Covering Report and Internal Audit Reports
Argyll and Bute Council · 13 June 2024
Back to Audit and Scrutiny Committee — 13 June 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 JUNE 2024 INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2023/2024 1. EXECUTIVE SUMMARY 1.1 There are six audits being reported to the Audit and Scrutiny Committee. 1.2 The table below provides a summary of the conclusions for the audits performed. The full reports are included as appendices to this report. Audit Name Level of Assurance High Actions Medium Actions Low Actions VFM Actions Financial Ledger Substantial 0 0 0 0 Learning and Physical Disability Care Packages Reasonable 0 7 0 0 Scottish Social Services Council (SSSC) Registration Substantial 1 1 4 0 Freedom of Information (FOI) High 0 0 4 0 Cloud Based Computer Services Substantial 0 4 1 0 Client Funds – Progress Review (EXEMPT) Reasonable 0 3 0 0 1.3 Internal Audit provides a level of assurance upon completion of audit work. A definition for each assurance level is documented in each audit report. 2. RECOMMENDATIONS 2.1 Audit and Scrutiny Committee to review and endorse this summary report and the detail within each individual report. 3. DETAIL 3.1 A high level summary of each completed audit report is noted below: Financial Ledger: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. After the initial delay of the start date, Fusion became operational in June 2022. Whilst fully operational it is recognised that some functionality has been lost which was previously available in Oracle EBS 12.1 resulting in the requirement to use
Page 2
manual interventions. However, it is reported that the manual interventions are functioning well and in relation to time do not add significant additional work. All feeder systems within the Financial Ledger are operating effectively. Interface feeder system reports are run by the system administration team. Cash and debtors interface reports are produced every day, however, others are generated when staff members process them – for example payroll (around the same timings every month). OTBI (Oracle Transactional Business Intelligence) Self Service is the replacement for Discoverer viewer. There is now no longer a need to build reports as a standard set of reports are available for users, although a number of users have full licences to allow them to write reports. Users of Fusion reported a more user friendly reporting tool, however, commented that there had been a loss of some functionality which was available in Discoverer Viewer. The work around for the loss of functionality now requires manual processes. It was reported that whist it does create additional work, this is not a time consuming job. Learning and Physical Disability Care Packages: this audit provided a reasonable level of assurance. Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Care Assessment policies and procedures are in place with a number of key documents provided for review, although these may not refer current practice and refer to Carefirst. Assessment and Care Planning Procedures’ (V1) details that the purpose of the policy, procedures and practice guidance is to improve outcomes for service users and carers by providing clear guidance for social work staff about assessment and planning with individuals. Case reviews are undertaken when there are significant changes to the client’s care needs. Children with Learning Disabilities are provided with a full care assessment when they move to Adult Services. We reviewed a 9% sample size of Learning Disability high value care packages. Clients are assigned a case manager, although heavy reliance is placed on the care providers reporting and updating the case manager on a regularly basis. Where case managers were not assigned, this was due to the allocated Social Worker moving on to different positions and the case was assigned to the specific team for Learning Disability. Case notes are maintained on Eclipse, the replacement client database for Carefirst. It was noted that case notes were not always maintained and up to date. A previous audit report highlighted the fact that client records were stored in multiple locations, including on the Council’s network drive. A Resource Allocation framework is in place based on a prioritisation of needs process. The prioritisation of all referrals is based primarily on the information received at the time of referral including any relevant background information held on CareFirst/Eclipse and is prioritised according to risk. Roles and Responsibilities are outlined in the various policies and procedures. The “Assessment and Care Planning procedures” outlines the roles and responsibilities for each of the staff categories. Scottish Social Services Council (SSSC) Registration: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Policies, procedures and guidance are available to support employees in their roles, however, some of these are overdue for review or lack version control. Recruitment follows a robust and consistent corporate
Page 3
process with a comprehensive induction programme in place, this includes provision of guidance on expected conduct of employees in undertaking their duties, there is no documentation regarding expected conduct of service users towards employees. SSSC registration status is regularly monitored by managers and centrally by the Council’s HR team to identify any issues to be addressed. Training needs, SVQ progress and continuous professional learning requirements are identified and discussed between managers and employees and overseen by the Social Work Training Board, additionally, feedback is gathered from service-users and employees to inform both individual and service level improvement plans. The supervision policy requires a significant time commitment from all involved, is applied inconsistently across care homes and contains no evidence of review since creation in 2011. Concerns raised regarding an employee’s fitness to practice are managed in accordance with the SSSC Codes of Practice and Council policies with support provided by the Council’s HR Officers. Freedom of Information: a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. The Council has an overarching procedure note for the collection and response to Information requests, this is published on the Council’s Intranet but is not up to date and does not reflect current working practices. Mandatory training for all staff is available on the LEON system, which also records and monitors completion. Additional training is provided to designated Service FOI representatives, who are responsible for ensuring that actions and correspondence in relation to the request are logged on the tracking database. There is a Teams Channel where FOI Service reps can access training and other materials. Key contact details, on the Hub, for staff involved in the collection and response to Information requests are not up to date. A review of the Council’s Publication scheme should be undertaken, including checking that any links to information are still working. The Compliance and Regulatory team provide monthly updates to the Chief Executive, the Chief Officer, Directors, Heads of Service and the departmental FOI reps. Quarterly reports are provided to all DMTs and on an annual basis to the Audit and Scrutiny Committee. The information in the reports is clear and relevant. The recent addition of a second tab provides Senior Managers with a detailed breakdown of the late responses and the reasons for such which further highlight specific areas for improvement. To highlight the number of marginally late responses, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. Cloud Based Computer Services: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. ICT and procurement teams assist services implement new systems following robust due diligence processes. Contracts and supporting documentation reviewed contained details of arrangements for business continuity, data recovery, change management and performance targets and appropriate oversight takes place. The ICT contracts application did not, however, contain records pertaining to all systems contained on a list provided. Cloud service providers have measures in place to protect the Council’s data in transit and at rest from unauthorised access, however multi-factor
Page 4
authentication (MFA) was not utilised for two systems reviewed, new users were not appropriately authorised in three instances and leavers are not always promptly notified to systems administrators. Whilst the cloud service providers have arrangements in place to ensure ongoing availability of services and customer data, the Council also has responsibilities and as such has a comprehensive overarching cyber-incident response plan in place. Specific cloud service disaster recovery plans/run books require to be prepared, updated and/or finalised and tested. Client Funds – Progress Review (EXEMPT): provided a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. The scope of the audit was to undertake a high level review of the agreed actions for the introduction and implementation of client fund accounts held on behalf of clients who lack capacity, noting progress and providing a revised action plan and dates for completion. The February 2023 report highlighted 8 high priority and 2 medium priority recommendations where there was scope to strengthen the control and governance environment. There have been significant resources deployed to enable the good progress so far, with 8 of the 10 recommendations now complete, and the 2 delayed and rescheduled actions rely on input from other services before they can be completed. There are 3 medium recommendations arising from this review. Argyll and Bute Health and Social Care Partnership (HSCP) have developed the Managing Service User’s Money Policy which sets out detailed processes and underlying operational procedures to ensure the management of client funds, however, these are not yet fully operational. Amendments have been added to the contracts of 3rd party providers of services in the community, recognising the need for providers to maintain appropriate financial records for clients and create the right for the Council to carry out independent reviews of records. A schedule for internal and external independent reviews is being developed. There is now a SharePoint site, which has been created to store information and records relating to the financial management of clients’ funds in one location. 4. CONCLUSION 4.1 Management has accepted each of the reports submitted and have agreed responses and timescales in the respective action plans. 5. IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – The implementation of recommendations contained in audit reports may help mitigate the risk to the Council. 5.8 Customer Service – None
Page 5
5.9 The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 13 June 2024 For further information contact: Paul Macaskill, Chief Internal Auditor Tel: 01546 604108 Email: paul.macaskill@argyll-bute.gov.uk APPENDICES 1. Financial Ledger 2. Learning and Physical Disability Care Packages 3. Scottish Social Services Council (SSSC) Registration 4. Freedom of Information Requests 5. Cloud Based Computer Services – To Follow 6. Client Funds – High Level Progress Review