagement, and other elements to be reviewed, and be sufficient to achieve the engagement objectives. 244. Internal auditors must consider whether the engagement is intended to provide assurance or advisory services because stakeholders expectations and the requirements of the GIAS differ depending on the type of engagement. 245. Scope limitations must be discussed with management when identified, with a goal of achieving resolutions. Scope limitations are assurance engagement conditions, such as resource constraints or restrictions on access to personnel, facilities, data, and information, that prevent internal auditors from performing the work as expected in the audit engagement work program. 246. If resolutions cannot be achieved with management, the CIA must elevate the scope limitation issue to the Board according to an established methodology. 247. Internal auditors must have the flexibility to make changes to the engagement objectives and scope when the work identifies the need to do so as the engagement progresses. 248. The CIA must approve the engagement objectives and the scope and any changes that occur during the engagement. Implementation of these requirements within Argyll and Bute Council will be as follows: 249. The scope of the audit work should be established so that it is sufficient to satisfy the engagement’s objectives. The engagement scope should consider the following relevant areas of the Council (this should also consider relevant areas under the controls of outside parties): • systems • records • personnel • physical properties. 250. Where significant consulting opportunities have arisen during an assurance engagement, a specific written understanding as to the objectives, scope, respective responsibilities and other expectations should be developed and agreed with the CIA. 251. In the event that the scope cannot be agreed with the management or that there are concerns over any limitations, resource constraints or restrictions, such matters will be raised by the CIA with the most appropriate senior officer within the Council. If at this stage such matters cannot be resolved this will be reported to the Audit and Scrutiny Committee. Page 255
Page 256
36 252. Internal auditors will have the flexibility to make changes to the engagement objectives and scope when audit work identifies the need to do so as the engagement progresses. Such changes must be discussed with the CIA during the audit engagement. Evaluation Criteria - Standard 13.4 253. Internal auditors must identify the most relevant criteria to be used to evaluate the aspects of the activity under review as defined in the engagement objectives and scope. For advisory services the identification of evaluation criteria may not be necessary, depending on the agreement with relevant stakeholders. 254. Internal auditors must assess the extent to which the Board and senior management have established adequate criteria to determine whether the activity under review has accomplished its objectives and goals. If such criteria are adequate, internal auditors must use them for the evaluation. If the criteria are inadequate, internal auditors must identify appropriate criteria through discussion with the Board and/or senior management. Implementation of these requirements within Argyll and Bute Council will be as follows: 255. Internal auditors as part of the information gathering process and planning of the audit engagement determine the criteria to evaluate the effectiveness and efficiency of the governance, risk management and control processes of the area under review. 256. Internal auditors will consider the necessary criteria for identifying a difference between the desired state and the condition which represents potential findings. This may include but not limited to the following criteria: • Internal (policies, procedures, key performance indicators, targets) • External (laws, regulations and contractual obligations) • Authoritative practices (frameworks, standards, guidance, benchmarks) • Established organisational practices Engagement Resources - Standard 13.5 257. When planning an engagement, internal auditors must identify the types and quantity of resources necessary to achieve the engagement objectives. 258. Internal auditors must consider: • The nature and complexity of the engagement • The time frame within which the engagement is to be completed • Whether the available financial, human, and technological resources are appropriate and sufficient to achieve the engagement objectives. 259. If the available resources are inappropriate or insufficient, internal auditors must discuss the concerns with the CIA to obtain the resources. Implementation of these requirements within Argyll and Bute Council will be as follows: 260. The CIPFA Local Government Application note states that ‘No formula exists that can be applied to determine internal audit coverage needs. However, as a guide, the minimum level of coverage is Page 256
Page 257
37 that required to give an annual evidence-based opinion. Local factors within each organisation will determine this minimum level of coverage’. 261. It is the CIA’s responsibility to ensure that resourcing arrangements are in place to deliver the annual risk based internal audit plan and that those resources are flexible enough to cope with special requests. Where applicable the CIA may seek additional input from external providers. 262. The internal audit plan will document the budgeted resource requirements for the audit year. It will also include a contingency to address unplanned work. Should circumstances arise during the year that suggests that available resource levels will fall or appear to be falling below the level required to deliver the plan, the CIA will communicate the impact of resource limitations and significant interim changes to the Committee. Work Program - Standard 13.6 263. Internal auditors must develop and document an engagement work program to achieve the engagement objectives. 264. The engagement work program must be based on the information obtained during engagement planning, including, when applicable, the results of the engagement risk assessment. 265. The engagement work program must identify: • Criteria to be used to evaluate each objective • Tasks to achieve the engagement objectives • Methodologies, including the analytical procedures to be used, and tools to perform the tasks • Internal auditors assigned to perform each task. 266. The CIA must review and approve the engagement work program, before its implemented and promptly when any subsequent changes are made. Implementation of these requirements within Argyll and Bute Council will be as follows: 267. The CIA has developed a template work programme which provides a clear link between the programme and the agreed terms of reference and Internal Auditors should use this template for all assignments. The template demonstrates how the work performed meets the agreed engagement objectives. 268. The work programme should be created by the internal audit team member assigned the audit, in discussion with the CIA, and include procedures for identifying, analysing, evaluating and documenting information. Work programmes for consulting engagements may vary in form and content depending on the nature of the engagement. This will require the approval of the CIA. 269. Work programmes must be approved by the CIA prior to implementation for each engagement and amended as necessary. Principle 14 – Conduct Engagement Work 270. Internal auditors implement the engagement work program to achieve the engagement objectives. Page 257
Page 258
38 271. To implement the engagement work program, internal auditors gather information and perform analysis and evaluations to produce evidence. These steps enable internal auditors to: • Provide assurance and identify potential findings • Determine the causes, effects, and significance of the findings • Develop recommendations and/or collaborate with management to develop action plans • Develop conclusions. Gathering Information for Analyses and Evaluation - Standard 14.1 272. To perform analysis and evaluations, internal auditors must gather information that is: • Relevant - consistent with engagement objectives, within the scope of the engagement, and contributes to the development of engagement results • Reliable – factual and current. Internal auditors use professional scepticism to evaluate whether information is reliable. Reliability is strengthened when the information is: o Obtained directly by an internal auditor or from an independent source. o Corroborated. o Gathered from a system with effective governance, risk management, and control processes. • Sufficient – when it enables internal auditors to perform analyses and complete evaluations and can enable a prudent, informed, and competent person to repeat the engagement work program and reach the same conclusions as the internal auditor. 273. Internal auditors must evaluate whether the information is relevant and reliable and whether it is sufficient such that analyses provide a reasonable basis upon which to formulate potential engagement findings and conclusions. 274. Internal auditors must determine whether to gather information for analyses and evaluation when evidence is not relevant, reliable, or sufficient to support engagement findings. If relevant evidence cannot be obtained, internal auditors must determine whether to identify that as a finding. Implementation of these requirements within Argyll and Bute Council will be as follows: 275. Internal auditors are required to identify sufficient, reliable, relevant and useful information to achieve each engagement’s objectives. 276. Sufficient information is factual, adequate and convincing so that a prudent, informed person would reach the same conclusions as the auditor. Reliable information is the best attainable information through the use of appropriate engagement techniques. Relevant information supports engagement observations and recommendations and is consistent with the objectives for the engagement. Useful information helps the organisation meet its goals. 277. In the event that such evidence cannot be obtained or deemed reliable, an appropriate finding or observation will be communicated within the report to management. Analyses and Potential Engagement Findings - Standard 14.2 278. Internal auditors must analyse relevant, reliable, and sufficient information to develop potential engagement findings. For advisory services, gathering evidence to develop findings may not be necessary, depending on the agreement with relevant stakeholders. Page 258
Page 259
39 279. Internal auditors must analyse information to determine whether there is a difference between the evaluation criteria and the existing state of the activity under review, known as the ‘condition’. 280. Internal auditors must determine the condition by using information and evidence gathered during the engagement. 281. A difference between the criteria and the condition indicates a potential engagement finding that must be noted and further evaluated. If initial analyses do not provide sufficient evidence to support a potential engagement finding, internal auditors must exercise due professional care to determine whether additional analyses are required. 282. If additional analysis is required, the work program must be adjusted accordingly and approved by the CIA. 283. If internal auditors determine that no additional analysis is required and there is no difference between the criteria and the condition, the internal auditors must provide assurance in the engagement conclusion regarding the effectiveness of the activity’s governance, risk management, and control processes. Implementation of these requirements within Argyll and Bute Council will be as follows: 284. Internal auditors must consider the information that is available in terms of achieving the objectives of the audit, in doing so, they may need to perform appropriate analysis if information using a variety of options, including but not limited to, ratio, trend, regression analysis, financial comparison, benchmarking. It is important for the internal auditor to assess what would be appropriate within each specific review and what would be the most helpful in achieving the objectives of the review. 285. There may also be the need for additional testing where concerns have been identified through initial testing results in order to identify unacceptable errors which will need to be reported to management in the final report. Evaluation of Findings - Standard 14.3 286. Internal auditors must evaluate each potential engagement finding to determine its significance. When evaluating potential engagement findings, internal auditors must collaborate with management to identify the root causes when possible, determine the potential effects, and evaluate the significance of the issue. 287. To determine the significance of the risk, internal auditors must consider the likelihood of the risk occurring and the impact the risk may have on the organisation’s governance, risk management, or control processes. 288. If internal auditors determine that the organisation is exposed to a significant risk, it must be documented and communicated as a finding. 289. Internal auditors must determine whether to report other risks as findings, based on the circumstances and established methodologies. Page 259
Page 260
40 290. Internal auditors must prioritize each engagement finding based on its significance, using methodologies established by the CIA. Implementation of these requirements within Argyll and Bute Council will be as follows: 291. Internal auditors are required to document the relevant information required to support engagement conclusions and results. This includes the need to ensure that working papers are sufficiently complete and detailed to enable another experienced internal auditor with no previous connection with the audit to ascertain what work was performed, to re-perform it if necessary and to support the conclusions reached. Recommendations and Action Plans - Standard 14.4 292. Internal auditors must determine whether to develop recommendations, request action plans from management, or collaborate with management to agree on actions to: • Resolve the differences between the established criteria and the existing condition • Mitigate identified risks to an acceptable level • Address the root cause of the finding • Enhance or improve the activity under review. 293. When developing recommendations, internal auditors must discuss the recommendations with management of the activity under review. 294. If internal auditors and management disagree about the engagement recommendations and/or action plans, internal auditors must follow an established methodology to allow both parties to express their positions and rationale and to determine a resolution. Implementation of these requirements within Argyll and Bute Council will be as follows: 295. All audit reports are to be drafted using the template developed by the CIA. This template requires, as a minimum, the overall audit opinion, executive summary, objectives and summary assessment, detailed findings, and an action plan. Any deviation from the template report requires approval by the CIA. 296. Prior to issuing the draft report internal auditors are required to discuss the draft findings with the appropriate officers to confirm factual accuracy. This will generally be carried out at a clearance meeting and a template has been created to facilitate and document that meeting. 297. Where auditors make recommendations and include an action plan, such recommendations are graded to allow the significance of findings to be ascertained. 298. Action plans will include a management response that sets out the agreed action and timescales for the completion of improvement actions. Internal Audit will enter the agreed actions and timescales in the internal audit follow up database. 299. Where there are any areas of disagreement between the internal auditors and management, which cannot be resolved by discussion, such disagreements should be recorded in the action plan and the residual risk highlighted. As all audit reports are reported to the Committee in their entirety this disagreement will be reported to the Committee as and when the report is presented. Page 260
Page 261
41 Engagement Conclusions - Standard 14.5 300. Internal auditors must develop an engagement conclusion that summarises the engagement results relative to the engagement objectives and management’s objectives. The engagement conclusion must summarize the internal auditors’ professional judgment about the overall significance of the aggregated engagement findings. 301. Assurance engagement conclusions must include the internal auditors’ judgement regarding the effectiveness of the governance, risk management and/or control processes are effective. Implementation of these requirements within Argyll and Bute Council will be as follows: 302. Internal auditors are required to document the relevant information required to support engagement conclusions and results. This includes the need to ensure that working papers are sufficiently complete and detailed to enable another experienced internal auditor with no previous connection with the audit to ascertain what work was performed, to re-perform it if necessary and to support the conclusions reached. 303. When performing audits, internal auditors are required to base their conclusions and engagement results on appropriate analysis and evaluation whilst remaining alert to the possibility of: • intentional or unintentional wrongdoing • errors and omissions • poor value for money • failure to comply with Council policy • conflicts of interest. Engagement Documentation - Standard 14.6 304. Internal auditors must document information and evidence to support the engagement results. The analysis, evaluations, and supporting information relevant to an engagement must be documented such that an informed, prudent internal auditor, or similarly informed and competent person, could repeat the work and derive the same engagement results. 305. Internal auditors and the engagement supervisor must review the engagement documentation for accuracy, relevance, and completeness. The CIA must review and approve the engagement documentation. Internal auditors must retain engagement documentation according to relevant laws and/or regulations as well as policies and procedures of the internal audit function and the organization. Implementation of these requirements within Argyll and Bute Council will be as follows: 306. Internal auditors are required to document the relevant information required to support engagement conclusions and results. This includes the need to ensure that working papers are sufficiently complete and detailed to enable another experienced internal auditor with no previous connection with the audit to ascertain what work was performed, to re-perform it if necessary and to support the conclusions reached. 307. Records management must be consistent with the Council’s overall document retention policy, which is in turn consistent with the requirements of the Information Commissioner’s Office. Internal Audit record keeping must also be consistent with the specific requirements of the area Page 261
Page 262
42 audited, for example EU audits require documents to be kept for 7 years after the last payment has been made. 308. Electronic engagement records are kept in a restricted folder and on Sharepoint. ICT are responsible for the security controls, and the CIA is responsible for specifying who should have access to this. 309. The CIA shall obtain the approval of senior management and/or legal counsel as appropriate before releasing any engagement records to external parties. Principle 15 – Communicate Engagement Results and Monitor Action Plans 310. Internal auditors communicate the engagement results to the appropriate parties and monitor management’s progress toward the implementation of recommendations or action plans. 311. Internal auditors are responsible for issuing a final communication after completing the engagement and communicating the engagement of the activity under review to confirm that action plans are implemented. Final Engagement Communication - Standard 15.1 312. For each engagement, internal auditors must develop a final communication that includes the engagement’s objectives, scope, recommendations and/or action plans if applicable, and conclusions. 313. The final communication for assurance engagements also must include: • The findings and their significance and prioritisation • An explanation of scope limitations, if any • A conclusion regarding the effectiveness of the governance, risk management and control processes of the activity reviewed. 314. The final communication must specify the individuals responsible for addressing the findings and the planned date by which the final communication should be completed. 315. When Internal auditors become aware that management has initiated or completed actions to address a finding before the final communication, the actions must be acknowledged in the communication. 316. The final communication must be accurate, objective, clear, concise. Constructive, complete, and timely, as described in Standard 11.2 Effective Communication. 317. Internal auditors must ensure the final communication is reviewed and approved by the CIA before it is issued. 318. The CIA must disseminate the final communication to parties who can ensure that the results are given consideration. Page 262
Page 263
43 319. If the engagement is not conducted in conformance with the GIAS. The final engagement communication must disclose the following details about the non-conformance: • Standard(s) with which conformance was not achieved • Reasons(s) for non-conformance. • Impact of non-conformance on the engagement findings and conclusions. Implementation of these requirements within Argyll and Bute Council will be as follows: 320. Communicating the results of our internal audit work is a crucial aspect of the audit process and is the key link to our stakeholders including the SMT, Heads of Service, Elected Members, the Committee and (where appropriate) the public. 321. All audit reports are to be drafted using the template developed by the CIA. This template requires, as a minimum, the overall audit opinion, executive summary, objectives and summary assessment, detailed findings, and an action plan. Any deviation from the template report requires approval by the CIA. 322. Prior to issuing the draft report internal auditors are required to discuss the draft findings with the appropriate officers to confirm factual accuracy. This will generally be carried out at a clearance meeting and a template has been created to facilitate and document that meeting. 323. Where auditors make recommendations and include an action plan, such recommendations are graded to allow the significance of findings to be ascertained. 324. Action plans will include a management response that sets out the agreed action and timescales for the completion of improvement actions. Internal Audit will enter the agreed actions and timescales in the internal audit follow up database. 325. Where there are any areas of disagreement between the internal auditors and management, which cannot be resolved by discussion, such disagreements should be recorded in the action plan and the residual risk highlighted. As all audit reports are reported to the Committee in their entirety this disagreement will be reported to the Committee as and when the report is presented. 326. In completing audit activities, auditors are required to include and disclose all material facts identified as part of their audit work and subsequent reports which, if not disclosed, could distort their reports or conceal unlawful practice. Such disclosures should be made with reference to confidentiality requirements or other considerations that may preclude the release of information into the public domain which are primarily outlined in Schedule 7A Exempt Information – Local Government (Scotland) Act 1973 or as amended. 327. The work of Internal Audit should always seek to ensure that communications are accurate, objective, clear, concise, constructive, complete, and timely. 328. It is the CIA’s responsibility to ensure that where a final report contains a significant error or omission, subsequent changes, revisions or corrections are communicated to all parties who received the original communication. 329. Where any non-conformance with the GIAS has impacted on a specific engagement, the communication of the results should include the following disclosures: Page 263
Page 264
44 • the principle(s) or rule(s) of conduct of the GIAS with which full conformance was not achieved • the reason(s) for non-conformance • the impact of non-conformance on the engagement and the engagement results. 330. The CIA is responsible for determining the circulation of audit reports within the Council. This circulation should be mindful of confidentiality or the possibility of other legislative requirements. Standard practice is for the report to be issued to the: • Chief Executive • relevant Executive Director • relevant Head of Service • Head of Financial Services • SMT Admin (for inclusion in SMT meeting) • key audit contact • external audit • the Committee 331. The CIA shall determine whether there is any specific reason for the distribution list to be amended for any specific report. All audit reports are submitted in their entirety to the Committee which, through the transparent provision of committee papers, makes them public documents. In the event that the report contains sensitive information they may be restricted however this decision will only be taken in consultation with senior management and legal counsel as appropriate. Confirming the Implementation of Recommendations or Action Plans - Standard 15.2 332. Internal auditors must confirm that management has implemented internal auditors’ recommendations or management’s action plans following an established methodology, which includes: • Inquiring about progress on implementation • Performing follow-up assessments using a risk-based approach • Updating the status of management’s actions in a tracking system. Implementation of these requirements within Argyll and Bute Council will be as follows: 333. Internal Audit are responsible for following up on agreed action plans to ensure those actions are properly implemented. On a quarterly basis services are contacted and asked to provide an update on progress against all open action plan points. This is reported to the SMT on a quarterly basis and as a standard agenda item to the Committee. Where a service reports an action has been closed Internal Audit ask for evidence to support that status. All action plan points will remain open until appropriate action is demonstrably taken by management or the risk of no action is formally accepted. Page 264
Page 265
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 MARCH 2025 INTERNAL AUDIT – GLOBAL INTERNAL AUDIT STANDARDS AND APPLICATION NOTE FOR UK PUBLIC SECTOR 1. INTRODUCTION 1.1 The objective of the report is to provide the Audit and Scrutiny Committee (the Committee) with an update arising from the introduction of new Global Internal Audit Standards (GIAS) and the supplementary Application Note: GIAS in the UK Public Sector (Application Note) issued by the Chartered institute of Public Finance and Accountancy (Cipfa). The Application Note will complement the standards that will apply to the practice of internal audit from the perspective of the head of internal audit. In addition, there may be implications for the Audit and Scrutiny Committee in their oversight role as those charged with governance and responsibility to discharge these duties taking cognisance of such changes required in order to comply. 1.2 The Local Authority Accounts (Scotland) Regulation 2014 makes provision for Internal Audit to be a statutory service and a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing. 1.3 The current Public Sector Internal Audit Standards (PSIAS) will remain in force until 31 March 2025. 1.4 The new GIAS and Application Note relating to UK Local Government will come into effect on 1st April 2025. 2. RECOMMENDATIONS The Audit and Scrutiny Committee is asked to: 2.1 Note the requirements of the new GIAS Standards as outlined in para 3.3 of the report and also those contained within the Application Note which require the Council’s Internal Audit section to comply with effect from the 1 April 2025. 2.2 Note the gaps outlined in paragraph 3.5 which require to be addressed in order to comply and agree the action plan to address these requirements of the Standards. 2.3 . Note the additional duties expected of the Audit and Scrutiny Committee in their roles as ‘those charged with governance duties’. 3 DETAIL 3.1 A number of key elements of the new GIAS continues to retain existing areas of applicability in relation to the operation of Internal Audit, particularly how it performs it work, is managed and the ethical and professional requirements Page 265 Agenda Item 16
Page 266
expected of those working within the profession. However, these are laid out differently and also include a number of changes which promote further requirements within the profession. Specific areas or as it is called within the GIAS ‘Domains’ provide a worldwide set of Standards, however, the implementation of these in relation to some specific areas need to be considered specifically to the way they may relate in the public sector. The GIAS is helpful in many elements in a global and ‘broadbrush’ way which whilst helpful, there is a further need to set out how this is to be interpreted in the context and form that is suitable for internal audit practice in the UK public sector. 3.2 The process of review and how the implications of these GIAS are best integrated into the UK are considered through the authority of the ‘Relevant Internal Audit Standard Setters’ (RIASS). The RIASS have determined that the Institute of Internal Auditors’ new Global Internal Audit Standards (GIAS) will apply from 1 April 2025, subject to interpretations and requirements for the UK public sector which are set out in an Application Note as the internal audit standard setter for UK local government. CIPFA has consulted on the Application Note and have subsequently issued it in final form. The Application Note complements the Standards which apply to the practice of internal audit. 3.3 The GIAS consists of five overarching areas consistent with the operation of internal audit, which are called ‘domains’ and each domain has associated attached principles relating to specific requirements of practice, there is a total of 15 ‘Principles’ across these five domains. I. Purpose of Internal Auditing II. Ethics & Professionalism III. Governing the Internal Audit Function IV. Managing the Internal Audit Function V. Performing Internal Audit Services Page 266
Page 267
GIAS do not add any UK public sector requirements in relation to governance but to achieve conformance the internal audit function must demonstrate that there are adequate and appropriate arrangements for its governance. Domain III of the GIAS sets out baseline ‘essential conditions’ for governance, but these require adjustment to reflect the operation of governance within the UK local government sector. The CIPFA Application Note sets out the basis for suitably adjusted essential conditions, and when the code is applied, together with the Application Note, the objectives of the GIAS conditions will be achieved. The Application Note will apply to all local government bodies whether their internal audit function is delivered in-house, through a shared service, or outsourced. Approach to the assessment of any gap in complying with GIAS, UK Public Sector Application Note and Code of Practice 3.4 As outlined, there are a significant number of requirements which are taken over from the previous Standards and we are able to demonstrate compliance with, albeit having to be presented and documented in a different way within the new GIAS. Notwithstanding, there are six specific areas where there needs to be further work in terms of how we approach our full compliance but also demonstrate it effectively, particularly when it comes to our annual and five-year reviews. A good way of identifying these areas to address is through an initial ‘gap analysis’. It should be noted that it is intended that a document to support a thorough benchmark will not be available until late autumn, as advised by CIPFA, however, when this is issued, this definitive assessment platform will form the basis of a further assessment which will be undertaken. The information currently available provides a reasonable basis to identify many of the issues that need to be dealt with and once the full assessment tool is available, this will be used to identify if any other minor elements need to be addressed. 3.5 The ‘Gap Analysis’ has identified the following areas which will need to be addressed in order to demonstrate compliance with the GIAS and Application Note, together with who will be responsible for taking these actions forward and the timeline which these gaps will be addressed, these are summarised in the table below. Page 267
Page 268
3.6 Action Required Officer(s)/Member(s) Responsible and Completion Date The Internal Audit Annual report with effect from financial year 2025/26 will require to include a statement on compliance with the GIAS and Application Note. (Where compliance is not achieved this should be outlined along with the reasons and proposed action plan to address any deficiency) Chief Internal Auditor Internal Audit Annual Report 2025/26 – June 2026 (The 2025/26 financial year will be the first year of applicability). The Internal Audit Charter will require to be updated to reflect the changes contained in the GIAS and Application Note– “the audit committee should be satisfied that it covers the governance arrangements for internal audit. It must include the mandate derived from the regulations, plus any additional agreed mandate, and include internal audit’s reporting line to the audit committee. The charter should include the administrative reporting arrangements for internal audit and the chief audit executive”. Chief Internal Auditor Updated Charter and Manual March 2025 (As these documents are routinely assessed on an annual basis, further updates will be included, where required and applicable in future iterations), The Chief Audit Executive must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organisation….” Chief Internal Auditor New Internal Audit Strategy 2025-28 to be considered by the Audit and Scrutiny Committee. April 2025 The Audit Committee must review the safeguards of internal audit’s independence at least annually including any concerns about Chief Internal Auditor Proposed action – A formal statement will be contained within the Internal Audit Annual Report outlining the position of safeguarding Internal Audit independence Page 268
Page 269
independence from the Chief Internal auditor. and whether there have been any restrictions or concerns. (This will allow the Audit and Scrutiny Committee to review the statement within the Annual Report and seek any explanations as is required on the current safeguards and/or the opinion from the CIA). June 2025 The Audit Committee and senior management must engage with the Chief Internal Auditor to review whether internal audit’s financial, human and technological resources are sufficient to meet internal audit’s mandate as set out in the regulations and achieve conformance with GIAS (UK public sector). Chief Internal Auditor, Head of Finance and Audit and Scrutiny Committee Proposed action – The Chief Internal Auditor will outline each year in the Operational Audit Plan, whether in his opinion, there are sufficient resources to enable the plan to be fulfilled. The Audit and Scrutiny Committee will review the plan and where appropriate seek explanation if there are any concerns raised by the Chief Internal Auditor in relation to the resources provided or available to undertake the work contained within the plan. (The CIA will continue to make a provision within the plan for contingency/unplanned work or events as is prudent) March 2025 and annually thereafter (The determination of resources and budgetary requirements are dealt with through each departmental resource identification process and which Internal Audit participates). Where there is disagreement about the management of risks or agreed audit actions between internal audit and senior management, the Audit Committee must review and make their recommendation to either management or those charged with governance Chief Internal Auditor Proposed action – The Chief Internal Auditor would submit the Internal Audit report highlighting any area(s) and recommendation(s) which could not be agreed along with the management comments in such an event. (This will be specifically referenced within the Internal Audit Manual to reflect this process) March 2025 Page 269
Page 270
3.7 The current PSIAS will be effective until 31 March 2025 and will be applicable to the preparation and reporting which will be contained within the Internal Audit Annual Report and opinion, presented to the Committee in June 2025. Once the Application Note – Assessment Tool becomes available this will allow a further detailed review to be undertaken and, if necessary, action taken to address any residual identified gaps, deviation or non-compliance. 4. CONCLUSION 4.1 4.2 The Council’s Internal Audit service must comply with the new Standards, Application Note and any supplementary guidance in relation to how these Standards should be implemented in the public sector in the United Kingdom. The Audit and Scrutiny Committee have overview in that role and there are good and open communications lines in place that will continue to support such relationship between the Committee, CIA and senior management. The CIA through discussions with the Chair and Vice/Chair and overview of the Committee require to monitor progress in meeting any areas of change required. 5 IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – By having an Internal audit function which complies with regulatory and global standards helps to demonstrate a good foundation to support governance and may reduce risk 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 13 March 2025 For further information contact: Paul Macaskill, Chief Internal Auditor (01546 604108) Page 270
Page 271
ARGYLL AND BUTE COUNCIL Audit and Scrutiny Committee Legal and Regulatory Support 13 March 2025 Regulation of Investigatory Powers (Scotland) Act 2000 (RIPSA) Annual report 1.0 HEADLINES 1.1 The Regulation of Investigatory Powers (Scotland) Act 2000 (RIPSA) places a requirement on public authorities to authorise certain types of covert surveillance during planned investigations. 1.2 The Scottish Government Code of Practice on Covert Surveillance and Property Interference requires an annual report on the use of RIPSA to be reported to Members (‘the code of practice’) 2.0 RECOMMENDATIONS 2.1 The Audit and Scrutiny Committee consider and note the terms of the report. 3.0 DETAIL 3.1 Regulation of Investigatory Powers (Scotland) Act 2000 places a requirement on public authorities to authorise certain types of covert surveillance during planned investigations. 3.2 The Council has a policy and procedure in place that allows for appropriate authorisation of requests for covert surveillance to be considered/approved/refused and monitored through to completion. 3.2 Between 1 January 2024 and 31 December 2024 the Council undertook no covert surveillance operations. 3.3 Training for staff in Roads and Infrastructure and Regulatory Services was undertaken in February and March 2024. 4.0 CONCLUSION 4.1 The Council has met the requirements of the code of practice by providing this report to Committee. Page 271 Agenda Item 17
Page 272
5.0 IMPLICATIONS 5.1 Policy - None 5.2 Financial - None 5.3 Legal - None 5.4 HR - None 5.5 Fairer Scotland Duty: 5.5.1 Equalities - protected characteristics - None 5.5.2 Socio-economic Duty - None 5.5.3 Islands - None 5.6 Climate Change - None 5.7 Risk - None 5.8 Customer Service - None 5.9 The Rights of the Child (UNCRC) - None Douglas Hendry - Executive Director with responsibility for Legal and Regulatory Support Policy Lead - Councillor Mark Irvine 17 February 2025 For further information contact: Iain Jackson, Governance, Risk and Safety Manager 01546 604188 APPENDICES None Page 272
Page 273
Audit & Scrutiny Committee Work Plan 2025 This is an outline plan to facilitate forward planning of reports to the Audit & Scrutiny Committee Report Lead Service Regularity 13 March 2025 Reports to Committee Services by 17 February 2025 Internal Audit and Counter Fraud Summary of Activities Chief Internal Auditor Quarterly Internal and External Audit Report Follow Up Chief Internal Auditor Quarterly Internal Audit Reports to Audit and Scrutiny Committee 2024/25 Chief Internal Auditor Quarterly Verbal Update by Chair(s) of Scrutiny Panel Chair and Vice Chair of Audit & Scrutiny Committee Quarterly Audit Progress Report Forvis Mazars – Mark Outterside Quarterly RIPSA Annual Report Governance and Risk Manager Annual Internal Audit 2025/26 Plan and Internal Audit Strategy 2025-2028 Chief Internal Auditor Annual 2024/25 Unaudited Annual Accounts Preparation Plan and Timetable Head of Financial Services Annual 2024-25 Treasury Management Update as at 31 December 2024 Head of Financial Services Annual 2025-26 Treasury Management Strategy and Annual Investment Strategy Head of Financial Services Annual Internal Audit Charter and Internal Audit Manual Chief Internal Auditor Annual Scrutiny Manual and Framework Update Chief Internal Auditor Annual Report on the Implementation of the New GIAS and Application Note 2025 Chief Internal Auditor As required Scrutiny Options Report 2025-26 Chief Internal Auditor As required 12 June 2025 Reports to Committee Services by 19 May 2025 Internal Audit and Counter Fraud Summary of Activities Chief Internal Auditor Quarterly Internal and External Audit Report Follow Up Chief Internal Auditor Quarterly Internal Audit Reports to Audit and Scrutiny Committee 2024/25 ➢ Asbestos Management ➢ Bridges Inspection Regime Chief Internal Auditor Quarterly Page 273 Agenda Item 18
Page 274
Audit & Scrutiny Committee Work Plan 2025 Verbal Update by Chair(s) of Scrutiny Panel Chair and Vice Chair of Audit & Scrutiny Committee Quarterly Internal Audit 2024-25 Annual Report Chief Internal Auditor Annual External Audit – 2024/25 Annual Plan Forvis Mazars – Mark Outterside Annual Audit Strategy Memorandum Forvis Mazars – Mark Outterside Annual Annual Audit Plan for year ending 31 March 2025 Forvis Mazars – Mark Outterside Annual Audit Scotland Report – Financial Overview 2024/25 Head of Financial Services Annual Local Government Benchmarking Framework Report Head of Customer Support Services/HR & OD Manager – Carolyn Cairns/Jennifer Coyle Annual Unaudited Financial Accounts Head of Financial Services Annual Annual Report on Treasury Management Strategy Head of Financial Services Annual Statement of Governance and Internal Control Governance, Risk and Safety Manager Annual 4 September 2025 Reports to Committee Services by 11 August 2025 Internal Audit and Counter Fraud Summary of Activities Chief Internal Auditor Quarterly Internal and External Audit Report Follow Up Chief Internal Auditor Quarterly Internal Audit Reports to Audit and Scrutiny Committee 2024/25 Chief Internal Auditor Quarterly External Audit Progress Report Forvis Mazars – Mark Outterside Quarterly Verbal Update by Chair(s) of Scrutiny Panel Chair and Vice Chair of Audit & Scrutiny Committee Quarterly PSIAS Self-Assessment Chief Internal Auditor Annual Corporate Complaints Annual Report 2024-25 Governance, Risk and Safety Manager Annual Freedom of Information Annual Report 2024-25 Governance, Risk and Safety Manager Annual Audit & Scrutiny Committee 2024/25 Annual Report Audit & Scrutiny Committee Chair Annual Strategic Risk Register – Assurance Mapping Chief Internal Auditor Annual Strategic Risk Register Update Chief Executive Annual 16 December 2025 Reports to Committee Services by 21 November 2025 Internal Audit and Counter Fraud Summary of Activities Chief Internal Auditor Quarterly Internal and External Audit Report Follow Up Chief Internal Auditor Quarterly Internal Audit Reports to Audit and Scrutiny Committee 2024/25 Chief Internal Auditor Quarterly Verbal Update by Chair(s) of Scrutiny Panel Chair and Vice Chair of Audit & Scrutiny Committee Quarterly Page 274
Page 275
Audit & Scrutiny Committee Work Plan 2025 Performance Reporting Update (to include reference to LGBF) Chief Executive/Head of Customer Support Services/HR & OD Manager – Carolyn Cairns/Jennifer Coyle Quarterly Council Annual Report 2025/26 Head of Customer Support Services Annual Annual Auditors Report Forvis Mazars – Mark Outterside Annual Draft Thematic Review Forvis Mazars – Mark Outterside Annual 2024-25 Audited Annual Accounts Forvis Mazars – Mark Outterside/Section 95 Officer/Head of Financial Services Annual Treasury Management Strategy and Annual Investment Strategy – Mid-year Review Report 2025/26 Head of Financial Services Annual Page 275
Page 276
This page is intentionally left blank