2024_25_InternalAudit_ITRiskRegister&MitigationProcesses_FinalReport
Argyll and Bute Council · 17 December 2024
Back to Audit and Scrutiny Committee — 17 December 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Classification: OFFICIAL Argyll and Bute Council Internal Audit Report November 2024 FINAL High Medium Low VFM Number of Findings 0 0 2 0 IT Risk Register & Mitigation Processes Audit Opinion: High
Page 2
2 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Key Dates ................................................................................................................................................ 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 10 Appendix 2 – Audit Opinion ................................................................................................................. 12 Contact Details Internal Auditor: Mhairi Weldon Telephone: 01546 604294 e-mail: mhairi.weldon@argyll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL 1. Executive Summary Introduction 1. As part of the 2024/25 internal audit plan, approved by the Audit & Scrutiny Committee in March 2024, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to IT Risk Register and Mitigation Processes. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. Risks are significant uncertainties that may affect the Council’s ability to achieve its strategic and operational objectives. Risk management is a key part of the Council's governance and internal control arrangements, it is the planned and systematic, cyclical process by which key risks are identified, evaluated and managed so as to maximise benefits and minimise potentially negative consequences to the Council and its partners. 5. The Council has prepared a Risk Management Manual to provide an overview of the risk management process within the Council and give practical guidance for consistent and proportionate management of risks across all service areas. It is the responsibility of managers to manage risks effectively within their operational areas and involve all employees in the risk identification and management process by communicating any concerns or risks to their team’s objectives. 6. Risk registers provide an inventory of identified risks, their specific challenges and consequences, mitigating actions to reduce the impact and likelihood and risk scoring. The resultant residual risk scores aid prioritisation of risks to ensure they are allocated sufficient resources to meet operational requirements within the agreed risk appetite. 7. In accordance with the “digital by default” position adopted in the 2021-24 ICT and Digital Strategy and the “Connect for Success” objective in the Data Strategy 2024-28, the Council places significant reliance on the integrity and availability of its data to inform decision-making and effectively deliver its services. 8. The working environment is no longer restricted to Council buildings; flexible working and the use of remote technologies provides numerous opportunities, however, this brings with it a greater risk of Information security incidents. Additionally, the Council continues to deliver digital transformational changes leading to significant new risks. 9. Operating within a landscape of changing risks and quickly evolving cyber threats means that sound risk management practices are required within the IT environment to provide a positive
Page 4
4 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL impact on the Council’s information assets by limiting risk exposure and exploiting potential opportunities. Scope 10. The scope of the audit was to review and assess the ICT Service Risk Register, together with any mitigations in place for day-to-day operational matters including cyber security as outlined in the Terms of Reference agreed with the Head of Customer Services on 7 October 2024. Key Dates 11. The Terms of Reference provided provisional timescales for the review to take place, the actual dates are noted below. Exhibit 1 – Key Dates Stage Actual Date Terms of Reference agreed 7 October 2024 Fieldwork Commencement 10 October 2024 Draft Report issued 18 November 2024 Management Comments received 21 November 2024 Final Report issued XX November 2024 Audit and Scrutiny Committee 17 December 2024 Risks 12. The risks considered throughout the audit were: • SRR10: Service Delivery – Cyber Security • Audit Risk 1: failure to identify appropriate risks to service delivery • Audit Risk 2: failure to adequately mitigate identified risks Audit Opinion 13. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 14. Our overall audit opinion for this audit is that we can take a high level of assurance. This means that Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Recommendations 15. We have two low priority recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below:
Page 5
5 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL • Cyber Security Risk Register should be updated to reflect all current mitigating controls and up-to-date scoring and prioritisation. • Evidence of review of mitigating controls should be retained. 16. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 17. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Relevant risks are identified, considered and included in ICT Risk Register. SRR10 Audit Risk 1 High The Council’s Risk Management Manual has been followed in preparation of the Cyber Security Risk Register (CSRR). The CSRR includes risks identified via sound judgement of officers involved and credible information sources and are appropriately detailed along with evaluation and scoring. 2 Appropriate mitigation activities are identified and implemented to meet desired risk appetite of Council/Service. SRR10 Audit Risk 2 Substantial The CSRR contains 51 risks, 20 of which are now closed, all have been assessed, scored and prioritised. Current mitigations are not in place for all risks, however, key actions and deadlines have been identified, additionally, six risks were found to have residual scores lower than gross scores despite there being no current mitigations in place. Risks, mitigating controls and key actions are identified by Officers with appropriate technical knowledge in collaboration with the ITC-CSO and passed to Management for oversight and approval purposes. 3 Mitigating activities are monitored regularly and updated in accordance with changes in the risk environment. SRR10 Audit Risk 2 Substantial All open risks are reviewed monthly and reported to security, ITMT and DMT meetings, any new insights received are considered immediately and escalated where required. All mitigating controls are reviewed and assessed for effectiveness and comments noted on the CSRR where appropriate, however, evidence of review is not always retained and scoring is not regularly reassessed.
Page 6
6 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL Control Objective Link to Risk Assessment Summary Conclusion 4 Risks are reported to appropriate forums for discussion and passed to senior management for oversight and escalation where relevant and required. All Risks High Management is made aware of progress in managing identified risks at appropriate forums via formal reporting mechanisms, the subsequent minutes indicate that the contents have been discussed, noted and actions assigned where required. 18. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings Relevant risks are identified, considered and included in ICT Risk Register 19. The Council’s Risk Management Manual has been communicated to the ICT Compliance and Security Officer (ICT-CSO) who prepares the Cyber Security Risk Register (CSRR), a recently appointed assistant, IT Engineer (ITE) will assist with maintenance of this register on a monthly basis to provide resilience. Both officers are familiar with the content of the manual and maintain the CSRR in accordance with the guidance and template provided. 20. The ICT-Compliance and Security Team are appropriately positioned to undertake this role, they hold suitable qualifications and have gained extensive experience in supporting IT infrastructure, including assessment and management of risks. 21. A comprehensive list of all Council systems and applications identified as critical has been created for disaster recovery purposes and is updated periodically when changes or testing takes place. Links to the associated documentation and run books are in the process of being added. A further list has been developed to prioritise systems for restoration should an adverse cyber event occur. 22. Risks pertaining to these critical systems and applications have been identified by a variety of means, including: • Participation in the Cyber Security Information Sharing Partnership (CISP) and Scottish Local Authority Information Security Group (SLAISG) where discussions take place concerning key risks, how they are managed, and sharing of insights and sources of new information and resources • Attendance at specific events or seminars and sharing important information with colleagues upon return • Reviewing details of relevant security incidents at other organisations. • Daily reports covering emerging threats from CyberScotland, Scottish Cyber Coordination Centre (SC3) • Monthly and ad-hoc threat reports from our Security Operations Centre • Alerts from National Cyber Security Centre • Automated internal system alerts and scanning to detect vulnerabilities • Annual ICT Health Checks to comply with necessary and appropriate frameworks
Page 7
7 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL • Annual Penetration testing 23. Where risks cannot be fully addressed immediately upon identification, they are added to the CSRR, this ensures that oversight is maintained while appropriate mitigating actions are considered for implementation to reduce or remove the risk to the Council’s systems and applications. 24. The CSRR contains a considerable range of risks of varying degrees of concern, each with a brief description, their relationship to service delivery, consequences should the risk occur, a gross score taking into account the likelihood and impact of occurrence, current mitigations in place, a residual score, key actions and deadlines to further manage the risks, review date, risk owner, team assigned responsibility and whether the risk remains open or is closed. 25. The content of the CSRR is summarised to provide a high-level entry in both the Departmental Operational Risk Register (ORR) and Strategic Risk Register (SRR) to provide oversight at senior management levels. 26. The likelihood and impact of risks occurring is assessed by the team assigned responsibility for managing the risk, this is based on their knowledge and experience within their respective fields of expertise. Scores are appropriately applied in accordance with guidance provided within the Risk Management Manual to aid prioritisation using Red, Amber and Green (RAG) ratings. Appropriate mitigation activities are identified and implemented to meet desired risk appetite of Council/Service 27. As at 7 November 2024, the CSRR contained 51 risks, all of which have been assessed, scored and prioritised. Of these risks, 20 have been either fully mitigated or sufficiently reduced to a tolerable level and subsequently closed. The 31 open risks are subject to regular review, a brief analysis is provided in the tables below: Following reassessment or implementation of mitigating actions taken to date, 19 risks have received a reduction in scoring whilst 12 have not changed: Risk Score and priority No. of Risks with Gross Score No. of Risks with Residual Score 25 0 0 20 2 0 16 0 0 15 18 9 12 3 2 10 2 7 9 2 2 8 1 6 6 2 2 5 0 0 4 0 2 3 0 0 2 1 0 1 0 1 TOTAL 31 31
Page 8
8 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL In terms of RAG priority ratings, 12 have moved into lower ratings and 19 remain the same: Gross RAG Priority Rating Residual RAG Priority Rating No. of Risks Red Red 9 Red Amber 10 Red Green 1 Amber Amber 7 Amber Green 1 Green Green 3 TOTAL 31 28. Within the CSRR, there is a column to enter ‘Current Mitigation’, this was completed in all instances, however, 16 risks stated within this column, stated that there were either no current mitigations in place or that there were none beside that provided by standard security arrangements. The ‘Key Actions and Deadlines’ column, however, has been populated for all risks and this appears to contain some mitigating actions that have not been recorded in the ‘Current Mitigation’ column. Action Plan 1 29. Six risks were found to have residual scores stated that were lower than the gross risk scores despite there being no current mitigations populated. Action Plan 1 30. Mitigating controls, key actions and deadlines are identified and assessed by the technical leads in each team allocated responsibility for managing risks in collaboration with the ICT-CSO and discussed at monthly security meetings to assess effectiveness and whether further control mechanisms are required. 31. These Officers possess appropriate technical knowledge, skills and experience to identify risks and associated mitigating controls, additional guidance may also be provided via compliance frameworks adopted by the Council e.g. Public Sector Network (PSN) or Cyber Essentials Plus (CE+), national alerts from recognised bodies e.g. NCSC or SC3, information sharing partnerships and lessons learned from other organisations. 32. Mitigating controls and key actions stated within the CSRR are consistent with the risk identified whilst taking cognisance of any financial constraints and service restrictions that may occur as a result of implementation. 33. A Security Highlight Report including a link to the CSRR is submitted monthly to the following forums for oversight, review and approval purposes: • Security Meetings attended by IT Managers, Senior IT Officers and the relevant technical officers • Information Technology Management Team (ITMT) attended by the Head of Service, IT Managers, the ICT-CSO and other officers as required and • Departmental Management Team (DMT) attended by the Executive Director, Heads of Service and other officers as required
Page 9
9 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL Mitigating activities are monitored regularly and updated in accordance with changes in the risk environment 34. All entries in the CSRR are reviewed and assessed on an individual basis either at the monthly security meetings or immediately upon receipt of relevant insights by Officers. A post- implementation review takes place of all mitigating controls to ensure they are operating effectively e.g. by re-running scans or checking tools. Whilst comments are input to the ‘Key Actions and Deadlines’ column of the CSRR confirming review, evidence is not always retained for further reference. Action Plan 2 35. New and additional actions may be identified as a result of IT Health Checks, updates to compliance frameworks or via reliable information sources and sharing arrangements. 36. The CSRR is a live document which is reviewed monthly in alignment with security, ITMT and DMT meetings and actions updated where any changes have occurred or are newly planned, however, residual Risk scores are not reviewed regularly. Action Plan 1 Risks are reported to appropriate forums for discussion and passed to senior management for oversight and escalation where relevant and required 37. As noted in paragraph 33 above, Management is made aware of new and escalating risks as well as those that have been either fully mitigated or managed to a tolerable level via security highlight reports and a link to the CSRR for review. Additionally, as the CSRR informs the content of the Department’s Operational Risk Register (ORR) and the Strategic Risk Register (SRR), the Strategic Management Team (SMT) review the SRR and High Risks from the ORRs six-monthly and an annual report is submitted to the Audit and Scrutiny Committee. These reporting mechanisms provide sufficient management oversight and opportunity for requesting further information for approval and noting purposes. 38. The content of both reports to management and the risk registers indicate that progress has been made in mitigating identified risks. 39. Meeting minutes reviewed indicate that the content of reports submitted have been discussed, noted and actions assigned where appropriate.
Page 10
Classification: OFFICIAL Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Low 1 Cyber Security Risk Register (CSRR) Maintenance Finding: There were no current mitigations in place for 16 risks recorded, however, notes within the Key actions and deadlines column indicate that mitigating actions had been completed in some instances. Finding: six risks were found to have residual scores lower than gross scores despite there being no mitigating controls recorded. Finding: Residual scores are not reviewed regularly. Recommendation: The CSRR is updated to reflect up-to- date mitigating actions and scoring. The CSRR may not accurately reflect current mitigating controls and scoring resulting in incorrect prioritisation. The CSRR will be updated to reflect up to date mitigating actions and scoring and will be maintained at that level forthwith. ICT and Digital Manager 31 December 2024 Low 2 Review of Mitigating Controls Finding: Comments are input to the CSRR indicating that review has taken place, however, evidence is not always retained for reference. Recommendation: Evidence of post-implementation review is retained. Mitigating controls may not be operating effectively. Any evidence of post- implementation review will be retained. ICT and Digital Manager 31 December 2024
Page 11
11 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 12
12 Argyll and Bute Council – Internal Audit Report – IT Risk Register and Mitigation Processes, November 2024 Classification: OFFICIAL Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.