2023_2024_FreedomOfInformation(FOI)_Report_FINAL
Argyll and Bute Council · 13 June 2024
Back to Audit and Scrutiny Committee — 13 June 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Report April 2024 FINAL High Medium Low VFM Number of Findings 0 0 4 0 Freedom of Information Audit Opinion: High
Page 2
2 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 Contents Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 1. Objectives and Summary Assessment ........................................................................................... 5 2. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 11 Appendix 2 – Audit Opinion ................................................................................................................. 13 Contact Details Internal Auditor: Annemarie McLean Telephone: 01700 501354 e-mail: annemarie.mclean@argyll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 Executive Summary Introduction 1. As part of the 2023/24 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Freedom of Information. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. There are three main pieces of legislation that provide rights of access, subject to certain exceptions or exemptions, to most of the information held by Scottish Public Authorities. These are: The Freedom of Information (Scotland) Act 2002 (FOISA), the main Act; The Environmental Information (Scotland) Regulations 2004 (EIRs); And The Data Protection Act 2018 (DPA), which updated data protection law in the UK, to complement the European Union's General Data Protection Regulation (GDPR). 5. The Freedom of Information (Scotland) Act 2002 (FOISA) came into force on the 1st of January 2005 and gives everyone a legal right to request information held by a Scottish Public Authority. The Act is regulated by the Scottish Information Commissioner and aims to increase openness and accountability across the public sector. Any information recorded by the Council on paper, electronically, and other methods, which cannot otherwise be withheld under the exemptions contained in the legislation, can be requested and obtained. 6. The Act requires Scottish public authorities to produce and maintain a publication scheme which tells the public, the classes of information that the authority makes routinely available, how to access the information and what it might cost. All Scottish authorities have adopted the Model Publication Scheme produced by the Scottish Information Commissioner. 7. The purpose of the publication scheme document is to make it easier for people to find information directly, without having to request it from the authority, setting out classes of information. Argyll and Bute Council (the Council) has listed on its website, all the information it currently publishes within each class and encourages The classes are shown below; About Argyll and Bute Council How we deliver our functions and services How we take decisions and what we have decided
Page 4
4 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 What we spend and how we spend it How we manage our human, physical and information resources How we procure goods and services from external providers How we are performing Our commercial publications 8. The Council encourages anyone looking for information from the Council, to check the publication scheme first, as it may be available people to access directly. Information that is not available from the publication scheme can be requested via a FOI online request form, with the Act requiring responses to be issued within 20 working days of receipt of the request. 9. The Environmental Information (Scotland) Regulations 2004 (EIRs) sit alongside the FOI Act, and govern access to environmental information held by Scottish public authorities. The EIRs require every Scottish public authority to publish environmental information, and make it available on request. 10. The Data Protection Act 2018 (DPA), incorporating GDPR, provides a right of access to any an individual’s personal information, via Subject Access Request (SAR) and must be responded to under data protection law, which is overseen and enforced by the UK Information Commissioner's Office (ICO). Scope 11. The scope of the audit was to review of the processes and procedures for the collection and response to FOI requests and assess the response times across the Council, as outlined in the Terms of Reference agreed with the Governance, Risk and Safety Manager on 17 July 2023. Risks 12. The risks considered throughout the audit were: Audit Risk 1: Failure to comply with the FOI legislation Audit Risk 2: Requested information is not provided within the statutory timescales Audit Opinion 13. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 14. Our overall audit opinion for this audit is that we can take a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Recommendations 15. We have highlighted four low priority actions where we believe there is scope to strengthen the control and governance environment. These are summarised below:
Page 5
5 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 The FOI/EIR procedure note requires to be updated to reflect current working practices Key contact details for staff involved in the collection and response to information requests are not up to date. A review of the Council’s Publication scheme should be undertaken, including checking that any links to information are still working. To highlight the number of marginally late responses, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. 1. Objectives and Summary Assessment 16. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 The Council has processes and procedures in place for the collection and response to FOI requests Audit Risk 1 High The Council has an overarching procedure note for the collection and response to Information requests, this is published on the Council’s Intranet but is not up to date and does not reflect current working practices. Mandatory training for all staff is available on the LEON system, which also records and monitors completion. Additional training is provided to designated Service FOI representatives, who are responsible for ensuring that actions and correspondence in relation to the request are logged on the tracking database. There is a Teams Channel where FOI Service reps can access training and other materials. Key contact details, on the Hub, for staff involved in the collection and response to Information requests are not up to date. A review of the Council’s Publication scheme should be undertaken, including checking that any links to information are still working. 2 The Council has arrangements in place to monitor its FOI performance. Audit Risk 2 High The Compliance and Regulatory team provide monthly updates to the Chief Executive, the Chief Officer, Directors, Heads of Service and the departmental FOI reps. Quarterly reports are provided to all DMTs and on an annual basis to the Audit and Scrutiny Committee. The information in the reports is clear and relevant. The recent addition of a second
Page 6
6 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 tab provides Senior Managers with a detailed breakdown of the late responses and the reasons for such which further highlight specific areas for improvement. To highlight the number of marginally late responses, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. 17. Further details of our conclusions against each control objective can be found in Section 3 of this report. 2. Detailed Findings The Council has processes and procedures in place for the collection and response to FOI requests 18. The Council has processes and procedures in place for the collection and response to Freedom of Information (FOI) requests. The access to information page on the Council’s Intranet site, the Hub, publishes the FOI and Environmental Information (EIR) requests procedure note, along with a list of the contact details for the Service FOI representatives. 19. The Compliance and Regulatory team within Legal and Regulatory Support Services are the Council’s experts on the legislation, that provide advice on the rights of access, subject to certain exceptions or exemptions, to most of the information held by the Council. They are responsible for overseeing compliance by the Council Services/Departments with regard to their statutory responsibilities in relation to information requests, providing training and support as required, and reporting upon performance. 20. The FOI/EIR procedure is the overarching guide for all Council staff. It sets out the procedure for dealing with and answering Information requests while emphasising the Council’s duties which include: proactively publish as much information as possible, respond to requests in within the statutory timescale of 20 working days for FOI requests and up to 40 days for more complex EIR requests to provide an adequate audit trail follow best practice guidelines 21. The document clearly defines the roles and responsibilities of staff by providing step by step instructions to be used by staff during collection and response for information, and the timescales for these, including: how staff should respond to these, checking if the information can be supplied using the Council’s Publication Scheme checking to see if the information has already been requested as part of another FOI request the documents/forms to use when collating information
Page 7
7 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 22. While the FOI/EIR procedure is comprehensive and takes cognisance of the legislation, testing of requests highlighted that it does not reflect all current working practices. The Compliance and Regulatory team are currently exploring options to see how the use of technology can streamline the collection and response to Information requests. A review of all procedure notes will be undertaken during this process. Action Plan 1 23. To ensure that staff comply with current policies and legislation and that knowledge is up to date, the Council has mandatory Freedom of Information module available on the LEON system. Monitoring of this mandatory training is automated now with LEON sending emails to staff with a link to the course two months before the training is due to expire. Reminders are sent to staff and their manager until the training has been completed. We regard this as an area of good practice. 24. Specific training is provided to the designated Service FOI representatives, by the Compliance and Regulatory Officer. Support is also offered during Reps meetings. In order to ensure business continuity, services identify staff to provide cover for holidays/ absence. Whenever new representatives are identified a training session is set up and invites are issued to all Service FOI representatives. There is a dedicated Teams Channel where the Reps can access training and other relevant materials as and when they need. 25. The Compliance and Regulatory Officer maintains a list of the current Service FOI Reps, a review of which found that it does not match those listed on the Councils Intranet Hub site. Additionally, at the time of the review there were ongoing staff changes within the Compliance and Regulatory team. The result is that key contact details on the Hub, for staff involved in the collection and response to information requests, are not up to date. It is expected that the staff recruitment process will be completed very soon, at which point the contact details on the Hub will be updated. Action Plan 2 26. The majority of FOI requests are in an electronic form, either email or web form, both these formats arrive via the FOI inbox. Where the request meets the legislative requirements, these are logged on the central database system, AXLR8, by staff within the Compliance and Regulatory Team. Requests are mostly distributed to the Services with the exception of more complex requests, for example where a response requires information from multiple services, it will be collated and monitored by staff within the Compliance and Regulatory team. 27. Services have ultimate responsibility for collating the requested information and responding to the requests. The designated Service FOI Reps administer this process, liaising with the staff tasked with gathering the information, monitoring the time taken, updating the case log where applicable, checking and issuing the response to the request to ensure it answers the questions and closing the log. 28. The Council uses the AXLR8 system when collecting and responding to requests for information to ensure that it can evidence that it is meeting its legislative requirements. The system is used to log requests, allocate these to the relevant services, monitor the timeframes, record when exemptions/exceptions have been used and record the response issued.
Page 8
8 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 29. There are built in email templates for responding to requestors to acknowledge the request and eleven response templates to choose from to cover various legislative options for response, examples include: Section 25 – Otherwise Accessible –where requested information is already published. Section 27 – Intended for future publication – where the information is held but there has been a decision to publish this prior to the request being received e.g. this could be a timing issue, where a procurement tender process is being undertaken the results and details of which will be published after the contract has been awarded. Section 38 – Personal Information – Disclosure would contravene data protection. 30. The decision on whether to apply an exemption/exception is taken by the Service when issuing a response with the specific exemption/exception applied recorded on the system and the appropriate standard template response used. It is the responsibility of Services to ensure any required quality assurance checks are carried out, the Compliance & Regulatory team are available should they have any queries or require further advice. 31. A sample of 31 requests were selected for testing, the conclusion is that the Council has robust procedures in place for the collection and response to requests for information. As noted above the procedure note needs to be updated to reflect current working practices and any recommendations as a result of this review. 32. As outlined in the background information above, legislation requires that all Scottish public authorities must adopt and maintain a "publication scheme", publish information in accordance with it and review the scheme from time to time. The Council’s publication scheme is easily accessible on its website but has not been updated since May 2021. The Council launched an updated website in 2023. A review of the Council’s Publication scheme should be undertaken, to ensure Services are publishing as much information as possible, this should include checking that any links to information are still valid and working as intended. Action Plan 3 33. The legalisation provides Councils with the choice of whether to publish and maintain a Disclosure Log. This is a list of the information that has been released in response to FOI/EIR requests. The Council has currently chosen not to have a Disclosure List, as the resources required to redact and publish responses and maintain the log would not be offset by a reduction in requests. The Council can evidence this by the volume of responses issued with the “otherwise accessible” exemption. The Council has arrangements in place to monitor its FOI performance 34. The Council has arrangements in place to monitor performance relating to the collection and response to information requests, at various stages during the process of gathering the requested information, prior to the response being issued and after to report upon uses of exemptions/exceptions and compliance with the statutory timescales and to further raise awareness where this has not been possible. 35. Performance relating to how Council collects and responds to requests for information has a high profile. Using information from the AXLR8 system, the Compliance and Regulatory team provide monthly updates to the Chief Executive, the Chief Officer, Directors, Heads of Service
Page 9
9 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 and the Service FOI Reps. These performance reports provide details of the number of responses, the responses submitted on time and those which were late, for each service/ department. 36. Quarterly reports, with this same information, are provided to all Departmental Management Team (DMT) meetings and the FOI annual report is presented to the Audit and Scrutiny Committee at its September meeting. Externally, quarterly statistical reports are submitted to the Office of Scottish Information Commissioner (OSIC) returns. 37. The statutory requirements are that FOI requests should be responded to within 20 days and up to 40 days for more complex EIR requests. Internally the Compliance and Regulatory team promote the aim to respond within 10 days where possible. As an aide, triggers have been built into the AXLR8 system to generate email reminders to the Service FOI reps which will reach the allocated inbox on the morning of day 10 and day 15. These should then be forwarded to those staff tasked with gathering the required information. Testing could not establish whether this happens consistently. 38. Overall, the Council has a very good within timescale response rate, which has increased slightly from 93% in 2021/22 to 94% in 2022/23 with many service areas achieving a very high level of performance, between 97-100%. The quality of the responses also appears to be high, with only 31 requests for reviews were received from a total of 1495 requests, which is less than 2%. 39. An analysis of responses was undertaken using the 2022/23 data with a summary by service, of the late responses broken down into 1 Day, 2 Day & 3 Days plus. The table below highlights the number of marginally late (1 or 2 days) responses: Dept / Service Total rec’d RESPONSES Days Late and percentage of total late responses In time % in time Late % Late 1 day late % 2 days late % 3 days + % Chief Exec Financial 98 97 99% 1 1% 0 0% 0 0% 1 100% Community P&D 1 0 0% 1 100% 0 0% 0 0% 1 100% Customer Services Education 254 251 99% 3 1% 2 67% 1 33% 0 0% L & RS 400 388 97% 13 3% 2 15% 1 8% 10 77% Commercial 44 44 100% 0 0% 0 0% 0 0% 0 0% D & I D & EG 246 204 83% 42 17% 4 10% 6 14% 32 76% R & IS 206 184 89% 22 11% 10 45% 5 23% 7 32% Customer Services 106 104 98% 2 2% 1 50% 0 0% 1 50% HSPC IJB 0 0 0% 0 0% 0 0% 0 0% 0 0% Adult Care 78 76 97% 2 3% 1 50% 0 0% 1 50% C & F / CJ 42 40 95% 2 5% 1 50% 0 0% 1 50% Live Argyll Live Argyll 20 16 80% 4 20% 1 25% 0 0% 3 75% TOTALS 1495 1404 94% 92 6% 22 24% 13 14% 57 62%
Page 10
10 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 40. If the number of 1 day and 2 day late responses were answered on time, this would have significant impact upon the Councils response time, which using the data above would rise by 1% for each day: PROJECTION Total rec’d RESPONSES In time % in time Late % Late If 1 day late was responded to on time 1495 1426 95% 70 5% If 2 day late was responded to on time 1495 1439 96% 57 4% 41. To raise awareness and to try and reduce the number of marginally late responses the Compliance and Regulatory team have taken the undernoted steps: Updating training notes for Service FOI reps advising that Third Tier Managers be copied into the 10 day reminder and Head of Service copied into day 15 reminder emails when these are issued by Service FOI representatives to those gathering the information. Introduced a second tab on the monthly and quarterly performance reports. This provides Senior Managers with a breakdown of the late responses and the reasons for such which highlights specific areas for improvement. This also brings the report format in line with the FOI Annual Report provided to Audit & Scrutiny Committee. 42. To highlight marginal late responses at Senior Manager level, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. Action Plan 4 43. The Council are required to submit statistical quarterly returns to OSIC, providing details which include reporting on the number and category of exemption and exception used. The Compliance and Regulatory Team submit these on behalf of the three bodies required by OSIC. These are: Argyll and Bute Council – which includes all of the information relating to the Council, the HSPC and LiveArgyll. The Integrated Joint Board (IJB) The Argyll and Bute Licensing Board. 44. Our review found these are submitted on time and with no issues arising which require to be brought to management’s attention.
Page 11
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Low 1 FOI/EIR Procedure Note The FOI/EIR Procedure Note is the overarching procedure note for the collection and response to information requests, is not up to date and does not reflect current working practices. The Compliance and Regulatory team are currently exploring options to see how the use of technology can streamline the collection and response to Information requests. A review of the procedure notes will be undertaken during this process. Potential for confusion as procedure note does not reflect current working practice Review and Update procedure, publish on HUB and provide copy to Audit Compliance & Regulatory Officer 31 March 2025 Low 2 Contact Details Key contact details, on the Hub, for staff involved in the collection and response to Information requests are not up to date. This is a known issue due to ongoing recruitment. Once this process is complete the contact details will be reviewed and the Hub updated. Potential for delays if information and departmental contact details are not be up to date. Update Hub and provide link to audit Compliance & Regulatory Officer 30 June 2024 Low 3 Publication Scheme The Council’s Publication scheme not updated since May 2021, and the Council’s website was updated in 2023. A review of the Council’s Publication scheme should be undertaken, including checking that any links to information are still working. The Publication Scheme is not be up to date and may contain outdated links to information. This may contribute to a rise in requests for information and staff time dealing with these. Review and Update Publication Scheme, publish on Website and provide link to Audit Compliance & Regulatory Officer 31 March 2025 Low 4 Performance Reports To highlight the number of marginally late responses, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. Potential that marginally late responses by services reduce the Councils overall response rate. Copy of 2024/25 FQ1 covering report to be provided to Audit Compliance & Regulatory Officer 30 Sept 2024
Page 12
12 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 13
13 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.