Internal Audit Reports to Audit and Scrutiny Committee 2024/2025
Argyll and Bute Council · 17 December 2024
Back to Audit and Scrutiny Committee — 17 December 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 17 DECEMBER 2024 INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2024/2025 1. EXECUTIVE SUMMARY 1.1 There are seven audits being reported to the Audit and Scrutiny Committee. 1.2 The table below provides a summary of the conclusions for the audits performed. The full reports are included as appendices to this report. Audit Name Level of Assurance High Actions Medium Actions Low Actions VFM Actions Non-Domestic Rates Substantial 0 3 0 0 IR35 Off-Payroll Working and Compliance Limited 2 2 0 0 IT Risk Register and Mitigation Processes High 0 0 2 0 Community Education High 0 0 1 0 Culture (HSCP) Reasonable 0 5 0 0 Joint Strategic Planning (HSCP) Reasonable 0 2 1 0 Information Governance (HSCP) Substantial 0 2 1 0 1.3 Internal Audit provides a level of assurance upon completion of audit work. A definition for each assurance level is documented in each audit report. 2. RECOMMENDATIONS 2.1 Audit and Scrutiny Committee to review and endorse this summary report and the detail within each individual report. 3. DETAIL 3.1 A high level summary of each completed audit report is noted below: Non Domestic Rates (NDR): this audit has provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Policies and procedures are largely driven by legislation, with regular annual updates provided by the Scottish Government. Standard procedures, dated October 2023 are in place, this document covers Business Rates -
Page 2
liability, changes and business rates relief. On an annual basis the Scottish Government provide regular bulletins as updates, however, this document is not statutory. The document aims to inform a mutual understanding amongst local authority practitioners. Detailed information about the reliefs available are found on the Council website including standard application forms to be completed for each category of relief. Application for relief can be made online. During the testing process of records it was found that there was very little in the way of supporting documentation to substantiate claims for reliefs, in particular for SBBS relief. There are no further checks undertaken to ensure that where relief is applied that the business is still trading and entitled to the relief. Thirty properties were selected testing, across a mix of available reliefs. Where businesses are jointly owned, liability for NDR is joint and several, however, at present, only one party is required to complete the application form and declaration. There is very little guidance available to the Council to support how NDR relief appeals should be managed, therefore the Council have adopted their own system and processes. At present there is no appeals process or an independent panel set up and trained to hear NDR appeals. IR35 Off-Payroll Working and Compliance: This audit provided a limited level of assurance, indicating that internal control, governance, and risk management are displaying an unacceptable level of residual risk, which may compromise system objectives. Key weaknesses identified must be addressed within a reasonable timeframe, with management allocating appropriate resources to resolve these issues. The audit report identified key areas for improvement in the Council’s IR35 compliance process, resulting in two high priority, two medium priority and one low priority recommendations. Main recommendations include establishing a documented process for IR35 assessments, appointing a responsible team or individual to improve clarity and accountability, ensuring relevant staff receive training on the HMRC’s CEST tool, and implementing a formal process to communicate IR35 legislative changes or procedural updates to staff. It is important to note the context of the impact and this is unlikely to be a widespread problem but will involve small pockets of staff across the organisation in very specific roles. IT Risk Register and Mitigation Processes: this audit provided a high level of assurance. This means that internal control, governance and the management of risk are of a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. The Council’s Risk Management Manual has been followed in preparation of the Cyber Security Risk Register (CSRR). The CSRR includes risks identified via sound judgement of officers involved and credible information sources and are appropriately detailed along with evaluation and scoring. All risks have been assessed, scored and prioritised, however, current mitigations are not recorded for all risks despite key actions and deadlines having been identified and progressed, additionally, six risks were found to have residual scores lower than gross scores although no current mitigations are recorded. Risks, mitigating controls and key actions are identified by Officers with appropriate technical knowledge in collaboration with the ITC-CSO and passed to Management for oversight and approval purposes. All open risks are reviewed monthly and reported to security, ITMT and DMT meetings, any new insights received are considered immediately and escalated where required. All mitigating controls are reviewed and assessed for effectiveness and comments noted on the CSRR where appropriate, however, evidence of review is not
Page 3
always retained and scoring is not regularly reassessed. Management is made aware of progress in managing identified risks at appropriate forums via formal reporting mechanisms, the subsequent minutes indicate that the contents have been discussed, noted and actions assigned where required. Community Education: This audit is that we can take a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. As required by the Community Learning & Development (Scotland) Regulations 2013, the Argyll and Bute Community Learning and Development (CLD) Strategic Partnership Plan 2024-2027 has been created and published on the liveArgyll website in September 2024.There should be consistent use of names throughout the new plan, and a check carried out to determine if all appropriate logos are displayed. There are arrangements in place for the provision of CLD across all four of Argyll and Bute Council areas for both identified priority age groups - youth and adult. It is recognised by the Scottish Government that the ability to meet the needs of learners is bound by funding restrictions. The Adult Numeracy and Literacy provision is dependent on funding, which is due to end March 2025. Alternative options are being explored but there is a risk that these may not be met once funding ends. The Council and liveArgyll via the SLA have agreed monitoring and reporting for arrangements to ensure that there is appropriate strategic oversight and scrutiny of the community learning provision across Argyll and Bute and progress towards the strategic priorities and allows evaluation of the effectiveness of CLD provision. Culture (HSCP) (For Noting): this audit provided a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. The HSCP Culture & Wellbeing Group work plan, dated 2023, should be updated to reflect priorities that are specific, focussed, measurable and have clear outcomes with target completion dates. Progress against the work plan should be clearly recorded within the work plan. Consideration should be given as to how staff surveys could focus on specific issues relating to the HSCP in order to assess the culture within the HSCP. Consideration should be given to how the HSCP can better communicate with staff across both organisations to encourage staff to participate and share their views in surveys. Consideration should be given to how a balance of staff between NHS Highland and the Council could be represented on the Culture and Wellbeing Group. The HSCP Culture & Wellbeing Group have developed a work plan, dated 2023, which outlines priorities, outcomes, responsible person and timeframes. The group is monitoring progress against the work plan which was approved in 2023. Progress reports are updated at Culture Group meetings and recorded in the notes of the meeting Quarterly performance data reports on FOI’s are provided to all Departmental Management Team (DMT) meetings. The Culture Group meets on a regular basis. The Terms of Reference for the Culture and Wellbeing group were created in June 2022 with the most recent update in May 2023. Initially to get momentum going the group met 4 weekly, however, it was felt to be too often and it was agreed to meet bimonthly. In 2023 the Group met most months, with the exception on a few months when meetings were cancelled. Updates from the Culture Group are reported to the Senior
Page 4
Management Team (SLT) and the IJB, with minutes of the IJB available to assess on the website. Joint Strategic Planning (HSCP) (For Noting): this audit provided a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. In order to support the delivery of the JSP it is important that a corresponding workforce plan is in place that is aligned with priorities and objectives of the JSP and that it supports the attraction, recruitment, development and retention of the workforce required to deliver the JSP. A workforce plan has been published that covers the same period of the JSP i.e. 2022-2025. A review of the workforce plan noted that there was no evidence of a direct alignment between the current workforce planning document and the priorities and objectives set forth in the Joint Strategic Plan. Discussions with the Head of Strategic Planning, Performance and Technology, HSCP noted that the workforce plan was completed after the JSP due to COVID interfering with the initial timelines of the workforce plan. Whilst there is extensive documentary evidence of various implementation plans to meet the priorities and objectives outlined within the JSP (see below) there is no documentary evidence that an alignment has been carried out between the workforces and financial spends against each of the priorities specified within the JSP. A review of the minutes to the Strategic Leadership Team on 3rd May 2023 noted “difficulties in aligning workforce and financial spends to priorities”. The Health and Social Care Partnership (HSCP) has in place a Strategic Risk Register, which identifies the risk of failing to achieve the Joint Strategic Plan and the potential consequences. A review of the risk register confirmed the presence of mitigation measures aimed at mitigating this risk. However, it was observed that there is a lack of a specific risk register focusing on the risk and subsequent impact of not meeting the individual priorities and objectives outlined within the Joint Strategic Plan (JSP). It is recommended that the HSCP consider developing such a risk register to address this gap. HSCP publish quarterly performance reporting based on the Integrated Performance Management Framework (IPMF). A review of a sample of performance reports noted that the performance reports focus on eight key service areas. The reports provide detailed performance analysis of each service area and the 93 supporting Key Performance Indicators (KPIs), complemented by commentary from Heads of Service and Service Leads. It also includes performance data on National Health & Wellbeing Indicators, System Pressures, and National Delayed Discharge, utilising the new performance dashboard within SharePoint for enhanced data access and analysis. Whilst it was confirmed that the reports provide a wide range of performance, it was noted that the reports do not specifically align to the objectives and priorities of the JSP. Information Governance (HSCP) (For Noting): this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. The Integrated Joint Board adopted Argyll and Bute Council's Records Management Policy (RMP) on January 30th, 2019 as the basis for the IJB Records Management Plan. The Keeper of the Records of Scotland's Assessment Team confirmed the Argyll and Bute Integrated Joint Board (IJB) RMP is compliant with the Act. An information-sharing agreement
Page 5
was signed between Argyll and Bute Council and NHS Highland on May 28th, 2024. The Public Records (Scotland) Act 2011 mandates that the IJB appoints the Governance, Risk, and Safety Manager of Argyll and Bute Council as the operational lead for records management, with additional support from the Business Improvement Manager of the HSCP, both of whom are skilled and responsible for overseeing records management, data protection, and FOI requests. Document reviews are outstanding in regards to the Records Management Plan and the Information Governance Policy Framework. A number of improvement recommendations made by the Keeper of Scotland were identified in the areas such as Business clarification, retention schedules, destruction arrangements, Archiving and Transfers and Business Continuity and vital records. An action plan to address these areas should be agreed and implemented. During 2023/24, the Council received 165 Subject Access Requests, with 73% being responded to within the required 20-day timescale. It is estimated that 85% of these requests pertain to the Social Work services within the HSCP. However, a precise breakdown of the SARs pertaining to Social Work services was not available. 4. CONCLUSION 4.1 Management has accepted each of the reports submitted and have agreed responses and timescales in the respective action plans. 5. IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – The implementation of recommendations contained in audit reports may help mitigate the risk to the Council. 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 17 December 2024 For further information contact: Paul Macaskill, Chief Internal Auditor Tel: 01546 604108 Email: paul.macaskill@argyll-bute.gov.uk APPENDICES 1. Non Domestic Rates (NDR) 2. IR35 Off-Payroll Working and Compliance 3. IT Risk Register and Mitigation Processes
Page 6
4. Community Education 5. Culture (HSCP) 6. Joint Strategic Planning (HSCP) 7. Information Governance (HSCP)