Public reports pack
Argyll and Bute Council · 13 June 2024
Back to Audit and Scrutiny Committee — 13 June 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Comhairle Earra-Ghàidheal Agus Bhòid Executive Director: Douglas Hendry Kilmory, Lochgilphead, PA31 8RT Tel: 01546 602127 Fax: 01546 604435 DX 599700 LOCHGILPHEAD 6 June 2024 NOTICE OF MEETING A meeting of the AUDIT AND SCRUTINY COMMITTEE will be held BY MICROSOFT TEAMS on THURSDAY, 13 JUNE 2024 at 11:00 AM, which you are requested to attend. Douglas Hendry Executive Director BUSINESS 1. APOLOGIES 2. DECLARATIONS OF INTEREST 3. MINUTE OF PREVIOUS MEETING OF THE AUDIT AND SCRUTINY COMMITTEE, HELD ON 14 MARCH 2024 (Pages 3 - 10) AUDIT ITEMS 4. INTERNAL AUDIT AND COUNTER FRAUD SUMMARY OF ACTIVITIES (Pages 11 - 18) Report by Chief Internal Auditor 5. INTERNAL AND EXTERNAL AUDIT REPORT FOLLOW UP 2023-24 (Pages 19 - 36) Report by Chief Internal Auditor SCRUTINY ITEMS 6. INTERNAL AUDIT - ANNUAL REPORT 2023/24 (Pages 37 - 60) Report by Chief Internal Auditor 7. STATEMENT OF GOVERNANCE AND INTERNAL CONTROL (Pages 61 - 78) Report by Executive Director with responsibility for Legal and Regulatory Support 8. EXTERNAL AUDIT - ANNUAL AUDIT PLAN, YEAR ENDING 31 MARCH 2024 (Pages 79 - 122) Report by Mazars 9. LOCAL GOVERNMENT BENCHMARKING FRAMEWORK (LGBF): 2022/23 (Pages Public Document Pack
Page 2
123 - 132) Report by Executive Director with responsibility for Customer Support Services 10. UNAUDITED FINANCIAL ACCOUNTS - TO FOLLOW Report by Head of Financial Services 11. WORKPLAN (Pages 133 - 136) For noting and updating 12. INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2023/2024 (a) Covering Report and Internal Audit Reports (Pages 137 - 212) Report by Chief Internal Auditor • Financial Ledger • Learning and Physical Disability Care Packages • Scottish Social Services Council (SSSC) Registration • Freedom of Information Requests • Cloud Based Computer Services E1 (b) Internal Audit Report (Pages 213 - 230) • Client Funds Progress Review The Committee will be asked to pass a resolution in terms of Section 50 (A)(4) of the Local Government (Scotland) Act 1973 to exclude the public for items of business with an “E” on the grounds that it is likely to involve the disclosure of exempt information as defined in the appropriate paragraphs of Part 1 of Schedule 7a to the Local Government (Scotland) Act 1973. The appropriate paragraphs are:- E1 Paragraph 6 Information relating to the financial or business affairs of any particular person (other than the authority). Audit and Scrutiny Committee Janice Wason Hall (Chair) Councillor Daniel Hampsey Councillor Graham Hardie Councillor Fiona Howard Councillor Reeni Kennedy-Boyle Councillor Gary Mulvaney (Vice-Chair) Councillor Andrew Vennard Shona Barton, Governance Manager Contact: Lynsey Innis, Senior Committee Assistant Tel: 01546 604338
Page 3
MINUTES of MEETING of AUDIT AND SCRUTINY COMMITTEE held BY MICROSOFT TEAMS on THURSDAY, 14 MARCH 2024 Present: Martin Caldwell (Chair) Janice Wason Hall Councillor Daniel Hampsey Councillor Graham Hardie Councillor Reeni Kennedy-Boyle Councillor Dougie McFadzean Attending: Kirsty Flanagan, Executive Director/Section 95 Officer Anne Blue, Head of Financial Services Jane Fowler, Head of Customer Support Services Paul MacAskill, Chief Internal Auditor Shona Barton, Governance Manager Morag Cupples, Finance Manager Jennifer Coyle, Senior HR Business Partner Mhairi Weldon, Senior Audit Assistant Cameron Waddell, Partner, Mazars LLP Gregory Odour, Audit Manager, Mazars LLP 1. APOLOGIES The Chair welcomed everyone to the meeting and took the opportunity to introduce Janice Wason Hall, who would be taking over the role of Chair of the Audit and Scrutiny Committee from its next meeting in June 2024. Apologies for absence were intimated on behalf of Councillor Jim Lynch. 2. DECLARATIONS OF INTEREST There were no declarations of interest intimated. 3. MINUTE OF PREVIOUS MEETING OF THE AUDIT AND SCRUTINY COMMITTEE HELD ON 19 DECEMBER 2023 The Minute of the previous meeting of the Audit and Scrutiny Committee, held on 19 December 2023 was approved as a correct record. 4. INTERNAL AUDIT AND COUNTER FRAUD SUMMARY OF ACTIVITIES The Committee gave consideration to a report providing a summary of Internal Audit activity and progress during quarter four of 2023/24 against the following areas: Audits Completed • Piers and Harbours • Pupil and Public Transport • Human Resources – Casual Workers Page 3 Agenda Item 3
Page 4
Audits in Planning/in Progress • Client Funds • Learning and Disability Care Packages • Financial Ledger • Scottish Social Services Council (SSSC) Registration • Freedom of Information Requests • Cloud Based Computer Services The report also provided information on the work carried out by the Counter Fraud Team (CFT); the continuous monitoring programme and the progress of work carried out as a result of information received from the National Fraud Initiative (NFI). Decision The Audit and Scrutiny Committee reviewed and endorsed the Summary of Activities report. (Reference: Report by Chief Internal Auditor, dated 14 March 2024, submitted) 5. INTERNAL AND EXTERNAL AUDIT REPORT FOLLOW UP 2023-24 Consideration was given to a report which provided an update on all open actions as at 31 December 2023. The report included information on actions where the agreed implementation date had been rescheduled. Decision The Audit and Scrutiny Committee endorsed the contents of the report. (Reference: Report by Chief Internal Auditor, dated 14 March 2024, submitted) 6. INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2023/24 Consideration was given to a report containing the action plans in relation to the following three audits:- • Human Resources – Casual Workers • Pupil and Public Transport • Piers and Harbours Decision The Audit and Scrutiny Committee reviewed and endorsed the summary report and detail within each individual report. (Reference: Report by Chief Internal Auditor, dated 14 March 2024, submitted) 7. FLY-TIPPING SCRUTINY REVIEW Page 4
Page 5
Having noted that the Fly-Tipping Scrutiny Review commenced as per the 2021/22 scrutiny plan and concluded as per the 2023/24 scrutiny plan, the Committee gave consideration to a report which presented the draft Fly-Tipping Scrutiny Report. Decision The Audit and Scrutiny Committee:- 1. agreed the draft Fly-Tipping Scrutiny Report; and 2. agreed that the Fly-Tipping Scrutiny Report be presented to the Environment, Development and Infrastructure Committee for consideration. (Reference: Report by Chair of Scrutiny Panel, dated 14 March 2024, submitted) 8. SCRUTINY - IDENITIFICATION OF A TOPIC 2024-25 The Committee gave consideration to a report which provided an update on the recent engagement on potential scrutiny options in order to identify a topic to take forward in the context of the Scrutiny Manual and Framework as part of the Committee’s scrutiny role for 2024-25. Decision The Audit and Scrutiny Committee:- 1. agreed that the topic for 2024-25 would be a review of the Council’s Complaints process based on the responses provided to the Chief Internal Auditor as part of the recent communications with the Committee and in accordance with the agreed process of assessment which is detailed in the Scrutiny Framework and Manual; 2. appointed Councillor Jim Lynch as the Panel Chair with the new Chair of the Committee, Janice Wason Hall shadowing; and 3. requested that the Chief Internal Auditor extend an invite to all Members of the Committee seeking nominations for a further two members to form a Scrutiny Panel for the review which will commence within financial year 2024-25. (Reference: Report by Chief Internal Auditor, dated 14 March 2024, submitted) 9. INTERNAL AUDIT PLAN 2024-25 The Committee gave consideration to a report which introduced the Internal Audit Plan for 2024-25. Decision The Audit and Scrutiny Committee agreed and endorsed the Internal Audit Plan 2024/25, as attached at Appendix 1 to the report. (Reference: Report by Chief Internal Auditor, dated 14 March 2024, submitted) Page 5
Page 6
10. REGULATION OF INVESTIGATORY POWERS (SCOTLAND) ACT 2000 (RIPSA) ANNUAL REPORT Having noted the legal requirements placed on the Council in relation to covert surveillance, the Committee gave consideration to a report which advised that between 1 January and 31 December 2023, the Council undertook no covert surveillance operations. Decision The Audit and Scrutiny Committee considered and noted the terms of the report. (Reference: Report by Executive Director with responsibility for Legal and Regulatory Support, dated 14 March 2024, submitted) Councillor Daniel Hampsey joined the meeting during discussions of agenda item 11 (2022-23 Audited Annual Accounts). . 11. 2022-23 AUDITED ANNUAL ACCOUNTS (a) 2022-23 Draft Annual Audit Report The Committee gave consideration to a report and a short verbal update outlining the unqualified opinion of the External Auditors, Mazars LLP, on the audit of the financial statements. Decision The Audit and Scrutiny Committee agreed to note the findings of the report. (Reference: Report by Mazars LLP, dated March 2024, submitted) (b) 2022-23 Argyll and Bute Council - ISA 580 Letter of Representation Consideration was given to the ISA 580 letter of representation on the audit of the annual accounts of Argyll and Bute Council for the year ended 31 March 2023. Decision The Audit and Scrutiny Committee:- 1. noted the contents of the ISA 580 letter of representation; and 2. agreed to recommend to Council that the ISA 580 letter of representation be approved for signing. (Reference: ISA 580 Letter of Representation by Section 95 Officer, dated March 2024, submitted) (c) 2022-23 Audited Annual Accounts The Committee gave consideration to a report presenting the Audited Annual Accounts of the Council for the year ended 31 March 2023. Page 6
Page 7
The Chair took the opportunity to thank the Finance team for the provision of highly informative management commentary and for their continued hard work in the provision of the annual accounts. Decision The Audit and Scrutiny Committee:- 1. noted that the audit is substantially complete and Mazars have advised the Council that they are expecting to issue an unqualified opinion on the Council’s Accounts for the year ended 31 March 2023; 2. agreed to accept and endorse the set of Accounts as attached to the report and refer them to the Council for approval; 3. noted that if the Council receive a follow-up letter from Mazars confirming that there are no material changes to the Accounts, there would be no impediment to the Council signing off the Annual Accounts; 4. noted that if the Council receive a follow-up letter from Mazars confirming there was a material change, it would be a matter for the Council to take forward the approval of the Accounts having regard to that. It was further noted that in this event, a further report would be submitted to the Audit and Scrutiny Committee for their information; and 5. noted that the Audit of the Charitable Trusts has still to be completed and the Charitable Trust Accounts will be submitted to the most appropriate meeting of the Council with a copy to the Audit and Scrutiny Committee for information. (Reference: Report by Section 95 Officer, dated 7 March 2024, submitted) 12. UNAUDITED ANNUAL ACCOUNTS 2023-24 Consideration was given to a report which outlined the plans in place for financial year end 31 March 2023 and the preparation of the Council’s Unaudited Annual Accounts for 2023- 24. Decision The Audit and Scrutiny Committee noted that plans are in place to prepare the Council’s Annual Accounts, consistent with the Accounting Code of Practice for submission to Council prior to 30 June 2024. (Reference: Report by Section 95 Officer, dated 21 February 2024, submitted) 13. TREASURY MANAGEMENT STRATEGY AND ANNUAL INVESTMENT STRATEGY Page 7
Page 8
Consideration was given to a report which outlined the proposed Treasury Management Strategy Statement and Annual Investment Strategy and set out the policy for the repayment of loans fund advances for 2024-25. Decision The Audit and Scrutiny Committee:- 1. agreed to endorse the proposed Treasury Management Strategy Statement and Annual Investment Strategy and the indicators contained within; 2. noted the continued use of the asset life method for the repayment of loan fund advances using a 5.1% annuity interest rate, with the exception of spend to save schemes where the funding/income profile method could be used; 3. noted the proposed asset repayment periods as detailed within section 2.7 of the Treasury Management Strategy Statement; and 4. noted the ability to continue to use countries with a sovereign rating of AA- and above, as recommended by the Council’s external treasury management advisors. (Reference: Report by Head of Financial Services, dated 15 February 2024, submitted) 14. CORPORATE IMPROVEMENT PLAN UPDATE The Committee gave consideration to a report which provided an update on the progress of the new Corporate Improvement Plan (CIP) within the Performance Excellence Project and highlighted completed work and upcoming activities to facilitate the development and implementation of the new plan. Decision The Audit and Scrutiny Committee considered and noted the work undertaken to date on the Corporate Improvement Plan and the activities planned to deliver and implement it. (Reference: Report by Chief Executive, dated 12 February 2024, submitted) 15. INTERNAL AUDIT CHARTER AND INTERNAL AUDIT MANUAL Consideration was given to a report which outlined the proposed changes to the Internal Audit Charter and Internal Audit Manual. Decision The Audit and Scrutiny Committee:- 1. approved the amended Internal Audit Charter, as attached at Appendix 1 to the report; and 2. approved the amended Internal Audit Manual, as attached at Appendix 2 to the report. (Reference: Report by Chief Internal Auditor, dated 14 March 2024, submitted) Page 8
Page 9
16. SCRUTINY FRAMEWORK AND MANUAL ANNUAL REVIEW The Committee gave consideration to a report which concluded the annual review to determine whether any changes were required to the Council’s Scrutiny Framework and Manual. Decision The Audit and Scrutiny Committee agreed to note the outcome of the annual review of the Scrutiny Framework and Manual, as outlined in Appendices 1 and 2 of the report. (Reference: Report by Chief Internal Auditor, dated 14 March 2024, submitted) 17. LOCAL GOVERNMENT IN SCOTLAND - FINANCIAL BULLETIN 2022-23 Consideration was given to a report which presented the main issues raised in the recent Local Government Financial Bulletin 2022-23 report by the Accounts Commission and highlighted relevant issues. Decision The Audit and Scrutiny Committee noted the contents of the Accounts Commission report. (Reference: Report by Section 95 Officer, dated 20 February 2024, submitted) 18. WORKPLAN In order to facilitate forward planning of reports to the Audit and Scrutiny Committee, Members considered the outline Audit and Scrutiny workplan. Decision The Audit and Scrutiny Committee agreed to note the outline workplan. (Reference: Audit and Scrutiny Workplan, dated 14 March 2024, submitted) On noting that this was his last meeting as Chair, Martin Caldwell took the opportunity to thank the officers and Members of the Committee, past and present for their support and assistance over the years. On behalf of the Internal Audit and Counter Fraud teams, the Chief Internal Auditor, Paul MacAskill expressed gratitude to Mr Caldwell who in his role as Chair has steered the Committee for over a decade. Mr MacAskill also thanked Mr Caldwell for the support he has provided to him in both a professional and personal capacity since he took up the position of Chief Internal Auditor. Councillor Hardie, on behalf of the Committee, also took the opportunity to thank Mr Caldwell for all his work in the role of Chair of the Audit and Scrutiny Committee over the years, and wished him well for the future. . Page 9
Page 10
This page is intentionally left blank
Page 11
ARGYLL AND BUTE COUNCIL AUDIT & SCRUTINY COMMITTEE FINANCIAL SERVICES 13 JUNE 2024 INTERNAL AUDIT AND COUNTER FRAUD SUMMARY OF ACTIVITIES 1. SUMMARY 1.1 The objective of the report is to provide the Audit and Scrutiny Committee (the Committee) with a summary of Internal Audit activity and progress during quarter four of 2023/24. 1.2 Core activities together with a progress update statement are shown below: • 2023/24 Audit Plan progress: The plan has now been completed and work has commenced on the 2024/25 audit plan. • 2023/24 Individual Audits undertaken: six audits have been completed during the period, 1 have been assessed as providing high assurance, 2 substantial assurance and 2 reasonable assurance, with one to be confirmed. (Where HSCP and LiveArgyll Audits are included, these are provided for information only). • Scrutiny: Planned work for 2023/24 in relation to ‘Fly Tipping’ has been completed following a meeting of the Scrutiny Panel in February 2024 and reported and considered by the Audit and Scrutiny Committee in March 2024. • Counter Fraud: The Counter Fraud Team (CFT) is continuing to rebill council tax accounts and recovery of funds is underway. All other aspects and referrals are being considered, investigated and evaluated and the Counter Fraud Team remain vigilant to protect our public purse. The established CFT team member is on secondment to Housing for career and personal development for a two year period. The CFT have obtained a member of staff, again on secondment for the same time period. The team lead is currently progressing through year 2 of a Master in Accountancy course. • Continuous Monitoring Programme Testing: A number of auditable units are subject to continuous testing. There have been no new issues which we have identified this quarter. • Performance indicators: Current status is green / on track. 2. RECOMMENDATIONS 2.1 To review and endorse the Summary of Activities report. Page 11 Agenda Item 4
Page 12
3. DETAIL 3.1 Six audits have been completed since the previous Committee in March 2024. Audits Completed • Freedom of Information (FOI) • Client Funds Progress Review • Financial Ledger • Scottish Social Services Council (SSSC) Registration • Learning and Disability Care Packages • Cloud Based Computer Services Audits in Planning / in Progress reported to a future meeting of the Committee. • Education Maintenance Allowance • SPT Annual Claim 3.2 In addition to those already in progress, indicative audits planned for Q1 2024/25 are: • Community Education • School Funds and Management of School Funds • Local Government Benchmarking Framework 3.3 2023/24 Audit Plan • Work has been fully completed on the approved plan and outlined in paragraphs 3.1. • A request has been made by senior management to postpone the planned review on Building Cleaning and similarly a review within the Education service due to staff sickness and external inspections which are ongoing. We will consider these areas in future plans and would note this as an amendment to the current Plan for 2023/24. Scrutiny 3.4 It was agreed in June 2023 that scrutiny work for 2023/24 will focus on the outstanding review concerning ‘Fly Tipping’. Work had previously been postponed until data became available to the Panel. Discussions have been ongoing with staff within the Council to ensure data was made available in January for further analysis and consideration at a meeting of the Panel to conclude on this review. In February 2024 the Scrutiny Panel met, along with staff responsible for this area of activity within the Council. The final report was prepared for consideration by the Audit and Scrutiny Committee in March 2024. A subject area for scrutiny in 2024/25 was agreed by the Committee and which relates to complaints, a report will be prepared for the September Committee to take forward this scrutiny review. Page 12
Page 13
Counter Fraud 3.5 The CFT is progressing well with both team members fully CIPFA accredited fraud investigators. The current investigator has taken on a 2 year secondment to empty homes for further skills development. The investigators post was filled again on a secondment basis. The new member of staff will undertake the above CIPFA accreditation and is booked onto this course commencing in the latter half of 2024. Both team members will revert to substantive post circa sept 2025. Continued routine work is still progressing to track the full income recovered from the team’s work, however, based on the amount of additional billing, even accounting for a degree of non-recovery, the indications are that the team are still exceeding their target. In addition, the team are raising awareness of the Council’s zero tolerance to fraud and this will help act as a deterrent to fraud being perpetrated in the first place. The team aimed to visit Mull, Tarbert and Lochgilphead in the next coming months with a proactive aim to gather any new evidence due to ongoing investigations. A large number of referrals are having to be sent to the DAB Assessors due to the nature of the information, and these will be followed up in due course. There is still a back log from Covid so there are delays. Helensburgh is still being reviewed and efforts are still being made to trace long term investigations, Operational demands means this will likely continue toward the end of 2024. Second homes review is beginning to play a larger role in the CFT team’s investigations with several claims already adjusted. The CFT have also assisted debt recovery to trace persons and allow communications between both parties. The team now have an established referral system in place from council tax teams and the CFT have already liaised with this team going forward into 2024 for the review of the second and holiday home tax changes. The information already shared in the short space of time has resulted in rebilling and adjustments of accounts. Together we aim to keep accurate records and update accounts where error or missing information is held. This approach will continue as the method of collaborative and interdepartmental working has been helpful. The CFT continue to work closely with the empty homes team to support each other in our remits. Work and communication between each department is key in identifying and finding appropriate solutions to enable empty homes to return to residency or open market. The NFI exercise continues to be a routine work area for the CFT. Pending any other data release from Cabinet Office, the 2022/23 exercise is coming to a close. Page 13
Page 14
Since the inception of the CFT a total of £1,119,584 has been rebilled and £796,759 has been recovered. A recovery percentage of 71% has been achieved at the last review of the figures. Additional Updates from Quarter Four 3.6 Staff continue to work from home or on a hybrid approach and this has proved to be successful, where on-site visits have been required due to the specific nature of the audit work, these have been undertaken. 3.7 Year- end stock checks were reinstated in 2023/24, visits to yards and stores took place across the Council area to verify stock quantities and values presented to Financial Services for presentation in the annual accounts. We found that comprehensive instructions were issued to relevant employees, stock was measured or counted at the arranged time close to year-end, items were stored safely and securely, regular monitoring is in place to ensure adequate supplies are available to meet demands throughout the year and year-end values were submitted to financial services. Testing identified some differences in quantities and values presented to Financial Services but these were not material. Whilst it is difficult to measure salt for road treatment, the areas visited employed the method of calculation inconsistently, this has been addressed by issue of additional instructions. 3.8 The Council has entered a ten-year programme to deliver the Rural Growth Deal (RGD) for Argyll and Bute. The Council, as the accountable body for this programme is required to allocate and account for distribution of the funding to partners, third parties and other bodies in accordance with the approved governance arrangements. The Council’s Chief Internal Auditor has been appointed to coordinate audit activity throughout the programme, this will include liaison with partner auditors to obtain annual confirmation of regular and planned reviews of grant funded activities and a specific review of RGD within the Council’s Annual Audit Plan at least every two years. Discussions regarding the audit input required have taken place and the first review will be included within the 2025/26 Internal Audit Plan. 3.9 As part of our work for the HSCP, audit plans for 2024/25 and indicative plans covering 2025/26 and 2026/27 have also been prepared for presentation to the Audit and Risk Committee of the HSCP. We have again, consulted with senior managers of the HSCP in the preparation of this plan and have been approved so these will be in place before the start of the new financial year. Work for 2023/24 has been fully completed. 3.10 Internal Audit have been liaising with our colleagues in IT where we have been closely monitoring the cyber incident at Comhairle nan Eilean Siar (Western Isles Council) in order to glean any areas for learning or consideration. This incident has had a significant effect on the Western Isles Council including, as reported, unavailability to access their ‘back-up’ data. It also highlights the threats and potential effects such incidents can have on public bodies and will continue to monitor this incident for any learning and/or risk mitigation purposes. Continuous Monitoring Page 14
Page 15
Our continuous monitoring programme is generally focused on transactional type activity. Standard audit tests are applied which are relevant to each auditable unit. Control design tests look at whether the controls in place adequately address the potential risk event. There has been no new findings within the quarter that require to be reported. Table 2: Continuous Monitoring Findings Auditable Area Areas Tested Issues Identified Management comment / action No issues identified. 3.11 A follow up process is in place whereby management are advised of continuous monitoring findings and, where appropriate, requested to take remedial action. There are currently no outstanding follow-up points arising from previous testing. Due to the volume of continuous monitoring tests carried out the decision was made to report by exception only. National Reports 3.12 A follow up process for national reports is in place whereby management are advised of national reports published and asked to confirm what, if any, action is planned as a result of the report. Table 2 details the national reports issued during quarter four of 2023/24 and quarter one of 2024/25 due to be reported in quarter one 2024/25. Table 3: National Reports National Report Issued To Detail Management response/ Action taken None National Fraud Initiative (NFI) 3.13 NFI data matching involves comparing computer records held by one body against other computer records held by the same or another body to identify potentially fraudulent claims and payments to be identified. Note though that the inclusion of personal data within a data matching exercise does not mean that any specific individual is under suspicion. Where a match is found it indicates that there may be an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out. A reminder process is in place to ensure that matches are reviewed on a timely basis. NFI have provided new data throughout 2023/24 and these have been matched and closed. This exercise is now coming to a close. 3.14 The current NFI exercise has been released after some technical delays from the Cabinet Office. This exercise is conducted throughout the year by officers and Page 15
Page 16
matches checked and closed accordingly. NFI provided additional data releases over the course of the exercise and matches are addressed when these become available. The current NFI matches are detailed below. The CFT are reviewing the information received from the NFI matching service, work has commenced to follow these up locally. Existing users have been reviewed and new users added where requested, all users have been informed that matches are available for review and progress will be monitored monthly by the Counter Fraud team and reported quarterly to the Audit and Scrutiny Committee. New HMRC data has been uploaded and released back to us, and teams have been contacted to start matching this data. Table 4: National Fraud Initiative Progress at 19/05/2024 Operational Area Total Matches Recommended/Very High / High/Medium Risk Matches Matches Complete * WIP Match Description CT to Elect Register 2155 0 2155 0 CT records to Electoral Register/ other data sets to ensure discount awarded to only those living alone aged over 18, taking into account disregarded occupants. (CT to other Datasets will not be progressed further due to poor quality data) CT rising 18s 402 0 402 0 CT to HMRC Household Composition 935 0 38 2 Housing Benefits 21 11 20 0 HB records to records in other authorities / other datasets including student loans, payroll and pensions to identify undeclared income and capital. Payroll 143 2 139 1 Payroll records to other datasets including other payrolls and pensions to ensure employee is not receiving additional income. Blue Badges 238 204 237 0 Blue badge records to DWP data to identify deceased claimant with valid badge. Housing Waiting list 233 214 231 2 Housing waiting list records to other organisations HBCTR and tenant data to identify undisclosed changes in circs or false info. Council Tax Reduction 307 157 278 0 CTR records with records in other authorities / other datasets including; student loans, payroll and pensions to identify undeclared income and capital Creditors 589 0 33 0 Analyses Creditors data to identify possible duplicate vendors and payments, VAT errors or fraud and Page 16
Page 17
multiple vendors sharing a bank account. Procurement 38 0 38 0 Payroll records to Companies House and creditors’ data to identify employees who appear to have a personal interest in a company that the authority has traded with. Business Rates 214 0 135 0 Business rates records within and between authorities to identify those fraudulently claiming small business bonus scheme and grants * Work in Progress Overall Summary of Matches Matches Complete Work In Progress Cleared Frauds Errors Total Value £ Recovering Recovering Value £ 3706 5 3613 0 93 60,450 0 0 Internal Audit Development 3.15 The table below details progress against the action points in our Internal Audit development plan. Table 5: Internal Audit Development Key Actions: updated 31/03/24. Area For Improvement Agreed Action Progress Update Timescale Review Continuous Monitoring Programme Continuous monitoring tests will be reviewed following audit of Debt recovery to assess value of existing tests carried out. Consider adding test to review date taken to process invoices from date of receipt within the Council (not at Creditors) In progress October 2024 Update internal audit report template to include key audit milestones. A table will be added to the internal audit report template to provide readers with the planned and actual reporting dates, this will allow better monitoring of any delays in responses which has been requested by DMT. Completed and will be used for internal audit reports issued 2024-25 onwards June 2024 3.16 Internal Audit scorecard data provided below are aligned to those for internal audit in the Financial Services service plan. All indicators are shown as currently being on track. Table 6: Internal Audit Team Scorecard Page 17
Page 18
Internal Audit Team Scorecard 2023– 24 – FQ4 23/24 (as at March 2024) BO115 We Are Efficient and Cost Effective Internal Audit Level of Satisfaction Actual 93% G Target 80% Review of Strategic Risk register Status Complete G Target Complete Percentage of audit plan completed Status 100% G Target 100% Percentage of audit recommendations accepted by management Actual 100% G Target 100% 4 CONCLUSION 4.1 The 2023/24 audit plan is complete, the 2024/25 audit plan has commenced and the Counter Fraud Team is continuing with visits and pro-active work throughout Argyll and Bute. 5 IMPLICATIONS 5.1 Policy – Internal Audit continues to adopt a risk based approach to activity 5.2 Financial –None 5.3 Legal –None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – None 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None For further information please contact Internal Audit (01546 604108) Paul Macaskill Chief Internal Auditor 13 June 2024 Page 18
Page 19
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 June 2024 INTERNAL AND EXTERNAL AUDIT REPORT FOLLOW UP 2023-24 1.0 INTRODUCTION 1.1 Internal and external audit reports include an action plan with a management response establishing the agreed action, timescale and responsible officer. Internal Audit record these in a database and, on a monthly basis, follow them up to ensure they are being progressed. 1.2 This report updates the committee on all open actions as at 31 March 2024 including information on actions where the agreed implementation date has been rescheduled. 2.0 RECOMMENDATIONS 2.1 To endorse the contents of the report. 3.0 DETAIL 3.1 The two tables below provide a numerical summary of open audit actions with a split between actions due by and due after 31 March 2024. 3.2 Appendix 1 provides further detail on actions that have either been delayed and rescheduled or superseded. Page 19 Agenda Item 5
Page 20
Table 1 - Actions Due by 31 March 2024 SMT/Service Complete Delayed/ Rescheduled Superseded Evidence Required Total Internal Audit DH – Commercial Services 3 4 0 0 7 DH – Education Performance & Improvement 1 0 0 0 1 DH – Legal & Regulatory Support 1 0 0 0 1 KF – Customer Support Services 4 0 0 0 4 KF – Development & Economic Growth 0 4 0 0 4 KF – Financial Services 6 7 1 0 14 KF – Roads & Infrastructure Services 1 2 0 0 3 H&SCP (IJB) – Finance & Transformation 0 2 0 0 2 H&SCP (SW) – Adult Services (Mental Health Learning Disability, Addictions & Lifelong Conditions) 0 2 0 0 2 External Audit Nil TOTAL 16 21 1 0 38 Table 2 - Actions due after 31 March 2024 SMT/Service Complete Delayed/ Rescheduled No Response On Course Evidence Required Total Internal Audit DH – Commercial Services 0 0 0 4 0 4 DH – Education Performance & Improvement 0 0 0 1 0 1 KF – Customer Support Services 1 1 0 1 0 3 KF – Development & Economic Growth 0 0 0 3 0 3 KF – Financial Services 0 4 0 0 0 4 KF – Roads & Infrastructure Services 1 0 0 16 0 17 H&SCP (IJB) – Finance & Transformation 0 0 0 2 0 2 H&SCP (IJB) – Strategic Planning & Performance 0 0 0 2 0 2 H&SCP (SW) – Adult Services (Mental Health Learning Disability, Addictions & Lifelong Conditions) 2 0 0 0 0 2 External Audit Nil TOTAL 4 5 0 29 0 38 Page 20
Page 21
4.0 CONCLUSION 4.1 Satisfactory progress continues to be made implementing audit actions. 5.0 IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – None 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Paul MacAskill Chief Internal Auditor 13 June 2024 For further information contact: Paul MacAskill, 01546 604108 Paul.macaskill@argyll-bute.gov.uk APPENDICES Appendix 1 – Action Plan Points Delayed & Rescheduled and Superseded Page 21
Page 22
Appendix 1 - Action Plan Points Delayed & Rescheduled or with Superseded Action Plan Points Due by 31 March 2024 LOW COMMERCIAL SERVICES Compliance Review (Period Products) 5. Monitoring of onsite provision The process for auditing of sites to ensure products remain available in an equitable way has still be developed. There are no records/evidence to support that checks are carried out to ensure that products, adequate storage and disposal facilities and branding are actually on site and available in one or more of, unisex, male, females and disabled toilets in Council establishments. Monitoring process will be implemented with an implementation date of March 2024. 31/03/2024 30 Sep 2024 Location survey was carried out - any locations that identified as low/no stock were sent stock. Locations that required branding packs were sent packs. Link to location survey form - My Tribe Period Product Location Survey (jotform.com) This is an annual process. Delayed and Rescheduled Project Lead – Period Products Medium COMMERCIAL SERVICES Compliance Review (Period Products) 6. Procedure Notes The Project Lead post is a temporary post, until December 2023, and with the exception of a draft stock ordering note, there are no procedure notes. As a priority procedure notes should be written for all key tasks, include detailing what the monitoring, evaluation are reporting requirements. Ongoing – implemented by January 2024 31/01/2024 30 Sep 2024 Due to changes within the management team, the current process are being reviewed. The new post of Business Support Officer will continue to have responsibility for the provision of free period products within Argyll and Bute with Admin team support for processing orders. Delayed and Rescheduled Project Lead – Period Products Low COMMERCIAL SERVICES Compliance Review (Period Products) 7. Engagement Given this is new statutory requirement there would be benefit to engaging internally with Engagement is ongoing, informally but will be formalised as part of the new monitoring process as per point 5. 31/03/2024 30 Sep 2024 Engagement with partners carried out as per point 5. Public consultation carried out 2023. No evidence of internal engagement. Delayed and Rescheduled Project Lead – Period Products Page 22
Page 23
other services and staff involved in the various processes to establish any issues arising and ensure procedures are efficient. Medium COMMERCIAL SERVICES Compliance Review (Period Products) 8. Monitoring and evaluation Limited evidence of monitoring and evaluation arrangements was provided during this review. Management should undertake a review of the monitoring and evaluation processes to ensure that they are in line with the Scottish Government Evaluation Strategy. Annex D on SGES – Procedure notes will be considered to cover how to gather data as per document. 31/03/2024 30 Sep 2024 Review of Annex D carried out in relation to types of questions to ask: Q1: How much does delivering access to free period products cost? - reviewed as part of the bid-in fund application. Q2: What level of demand is there for period products? - Reviewed within bid-in fund application. Q3: How is access to free period products being provided by local authorities and education providers? - reviewed as part of ongoing management and via the guidance notes of the act. Q4: Does delivery of access to free period products meet user needs? - Reviewed as part of the 2023 consultation. Q5: What impact did the availability of free period products have on users? – option to add comments/feedback as part of ordering process. Delayed and Rescheduled Project Lead – Period Products Low DEVELOPMENT & ECONOMIC GROWTH PLANNING 3. Customer Charter The framework document for 2022/23 stated “A review and update of the Development Management Customer Service 31/12/2023 31/03/2024 30 Jun 2024 Delayed due to other operational pressures on staff time during FQ4 2023/24 - in particular the replacement of Development Manager Page 23
Page 24
Planning have in place a customer charter, however it was last reviewed in 2012 and requires to be updated as it does not reflect current practice. Charter will also be undertaken during 2023/24.” LDP with LDP2 in Feb 2024. Delayed until end of FQ1 24/25. Delayed and Rescheduled Low DEVELOPMENT & ECONOMIC GROWTH PLANNING 4. Service level Customer User Forums Customer User Forums have previously been held regularly however currently customer forums are not being undertaken. The Planning Performance Framework for 2022/23 states that “it is intended to reinitiate Service level Customer User Forums during 2023/24”. 31/12/2023 31/03/2024 30 Jun 2024 Delayed due to pressures from operational commitments, in particular the replacement of LDP with LDP2 during Feb 2024. Customer engagement has however been undertaken during March 2024 to establish customer appetite for a User Forum and to ascertain what format this will be provided in (online/hybrid/in person) and the content of the forum. It is expected that the forum will be held during FQ1 24/25. Delayed and Rescheduled Development Manager Low DEVELOPMENT & ECONOMIC GROWTH Private Sector Housing Grants & Adaptions 2. The Scheme of Assistance The Councils Scheme of Assistance (SoA) which was introduced under the duties and powers set out in the Housing (Scotland) Act 2006, and sets out the strategy of support for owners to address properties which are Below Tolerable Standard (BTS) and in disrepair does not contain up to date information and should be updated after the outcome of the national policy review. As per Local Housing Strategy 2022-2027 Action Plan; The Scheme of Assistance, will be revised in 2023, after the outcome of national policy review on adaptions. 31/12/2022 30/06/2023 31/03/2024 30 Sep 2024 Over the last 3 months work has continued with updating the Scheme of Assistance. The Housing Team have taken the opportunity to benchmark with other Scottish Local Authorities and have also worked closely with the HSCP to ensure that all current legislation has been addressed within the revised document. The revised Scheme of Assistance is now at final draft stage and is currently undergoing scrutiny by the Housing Team and relevant Team Lead - Housing operations Page 24
Page 25
HSCP partners prior to progressing to committee cycle for approval. I have updated the revised completion date to 30/09/24 to allow time for the Scheme of Assistance to complete the approval cycle. Delayed and Rescheduled Low DEVELOPMENT & ECONOMIC GROWTH Private Sector Housing Grants & Adaptions 3. Procedure Notes and Shared Documents While the vast majority of requirements are included there would be benefit to updating these to reflect current working practices, which have evolved due to hybrid working arrangements and the digitalisation of records. Consideration should be given to creating a checklist to ensure consistent application of processes. Procedures and documents will be reviewed and updated. Checklists to be drawn up and introduced when updating the procedures. 31/12/2022 30/06/2023 31/03/2024 30 Sep 2024 Housing Officers, HSCP and Care and Repair have progressed on updating policies and procedures. The HSCP are in the final stages of updating their Criteria and Practice Guide and the Housing Service is currently updating the Scheme of Assistance. In addition, the Housing Service has taken the opportunity to revise all internal admin procedures relating to Private Sector Housing Grants. A meeting has been scheduled for 30th May 2024 to allow relevant Housing, HSCP and Care and Repair staff to meet and go through the procedure documents. As this action links to the action relating to the Scheme of Assistance review this has also been updated to September 2024. Delayed and Rescheduled Team Lead – Housing Operations Medium FINANCIAL SERVICES CAPITAL MONITORING Capital Planning and Management Guide to be updated once the Capital Strategy has been approved 31/03/2022 30/09/2022 The Guide has been updated but requires consultation with the Head of Commercial Head of Commercial Services/Finance Manager Page 25
Page 26
1. Capital Programme Planning & Management Guide The Council’s Capital Guide has not been revised since 2018 and requires a review to ensure it reflects current working practices and provides appropriate support to officers involved in the capital monitoring process. The Council is currently developing a new Capital Strategy which is to be presented to the Policy and Resources Committee in August 2021 and we recognise that a review of the Guide should be conducted after the Strategy has been finalised to ensure the two documents complement each other and. The Guide could also benefit from being linked to, or referencing, other relevant Council processes, in particular the Project Management section on the Hub. to ensure the two are aligned and provide clarity. 31/12/2022 31/03/2023 30/09/2023 31/12/2023 31/03/2024 31 Mar 2025 Services as it has a lot of duplication with the new Capital Investment Strategy and it may be possible to streamline this guide. A significant update is required to the guide from not only finance but other services of the council with heavy involvement from the Capital Investment Board. With changes imminent on the capital plan with new groupings and a review of the block allocations in the pipeline this document will evolve over the coming months. Delayed and Rescheduled Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 5. Debtors Procedure Manual and Processes Finding: There is insufficient evidence to determine whether all Services receive details of invoices being written off. Recommendation: Services should be sent this information. A thorough review of Sundry Debt write-off procedure to be carried out by the working group as part of the overall update of the Sundry Debt Procedures. Reporting and communication with stakeholders is being reviewed by the working group. It is anticipated that reports of debt written off will be sent to departments as part of a standard suite of reporting for discussions at quarterly meetings this will be confirmed within the reviewed Sundry Debt Procedure Manual. 31/12/2023 31/03/2024 30 Sep 2024 Departments get a list of debts to be written off and are asked for approval. A copy of the Q4 list 23/24 is attached and the column on the right hand side shows that the details are shared. Where a debt has prescribed as it hasn't been collected for 5 years, we can no longer legally pursue the amount, departments are not asked to approve write-off in these circumstances because the Council has no other option. More evidence of the exchange between legal services and departments re the write-off list can be supplied if required. Quarter 4 is not complete as Revenues and Benefits Manager Page 26
Page 27
yet, write off process still to be completed. Departmental load unforeseen. Delayed and Rescheduled Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 6. Debtors Procedure Manual and Processes Finding: While there is a pdf version of the authorisation and the spreadsheets containing the individual invoices, there are concerns that different sources of data are used during the write off process as there is more than one version of the write off spreadsheet. Recommendation: Checks should be carried out to ensure that Original Data is retained with records kept of any alteration to the Source Data. There must only be one version of the write-off spreadsheet. This can be shared between Finance and Legal Services on MS Teams. Changes can be made to the document by Legal or Finance before it is presented to senior management for final consideration. 31/12/2023 31/03/2024 30 Sep 2024 We have been provided with the only version of the write-off spreadsheet. Once the Executive Director has written off the debt the spreadsheet will be passed to Finance so that the write-off can be keyed to the Debtors system and the departments will also get the full list of debt written off. Ok to delay as per comments in action number 5 above. Delayed and Rescheduled Revenues and Benefits Manager Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 11. Performance Monitoring and Reporting Findings: There are no performance measures in place to monitor recovery of Sundry debt. Quarterly meetings with Legal Services to discuss recovery of Sundry Debtors were postponed during the pandemic, these have not been reinstated. Management information relating to Sundry Debtors is not made widely available. Aged debtors reports are only sent to Services who ask. Performance monitoring and reporting will be a key part of the Sundry Debt review undertaken by the working group led by the Head of Legal Services. It is anticipated that proposals for quarterly meetings and the reporting suite will be developed and implemented by March 2024. 31/10/2023 31/03/2024 30 Sep 2024 Policy paper going to P&R includes an appendix on role of the Debt Champions covering their duties and including details of a data dashboard that they will be receiving quarterly. Once approved meetings will be held quarterly from July 2024. Delayed P&R and unforeseen workload. Delayed and Rescheduled Revenues and Benefits Manager Page 27
Page 28
Reporting is only to the Financial Services Management Team via Highlight Reports. Recommendations: Appropriate performance measures should be put in place to monitor recovery of Sundry Debt. The meetings with Legal Services should be re-instated and consideration given to which committees and meetings should receive reports regarding the management and recovery of Sundry Debtors. Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 18. Debtors Procedure Manual and Processes Finding: Management information, detailing outstanding invoices, should be provided on a monthly basis to a Single Point of Contact in each Service. This is not happening, currently only those Services who request the information are being sent the reports. Recommendation: Reports should be provided to all Services. This working group review of Sundry Debt will include the key issue of reporting, this aspect of the process will be vastly improved in the future. A suite of reports will be developed, the identification departmental debt champions reinstated and quarterly meetings setup for all relevant stakeholders. 31/12/2023 31/07/2024 30 Sep 2024 On course for completion, new policy and procedures to be considered by P&R in May, new Debt Champions and meetings in place for June/July. Delayed due to revised P&R dated and unforeseen workload. Delayed and Rescheduled Revenues and Benefits Manager Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 20. Debtors Procedure Manual and Processes Finding: Insufficient evidence to conclude whether supporting back up evidence of invoices being written off is retained, leading to concerns that full records may not be retained. Recommendation: Checks should be carried out to ensure that appropriate back up is retained. Back up evidence re write-off should be retained, the write-off lists and any backup documentation held together in MS Teams group for example. This could be further enhanced if we can use EDMS for storage of the information. If we can move this onto Civica’s Electronic Document Management System (EDMS) Comino this will make collation of information, document retention and disposal so much easier and more efficient. Discuss with Civica, 30/09/2023 30/10/2023 30/06/2024 30 Sep 2024 Checks have been carried out relating to items being proposed for write-off for 2023/2024. An area of Civica W3 has been identified and will be used as an area to store write-off and backup from 2024/2025 onwards in line with our stated retention dates in our Information Asset Register. Delayed until system updated by developer. Delayed and Rescheduled Revenues and Benefits Manager Page 28
Page 29
re the use of the Electronic Document Management System for these purposes and overall case management. Improve the file structure within the network with the supporting documentation. Expected timescales for progress - Civica EDMS System Admin Discussion with Supplier by May 2023 - NDR and Income Manager to review the file structure on the network - Revenues and Benefits Manager Evaluation of options by July 2023 then NDR and Income Manager to review the file structure on the network. Revs and Bens Manager Development and Implementation of Solution March 2024 Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 21. Performance Monitoring and Reporting Invoices are raised using Civica Debtors system which does not interface with the Iken System used by Legal Services. The process for the raising of and the recovery Commercial Waste debt and Residential Care debt will be considered as part of the Review of Sundry Debt. There was efforts made previously by staff in D&I and Finance to integrate Commercial Waste onto the Sundry Debt system but it failed. 30/06/2023 31/12/2023 31/03/2024 30 Sep 2024 No interface can be developed between Civica Debtors and IKen. We have decided to create a space in Civica W3 (Comino) which will hold all of the relevant information. Work has commenced on this and should be complete in June 2024. Delayed until system updated by developer. Delayed and Rescheduled Head of Legal & Regulatory Services. Medium FINANCIAL SERVICES Payroll Processes 3. Processes Using the above process flow completed for action 1, conduct a value chain analysis exercise to identify points of duplication and any other inefficiencies in the 31/12/2023 31 Jul 2024 This action has now been superseded by the planned move from ResourceLink to the new iTrent HR and Payroll System. The project team is Payroll & Pension Officer and Team Leader - HR Service Centre Page 29
Page 30
Whilst there are well understood processes and procedures in place for the management of payroll updates, the whole process is hugely inefficient. A new HR and payroll system is planned for the future to replace the existing systems. current process. Redesign the process to remove the inefficiencies identified to optimise the use of staff and speed the process up. working on the processes for the new system which will incorporate workflow functionality which was not previously available in ResourceLink. No further work will be undertaken to review the ResourceLink processes as the system is planned to be decommissioned over the next 4 months. A review would be recommended when the new system is set up. Superseded VFM ROADS & INFRASTRUCTURE SERVICES External Hire 3. External hires exceeding their expected return date Of the 124 current ongoing hires 101 of these have exceeded their expected return. In addition 29 items were over the return date by more than 1000 days. There is no document available that explains the reasons why these items have substantially exceeded their expected return date. Roads and infrastructure services are currently under a review of all services and the recommendation will be assessed as part of the review. 30/06/2023 31/12/2023 31/03/2024 31 Aug 2024 The service will put in place an action plan with the fleet manager to reduce the hires exceeding 24 months. A reporting dashboard will be developed with triggers to remind the service to review the list of ongoing hires and advise of any items that should be taken off hire and information will be provided to explain the reasons for any external hires that are substantially over their return date. Given the nature of Operations works, there will always be a requirement for external hires to ensure the delivery of works programmes such as the roads reconstruction programme. Operations Manager, Roads and Infrastructure Services Page 30
Page 31
Delayed and Rescheduled VFM ROADS & INFRASTRUCTURE SERVICES External Hire 4. Evaluating whether long term hires should be leased or purchased outright There is currently no mechanism that triggers an exercise where “finance” considers whether cheaper long term finance options are available such as an operating lease or for the Council to purchase an item outright Roads and infrastructure services are currently under a review of all services and the recommendation will be assessed as part of the review. 31/03/2024 31 Dec 2024 This issue should be picked up as part of the RIS review which is currently being undertaken and more time is required for this action. Delayed and Rescheduled Principal Accountant, Roads and Infrastructure Services High ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) Client Funds 4. Safe Detail Restricted Detail Restricted 31/03/2023 30/06/2023 31/08/2023 31/10/2023 31/03/2024 30 Jun 2024 Delayed and Rescheduled SW Admin Manager High ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) Client Funds 6. Unaccounted Funds Detail Restricted. Detail Restricted 30/06/2023 31/08/2023 31/12/2023 31/03/2024 30 Sep 2024 Delayed and Rescheduled SW Admin Manager High FINANCE/TRANSFORMATION Customer Service Centre - H&SCP Provided by key officer HSCP management will work with the CET team to determine the best way to approach the current problem and implement the 30/06/2023 30/09/2023 31/03/2024 30 Jun 2024 In progress updated external sites and trialling approach with a Dunoon based integrated team to act as champions based on excellent communication Business Improvement Manager Page 31
Page 32
1. Failure to ensure CET have up to date Service information There is concern that some teams within HSPC are not fully engaging with CSC, despite repeated requests from Senior Managers to review their information. In addition, the Duty rotas and contact details on the HSPC SharePoint are not always up to date. HSCP must engage with CET to review the online and offline information available to agents and customers to ensure it is accurate, up to date and reflects current team structures and duty rotas. correct solution agreeable by HSCP and CSC. between integrated teams. Monitoring ongoing time commitment due to regulated responsibilities of responsible officers to ensure we can prescribe a reasonable time period for input. Delayed and Rescheduled VFM FINANCE/TRANSFORMATION Customer Service Centre - H&SCP 6. Routing of calls to the appropriate channels Calls for HSPC represent the highest volume of both calls handled by CSC and transferred to the Service. The data provided detailing the teams the calls are transferred to indicates that it may be more appropriate for properly trained staff to handle and manage these calls. Contact Centre and HSCP should analyse whether it is more efficient to route certain call types on the HSCP Golden Number directly to HSCP for them to manage or that specific issues which require more specialist or detailed knowledge are dealt directly by HSCP. Provided by key officer The service will engage in discussions with CET’s Customer Engagement Manager to ensure that suitable arrangements are in place which maximises efficiency and effectiveness of the handling of customer contacts and enquiries via the HSCP Golden Number. 30/06/2023 30/09/2023 31/03/2024 30 Jun 2024 In progress updated external sites and trialling approach with a Dunoon based integrated team to act as champions based on excellent communication between integrated teams. Monitoring ongoing time commitment due to regulated responsibilities of responsible officers to ensure we can prescribe a reasonable time period for input. Note this is an ongoing working relationship. Delayed and Rescheduled Business Improvement Manager Page 32
Page 33
Action Plan Points Due after 31 March 2024 Service, Report, Plan no. & Finding Agreed Action Dates Comment Responsible Officer Medium CUSTOMER SUPPORT SERVICES Equality and Socio-Economic Impact Assessment 1. EqSEIA EqSEIAs are being undertaken, however, there are inconsistencies in practice across the Council. A review of papers submitted to committee and papers as part of the budget setting process indicate that a number of EqSEIAs had been missed. It was noted that other Councils provide online EqSEIA toolkits for managers to assist them with the process of completing these. Present options for online EqSEIA toolkit to ELT. 30/06/2023 31/12/2023 31/03/2024 28 Jun 2024 This is being worked on and a proposal for the approach will be completed by June 2024. Delayed and Rescheduled Head of Customer Support Services Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 1. Corporate Debt Policy The Document has not been updated since 2017 and does not reflect the current Council Organisational Structure nor current working practices. The Revenues and Benefits Manager will review the Corporate Debt Recovery Policy and submit it to a working group led by the Head of Legal Services reviewing the Sundry Debt process for consultation. The final document will proceed to October P&R via the Head of Financial Services and Executive Director Kirsty Flanagan’s DMT. 31/12/2023 31/05/2024 30 Sep 2024 Document considered by Kirsty Flanagan's DMT Monday 8 April, now on way to SMT in advance of P&R in May. This will now go to August P&R. Delayed and Rescheduled Revenues and Benefits Manager Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 2. Debtors Procedure Manual and Processes Finding: The Debtors Procedure Manual has not been reviewed since 2017 and does not reflect the current Council Organisational Structure or current working practices. A working group (“the working group”), led by the Head of Legal and Regulatory Services, will review the Sundry Debt Procedure Manual, processes and procedures relating to the management and recovery of Sundry debt. This document will progress through the 31/12/2023, 31/05/2024 30 Sep 2024 Procedures will be included in P&R report for May 2024, should be developed in full by end of April 2024. As per action 1, this will now go to P&R in August. Delayed and Rescheduled Revenues and Benefits Manager Page 33
Page 34
Service, Report, Plan no. & Finding Agreed Action Dates Comment Responsible Officer Recommendation: A full review of the processes and procedures for Sundry Debtors relating to the management, arrears, follow-ups and bad debt write offs should be carried out., then the Debtors Procedure Manual should be updated. Finding: Management information, detailing outstanding invoices, should be provided on a monthly basis to a Single Point of Contact in each Service. This is not happening, currently only those Services who request the information are being sent the reports. Recommendation: Reports should be provided to all Services. Council’s DMT to SMT/ELT in a similar timescale to the Corporate Debt Recovery Policy going to P&R (see action 1 above). Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 7. Debtors Procedure Manual and Processes Finding: The Debtors Procedure Manual does not mention that the keying of the Sundry Debtors Write Offs has two separate stages - first is the creating and approving of invoices as written off on the Debtors system and second is the manual journals to be processed to account for the VAT element of the invoices written off. The journal processed in February did not contain all of the invoices that had been written off. This caused a difference in the debtors’ element of the VAT return. While this was a small value it raises concerns as to whether there is appropriate monitoring and oversight of the balancing of the write off, back to the authorised invoices and values. Recommendation: Checks should be carried to ensure that there is appropriate monitoring and This can be added to the revision of the procedure manual which will be finalised in December 2023. NDR and Income Manager will ensure the write-offs in the Debtors system are fully reconciled with the general ledger position each quarter. 31/12/2023 31/05/2024 30 Sep 2024 Going to P&R in August 2024. Delayed and Rescheduled Revenues and Benefits Manager Page 34
Page 35
Service, Report, Plan no. & Finding Agreed Action Dates Comment Responsible Officer oversight of the balancing of the write off, back to the authorised invoices and values. The Debtors Procedure Manual should be updated to reflect all stages of the write off. Medium FINANCIAL SERVICES MANAGEMENT OF DEBT/DEBT RECOVERY 8. Raising of invoices and Recovery Routes Finding: Invoice inappropriately raised for the drawdown of grant monies. Legal Services confirm this is not a one off. Recommendation: Services should be reminded that Debtors invoices should not be raised for the drawdown of grant monies nor to recover income. These examples should be collated and used to support some internal training that will be delivered to launch the new Sundry Debt Procedure Manual. Training will be delivered by Finance and Legal Services to all users of the Sundry Debt System. Consideration will be given to the format of the training, mandatory e-training for all current users and new users or something delivered via MS Teams. Training to be delivered to all users by June 2024. 31/12/2023 31/05/2024 30 Sep 2024 E-mail issued on 15 April 2024 Email linked to action number 18. New shared storage still to be developed by supplier. Delayed and Rescheduled Revenue and Benefits Manager/Legal Manager Page 35
Page 36
This page is intentionally left blank
Page 37
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 JUNE 2024 INTERNAL AUDIT – ANNUAL REPORT 2023/24 1.0 INTRODUCTION 1.1 The purpose of this report is to advise the Audit and Scrutiny Committee (the Committee) of the work undertaken by Internal Audit in respect of the Annual Audit Plan 2023/24 and advise the Committee of the contents of the Chief Internal Auditor’s (CIA) independent annual opinion on the effectiveness of the Council’s risk management, internal control and governance processes. 1.2 The Public Sector Internal Audit Standards (PSIAS) became effective on 1st April 2013 and as amended, require that: “The chief audit executive [ABC: Chief Internal Auditor] must deliver an annual internal audit opinion and report that can be used by the organisation to inform its governance statement. The annual internal audit opinion must conclude on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control. The annual report must also include a statement on conformance with the Public Sector Internal Audit Standards and the results of the quality assurance and improvement programme.” 1.3 Attached as appendices to this report are: • Appendix 1 – Internal Audit Annual Report and Summary of the audits completed in 2023/24 • Appendix 2 – Internal Audit Opinion for 2023/24 2.0 RECOMMENDATIONS 2.1 The Audit and Scrutiny Committee endorses the content of this report and the associated annual opinion of the CIA. 3.0 DETAIL 3.1 Internal Audit is an independent and objective assurance function designed to add value and improve the Council's operations. It helps the Council accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of the Council's risk management, internal control and governance processes. Page 37 Agenda Item 6
Page 38
3.2 Internal Audit's purpose, authority and responsibilities are set out in detail in the Internal Audit Charter, which was most recently approved by the Committee in March 2024. Internal Audit reports its outputs regularly throughout the year to the Committee. The Committee also approves Internal Audit’s annual plan and monitors the performance of the function. 3.3 The risk based audits contained within the 2023/24 Internal Audit Annual Plan are shown in the table included at Appendix 1 page 12. This shows the overall audit opinion for each audit and the number and significance of agreed actions. 3.4 Internal audit activity is planned to enable an independent annual opinion to be given by the CIA on the adequacy and effectiveness of internal controls within the authority, including the systems that achieve the corporate objectives of the Council and those that manage the material risks faced by the authority. It should be noted, however, that the presence of an effective internal audit function contributes toward, but is not a substitute for, effective control and it is primarily the responsibility of line management to establish internal controls so that the Council's activities are conducted in an efficient manner, to ensure that management policies and directives are adhered to and that assets and records are safeguarded. 3.5 Internal Audit operated during financial year 2023/24 as part of the Directorate of Kirsty Flanagan and whilst I report to the Council’s Head of Financial Services on an administrative basis, I also have unrestricted access to those charged with governance, specifically: Elected Members; the Chief Executive; Executive Directors including the Executive Director who is the Council’s Monitoring Officer. In addition, Internal Audit staff have unrestricted access to all documents, systems and information necessary to reach an opinion or view on any matter under consideration. 3.6 Internal Audit activity during the year was undertaken in accordance with the revised Internal Audit Annual Plan. 3.7 There were no substantial changes made to the 2023/24 audit plan. Two reviews relating to ‘Stretch Aims’ and Building Cleaning were cancelled due to staff availability/illness and resources within the service areas. 3.8 I am pleased to report that, successful attempts have been made to address the majority of outstanding historical recommendations which may have been delayed due to Covid and more recently adverse weather incidents. Council officers have continued to make progress in terms of implementing agreed audit recommendations, despite competing demands and finite resources. Furthermore, there are robust follow up procedures in place with reports taken to the SMT on a quarterly basis and reported as a standing item on the Committee’s agenda. Page 38
Page 39
3.9 There is a formal requirement for me to prepare an annual opinion on the Council’s internal control system. The opinion is presented to members of the Committee and is intended to provide independent and objective assurance as to the adequacy and effectiveness of internal controls within the Council. 3.10 In addition to the work carried out by internal audit, my opinion is also informed by: • the work of External Audit • the work of other external inspection agencies who report on the Council’s work • statements of assurances provided by the Chief Executive, Executive Directors and Heads of Service providing their opinion on the effectiveness of control, governance and risk management within their areas of responsibility. 3.11 My evaluation of the control environment is informed by these sources and in bringing these together, consideration has been given to whether there is evidence that any key controls are absent, inadequate or ineffective and whether the existence of any weaknesses identified, taken independently or with other findings, significantly impairs the Council's overall systems of internal control. Wider issues relating to the Council's corporate governance and risk management arrangements have also been considered. 3.12 The nature of individual audit assignments is such that most Internal Audit reports identify some weaknesses or areas where scope for improvement exists. However, I am pleased to report that, generally across the Council, there continues to be a strong recognition amongst management of the importance of proportionate but effective internal controls. Senior management has also established an operating culture where good standards of governance are seen as a key requirement in the way in which the Council conducts its activities. 3.13 During work undertaken in 2023/24 there have been instances where the control environment was not strong enough or complied with sufficiently to prevent risks to the organisation. In these cases, Internal Audit has made recommendations to further improve the systems of control and compliance. Although sometimes significant to the control environment in place for the individual system or areas that have been audited, I do not consider these weaknesses material enough to have a significant impact on the overall opinion on the adequacy of the Council's control environment at the year end. 3.14 My formal annual Internal Audit opinion on the soundness of the Council's internal control systems is presented in my Internal Audit Annual Report in particular at Appendix 2. Overall, the results of the work of Internal Audit in 2023/24 taken with other information available to me did not lead me to conclude that the Council's overall systems of internal control were significantly or materially impaired. Page 39
Page 40
3.15 It has been a particularly busy year for the internal audit team as they have supported the Chief Internal Auditor in the further development of our work practices including working closely with the counter fraud team. The team have worked hard to deliver the internal audit plan, and in a backdrop of the retirement of a qualified experience auditor, interim arrangements have been made to address this vacancy and this will continue until training plans are progressed and staff have developed experience along with professional qualifications in order to improve resilience. It is my opinion that the profile of Internal Audit continues to improve within the Council as does the quality of the work it delivers and is evident in the feedback received from post-audit surveys indicating a satisfaction rate of 93%. 3.16 As required by the PSIAS a five-yearly external assessment took place in 2022-23 and the service was found to be fully compliant in all 14 areas of review. Two minor housekeeping issues were identified and these have now been fully implemented. All identified actions for improvement have been tracked through our quality assurance improvement programme with updates reported to Committee as part of a standard agenda item. 3.17 On behalf of my team I would like to thank all Council staff who have assisted Internal Audit during the course of our work throughout 2023/24 and to thank senior management and elected Members for the consideration and due regard given to our work. It is important that good relationships exist in order to promote and improve controls within the Council and it is clear that such relationships are in place. 4.0 CONCLUSION 4.1 Subject to the matters listed in the Annual Governance Statement reasonable/satisfactory assurance can be taken that the systems of governance and internal control are operating effectively. Internal Audit continues to develop and improve as a service. Our Internal Audit Annual Report 2023/24 on page 10 provides a dashboard of our opinion in each area of Governance, Risk Management and Internal Control. 5.0 IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – The implementation of recommendations contained in audit reports may help mitigate the risk to the Council. 5.8 Customer Service – None 5.9 The Rights of the Child (UNCRC) – None Page 40
Page 41
Paul Macaskill Chief Internal Auditor 13 June 2024 For further information contact: Paul Macaskill, Chief Internal Auditor Tel: 01436 604108 Email: paul.macaskill@argyll-bute.gov.uk APPENDICES 1. Internal Audit Annual Report 2023/24, Counter Fraud update and summary of planned work in 2023/24 2. The Certificate of internal Audit Opinion 2023/24 Page 41
Page 42
This page is intentionally left blank
Page 43
ARGYLL AND BUTE COUNCIL COMHAIRLE EARRA-GHÀIDHEAL AGUS BHÒID INTERNAL AUDIT ANNUAL REPORT 2023-24 Page 43
Page 44
2 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 Contents Introduction ..................................................................................................................................................................................................................................... 1 Basis of opinion ............................................................................................................................................................................................................................... 2 Analysis of the Internal Audit Coverage and Performance ........................................................................................................................................................... 4 Quality Assurance and Improvement Programme ........................................................................................................................................................................ 5 Confirmation of Independence ....................................................................................................................................................................................................... 7 Counter Fraud Services ................................................................................................................................................................................................................... 8 Opinion, Conclusions and Observations ......................................................................................................................................................................................... 9 Appendix 1 – Summary of Internal Audit Plan 2023/24 .............................................................................................................................................................. 12 Appendix 2 – Certificate of Internal Audit Opinion 2023/24 ....................................................................................................................................................... 13 Contact Details Chief Internal Auditor: Paul Macaskill Telephone: 01546 604108 e-mail: paul.macaskill@argyll-bute.co.uk www.argyll-bute.gov.uk Page 44
Page 45
1 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 Introduction 1. This report aims to provide the Audit & Scrutiny Committee with an evaluation of elements of Argyll and Bute Council’s internal control, risk management and corporate governance systems based on our work during 2023/24 and to summarise the Internal Audit coverage in the year. 2. Corporate governance is the system by which local authorities direct and control their functions and relate to their communities. The three fundamental principles of corporate governance are openness, integrity and accountability. A sound system of internal control must be maintained to support Councils in operating effective corporate governance arrangements. 3. Good governance practice and internal control suggests that:- • Council Members should set appropriate policies on internal control and seek regular assurance that the system of internal control is functioning effectively; • management should implement the Council’s policies on internal control and design, implement and monitor suitable systems; • a well-established and effective Audit and Scrutiny function should be in place within the Council; • a local Code of Corporate Governance exists and is reviewed annually; and • Internal Audit should provide an independent assessment of the adequacy of the system of internal control. 4. In Argyll and Bute Council a system of good governance is in existence and this is supported by a variety of policies, codes and guidance to promote expected conduct of its business on a day to day basis. The national framework ‘Delivering Good Governance in Local government’ which was published by the Chartered Institute of Public Finance and Accountancy (CIPFA) and the Society of Local Authority Chief Executives (SOLACE) in April 2016 aims to assist authorities in reviewing and assessing their own governance arrangements. The Council has a ‘Local Code of Corporate Governance’ in place and these arrangements are reviewed periodically and improvements required will be implemented, where necessary. 5. To support the governance statement the Council will need to carry out a review of the effectiveness of internal control, deriving evidence from a variety of sources including Internal Audit, senior managers within the authority with responsibility for developing and maintaining internal control and cognisance of external/internal audit recommendations along with recommendations of other regulatory bodies. 6. This report provides internal audit information in support of the assurance statements and covers the period from 1 April 2023 to 31 March 2024. The attached Appendix reports the Internal Audit activity against the operational audit plan Page 45
Page 46
2 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 Basis of opinion 7. We are able to provide assurance on the adequacy of internal controls and governance arrangements within the Council arising only from the results of Internal Audit reviews we have completed during the period in accordance with the programme of Internal Audit work approved by the Audit and Scrutiny Committee. In this context, it is important to note that: (a) it is Management’s responsibility to maintain internal control and good governance arrangements on an ongoing basis; (b) the Internal Audit function forms part of the overall internal control and governance structure of the organisation; (c) while we have planned our work so that we have a reasonable expectation of detecting significant control and governance weakness, internal audit procedures alone do not prevent the possibility of poor judgement in decision making, human error, control processes being deliberately circumvented by employees and others, management overriding controls and the occurrence of unforeseeable circumstances; (d) a sound system of corporate governance and internal control provides reasonable but not absolute assurance that the Council will not be hindered in achieving its objectives or in the orderly and legitimate conduct of its business by circumstances which may reasonably be foreseen. However, a system of corporate governance and internal control cannot provide protection with certainty against any organisation failing to meet its objectives or all material errors, losses, fraud or breaches of laws or regulations; (e) it is the responsibility of Internal Audit to assess the adequacy of the internal control and governance processes as far as it is reasonably possible by reviewing arrangements put in place by management and to perform testing to confirm whether those controls were operating for the period under review; and (f) reasonable expectations of senior management, the Audit and Scrutiny Committee and other stakeholders have been taken into account in terms of our duty to report all matters which come to our attention for the period under review. 8. In our reports issued to date we have made recommendations, where appropriate, to improve internal controls and promote good governance. On the basis of our sample testing of key controls, we concluded that these controls were generally operating as expected during the period under review, with some exceptions that have been reported to management. Appropriate responses to the recommendations made in our reports have been obtained and, if actioned, should provide management with additional comfort that the system of control operates as intended. 9. Summaries of the issues arising in relation to each system or activity covered by the internal audit work in 2023/24 have been reported to management and the Audit and Scrutiny Committee throughout the year. We do not, therefore, propose to repeat the matters in this report. There have been no significant issues which have come to our attention that have not been reported to management. 10. The services provided to the Council in 2023/24 by Internal Audit and Counter Fraud Services are summarised below:- Page 46
Page 47
3 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 INTERNAL AUDIT AND COUNTER FRAUD SERVICES Page 47
Page 48
4 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 Analysis of the Internal Audit Coverage and Performance 11. In respect of 2023/24 the Internal Audit days planned and delivered can be summarised as follows: 12. We have been able to achieve 100% of the agreed 2023/24 audit plan. In addition to the Council’s audit plan we have completed the agreed work for the Health and Social Care Partnership (HSCP) contract and also that for LiveArgyll. The work demands on the service continue to be high and this is expected to continue, therefore, our focus will remain on our high risk work and core continuous monitoring of our key financial systems. Notwithstanding, the service remains focused on providing a high quality service and output supporting the Council to achieve its desired goals and outcomes for the communities we serve. 13. We have worked with Council services and our appointed External Auditors, Mazars, to focus our work on those areas of the highest business risk to the Council and those on which External Audit may wish to place reliance. 14. At Appendix 1, we provide details of the internal audit work undertaken in 2023/24. 15. In 2023/24, we issued 17 reports, which contained a variety of recommendations to improve the system of control, along with verification work in a further 3 areas. Follow up internal audit work has been and will continue to be undertaken to establish if the more significant recommendations made in those reports have been implemented as agreed. Two planned reviews were cancelled due to staff absences and unavailability of staff within the service areas, these areas will be considered as part of future risk assessed internal audit planning processes, these were noted as amendments to the 0 20 40 60 80 100 2021/22 2022/23 2023/24 Percentage of Internal Audit Plan Completed Page 48
Page 49
5 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 audit plan. During the year we undertook quarterly ‘follow up’ arrangements to report progress made by management in relation to previously agreed recommendations. In addition, regular reporting of outstanding recommendations are considered by the Council’s Strategic Management Team (SMT) on a regular basis to monitor progress and where appropriate seek that managers resolve any outstanding matters where these have gone beyond agreed implementation dates; SMT are supportive in our work and this is helpful in our continued monitoring and progress assessments until such time as our recommendations are fully implemented. 16. We also submitted formal progress reports to the Audit & Scrutiny Committee throughout the course of the year. Quality Assurance and Improvement Programme 17. Internal Audit monitors its performance in a number of ways. This allows us the opportunity to gauge the effectiveness of our service and may inform future improvements. Principally, we monitor performance by the use of client questionnaires which are issued after each piece of work and allow client departments to feedback contributions we have made to improve control, address any areas of value for money and raise any concerns. We are pleased to report, from the questionnaires returned, that clients are generally very satisfied with our service. In addition, Internal Audit produce quarterly and annual reports to the Audit and Scrutiny Committee allowing our progress to be monitored. 18. CIPFA has issued a statement that sets out the role of the Head of Internal Audit in Local Government in 2019. The purpose of this statement is to outline the core activities and behaviours that belong to the role of Head of Internal Audit and how these should influence and champion good governance, risk management and internal control. The Council’s Internal Audit section conforms to the Statement. 19. CIPFA and the Institute of Internal Auditors (IIA) have reviewed the guidance and made amendments in order to have a common set of standards across the whole public sector. These changes are primarily based on the International Professional Practices Framework (IPPF). The new standards termed Public Sector Internal Audit Standards (PSIAS) became effective in April 2013 and amended in 2017. It should, however, be noted that a comprehensive review of the IPPF has been completed and a new set of standards called the ‘Global Internal Audit Standards’ will be implemented in January 2025. A new and updated PSIAS reflecting these changes will be issued to public bodies in due course and a gap analysis will be undertaken to identify any changes that Internal Audit may need to make to our documentation and processes. 20. A key requirement of the PSIAS is that Internal Audit sections are required to state whether or not they conform to these standards as part of their annual reporting. In addition, they should outline the results of the quality assurance and improvement programme together with progress against any improvements identified during this assessment. 21. In 2022/23 financial year, Internal Audit were subject to an external evaluation against the PSIAS, Local Government Application note and Quality Assurance Improvement Programme. It is a requirement of the new standards that all public sector Internal Audit sections will require to be independently assessed against these standards during a five year rolling period. The assessment found that in all 14 categories the Council’s Internal Page 49
Page 50
6 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 Audit section were fully compliant. This is the highest level of standard attainable in the assessment and a report outlining the findings was presented to the Council’s Audit and Scrutiny Committee in March 2023. Arrangements for the next review will be scheduled in for January 2028. The table below outlines each of the 14 categories of assessment and the level of compliance/conformance achieved. Assessment Area Level of Conformance External Independent EQA 2023 Level of Conformance Internal Self-Assessment 2024 Mission of Internal Audit and Core Principles Fully Conforms Fully Conforms Definition of Internal Auditing Fully Conforms Fully Conforms Code of Ethics Fully Conforms Fully Conforms Purpose, Authority and Responsibility Fully Conforms Fully Conforms Independence and Objectivity Fully Conforms Fully Conforms Proficiency and Due Professional Care Fully Conforms Fully Conforms Quality Assurance and Improvement Programme Fully Conforms Fully Conforms Managing the Internal Audit Activity Fully Conforms Fully Conforms Nature of Work Fully Conforms Fully Conforms Engagement Planning Fully Conforms Fully Conforms Performing the Engagement Fully Conforms Fully Conforms Communicating Results Fully Conforms Fully Conforms Monitoring Progress Fully Conforms Fully Conforms Communicating the Acceptance of Risks Fully Conforms Fully Conforms Assessment Gradings: Fully Conforms Generally Conforms Partially Conforms Does Not Conform Page 50
Page 51
7 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 22. In terms of the findings of the EQA a number of areas of good practice were identified: • Full compliance with the PSIAS; • Qualified Internal Auditors with extensive local authority experience; • Internal Audit staff who are enthusiastic, experienced and focused on providing a good and professional service; • Well defined procedures which ensures that the service provided is robust, reliable and efficient in carrying out audit activity; and • The ability of External Audit to place reliance on the work of Internal Audit. The overall conclusion was that the Internal Audit Service Fully Conforms to the PSIAS. It was, however, noted that the two areas for improvement highlighted in the report are as follows: • The need to undertake an annual review of the declarations of interest – this has now been implemented. • Clearer referencing in the internal audit annual report to matters referenced in the Annual Governance Statement – this has now been implemented. As part of the annual process the Internal audit service undertakes a self-assessment against the PSIAS and this has concurred with the independent assessment which was reported to the Council’s Audit and Scrutiny Committee in March 2023. A full copy of the EQA report can be accessed using the link provided. Confirmation of Independence 23. Internal audit activity is planned to enable an independent annual opinion to be given by the CIA on the adequacy and effectiveness of internal controls within the authority, including the systems that achieve the corporate objectives of the Council and those that manage the material risks faced by the authority. It should be noted, however, that the presence of an effective internal audit function contributes toward, but is not a substitute for, effective control and it is primarily the responsibility of line management to establish internal controls so that the Council's activities are conducted in an efficient manner, to ensure that management policies and directives are adhered to and that assets and records are safeguarded. 24. Internal Audit operates as part of the Directorate of Kirsty Flanagan and reports to the Council’s Head of Financial Services on an administrative basis, however, has unrestricted access to those charged with governance, specifically: Elected Members; the Chief Executive; Executive Directors including the Executive Director who is also the Council’s Monitoring Officer. 25. Internal Audit operated without restriction and had unfettered access to all staff and documents both electronic and paper to allow full and effective Page 51
Page 52
8 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 assessment of the work during 2023-24. We are therefore pleased to note that there are no matters which require to be drawn to the Audit and Scrutiny Committee’s attention or wider senior management contained within this report regarding the independence of the Internal Audit service during 2023- 24. Counter Fraud Services 26. The Counter Fraud Team (CFT) was established in September 2020 on a two year trial basis, during this period significant successes have been made in identifying monies due to the Council and issuing bills for the rightful charges. In September 2022, on conclusion of the trial period and having demonstrated a need for the service and its continued success, these arrangements were made permanent. The work of the CFT is wide in nature, covering complaints of theft, fraud, dishonesty and irregularity to reviewing and proactively working to maximising the Council’s revenue streams by reducing the amount of benefit fraud, not to mention educating and training staff on such issues. The Council also participates in the National Fraud Initiative (NFI) which uses data analysis and matching to highlight potential irregularities that are reported back to each participating authority to investigate. 27. The CFT consist of two full time staff who have formal qualifications in CIPFA Accredited Fraud investigators course. Indeed, both members of staff have significant public sector experience in dealing with such matters and this has contributed to a successful approach. One member of staff is currently on secondment until 2025 and the post is being backfilled during this period. 28. The table below summaries the total income recovered by the team to date. This has been broken down into reactive work through referrals, which can also be quantified in terms of numbers, and proactive work such as large scale council tax reviews. The total funds recovered by the Fraud Team are: Reactive Work Total Rebilled Value Employee 7 0 Council Tax 41 34,443.79 Blue Badge 7 0 DWP 4 0 Grants 1 0 Other 13 0 Welfare Fund 0 0 Total 73 34,443.79 Proactive Work Total combined work rebilled 1,039,939 Total combined work recovery 777,453 Page 52
Page 53
9 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 29. These figures represent the rolling total since the inception of the team to date and so far 74% of the income due that has been rebilled has been paid to the Council. The rebilled accounts are routinely monitored and recovery is updated routinely. It is not within the CFT’s remit to pursue rebilling as that rests with the Debt Recovery teams. The CFT will liaise with Debt Recovery for long term debts, work closely together to maximise the income for the Council. The CFT monitor recovery for its own records. The unquantifiable work carried out by the CFT also raises awareness of the potential for suspicious activity toward the Council and information is passed nationally to other local authorities and Police Scotland. 30. Local visits throughout Argyll and Bute were undertaken in the year and this will form part of a rolling programme of visits going forward, focusing on maximising the income due to the Council. In addition the CFT are raising awareness of the Council’s zero tolerance to fraud and this will help act as a deterrent to fraud being perpetrated in the first place. 31. In addition to the above role the CFT undertake investigative work on complaints received regarding allegations against staff and where these require to be looked at in terms of fraud, theft or other irregularity then a full examination of the facts will follow and be reported. This work can be and often is time consuming and is fitted in to the overall demands of the role. The nature of this work is sensitive and confidential and reporting is therefore restricted in terms of data protection and associated rights. Opinion, Conclusions and Observations 32. We agreed a rolling programme of Internal Audit coverage based on an assessment of risk factors with Management and the Audit and Scrutiny Committee. This programme related to the level of available resources, focusing on higher risks and areas identified by management as requiring audit review within the Council. On the basis of the internal audit systems and work completed in respect of this year, we consider that the assessment of key systems are noted below. A certificate of opinion is noted within Appendix 2 of this document reflecting our opinion. Page 53
Page 54
10 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 Governance Risk Management Internal Control 33. However, we would point out the following exceptions and/or observations: • Across Scotland’s public sector significant pressures continue as a result of financial settlements and this has been particularly compounded as a result of inflationary pressures and rising costs of fuel, gas and electricity, together with the risk of unfunded or partly funded pay settlements. These pressures are likely to remain going into 2024/25 financial year and will continue to add an element of uncertainty in relation to the overall financial picture affecting the Council. The Council continues to undertake appropriate medium to long term financial planning using a scenario modelling approach which helps to provide Members with a thorough overview of the implications of funding and cost pressures. • The Argyll and Bute HSCP is having to manage a number of challenges relating to financial pressures and staffing. This is resulting in increased reliance upon agency and locum staff which does not provide for a stable and sustainable service model and in turn is placing increased pressure on service budgets. The HSCP had provisionally identified a budget gap of approx. £12M for 2024/25 but have identified savings of Classification and Assessment Poor and Requiring Improvement – Does not meet any key areas of good practice or partially or fails to meet most key areas of good practice. Adequate and/or Improving - Attempting to meet or meets most key areas of good practice/ with effort being made to improve further. Reasonable/Satisfactory - Substantially meets all key areas of good practice. Page 54
Page 55
11 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 £8.2M to date and are seeking to identify further savings to bridge this gap and manage its financial position. Such a position increases the risk to parent bodies in terms of financial support being required. • During our planned work for 2023/24, we found no significant reporting issues that have not already been drawn to the Audit and Scrutiny Committee’s attention. • The Work of our CFT continues to be supportive and preventative in approach and where there is evidence of error, fraud or complaint which has a financial impact on the Council, every attempt will be made to actively recover monies due in order to maximise income and serve as a deterrent. • Our findings contained within this report should be considered in the preparation and reporting of the Council’s Annual Governance Statement which can be found on the Council’s web page. 34. Finally, we would also like to highlight our appreciation to the Council’s Audit & Scrutiny Committee for their strong support, together with the full co- operation of the Council’s Management Team and ongoing working relationship with the appointed External Auditors, Mazars. Page 55
Page 56
12 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Appendix 1 – Summary of Internal Audit Plan 2023/24 Appendix 1 - Summary of 2023/24 Internal Audit Plan No. of Recommendations Report Title Overall Opinion High Medium Low VFM Pupil Registration High 0 0 3 1 Freedom of Information High 0 0 4 0 Compliance Review – Period Products Substantial 0 5 4 0 Financial Ledger Substantial 0 0 0 0 Risk Management High 0 0 1 0 Fleet Management Reasonable 0 0 1 4 Pupil and Public Transport Substantial 0 1 1 2 Piers and Harbours Reasonable 0 0 8 0 Oban Airport High 0 0 0 0 Planning Substantial 0 1 3 0 Human Resources Substantial 0 2 3 0 Cloud Based Computer Services Substantial 0 4 1 0 SSSC Registration Substantial 1 1 4 0 Client Funds Reasonable 0 0 0 0 Learning and Physical Disability Care Packages Reasonable 0 7 0 0 Establishment Visits Substantial 0 0 0 0 LGBF n/a 0 0 0 0 Stores & Stock Control n/a 0 0 0 0 EMA High 0 0 0 0 SPT Concessionary Fares n/a 0 0 0 0 Page 56
Page 57
13 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 Appendix 2 – Certificate of Internal Audit Opinion 2023/24 To the Members of Argyll and Bute Council, the Chief Executive, other members of the Council’s Senior Management Team including the Section 95 Officer As the Chief Internal Auditor of Argyll and Bute Council (the Council), I am pleased to present my annual statement on the adequacy and effectiveness of the internal financial control system of the Group Accounts prepared by the Council for the year ended 31 March 2024. Respective responsibilities of management and internal auditors in relation to internal control It is the responsibility of the Council’s senior management to establish an appropriate and sound system of internal financial control and to monitor the continuing effectiveness of that system. It is the responsibility of the Chief Internal Auditor to provide an annual overall assessment of the robustness of the internal financial control system. The Council’s framework of governance, risk management and internal control The Council has a responsibility to ensure that its business is conducted in accordance with legislation and proper standards. The governance framework comprises the systems and processes, culture and values by which the Council is directed and controlled and how it accounts to communities. It enables the Council to monitor the achievement of its strategic priorities and to consider whether those objectives have led to the delivery of appropriate services and value for money. The main objectives of the Council’s internal control systems are to ensure: • adherence to management policies and directives in order to achieve the organisation’s objectives • economic, efficient, effective and safe use of resources and assets • the relevance, reliability and integrity of information, so ensuring as far as possible the completeness and accuracy of records • compliance with statutory requirements. The system of internal control is a significant element of the governance framework. Any system of control can only ever provide reasonable and not absolute assurance that control weaknesses or irregularities do not exist or that there is no risk of material errors, losses, fraud, or breaches of laws or regulations. Accordingly, the Council is continually seeking to improve the effectiveness of its systems of internal control in order to identify and prioritise the risks that would prevent the achievement of the Council’s strategic objectives. The work of internal audit Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. The Council’s Internal Audit Section operates in accordance with the Public Sector Internal Audit Standards (PSIAS) which have been agreed to be adopted from 1 April 2013 by the relevant public sector Internal Audit Standard setters. PSIAS applies the Institute of Internal Auditors International Standards to the UK Public Sector. Page 57
Page 58
14 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 PSIAS requires that a Quality Assurance and Improvement Programme (QAIP) is developed in order to provide assurance that internal audit activity: • is conducted in accordance with an Internal Audit Charter • operates in an efficient and effective manner • is perceived to be adding value and improving operations. PSIAS also requires, as outlined in Standard 1300 “QAIP”, that: “External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organisation. External assessments can be in the form of a full external assessment or a self-assessment with independent external validation”. To meet this requirement, a reciprocal arrangement to complete a programme of inspections has been developed by the Scottish Local Authorities Chief Internal Auditors Group (SLACIAG). This process identified East Dunbartonshire Council as the body to undertake the independent review of the Council’s Internal Audit function’s level of compliance with PSIAS. This output of this review was presented to the Audit and Scrutiny Committee in March 2023. It concluded that the internal audit service demonstrates full compliance/conformance with PSIAS and identified many areas of strong practice including the internal audit team is highly qualified, delivers a high quality service, good engagement and clear reporting lines and clear evidence of supervision and audit follow up. Internal Audit undertakes an annual programme of work based on a risk assessment process which is revised on an ongoing basis to reflect evolving risks and changes within the Council. All Internal Audit reports identifying system weaknesses and / or non-compliance with expected controls are brought to the attention of management and the Audit and Scrutiny Committee together with appropriate recommendations and agreed action plans. It is management’s responsibility to ensure that proper consideration is given to Internal Audit reports and that appropriate action is taken on audit recommendations. The internal auditor is required to ensure that appropriate arrangements are made to determine whether action has been taken on internal audit recommendations or that management has understood and assumed the risk of not taking action. A programme of follow-up on assignment findings and recommendations provides assurance on the complete and timeous implementation of internal audit recommendations. Internal Audit staff regularly attended the following external user group meetings: • SLACIAG, the purpose of which is to develop and improve the practice of internal audit activity with Scottish local authorities. It achieves this by meeting to discuss issues of common concern, commissioning work to develop ideas, sharing good practice, working in partnership with other professional / governing bodies and promoting SLACIAG as the representative body for internal audit in local authorities. We have attended meetings of SLACIAG during 2023/24. • SLACIAG Computer Audit sub group: a member of the audit team attends this forum and contributes to outputs and communications that are regularly exchanged with the aim of ensuring that audit teams are better equipped to perform technical information systems audits. Page 58
Page 59
15 Argyll and Bute Council – Internal Audit Annual Audit Report 2023/24 • The CIA also meets the Chief Internal Auditors of West Dunbartonshire Council, East Dunbartonshire Council, West Lothian Council, Falkirk Council and Inverclyde Council on a quarterly basis to discuss developments and share knowledge. In-between these meetings we are in regular contact to share information which helps deliver audit plans more efficiently including consistent use of benchmarking indicators. Basis of Opinion My evaluation of the control environment is informed by a number of sources: • the audit work undertaken by Internal Audit during the year to 31 March 2024, including risk based audits, continuous monitoring and follow-up activity. • the assurance statements signed by the executive directors and heads of service on the operation of the internal financial controls for the services for which they were responsible during the year to 31 March 2024. • the assurance statement signed by the Chief Executive for the overall Council for the year ended 31 March 2024. • reports issued by the Council’s external auditors, Mazars, and other external review agencies. • my knowledge of the Council’s governance, risk management and performance monitoring arrangements. Limitation to Resources or Scope of Internal Audit Work I can report that Internal Audit operated throughout 2023/24 with no impairments or restrictions in scope or independence. There were sufficient resources available to deliver the amended programme of audit assignments contained within the 2023/24 Internal Audit Plan and no significant threats emerged to the independence of the internal audit activity such as inappropriate scope or resource limitations. Opinion It is my opinion, based on the above, that reasonable assurance can be placed upon the adequacy and effectiveness of the Council’s systems of governance, risk management and internal control in the year to 31 March 2024. Signature: Paul Macaskill FCPFA CMIIA Title: Chief Internal Auditor Date: 13 June 2024 Page 59
Page 60
This page is intentionally left blank
Page 61
ARGYLL & BUTE COUNCIL LEGAL AND REGULATORY SUPPORT FINANCIAL SERVICES Audit and Scrutiny Committee 13 June 2024 STATEMENT OF GOVERNANCE AND INTERNAL CONTROL 1. EXECUTIVE SUMMARY 1.1. This report advises that the statement of governance and internal control for 2022/23 has been reviewed and updated which allows the Council to include a statement of governance and internal control in the Annual Accounts for 2023/24. 2. RECOMMENDATIONS 2.1 The Committee consider and approve the draft statement of governance and internal control for 2023/24. Page 61 Agenda Item 7
Page 62
ARGYLL & BUTE COUNCIL LEGAL AND REGULATORY SUPPORT FINANCIAL SERVICES Audit and Scrutiny Committee 13 June 2024 STATEMENT OF GOVERNANCE AND INTERNAL CONTROL 1. HEADLINES 1.1 This report advises that the statement of governance and internal control for 2022/23 has been reviewed and updated which allows the Council to include a statement of governance and internal control in the Annual Accounts for 2023/24. 2. RECOMMENDATIONS 2.1 The Committee consider and approve the draft statement of governance and internal control for 2023/24 3. DETAIL 3.1 CIPFA and SOLACE published a revised Framework for ‘Delivering Good Governance in Local Government’ in 2016. The Framework was defines seven core principles that should underpin the governance of local authorities and provides a structure to assist authorities with assessing their own approach to governance. 3.2 3.3 3.4 The Council is required to prepare a statement of governance and internal control confirming the Council’s position in regard to the seven core principles for 2023/24. The draft document which is attached at Appendix 1 provides details of the position for 2023/24 and includes an update on the ‘areas for further development’ identified in the 2022/23 document. It has been approved by ELT. Once approved the statement of governance and internal control is included in the Council’s Annual Accounts for 2023/24 and identifies areas within the Council where work to improve its governance arrangements will be being undertaken in 2024/25. 3.5 The seven principles contained in the local code are: 1. Behaving with integrity, demonstrating strong commitment to ethical values, and respecting the rule of law. 2. Ensuring openness and comprehensive stakeholder engagement. Page 62
Page 63
3. Defining outcomes in terms of sustainable economic, social and environmental benefits. 4. Determining the interventions necessary to optimise the achievement of the intended outcomes. 5. Developing the entity’s capacity, including the capability of its leadership and the individuals within it. 6. Managing risks and performance through robust internal control and strong public financial management 7. Implementing good practices in transparency, reporting, and audit to deliver effective accountability 3.6 The review of the effectiveness of the system of governance and internal control is informed by the: • work of council officers • work of External and Internal Audit • Statements of Governance or Internal Control provided by external bodies • external review and inspection reports • recommendations from the Audit and Scrutiny Committee 4. CONCLUSION 4.1 This review gives assurance about the robustness of the Council’s governance arrangements. 5. IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 5.6 Fairer Scotland Duty – None 5.5.1 Equalities – Protected Characteristics 5.5.2 Socio Economic Duty 5.5.3 Islands Climate Change – None 5.7 Risk – None 5.8 5.9 Customer Service – None The Rights of the Child (UNCRC) – None Douglas Hendry Executive Director with responsibility for Legal and Regulatory Support Page 63
Page 64
Kirsty Flanagan Executive Director with responsibility for Internal Audit For further information please contact: Iain Jackson, Governance, Risk and Safety Manager - 01546 604188 Paul MacAskill, Chief Internal Auditor - 01546 604108 Appendices Appendix 1 - Draft Statement of Governance and Internal Control 23/24 Page 64
Page 65
Appendix 1 Annual Governance Statement 1. BACKGROUND AND SCOPE OF RESPONSIBILITY Argyll and Bute Council’s (the Council) governance framework includes the systems, processes and culture by which the Council is controlled, engages with communities and monitors the achievement of strategic objectives. The Council conducts its business in accordance with the law and proper standards. The Council has a duty to make arrangements to secure continuous improvement in the way in which its functions are exercised, having regard to the economic, efficient and effective use of public money. The system of internal control is a key part of the framework and is designed to manage risk to an acceptable level. In discharging these responsibilities, the Council has put in place proper arrangements for the governance of its affairs and the stewardship of the resources at its disposal. The Council has approved and adopted a Local Code of Corporate Governance (the Code) which is consistent with the principles and requirements of the CIPFA/SOLACE revised Framework for ‘Delivering Good Governance in Local Government. This Statement explains how the Council has complied with the Code and meets the requirements of current good practice. 2. THE GOVERNANCE FRAMEWORK The Code details how the Council will demonstrate compliance with the fundamental principles of corporate governance for public sector bodies. The seven key principles of our governance arrangements in 2023/24 are described in the Code, along with our supporting principles and key aspects of our arrangements to ensure compliance. 1. Behaving with integrity, demonstrating strong commitment to ethical values, and respecting the rule of law. We have four values, which underpin all that we do and provide a sound basis to achieve transformation to ensure we meet the challenges of the future and deliver quality services. These values are that we have a workforce which is: Caring Committed Collaborative Creative The Council has developed a change programme ‘Connect for Success’ with the seven principles – One Council One Place Approach, Purpose and Mission Focus, Employee Empowerment, Data and Evidence Driven Decision Making, Learning Council, Agile and Maximise Opportunities that Technology Offers - Connect for Success We have developed and communicated an Ethical Framework within the Council's Constitution, which defines standards of behaviour for Members and staff. Protocols for Member/Officer relations are also detailed within the Constitution. The Councillors’ Code of Conduct is set out at a national level, applying to all members in Scottish local authorities and is incorporated into the Council’s Constitution as part of the ethical framework which also includes a protocol for the Monitoring Officer. A Register of Members Interests is publically available for inspection. In addition, the Constitution has a section on conduct at meetings and meeting agendas require declarations of interest to be made where appropriate. Standing orders for meetings are included within the Council’s constitution and training and support is provided to members on their role in Council committees. Anti-fraud and whistleblowing policies are in place and the Council has adopted the Page 65
Page 66
Appendix 1 Annual Governance Statement Scottish Public Services Ombudsman’s (SPSO’s) Model Complaints Handling Procedure. The Council complies with CIPFA’s Statement on the Role of the Chief Financial Officer in Local Government. In addition, Professional advice on the discharge of statutory social work duties is provided to the Council by the Chief Social Work (CSWO). A structure of governance and framework across our day to day activities and which supports accountability, control, risk management and appropriate overview of the Council are outlined in the diagram below: Page 66
Page 67
Appendix 1 Annual Governance Statement 2. Ensuring openness and comprehensive stakeholder engagement. We have established clear channels of communication with the community and other stakeholders through our Communication Strategy. Key mechanisms include: Consultation Diary Decision Making / Procedural Council and Committee Structure Council and Committee Terms of Reference Council and Committee Standing Orders Scheme of Delegated Functions Standing Orders Relating to Contracts Councillor's Code of Conduct Corporate Governance Executive Leadership Team and Senior Management Team Risk Management Integrity HR and Individual Capability Strategic Planning Performance Management Framework Community Planning and Empowerment Stakeholder Engagement Financial Governance Internal Control ALEO Governance Scheme of Delegation ALEO Governance Framework Risk and Governance Reporting Financial and Operational Performance ALEO Risk Register Asset Governance Corporate Asset Management Strategy Corporate Asset Managment Plan and Capital Plan Records Management Information Management and Security Local Development Plan ICT and Digital Strategy Major Programmes/Projects Capital Investment Programme Conservation Area Regeneration Scheme (CARS) Projects Campbeltown, Helensburgh, Oban, Rothesay & Dunoon (CHORD) Projects Marine Asset Management Plan Rural Growth Deal Annual Status and Options Report External and Internal Audit and other regulatory inspections Constitution, Governance, Risk Management and Accountability Page 67
Page 68
Appendix 1 Annual Governance Statement The Council has developed a consultation section on its website which hosts all consultations run by the Council and includes a section which publicises the results and/or outcome of the consultation and the resultant decisions that have been taken, showing how they were informed by the consultation process. This is part of our commitment to You Said, We Did information sharing for the public. Consultations provide communities with an opportunity to get involved with wide ranging aspects of the council’s work and life in Argyll and Bute. These include for example, play park funding, active travel routes, primary school consultations, and the council’s customer service strategy. Keep in the Loop Service Over 10,870 customers currently subscribe to receive notifications across the range of services. 'Myaccount' is a secure sign-in service for accessing online public services in Scotland. It provides the ability to set up an online account and use it to access a growing range of online public services, Scotland-wide, including Argyll and Bute Council. Currently 16,744 customers up from 15,399 last year have signed up to this service and it allows customers to access and personalise their interaction with the Council on a range of services. Public Performance Reporting The Council’s website makes all performance information available to the public. This includes information on performance scorecards, budgets and other service related information. This promotes open accountability to the public for its performance against agreed policies and standards. As part of phase two of the performance excellence project a review of the council's approach to public performance reporting is being undertaken. Accessibility In 2023/24 75% of 593,362 customer interactions through the council’s Customer Engagement Team were made using digital self-service. This very high proportion is because of the scope and quality of the digital services provided. In order to ensure maximum accessibility for everyone and meet our equalities responsibilities, the Council’s website was upgraded to the latest software version Drupal 10 and its content refreshed to meet the new international WCAG2.2 standard. In March 2024 it scored 98% in the Uk Independent Silktide accessibility score, rating it the 37th highest ranking Council in the UK. In addition the Reachdeck supported access tool was added to the website to give read aloud and translation help to users seeking such additional assistance and our 24/7 automated telephone service was used 46,942 times by those customers who struggle with online digital services. Community Engagement To support strengthening communities, community empowerment and engagement the council has in place: • An officer Community Engagement Strategy Group to oversee the development and implementation of the council’s internal Engagement Strategy; advising on best practice in engagement tools and techniques, supporting skills development and capacity within the council to effectively engage with communities. On this group sit those officers with expertise in engagement including those from Corporate Communications and the Communities & Partnership Team. The Councils Communications Team has developed an engagement app for services to use, and the council’s Communities & Partnership Team has resources and expertise to support hard to reach groups, community Page 68
Page 69
Appendix 1 Annual Governance Statement organisations and remote communities to have a voice in decision making. • A Community Development service, with a focus on improving active citizenship and capacity building through best practice in community development through a responsive and effectively targeted programme of Community Development support internally to the council and externally within communities across Argyll and Bute. • A range of training and resources to help build the knowledge, skills and confidence of community groups • Funding support to help empower community organisations to take forward priority projects and activities in their area: Monthly funding alert | Argyll and Bute Council (argyll-bute.gov.uk) • Resourcing community council liaison activities, including training and support activity, which helps to build the capacity of community councils. The Council also has a statutory lead role to ensuring Community Learning and Development provision in Argyll and Bute is set out in an Argyll and Bute Community Learning and Development Strategic Plan, and this is delivered through its collaboration with its Arms-length External Organisation (ALEO) partner Live Argyll. The Council continues to promote the Community-led action plan toolkit (developed in partnership with Scottish Community Development Centre) to help support communities interested in developing a local Community-led Action Plan. The Council also provides support for communities interested in development a Place Plan: Local Place Plans | Argyll and Bute Council (argyll-bute.gov.uk) The Council directly resources the management of the Community Planning Partnership (CPP) to bring partners together, including community, to deliver on the Outcome Improvement Plan. It actively seeks to ensure that young people are engaged in Community Planning and has implemented the following: • The 3 local Members of the Scottish Youth Parliament (MSYP's) attend the Community Planning Partnership Management Committee meetings on a rotational basis. • The Area Community Planning Groups (ACPG) invite members of local Youth Forums to attend meetings when they are held in their local areas & information is passed on to young people by Youth Workers who are kept updated on any developments. • The revised Scheme of Establishment for Community Councils outlines the requirement to encourage young people to attend and participate in community council meetings” and the age to become a Community Councillor was lowered to be 16 to encourage more young people to become involved. Council/Committee Meetings Meetings are always held in public, unless one of the statutory exemptions in the Local Government (Scotland) Act 1973, schedule 7A applies to the content of the report. Agendas for and minutes of meetings are detailed on the Council’s website. When schedule 7A applies papers are adjusted to ensure that the maximum amount of content is in the public domain. The Council’s Constitution defines the roles and responsibilities of the administration, committees, scrutiny and officer functions, with clear delegation arrangements and protocols for effective communication. Page 69
Page 70
Appendix 1 Annual Governance Statement The Standards Commission Advice Note for Councillors on Distinguishing between their Strategic Role and any Operational Work has previously been included in an Elected Member Seminar and is hosted on the Members Resource page on the Hub for ease of reference. 3. Defining outcomes in terms of sustainable economic, social, and environmental benefits. Our Corporate plan sets out our, and our community planning partner’s, vision for Argyll and Bute’s economic success to be built on a growing population. It also defines our mission “To make Argyll and Bute a place people choose to live, learn, work and do business” and establishes our outcomes, priorities and approach to delivering on our shared ambition with our community partners. We have a Performance Improvement Framework (PIF) that ensures performance is integral to the work of the Council. The PIF is focused not just on measuring what we do but on measuring the difference we make in terms of our outcomes. Asset management planning and capital investment is structured to consider and balance the combined economic, social and environmental impact of policies and plans when taking decisions about service provision. The Council has put arrangements in place to comply with key elements of the Community Empowerment Act. In determining how services and other courses of action should be planned and delivered the Council is increasingly engaging with internal and external stakeholders. Community benefit is an important consideration in the procurement of goods and services. The Council has acknowledges the effects of the ‘Cost of Living’ within Argyll and Bute and during 2023/2024 client gain achieved by the Flexible food and Fuel fund project reached £3.8 million. This project, supporting the most vulnerable low income households and those using foodbanks in our area to access short-term grants to cover the cost of food and fuel in the short term. In the longer term support through the provision benefit maximisation, money advice and energy advice services is provided by third sector partner agencies. In addition, this year the Council has issued 1,300 Scotland Loves Local Gift Cards to low income households in the year ensuring the £110,000 loaded onto the gift cards is spent in Island based local businesses in Argyll and Bute. The Council and the Third Sector Interface is supporting the Poverty Alliance on a project entitled “Taking Action on Rural Poverty” which is looking at new ways of addressing rural poverty in Argyll and Bute by reducing the rural poverty premium. The Council has also provided a one-stop-shop webpage where individuals and families can access energy advice, money advice and links to the services the Council provides in this area and those provided by third sector partner organisations. In 2022/23 Argyll & Bute Council recorded its lowest level of operational carbon emissions since reporting commenced in 2015/16 via the Public Bodies Climate Change Duties. This represents a reduction of 12,952 tCO2e (tonnes of carbon dioxide equivalent), approximately 33% against baseline figures. Work continues across Council services to reduce our emissions and support our journey to net zero including the transition to energy efficient LED streetlighting, moving to electric or hybrid fleet vehicles, and increasing diversion of waste from landfill. Integrated impact assessments as well as environmental, sustainability and island implications are considered during the decision making process to promote fair access to services. 4. Determining the interventions necessary to optimise the achievement of the intended outcomes. Page 70
Page 71
Appendix 1 Annual Governance Statement Decision makers receive detailed information indicating how intended outcomes would be achieved together with the implications associated with the proposals covering financial, risks and mitigations, integrated impact assessment, acting sustainably, carbon management, island proofing, and changes to schemes, by way of the compulsory sections of the Committee report. The Council’s Executive Leadership Team (ELT) meet regularly with the administration to discuss their key priorities and requirements for decision making in addition there is regular survey and feedback on their needs and a regular review of governance arrangements to ensure that decision making is fully supported. In determining how services and other courses of action should be planned and delivered the Council is increasingly engaging with internal and external stakeholders. Community benefit is an important consideration in the procurement of goods and services. The Council fosters effective relationships, collaborative working and contractual arrangements with other public, private, and voluntary organisations in delivering services that meet the needs of the local community as stated in the Council’s Corporate Plan 5. Developing the entity’s capacity, including the capability of its leadership and the individuals within it. Elected Member Development The Council has signed up to the Improvement Service’s Continuing Professional Development Framework for Elected Members. All Elected Members are provided with opportunities to progress personal development plans so that individual training needs and aspirations are identified and support provided as appropriate. This is complemented by a comprehensive seminar and workshop programme which addresses a wide range of topics and strategic issues. Additional training was undertaken by Elected Members in relation to the technology, knowledge and skills necessary to support the transition to a virtual environment including webcasting of strategic Committee meetings and the operation of meetings on a hybrid basis, enabling a mixed attendance of members being physically or virtually present. Officer Development The Council supports officer development through a structured approach, driven by the values set out in the Corporate Plan and a behavioural competency framework. The Council has Argyll and Bute Manager and Leadership Programmes, which ensure that all employees who have management responsibilities are knowledgeable and effective in delivering services within the priority management policies and procedures of the Council, including finance, performance and people management. The Leadership Programme ensures that senior and aspiring leaders in the organisation have support to develop their leadership behaviours and to improve their overall impact and performance across the organisation. 6. Managing risks and performance through robust internal control and strong public financial management. Internal Financial Control Our standing orders, financial instructions, scheme of delegation and supporting procedure notes/manuals clearly define how decisions are taken and the processes and controls in place to manage risks. These are reviewed and updated on an annual basis. We ensure compliance with relevant laws and regulations, internal policies and procedures, and that expenditure is lawful. The Council’s Monitoring Officer advises on compliance with our policy framework, Page 71
Page 72
Appendix 1 Annual Governance Statement ensuring that decision making is lawful and fair. Furthermore the Council has a designated Data Protection Officer and all services have Information Asset Registers along with appropriate guidance on how data should be managed. Our financial management arrangements conform to the CIPFA Statement on the Role of the Chief Financial Officer and we ensure that our independent Audit and Scrutiny Committee undertakes the core functions identified in CIPFA’s Audit Committees – Practical Guidance for Local Authorities. The Council has a proactive, holistic approach to tackling fraud, theft, corruption and crime, as an integral part of protecting public finances, safeguarding assets, and delivering services effectively. It is based upon the national counter fraud standard CIPFA’s Code of Practice on ‘Managing the Risk of Fraud and Corruption’. The Council has a system of internal financial control designed to manage risk to a reasonable level. It is based on a framework of regular management information, financial regulations, administrative procedures (including segregation of duties), management supervision, and a system of delegation and accountability. Development and maintenance of the system is undertaken by officers within the Council and the named bodies mentioned below. Internal Financial Controls and Prevention Are these in Place? Comprehensive budget systems Financial and budget monitoring systems Financial and Performance reporting systems Clearly defined Capital Expenditure guidelines Project Management processes and disciplines An effective Internal Audit Section An effective Counter Fraud Team Internal controls cannot eliminate risk of failure to achieve policies, aims and objectives and can therefore only provide reasonable and not absolute assurance of effectiveness. This annual review also covers the other bodies whose activities are incorporated into our Group Accounts and reliance is placed on the formal audit opinion contained in the financial statements of each individual body. • Dunbartonshire and Argyll and Bute Valuation Board • Live Argyll • Argyll and Bute Integration Joint Board The Council’s risk management processes are well developed. In particular the: • Strategic Risk Register is updated twice a year and approved by the SMT • Chief Executive presents the Strategic Risk Register to the Audit and Scrutiny Committee on an annual basis • Operational Risk Registers are updated quarterly by departmental management teams. • Internal Audit will perform an audit of compliance with risk management arrangements Page 72
Page 73
Appendix 1 Annual Governance Statement every three years. • The CIA performs an annual strategic risk assurance mapping exercise. 7. Implementing good practices in transparency, reporting, and audit to deliver effective accountability Internal Audit The Council and its Group bodies have internal audit functions, which operate to Public Sector Internal Audit Standards. The work of internal audit is informed by an analysis of the risk to which the Council and its Group bodies are exposed, with annual internal audit plans prepared based on that analysis. The Council's Audit and Scrutiny Committee endorses the preparation methodology and annual internal audit plan and monitors the performance of Internal Audit in completing the plan. In addition, the Council has developed a hybrid meeting facility enabling physical and virtual attendance at meetings with a public broadcast function so that members of the public can see and hear meetings of the Council’s strategic committees’ live increasing openness and transparency. The Chief Internal Auditor (CIA) provides the Audit and Scrutiny Committee with an annual report on internal audit activity in the Council and an opinion of the assurance can be taken regarding the systems of governance and internal control and whether they are operating effectively. This is an independent and objective opinion of the CIA based on work carried out in conformance with the Public Sector Internal Audit Standards to fulfil statutory Internal Audit provision. Internal audit provides members and management of the Council with independent assurance on risk management, internal control and corporate governance processes. External audit has, and continues to, use the work of internal audit. The Annual Accounts and Report sets out the financial position in accordance with relevant accounting regulations. Review of the Adequacy of Effectiveness of the Council’s Governance Framework Work to deliver Argyll and Bute’s Covid Recovery Strategy and Action plan continued in 2023/24 with the same governance arrangements. Full details of the action plan is detailed in the document “Recovery, Renew and Restart”, which was approved by Councils Economic, Development and Infrastructure Committee. The Council has appropriate management and reporting arrangements to enable it to satisfy itself that its approach to corporate governance is adequate and effective in practice. The legislative framework of local government defines a number of posts which are primary to the Council’s governance arrangements. These include the Chief Executive, Pippa Milne fulfilling the role of Head of Paid Service. As Monitoring Officer, the Executive Director Douglas Hendry: • oversees the implementation of the Code and monitoring its operation • reports annually to the Council on compliance with the Code and any changes required to maintain it and ensure its effectiveness. Specific responsibilities are assigned to the Executive Director Kirsty Flanagan as the Council’s Chief Financial Officer (S95 Officer), to ensure that public funds are properly accounted for. In recognition of the significant role that the Chief Financial Officer has in relation to financial performance and the financial control environment, CIPFA has set out key principles that define the core activities and behaviours that belong to the role. These include, being a key member of the Leadership Team, being actively involved in and influencing decision making, and leading the delivery of good financial management across the whole Page 73
Page 74
Appendix 1 Annual Governance Statement organisation. The Council have appointed a Data Protection Officer in line with the requirements of the UK-General Data Protection Regulations and the Data Protection Act 2018. Covid Recovery Progress Report 2023/24 The Argyll and Bute Overarching Recovery Group (formed to lead this process with specific thematic groups focused on Council recovery, building back stronger communities, economic and social recovery, infrastructure and transportation, financial management and public health) continues to have an overview of the Councils Covid Recovery Strategy and critical themes, although the majority of the actions have either been completed or been mainstreamed into other strategic or operational plans. Key updates are as follows: a) Economic and Social Recovery: Issues and actions are incorporated within the Councils Economic Strategy b) Building Back Stronger Communities. Issues and actions are incorporated within the Corporate Community Planning priorities c) Our Modern Workspaces program. The Council have established hybrid working across its activities and Our Modern Workspace project aims to look at how we use offices on a town by town basis and take into account the needs of employees and members of the public, as well as any opportunities for working more closely with partners. Good progress is being made to develop Hub buildings and reducing heating and maintenance costs and our huge portfolio of buildings. d) The Joint Health Protection Plan, agreed by Argyll and Bute Council, Highland Council and NHS Highland, sets out the public health arrangements for the management and control of public health incidents and outbreaks, together with detailing our collective public health priorities for 2023-25. FINANCIAL SUSTAINABILITY It is anticipated the Scottish public sector will continue to face a very challenging short and medium term financial outlook with uncertainty over the level of Scottish Government funding. The one year financial settlements do not provide any degree of medium term certainty and ring-fencing of monies and additional policy commitments which are not always fully funded limit financial flexibility and create additional financial pressures. In June 2023 the Verity House agreement was signed by representatives from Scottish Local Government and Scottish Government which signified a shared vision for a more collaborative approach to delivering our Services. This agreement included a commitment to improve engagement on budgetary matters and provide more flexibility to Local Authorities by baselining specific grants to allow them to be utilised on local priorities. It has been disappointing to note that very little has changed in light of this agreement with no engagement with Local Authorities prior to the Council Tax freeze announcement for 2024- 25. The financial outlook continues to be impacted by higher levels of inflation than pre-COVID which results in significant price increases as well as ongoing disruptions to the supply chain and longer lead in times. Tender prices are substantially higher than in previous years meaning a reduced level of Service can be provided for the same amount of money. The Council continues to provide financial estimates for future years with their medium term financial outlook covering a five year window to provide a longer term view of the Council’s estimated budget gap. Preparing any forward looking financial outlook is challenging due to the levels of uncertainty however the assumptions are reviewed regularly and updated with Page 74
Page 75
Appendix 1 Annual Governance Statement the outlook prepared to reflect a best case, worst case and mid-range scenario. The Council has a strong track record in financial management as recognised by previous year’s annual external audit reports and the Council’s Best Value report issued in May 2020. The Best Value report also recognises that the Council’s medium to long term financial strategy helps support financial planning arrangements. In addition to providing revenue and capital projections the Strategy also sets out the position in relation to the Council’s general fund reserve, the approach to managing the financial impact of inflationary pressures, approach to Treasury Management and the strategy to address budget gaps. HEALTH AND SOCIAL CARE INTEGRATION The Argyll and Bute IJB has been established as a separate legal entity from Argyll and Bute Council and NHS Highland, with its own board of governance. The IJB comprises eight voting members with four Elected Members nominated by Argyll and Bute Council and four Board members from NHS Highland. In addition there are a number of non-voting appointees representing other sectors and stakeholder groups, such as the Third Sector, Independent Sector, Patients and Service Users, Carers and Staff. The arrangements for the operation, remit and governance of the IJB are set out in the Argyll and Bute Integration Scheme which has been prepared and approved by Argyll and Bute Council and NHS Highland. It has also been approved by the Scottish Government. The IJB, via a process of delegation from the Health Board and Local Authority as outlined in the Scheme of Integration has responsibility for the planning, resourcing and operational delivery of all health and social care services within Argyll and Bute. The Council places reliance on the IJB’s framework of internal controls and similarly the IJB places reliance on the procedures, policies and operational systems of the Council and the Health Board. The IJB operates within an established procedural framework. The roles and responsibilities of board members and officers are defined within Standing Orders, the Integration Scheme, Financial Regulations and Standing Financial Instructions. The IJB has proportionate internal audit arrangements in place to provide independent assurance on risk management, corporate governance and the system of internal control. A risk based internal audit plan developed and commissioned for 2023/24 and the IJB’s internal auditor has issued a formal annual report providing their independent opinion on the effectiveness of the IJB’s risk management, internal control and governance processes. The overall conclusion of the Internal Auditor is to provide a satisfactory level of assurance on the adequacy of internal controls and governance arrangements within the IJB. During 2023-24 the IJB has progressed a number of initiatives to develop its governance arrangements including improving the use of Directions and the implementation of the integrated performance management system. It has also focused upon re-mobilising services following the pandemic, refreshing its service transformation program and progressing strategic development projects. It has focused on taking action to manage strategic risks during the year. However, it is acknowledged that budgetary challenges have resulted in some key capital projects and business case development work being paused. The financial position of the HSCP has also remained stable. It repaid all of the debt it owed to the Council in 2021/22 and reported an underspend against its approved budget in 2023/24. The operating environment going forward is very challenging as funding allocations have not kept pace with cost and demand increases. The impact of an increasing older population with on-going recruitment constraints and workforce shortages is adding to the challenge. The HSCP is working to address its workforce gaps throughout the area and across many professions in a variety of ways. For example, it is seeking to address key worker accommodation shortages in partnership with the Council, Shelter and the Social Housing Page 75
Page 76
Appendix 1 Annual Governance Statement Sector and is constantly trying new approaches to attract workers from outside Argyll & Bute. The new Health and Care Staffing act will also be progressively implemented throughout 2024/25 which places additional duties upon the IJB to monitor, manage and report upon its staffing levels and risks. These risks and challenges are particularly acute in many of our rural and island communities which are experiencing increasing costs along with very small scale, lifeline services which are become ever more difficult to sustain or operate in a financially efficient way. The IJB approved a budget for 2024/25 which indicates that additional funding from NHS Highland may be required, although it is likely that any actual gap can be funded by the allocation of HSCP reserves. The budget is also dependent upon the allocation of non- recurring pension fund savings held by Argyll & Bute Council. The management of longer- term financial sustainability is a priority and service change and transformation plans aimed at addressing this require to be developed, consulted upon and implemented during the course of 2024/25 and 2025/26. The delivery of the short term savings plan is a priority for the HSCP particularly as it seeks to manage down spend on expensive agency and locum staff whilst maintaining the safety of services. UPDATE ON AREAS FOR DEVELOPMENT IDENTIFIED IN PREVIOUS ANNUAL GOVERNANCE STATEMENTS The 2022/23 Annual Governance Statement identified a number of areas for further development. A summary update for each area is provided in the table below. Area 2023/24 Update Continue to engage with the Scottish Government, other local authorities and our Waste PPP contractor to determine the most efficient and effective way of ensuring the Council can provide a waste solution which complies with the 2025 Bio- degradable Municipal Waste Ban We continue to pursue Scottish Government for either a derogation or financial contribution of circa £1.5M to enable the Waste PPP contract to be accommodated alongside the 2025 BMW ban. At the time of writing (30 April 2024) we are still awaiting final confirmation from Scottish Government although given the passage of time we are now working on the basis that a derogation will not be approved and are progressing discussions with Renewi for MBT plants to be converted to Waste Transfer Stations for use from January 2026 onwards, earlier if practical. Further enhance reporting of workforce planning to the Strategic Management Team Workforce planning conversations took place with Managers during January - March and operational workforce plans are now being finalised for reporting to SMT. Absence data is being included in the workforce planning risk matrix to improve reporting to SMT. Progress against actions outlined within operational workforce plans will now be reported through regular Health of the Organisation reporting to Department Management Teams and SMT. The council approved its revised People Strategy and updated strategic workforce planning priorities in February. All strategic workforce planning actions will be included in the annual People Strategy delivery plan. Continue to Improve quality and accuracy of asset information which will benefit asset valuations, calculations for utilities costs and asset management A further 57 condition surveys (7 within the school estate and 50 within the non-school estate) and in accordance with the Scottish Government’s Core Fact of Condition were commissioned in 2023/24 and output will be delivered in 2024/25. Additionally records were updated through inspections and measurements undertaken as part of the ongoing rolling programme of asset valuations. Page 76
Page 77
Appendix 1 Annual Governance Statement Develop data/analytics business intelligence tool The council is taking a two-pronged approach to building its capacity for business intelligence, within the framework of its new data strategy and action plan (2024-28) approved by SMT in October 2023: a) Microsoft PowerBI – PowerBI is one of the products in the Microsoft 365 (M365) productivity suite and includes some familiar aspects of Microsoft Excel but with much greater capacity to combine and visualise data from multiple sources. Since the council has a long-term plan for the adoption and utilisation of M365 it is the logical tool for data visualisation and analysis. b) The data platform – The “minimum viable product” (MVP) version of this was launched on 26/3/24 and is now available for staff to use. The Data Platform will be essential to allowing “democratised” access to data for use in PowerBI report building by services themselves. The Data Platform will also allow for access to datasets to be controlled and managed by a robust permissions framework; ensure consistent application of data quality, ethics and standards; and enable the FAIR Principles of making data Findable, Accessible, Interoperable and Re-usable. Complete review of performance management Phase one of the Performance Excellence Project is now complete with the following deliverables: - Reduced set of Corporate Outcome Indicators to review and report on long term trends and progress against targets - Decommissioning of Pyramid and development of new Area Scorecards using MS365. - Development of a new Corporate Plan and Business Plan setting out elected members overall priorities and the activities and projects that will deliver on these. - Design and Pilot of a new approach to Self-Assessment which has been piloted at team level and thematic level. Phase Two of the project has been scoped and is now underway. Phase two of the project will involve redesign the council Performance Improvement Framework with workstreams covering planning, design of performance dashboards and the council's approach to public performance reporting. Complete the External Quality Assessment Framework The External Quality Assessment was undertaken and reported to the Audit and Scrutiny Committee. The findings were that the Internal Audit service are fully compliant with the Public Sector Internal Audit Standards in all 14 areas of assessment. Two minor recommendations were made and have been fully actioned. ISSUES FOR FURTHER DEVELOPMENT The review of governance and internal control has identified the following areas for consideration during 2024/25, particularly in the context of continuous improvement within the Council: • Preparation for the implementation of the Visitor Levy in 2026 - Work with the Digital Office, improvement Service, City of Edinburgh and Highland Council on the Page 77
Page 78
Appendix 1 Annual Governance Statement development of a new digital platform for the billing and collection of the new levy. (Head of Financial Services/Head of Development and Economic Growth – March 2025). • Preparation for new processes being implemented including the practice around Initial Referral Discussions relating to child protection, there will be a need to audit and develop practice further and the development of an action plan based on the findings will help improvement and the need to consider the staffing structures which support this vital area of work. (Head of Children, Families and Justice – March 2025) • Housing Emergency declared by the Council in June 2023 - Utilise outputs from the Housing Summit held, to develop a multi-stakeholder Action Plan, and synthesise the relative elements of this into a revised Local Housing Strategy Action Programme. (Head of Development and Economic Growth – March 2025) • The revaluation of properties for building insurances purposes - Estates will undertake a revaluation programme for the general portfolio, together with a programme of recorded inspections of vacant properties. (Head of Commercial services March 2025) • Publication of the Annual Procurement Report for the Council – This will promote our obligations set out in the Procurement Regulations. (Head of Legal and Regulatory Support – March 2025) • The Licensing Board will undertake a review of its Licensing Policy statement as required in terms of the Licensing (Scotland) Act 2005. (Head of Legal and Regulatory Support – March 2025) • The use of Cloud Storage – Following results of the Internal Audit, put in place actions to ensure optimum, appropriate and secure use of cloud storage is applied across all applications. (Head of Customer Support Services – March 2025) • Further enhance school engagement with national programmes and community partnership approaches supporting young people to build their confidence, increase mental health awareness and promote diversity. (Head of Education, Performance & Improvement – March 2025). CONCLUSION The conclusion from the review activity outlined above and our opinion is that reasonable assurance can be placed upon the adequacy and effectiveness of Argyll and Bute Council’s systems of internal control and governance. Although areas for further improvement have been identified, the annual review demonstrates sufficient evidence that the Council’s Local Code of Corporate Governance is operating effectively and that the Council complies with that Local Code in all significant respects. Systems are in place to regularly review and improve governance and systems of internal control. Page 78
Page 79
Annual Audit Plan Argyll and Bute Council Year ending 31 March 2024 Page 79 Agenda Item 8
Page 80
Contents 01 Engagement and responsibilities summary 02 Your audit engagement team 03 Audit scope, approach and timeline 04 Significant risks and other key judgement areas 05 Wider scope and Best Value 06 Fees for audit and other services 07 Our commitment to independence 08 Materiality and misstatements Appendix A – Key communication points Appendix B - Current year updates, forthcoming accounting and other issues This document is to be regarded as confidential to Argyll and Bute Council. It has been prepared for the sole use of the Audit and Scrutiny Committee as the appropriate sub-committee charged with governance. No responsibility is accepted to any other person in respect of the whole or part of its contents. Our written consent must first be obtained before this document, or any part of it, is disclosed to a third party. 2 Page 80
Page 81
Mazars LLP 26 Mosley Street Newcastle upon Tyne NE1 1DF Audit and Scrutiny Committee Argyll and Bute Council Lochgilphead Argyll PA31 8RT 24 May 2024 Dear Audit and Scrutiny Committee Members Annual Audit Plan – Year ending 31 March 2024 We are pleased to present our Audit Strategy Memorandum for Argyll and Bute Council for the year ending 31 March 2024. The purpose of this document is to summarise our audit approach, highlight significant audit risks and areas of key judgements and provide you with the details of our audit team. As it is a fundamental requirement that an auditor is, and is seen to be, independent of its clients, section 7 of this document also summarises our considerations and conclusions on our independence as auditors. We consider two-way communication with you to be key to a successful audit and important in: • reaching a mutual understanding of the scope of the audit and the responsibilities of each of us; • sharing information to assist each of us to fulfil our respective responsibilities; • providing you with constructive observations arising from the audit process; and • ensuring that we, as external auditors, gain an understanding of your attitude and views in respect of the internal and external operational, financial, compliance and other risks facing Argyll and Bute Council which may affect the audit, including the likelihood of those risks materialising and how they are monitored and managed. With that in mind, we see this document, which has been prepared following our initial planning discussions with management, as being the basis for a discussion around our audit approach, any questions, concerns or input you may have on our approach or role as auditor. This document also contains an appendix that outlines our key communications with you during the course of the audit and forthcoming accounting issues and other issues that may be of interest to you. Providing a high-quality service is extremely important to us and we strive to provide technical excellence with the highest level of service quality, together with continuous improvement to exceed your expectations. If you have any concerns or comments about this report or our audit approach, please contact me on 0191 383 6339. Yours faithfully Mark Outterside (Director) Mazars LLP Mazars LLP – 26 Mosley Street – Newcastle upon Tyne – NE1 1DF Tel: 0191 383 6339 – www.mazars.co.uk Mazars LLP is the UK firm of Mazars, an integrated international advisory and accountancy organisation. Mazars LLP is a limited liability partnership registered in England and Wales with registered number OC308299 and with its registered office at 30 Old Bailey, London EC4M 7AU. We are registered to carry on audit work in the UK by the Institute of Chartered Accountants in England and Wales. Details about our audit registration can be viewed at www.auditregister.org.uk under reference number C001139861. VAT number: 839 8356 73 Annual Audit Plan – Year ending 31 March 2024 3 Page 81
Page 82
Section 01: Engagement and responsibilities summary Page 82
Page 83
1. Engagement and responsibilities summary Overview of engagement We are appointed to perform the external audit of Argyll and Bute Council for the year to 31 March 2024. The scope of our engagement is set out in the Code of Audit Practice, issued by the Auditor General and the Accounts Commission available from the Audit Scotland website: Code of audit practice | Audit Scotland (audit-scotland.gov.uk). Our responsibilities are principally derived from the Local Government (Scotland) Act 1973 (the 1973 Act) and the Code of Audit Practice, as outlined below and overleaf. Blank cell Engagement area Responsibilities Audit opinion We are responsible for forming and expressing an independent opinion on whether the financial statements are prepared, in all material respects, in accordance with all applicable statutory requirements. Our audit does not relieve management or the Audit and Scrutiny Committee, as Those Charged With Governance, of their responsibilities. The Section 95 Officer is responsible for the assessment of whether is it appropriate for the Council to prepare its accounts on a going concern basis. As auditors, we are required to obtain sufficient appropriate audit evidence regarding, and conclude on: a) whether a material uncertainty related to going concern exists; and b) consider the appropriateness of the Section 95 Officer’s use of the going concern basis of accounting in the preparation of the financial statements. Internal control Management is responsible for such internal control as management determines is necessary to enable the preparation of financial statements that are free from material misstatement, whether due to fraud or error. We are responsible for obtaining an understanding of internal control relevant to our audit and the preparation of the financial statements to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Council’s internal control. 5 Page 83
Page 84
1. Engagement and responsibilities summary Overview of engagement (continued) Blank cell Engagement area Responsibilities Fraud The responsibility for safeguarding assets and for the prevention and detection of fraud, error and non-compliance with law or regulations rests with both Those Charged With Governance and management. This includes establishing and maintaining internal controls over compliance with relevant laws and regulations, and the reliability of financial reporting. As part of our audit procedures in relation to fraud we are required to enquire of those charged with governance, including key management and internal audit as to their knowledge of instances of fraud, the risk of fraud and their views on internal controls that mitigate the fraud risks. In accordance with International Standards on Auditing (UK), we plan and perform our audit so as to obtain reasonable assurance that the financial statements taken as a whole are free from material misstatement, whether caused by fraud or error. However, our audit should not be relied upon to identify all such misstatements. Wider reporting We report to the National Audit Office on the consistency of the Council’s financial statements with its Whole of Government Accounts (WGA) submission. The level of auditor assurance required depends on monetary thresholds set by HM Treasury. Wider scope and Best Value We are also responsible for reviewing and reporting on the wider scope arrangements that the Council has in place and its arrangements to secure Best Value. We discuss our approach to wider scope and Best Value work further in section 5 of this report. 6 Page 84
Page 85
Section 02: Your audit engagement team Page 85
Page 86
mark.outterside@mazars.co.uk 07824 086 593 gregory.oduor@mazars.co.uk 07974 124 461 2. Your audit engagement team Below is your audit engagement team and their contact details. Mark Outterside Engagement Leader Gregory Oduor Engagement Manager alfred.mugani@mazars.co.uk 0781 569 0995 We will utilise Mazars experts on this engagement in the following area: valuation of property, plant and equipment. 8 Team Leader Alfred Mugani Page 86
Page 87
Section 03: Audit scope, approach and timeline 9 Page 87
Page 88
3. Audit scope, approach and timeline Audit scope Our audit approach is designed to provide an audit that complies with all professional requirements. Our audit of the financial statements will be conducted in accordance with International Standards on Auditing (UK), relevant ethical and professional standards, our own audit approach and in accordance with the terms of our engagement. Our work is focused on those aspects of your activities which we consider to have a higher risk of material misstatement, such as those impacted by management judgement and estimation, application of new accounting standards, changes of accounting policy, changes to operations or areas which have been found to contain material errors in the past. Audit approach Our audit approach is risk-based, and the nature, extent, and timing of our audit procedures are primarily driven by the areas of the financial statements we consider to be more susceptible to material misstatement. Following our risk assessment where we assess the inherent risk factors (subjectivity, complexity, uncertainty, change and susceptibility to misstatement due to management bias or fraud) to aid in our risk assessment, we develop our audit strategy and design audit procedures to respond to the risks we have identified. If we conclude that appropriately designed controls are in place, we may plan to test and rely on those controls. If we decide controls are not appropriately designed, or we decide that it would be more efficient to do so, we may take a wholly substantive approach to our audit testing where, in our professional judgement, substantive procedures alone will provide sufficient appropriate audit evidence. Substantive procedures are audit procedures designed to detect material misstatements at the assertion level and comprise tests of detail (of classes of transaction, account balances, and disclosures), and substantive analytical procedures. Irrespective of our assessed risks of material misstatement, which takes account of our evaluation of the operating effectiveness of controls, we are required to design and perform substantive procedures for each material class of transaction, account balance, and disclosure. Our audit will be planned and performed so as to provide reasonable assurance that the financial statements are free from material misstatement and give a true and fair view. The concept of materiality and how we define a misstatement is explained in more detail in section 8. The diagram on the next page outlines the procedures we perform at the different stages of the audit. 10 Page 88
Page 89
11 3. Audit scope, approach and timeline Planning and Risk Assessment (April to May 2024) • Planning visit and developing our understanding of the Council • Initial opinion and wider scope risk assessments • Risk identification and assessment • Considering proposed accounting treatments and accounting policies • Developing the audit strategy and planning the audit work to be performed • Agreeing timetable and deadlines • Risk assessment analytical procedures • Determination of materiality Interim (June to July 2024) • Documenting systems and controls • Performing walkthroughs • Testing of IT general controls • Reassessment of audit plan and revision if necessary Fieldwork (July to October 2024) • Receiving and reviewing draft financial statements • Delivering our audit strategy starting with significant risks and high-risk areas including detailed testing of transactions, account balances and disclosures • Communicating progress and issues • Clearance meeting Completion (December 2024) • Final review and disclosure checklist of financial statements • Final director review • Agreeing content of letter of representation • Reporting to the Audit and Scrutiny Committee • Reviewing subsequent events • Signing the independent auditor’s report Page 89
Page 90
12 3. Audit scope, approach and timeline Reliance on internal audit We will meet with internal audit to discuss their work and findings, to inform our understanding of the Council’s key business processes and to update our risk assessment. If appropriate, we will seek to place reliance on internal audit’s work on the Council's key business processes and will perform our own procedures to determine its adequacy for our audit. During the audit, we will meet with internal audit to discuss the progress and findings of their work prior to the commencement of our controls’ evaluation procedures. Service organisations International Auditing Standards (UK) (ISAs) define service organisations as third-party organisations that provide services to the Council that are part of its information systems relevant to financial reporting. We are required to obtain an understanding of the services provided by service organisations as well as evaluating the design and implementation of controls over those services. We have not identified any relevant service organisations. Management’s and our experts Management makes use of experts in specific areas when preparing the Council’s financial statements. We also use experts to assist us to obtain sufficient appropriate audit evidence on specific items of account. Item of account Management’s expert Our expert Defined benefit liability/Asset Hymans Robertson (Strathclyde Pension Fund) We make use of PWC actuarial services who are commissioned by the NAO to review the national analysis of pension trends and assumptions of the various LGPS actuaries Property, plant and equipment valuation Council’s in-house Valuer We will review the analysis of property valuation movements available from third parties and consider the outcome of the Council’s valuations in comparison with these, challenging conclusions as appropriate. We have also engaged the Mazars Property Valuation team to assist in our valuations work, including a review the Council’s DRC valuation methodology. Financial instrument disclosures Link Asset Services (formerly Capita) No expert required. Page 90
Page 91
13 3. Audit scope, approach and timeline Group audit approach The scope of our audit is based on an analysis of the risks we have identified at the group level. When scoping our audit, we have considered quantitative criteria (the contribution of the group’s consolidated components to the group financial statements) and qualitative criteria (risks of material misstatement that consolidated components may present individually). A further analysis will be performed on the other entities to verify they do not present any other risks. Where necessary, we will include some of these subsidiaries in our audit scope. Our review of the group boundary is not complete; however, the nature and extent of audit work we expect to perform on the consolidated components is set out below: Entity Identifier % Group Expenditure Location Auditor Scope Argyll and Bute Council (parent) Parent – local authority 98.6% Kilmory, Lochgilphead, Argyll, PA31 8RT Mazars LLP Full Argyll and Bute Integration Joint Board Joint venture between the Council and NHS Highland with responsibility for health and social care functions. 0.3% Campbeltown PA28 6LE Mazars LLP Full Dunbartonshire and Argyll & Bute Valuation Joint Board Joint Board responsible for the maintenance of the electoral, council tax and non-domestic rates registers for Argyll and Bute, West Dunbartonshire and East Dunbartonshire Councils. 0.3% Kilbrannan House, Bolgam St, Campbeltown PA28 6JY Mazars LLP Full Live Argyll 100% owned subsidiary of the Council, which provides a wide range of services within the area including libraries, leisure facilities, halls, sports development and community centres. 0.8% Campbeltown Aqualibrium. Kinloch Road, Campbeltown, Argyll PA28 6EG Mazars LLP Specific Common Good Accounts The Council administers the Common Good Accounts for several former Burghs. - Kilmory, Lochgilphead, Argyll, PA31 8RT N/A N/A Page 91
Page 92
14 3. Audit scope, approach and timeline Audit of trusts registered as Scottish charities The Charities Accounts (Scotland) Regulations 2006 outline the accounting and auditing requirements for charitable bodies. The 2006 Regulations require charities to prepare annual accounts and an auditor to prepare a report to the charity trustees where any legislation requires an audit. The Local Government (Scotland) Act 1973 specifies the audit requirements for any trust fund where some or all members of a Council are the sole trustees. Therefore, a full and separate audit and independent auditor’s report is required for each registered charity where members of the Council are sole trustees. Members of the Council are the sole trustees for 7 trusts registered as Scottish charities, with total assets of circa £800,000. The preparation and audit of financial statements of registered charities is regulated by the Charities and Trustee Investment (Scotland) Act 2005 and the Charities Accounts (Scotland) Regulations 2006. We have not identified any significant risks, other than the risk of management override of controls which we have also identified as a risk for the Council’s annual accounts, for the financial statements of the Council’s charitable trusts. Page 92
Page 93
Section 04: Significant risks and other key judgement areas 15 Page 93
Page 94
4. Significant risks and other key judgement areas Following the risk assessment approach discussed in section 3 of this document, we have identified risks relevant to the audit of financial statements. The risks that we identify are categorised as significant, enhanced or standard. The definitions of the level of risk rating are given below: Significant risk A risk that is assessed as being at or close to the upper end of the spectrum of inherent risk, based on a combination of the likelihood of a misstatement occurring and the magnitude of any potential misstatement. A fraud risk is always assessed as a significant risk (as required by auditing standards), including management override of controls and revenue recognition. Enhanced risk An area with an elevated risk of material misstatement at the assertion level, other than a significant risk, based on factors/ information inherent to that area. Enhanced risks require additional consideration but do not rise to the level of a significant risk. These include but are not limited to: • Key areas of management judgement and estimation uncertainty, including accounting estimates related to material classes of transaction, account balances, and disclosures but which are not considered to give rise to a significant risk of material misstatement; and • Risks relating to other assertions and arising from significant events or transactions that occurred during the period. Standard risk A risk related to assertions over classes of transaction, account balances, and disclosures that are relatively routine, non-complex, tend to be subject to systematic processing, and require little or no management judgement/ estimation. Although it is considered that there is a risk of material misstatement, there are no elevated or special factors related to the nature of the financial statement area, the likely magnitude of potential misstatements, or the likelihood of a risk occurring. 16 Summary risk assessment The summary risk assessment, illustrated in the table below, highlights those risks which we deem to be significant and other enhanced risks in respect of the Council. We have summarised our audit response to these risks on the next page. Key: Significant risk Enhanced risk / significant management judgement 3 2 1 4 High HighLow Low Likelihood Financial impact 1. Management override of controls 2. Valuation of the net defined benefit liability/Asset 3. Valuation of property, plant and equipment 4. Accounting for PFI and PPP contracts Page 94
Page 95
4. Significant risks and other key judgement areas Specific identified audit risks and planned testing strategy We have presented below in more detail the reasons for the risk assessment highlighted above, and also our testing approach with respect to significant risks. An audit is a dynamic process, should we change our view of risk or approach to address the identified risks during the course of our audit, we will report this to the Audit and Scrutiny Committee. Significant risks Blank cell Description Fraud Error Judgement Planned response 1 Management override of controls This is a mandatory significant risk on all audits due to the unpredictable way in which such override could occur. Management at various levels within an organisation are in a unique position to perpetrate fraud because of their ability to manipulate accounting records and prepare fraudulent financial statements by overriding controls that otherwise appear to be operating effectively. Due to the unpredictable way in which such override could occur there is a risk of material misstatement due to fraud on all audits. We plan to address the management override of controls risk through performing audit work over accounting estimates, journal entries and significant transactions outside the normal course of business or otherwise unusual. We will address the risk through performing audit procedures covering a range of areas including (but not limited to): • accounting estimates included in the financial statements for evidence of management bias; • any significant transactions outside the normal course of business; and • journals and other adjustments recorded in the general ledger in preparing the financial statements. 17 Page 95
Page 96
4. Significant risks and other key judgement areas 18 Significant risks (continued) Blank cell Description Fraud Error Judgement Planned response 2 Valuation of the net defined benefit (liability)/surplus As at 31 March 2023, the net defined benefit surplus was £139m (2022/23 - 4.6 Million). The valuation of the Council’s net liabilities/assets includes use of discount rates, inflation rates, mortality rates etc., all of which should reflect the profile of the Council’s employees and other appropriate data. Due to the high degree of estimation uncertainty associated with the valuations, we have determined there is a significant risk in this area. We will address this risk by reviewing the controls that the Council has in place over the information sent to the Scheme Actuary by the fund administrators (Strathclyde Pension Fund). We will : • challenge the reasonableness of the Actuary’s assumptions that underpin the relevant entries made in the financial statements; • critically assess the competency, objectivity and independence of the Actuary; • liaise with the auditors of the Pension Fund to gain assurance that the overall IAS19 procedures and controls in place at the Pension Fund are operating effectively; • compare assumptions to expected ranges; and • agree data in the Actuary’s valuation report for accounting purposes to the relevant accounting entries and disclosures in the Council’s financial statements. Page 96
Page 97
4. Significant risks and other key judgement areas 19 Significant risks (continued) Blank cell Description Fraud Error Judgement Planned response 3 Valuation of property, plant and equipment The Council held land and buildings (including council dwellings) with a net book value of £451 million at 31 March 2023. The Council has adopted a rolling revaluation model which sees other land and buildings revalued over a five-year cycle. This may result in individual assets not being revalued for several years. This creates a risk that the carrying value of those assets that have been revalued in year is materially different from the year end fair value. Valuations are based on specialist and management assumptions and changes in these can result in material changes to valuations. Due to the high degree of estimation uncertainty associated with valuations, we have determined there is a significant risk in this area. We will address this risk through: • assessing the scope and terms of engagement with the in-house Valuer; • assessing the competence, skills and objectivity of the in-house Valuer; • assessing how management use the in-house Valuer’s report to value land and buildings included in the financial statements; • testing the accuracy of the data used in valuations; • challenging the Council and in-house Valuer’s assumptions and judgements applied in the valuations; • reviewing the valuation methodology used, including the appropriateness of the valuation basis; • considering the reasonableness of the valuation by comparing the valuation output with market intelligence; • testing a sample of revaluations in the year, by agreeing the revaluations recorded in the Annual Accounts to the in-house valuer’s reports. As part of this testing, we will check whether the movements have been accounted for in accordance with the Code; • challenging management’s assessment for those assets not subject to valuation in the year; • For those valued on Existing Use Value on a market comparable basis, we will check market movements to assess the materiality of potential movement for 2023/24; and • For those valued on a Depreciated Replacement Cost basis, which would be impacted by changes in build costs during the year, we will test management’s analysis of changes in the Build Costs Information Service (BCIS) index and assess any decisions management make this regard. We will engage the Mazars Real Estate Valuation Team to assist us with the above. Page 97
Page 98
4. Significant risks and other key judgement areas Other key areas of management judgement and enhanced risks Key areas of management judgement include accounting estimates which are material but are not considered to give rise to a significant risk of material misstatement. These areas of management judgement represent other areas of audit emphasis. 20 Description Fraud Error Judgement Planned response 4 Accounting for PFI and PPP contracts The Council currently operates three Private Finance Initiative (PFI), or similar, contracts which are accounted for as Service Concession arrangements under IFRIC12 – Service Concession Arrangements. The Council has determined that in the case of the Schools NPDO contract and the new Schools DBFM contract, the Council has control over the services provided through use of the schools and that a qualifying asset has been created. Therefore, the assets are included on the Council’s Balance Sheet along with a finance lease liability. The Council also operates a Waste Management PPP contract. In this case the Council determined that a “qualifying asset” has not been created and that the Council does not have significant control over the services being provided. Therefore, the asset has not been included on the Council’s Balance Sheet and payments to the contractor are charged to the appropriate service line within the Comprehensive Income and Expenditure Account. The method of accounting for PFI and PP assets can be complex and involves management judgement as set out in Note 3 to the financial statements. Therefore, there is a potential risk of material misstatement if the Council fails to appropriately account for these assets. We will: • review the Council’s adopted approach for accounting for its PFI arrangements; • review any changes from prior years to the long-term financial model used; • critically review the assumptions made by management; and • assess the completeness and accuracy of disclosures. Page 98
Page 99
Section 05: Wider scope and Best Value 21 Page 99
Page 100
22 5. Wider scope and Best Value The framework for wider scope work The Code of Audit Practice sets out the four areas that frame the wider scope of public sector audit. We are required to form a view on the adequacy of the Council’s arrangements in four areas: 1. Financial management 2. Financial sustainability 3. Vision, leadership, and governance 4. Use of resources to improve outcomes. Financial management Financial management means having sound budgetary processes. Audited bodies require the ability to understand the financial environment and whether internal controls are operating effectively. Auditors consider whether the body has effective arrangements to secure sound financial management. Financial sustainability Financial sustainability means being able to meet the needs of the present without compromising the ability of future generations to meet their own needs. Auditors consider the extent to which audited bodies have shown regard to financial sustainability. They look ahead to the medium term (two to five years) and longer term (over five years) to consider whether the body is planning effectively so that it can continue to deliver services. Vision, leadership and governance Audited bodies must have a clear vision and strategy and set priorities for improvement within this vision and strategy. They work together with partners and communities to improve outcomes and foster a culture of innovation. Auditors consider the clarity of plans to implement the vision, strategy and priorities adopted by the leaders of the audited body. They also consider the effectiveness of governance arrangements for delivery. Use of resources to improve outcomes Audited bodies need to make best use of their resources to meet stated outcomes and improvement objectives, through effective planning and working with strategic partners and communities. Auditors consider the clarity of the arrangements in place to ensure that resources are deployed to improve strategic outcomes, meet the needs of service users taking account of equalities, and deliver continuous improvements in priority services. Page 100
Page 101
23 5. Wider scope and Best Value Our approach Our planned audit work against the four wider scope areas is risk based and proportionate. We need to gather sufficient evidence to support our commentary on the Council’s arrangements and to identify and report on any significant weaknesses. We will carry out more detailed work where we identify significant risks. Where significant weaknesses are identified we will report these to the Council and make recommendations for improvement. In addition to local risks, we consider challenges that are affecting the public sector as a whole. Best Value Under the Code of Audit Practice, the audit of Best Value in councils is fully integrated within our annual audit work. Best Value at the Council will be assessed over the period of the audit appointment. We will also follow up previously reported Best Value findings to assess the pace and depth of improvement. This work will be integrated into our audit approach, including our work on the wider scope areas. We will also conduct thematic reviews as directed by the Accounts Commission. In 2023/24 this will be on workforce innovation. We will prepare a separate management report to document the findings of this work. At least once every five years, the Controller of Audit will report to the Accounts Commission on the Council’s performance in meeting its Best Value duties. The Council is included in the second year of the programme which runs from October 2024 to August 2025. Page 101
Page 102
24 5. Wider scope and Best Value Wider scope risks The Code of Audit Practice requires us to consider the significant audit risks in areas defined in the Code as the wider scope audit. Although we have not fully completed our planning and risk assessment work, the table below outlines the wider scope audit risks that we have identified to date. We will report any further identified risks to the Audit and Scrutiny Committee on completion of our planning and risk identification work. Bla nk cell Description Financial management Financial sustainability Vision, leadership and governance Use of resources to improve outcomes Planned procedures 1 Financial Sustainability The 2024/25 budget highlighted a balanced budget after measures to address the initial in- year budget gap of £10.167m. However, that budget also highlighted a gap of £4.734m in 2025/26 rising to a cumulative budget gap of £50.084m by the end of 2028/29 based upon a ‘midrange’ scenario. The Council’s ‘worst case’ scenario highlights a potential £187.840m cumulative budget gap by the end of 2028/29. There are also anticipated pressures on capital planning, with a total gap in the capital programme of £29.843m. This represents a risk in relation to financial sustainability, impacting on the future provision of services in the Council’s area. As part of our audit we will review the Council’s: medium to long term financial strategy; • financial position and track record in delivering planned recurrent and non-recurrent savings in 2023/24; • financial performance in 2024/25 and updates to its financial planning during the year, including the implications for general reserves balances; • regular reporting to Members on financial performance, savings plans and financial risks; • progress in developing plans to address future years budget gaps; and • plans to address the gaps in the capital programme. Page 102
Page 103
Section 06: Fees for audit and other services 25 Page 103
Page 104
Fees for work as the Council’s appointed auditor At this stage of the audit, we are not planning any divergence from the expected fees set by Audit Scotland, which is available on the Audit Scotland website: Audit Scotland expected fees for 2023/24 audits. The impact of the non-audit services and the associated fees has been assessed as part of our independence considerations (refer to section 7 of this report). OR We have not provided any non-audit services to XXX during the year. We will agree separately with the Council on the Fee for the Charitable Trusts for the 2023/24 audit (prior year £6,500). We have not provided any non-audit services to the Charitable Trusts in 2023/24. Services provided to other entities within the Council's group In addition, to auditing the Council’s 7 charitable trusts, we are providing audit services to the following entities in the Council's group: • Argyll and Bute Integration Joint Board (total fee of £33,360) • Dunbartonshire and Argyll & Bute Valuation Joint Board (total fee of £9,320). • Live Argyll (estimated total fee for 2023/24 of £18,200). 6. Fees for audit and other services Fees for audit and other services Our fees for the audit of the Council’s financial statements for the year ended 31 March 2024 are outlined below. Blank cell 2023/24 Proposed Fee 2022/23 Actual Fee Auditor remuneration £251,690 £237,440 Pooled costs £9,170 £0 Contribution to PABV costs £63,850 £57,770 Audit support costs £0 £9,000 Sectoral cap adjustment (£110) (£2,030) Additional testing required to reflect the transition to a new ledger in 202/23 0 £4,225 Total fee £324,600 £310,465 26 Page 104
Page 105
Section 07: Our commitment to independence 27 Page 105
Page 106
7. Our commitment to independence 28 Requirements We comply with the International Code of Ethics for Professional Accountants, including International Independence Standards issued by the International Ethics Standards Board for Accountants together with the ethical requirements that are relevant to our audit of the financial statements in the UK reflected in the ICAEW Code of Ethics and the FRC Ethical Standard 2019. Compliance We are not aware of any relationship between Mazars and Argyll and Bute Council Argyll and Bute Council that, in our professional judgement, may reasonably be thought to impair our independence. We are independent of Argyll and Bute Council and have fulfilled our independence and ethical responsibilities in accordance with the requirements applicable to our audit. Non-audit and Audit fees We have set out a summary any non-audit services provided by Mazars (with related fees) to Argyll and Bute Council in Section 6, together with our audit fees and independence assessment. Page 106
Page 107
7. Our commitment to independence We are committed to independence and confirm that we comply with the FRC’s Ethical Standard. In addition, we have set out in this section any matters or relationships we believe may have a bearing on our independence or the objectivity of our audit team. Based on the information provided by you and our own internal procedures to safeguard our independence as auditors, we confirm that in our professional judgement there are no relationships between us and any of our related or subsidiary entities, and you and your related entities, that create any unacceptable threats to our independence within the regulatory or professional requirements governing us as your auditors. We have policies and procedures in place that are designed to ensure that we carry out our work with integrity, objectivity, and independence. These policies include: • All partners and staff are required to complete an annual independence declaration. • All new partners and staff are required to complete an independence confirmation and complete annual ethical training. • Rotation policies covering audit engagement partners and other key members of the audit team. • Use by managers and partners of our client and engagement acceptance system, which requires all non-audit services to be approved in advance by the audit engagement partner. We confirm, as at the date of this report, that the engagement team and others in the firm as appropriate, Mazars LLP are independent and comply with relevant ethical requirements. However, if at any time you have concerns or questions about our integrity, objectivity or independence, please discuss these with Mark Outterside in the first instance. Prior to the provision of any non-audit services, Mark Outterside will undertake appropriate procedures to consider and fully assess the impact that providing the service may have on our independence as auditor. Principal threats to our independence and the associated safeguards we have identified and/ or put in place are set out in Framework Agreement issued by Audit Scotland available from the Audit Scotland website: Audit Scotland Framework Agreement (audit-scotland.gov.uk). Any emerging independence threats and associated identified safeguards will be communicated in our Annual Audit Report. 29 Page 107
Page 108
Section 08: Materiality and misstatements 30 Page 108
Page 109
8. Materiality and misstatements 31 Definitions Materiality is an expression of the relative significance or importance of a particular matter in the context of the financial statements as a whole. Misstatements in the financial statements are considered to be material if they could, individually or in aggregate, reasonably be expected to influence the economic decisions of users based on the financial statements. Materiality We determine materiality for the financial statements as a whole (overall materiality) using a benchmark that, in our professional judgement, is most appropriate to entity. We also determine an amount less than materiality (performance materiality), which is applied when we carry out our audit procedures and is designed to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds overall materiality. Further, we set a threshold above which all misstatements we identify during our audit (adjusted and unadjusted) will be reported to the Audit and Scrutiny Committee. Judgements on materiality are made in light of surrounding circumstances and are affected by the size and nature of a misstatement, or a combination of both. Judgements about materiality are based on a consideration of the common financial information needs of users as a group and not on specific individual users. An assessment of what is material is a matter of professional judgement and is affected by our perception of the financial information needs of the users of the financial statements. In making our assessment we assume that users: • Have a reasonable knowledge of business, economic activities, and accounts; • Have a willingness to study the information in the financial statements with reasonable diligence; • Understand that financial statements are prepared, presented, and audited to levels of materiality; • Recognise the uncertainties inherent in the measurement of amounts based on the use of estimates, judgement, and consideration of future events; and • Will make reasonable economic decisions based on the information in the financial statements. We consider overall materiality and performance materiality while planning and performing our audit based on quantitative and qualitative factors. When planning our audit, we make judgements about the size of misstatements we consider to be material. This provide a basis for our risk assessment procedures, including identifying and assessing the risks of material misstatement, and determining the nature, timing and extent of our responses to those risks. The overall materiality and performance materiality that we determine does not necessarily mean that uncorrected misstatements that are below materiality, individually or in aggregate, will be considered immaterial. We revise materiality as our audit progresses should we become aware of information that would have caused us to determine a different amount had we been aware of that information at the planning stage. Page 109
Page 110
8. Materiality and misstatements Materiality (continued) For the consolidated and parent financial statements, we consider that gross revenue expenditure at surplus/deficit level is the key focus of users of the financial statements and, as such, we base our materiality levels around this benchmark. We expect to set a materiality threshold of 2% of gross revenue expenditure at surplus/deficit level for the consolidated financial statements, and a materiality threshold of 2% of gross revenue expenditure at surplus/deficit level for the parent company. As set out in the tables alongside, based on currently available information, being the prior period signed financial statements we anticipate overall materiality for the year ended 31 March 2024 to be in the region of £9.665 (£9.665m in the prior year), and performance materiality to be in the region of £6,766m (£5.799m in the prior year). For the Council, we anticipate overall materiality for the year ended 31 March 2024 to be in the region of £9.529m (£9.529m in the prior year), and performance materiality to be in the region of £6.670m (£5.717m in the prior year). As set out in the tables overleaf, for Argyll and Bute Charitable Trusts, we anticipate overall materiality for the year ended 31 March 2024 to be in the region of £15,359 (£15,359 in the prior year), and performance materiality to be in the region of £10,751 (£9,215 in the prior year). We will continue to monitor materiality throughout our audit to ensure it is set at an appropriate level. Consolidated financial statements Blank cell 2023/24 £’000s 2022/23 £’000s Overall materiality £9,665 £9,665 Performance materiality £6,766 £5,799 Clearly trivial £290 £250 Specific Materiality: Remuneration Report £1 for senior councillors and senior employees’ remuneration and pensions benefits 1 banding for Employees’ remuneration 1 banding for exit packages Council financial statements Blank cell 2023/24 £’000s 2022/23 £’000s Overall materiality £9,529 £9,529 Performance materiality £6,670 £5,717 Clearly trivial £286 £250 Specific Materiality: Remuneration Report £1 for senior councillors and senior employees’ remuneration and pensions benefits 1 banding for Employees’ remuneration 1 banding for exit packages 32 Page 110
Page 111
8. Materiality and misstatements Materiality (continued) Argyll and Bute Charitable Trusts statements Blank cell 2023/24 2022/23 Overall materiality £15,359 £15,359 Performance materiality £10,751 £9,215 Clearly trivial £461 £461 Specific Materiality: Remuneration Report £1 for senior councillors and senior employees’ remuneration and pensions benefits 1 banding for Employees’ remuneration 1 banding for exit packages 33 Page 111
Page 112
8. Materiality and misstatements Misstatements We will accumulate misstatements identified during our audit that are above our determined clearly trivial threshold. We have set a clearly trivial threshold for individual misstatements we identify (a reporting threshold) for reporting to the Audit and Scrutiny Committee and management that is consistent with a threshold where misstatements below that amount would not need to be accumulated because we expect that the accumulation of such amounts would not have a material effect on the financial statements. Based on our preliminary assessment of overall materiality, our proposed clearly trivial threshold is £290k for the Group and £286k for the Council, based on 3% of overall materiality. If you have any queries about this, please raise these with Mark Outterside. Each misstatement above the reporting threshold that we identify will be classified as: • Adjusted: Those misstatements that we identify and are corrected by management. • Unadjusted: Those misstatements that we identify that are not corrected by management. We will report all misstatements above the reporting threshold to management and request that they are corrected. If they are not corrected, we will report each misstatement to the Audit and Scrutiny Committee as unadjusted misstatements and, if they remain uncorrected, we will communicate the effect that they may have individually, or in aggregate, on our audit opinion. Misstatements also cover quantitative misstatements, including those relating to the notes of the financial statements. Reporting In summary, we will categorise and report misstatements above the reporting threshold to the Audit and Scrutiny Committee as follows: • Adjusted misstatements; • Unadjusted misstatements; and • Disclosure misstatements (adjusted and unadjusted). 34 Page 112
Page 113
A 35 Appendices A: Key communication points B: Current year updates, forthcoming accounting & other issues Page 113
Page 114
Appendix A: Key communication points 36 We value communication with Those Charged With Governance as a two way feedback process at the heart of our client service commitment. ISA 260 (UK) ‘Communication with Those Charged with Governance’ and ISA 265 (UK) ‘Communicating Deficiencies In Internal Control To Those Charged With Governance And Management’ specifically require us to communicate a number of points with you. Relevant points that need to be communicated with you at each stage of the audit are outlined below. Form, timing and content of our communications We will present the following reports: • Our Annual Audit Plan; and • Our Annual Audit Report. These documents will be discussed with management prior to being presented to yourselves and their comments will be incorporated as appropriate. Key communication points at the planning stage as included in this Annual Audit Plan Our responsibilities in relation to the audit of the financial statements; • The planned scope and timing of the audit; • Significant audit risks and areas of management judgement; • Our commitment to independence; • Responsibilities for preventing and detecting errors; • Materiality and misstatements; and • Fees for audit and other services. Key communication points at the completion stage to be included in our Annual Audit Report • Significant deficiencies in internal control; • Significant findings from the audit; • Significant matters discussed with management; • Significant difficulties, if any, encountered during the audit; • Qualitative aspects of the entity’s accounting practices, including accounting policies, accounting estimates and financial statement disclosures; • Our conclusions on the significant audit risks and areas of management judgement; • Summary of misstatements; • Management representation letter; • Our proposed draft audit report; and • Independence. Page 114
Page 115
37 Appendix A: Key communication points ISA (UK) 260 ‘Communication with Those Charged with Governance’, ISA (UK) 265 ‘Communicating Deficiencies In Internal Control To Those Charged With Governance And Management’ and other ISAs (UK) specifically require us to communicate the following: Required communication Where addressed Our responsibilities in relation to the financial statement audit and those of management and those charged with governance. Annual Audit Plan The planned scope and timing of the audit including any limitations, specifically including with respect to significant risks. Annual Audit Plan With respect to misstatements: • uncorrected misstatements and their effect on our audit opinion; • the effect of uncorrected misstatements related to prior periods; • a request that any uncorrected misstatement is corrected; and • in writing, corrected misstatements that are significant. Annual Audit Report With respect to fraud communications: • enquiries of the Audit and Scrutiny Committee to determine whether they have a knowledge of any actual, suspected or alleged fraud affecting the entity; • any fraud that we have identified or information we have obtained that indicates that fraud may exist; and • a discussion of any other matters related to fraud. Annual Audit Report and discussion at Audit and Scrutiny Committee Audit Planning and Clearance meetings Page 115
Page 116
38 Appendix A: Key communication points Required communication Where addressed Significant matters arising during the audit in connection with the entity’s related parties including, when applicable: • non-disclosure by management; • inappropriate authorisation and approval of transactions; • disagreement over disclosures; • non-compliance with laws and regulations; and • difficulty in identifying the party that ultimately controls the entity. Annual Audit Report Significant findings from the audit including: • our view about the significant qualitative aspects of accounting practices including accounting policies, accounting estimates and financial statement disclosures; • significant difficulties, if any, encountered during the audit; • significant matters, if any, arising from the audit that were discussed with management or were the subject of correspondence with management; • written representations that we are seeking; • expected modifications to the audit report; and • other matters, if any, significant to the oversight of the financial reporting process or otherwise identified in the course of the audit that we believe will be relevant to the Council or the Audit and Scrutiny Committee in the context of fulfilling their responsibilities. Annual Audit Report Significant deficiencies in internal controls identified during the audit. Annual Audit Report Where relevant, any issues identified with respect to authority to obtain external confirmations or inability to obtain relevant and reliable audit evidence from other procedures. Annual Audit Report Page 116
Page 117
39 Appendix A: Key communication points Required communication Where addressed Audit findings regarding non-compliance with laws and regulations where the non-compliance is material and believed to be intentional (subject to compliance with legislation on tipping off) and enquiry of the Audit and Scrutiny Committee into possible instances of non- compliance with laws and regulations that may have a material effect on the financial statements and that the Audit and Scrutiny Committee may be aware of. Annual Audit Report and the Audit and Scrutiny Committee meetings With respect to going concern, events or conditions identified that may cast significant doubt on the entity’s ability to continue as a going concern, including: • whether the events or conditions constitute a material uncertainty; • whether the use of the going concern assumption is appropriate in the preparation and presentation of the financial statements; and • the adequacy of related disclosures in the financial statements. Annual Audit Report Reporting on the valuation methods applied to the various items in the annual Council and Group financial statements including any impact of changes of such methods Annual Audit Report Communication regarding our system of quality management, compliant with ISQM 1, developed to support the consistent performance of quality audit engagements. To address the requirements of ISQM (UK) 1, the firm’s ISQM 1 team completes, as part of an ongoing and iterative process, a number of key steps to assess and conclude on the firm’s System of Quality Management: • Ensure there is an appropriate assignment of responsibilities under ISQM1 and across Leadership • Establish and review quality objectives each year, ensuring ISQM (UK) 1 objectives align with the firm's strategies and priorities • Identify, review and update quality risks each quarter, taking into consideration of number of input sources (such as FRC / ICAEW review findings, AQT findings, RCA findings, etc.) • Identify, design and implement responses as part of the process to strengthen the firm's internal control environment and overall quality • Evaluate responses to identify and remediation process / control gaps We perform an evaluation of our system of quality management on an annual basis. Our first evaluation was performed as of 31 August 2023. Details of that assessment and our conclusion are set out in our 2022/2023 Transparency Report, which is available on our website here. Annual Audit Plan Page 117
Page 118
40 Appendix A: Key communication points Required communication Where addressed Explanation of the scope of consolidation and the exclusion criteria applied by the entity to the non-consolidated entities, if any, and whether those criteria applied are in accordance with the relevant financial reporting framework. Annual Audit Plan and/or Annual Audit Report as appropriate Where applicable, identification of any audit work performed by component auditors in relation to the audit of the consolidated financial statements other than by Mazars’ member firms. Annual Audit Plan and/or Annual Audit Report as appropriate Indication of whether all requested explanations and documents were provided by the entity Annual Audit Report Page 118
Page 119
41 Appendix B: Current year updates, forthcoming accounting & other issues Applicable for IFRS Reporters Current and forthcoming accounting issue (continued) New standards and amendments (continued) Effective for accounting periods beginning on or after 1 January 2023 Amendments to IAS 1 Presentation of Financial Statements and IFRS Practice Statement 2 Making Materiality Judgements: Disclosure of Accounting Policies (Issued February 2021) • The amendments set out new requirements for material accounting policy information to be disclosed, rather than significant accounting policies. Immaterial accounting policy information should not be disclosed as accounting policy information taken in isolation is unlikely to be material, but it is when the information is considered together with other information in the financial statements that may make it material. Amendments to IAS 8 Accounting Policies, Changes in Accounting Estimates and Errors: Definition of Accounting Estimates (Issued February 2021) • The amendment introduces a new definition for accounting estimates and clarifies how entities should distinguish changes in accounting policies from changes in accounting estimates. The distinction is important because changes in accounting estimates are applied prospectively only to future transactions and other future events, but changes in accounting policies are generally applied retrospectively to past transactions and other past events. IFRS 17 Insurance Contracts (issued May 2017) and Amendments to IFRS 17 Insurance Contracts (Issued June 2020) • IFRS 17 is a new standard that will replace IFRS 4 Insurance Contracts (IFRS 4). The standard sets out the principles for the recognition, measurement, presentation and disclosure about insurance contracts issued, and reinsurance contracts held, by entities. Amendments to IFRS 17 Insurance Contracts: Initial Application of IFRS 17 and IFRS 9 Financial Instruments (Issued December 2021) • The amendments address potential mismatches between the measurement of financial assets and insurance liabilities in the comparative period because of different transitional requirements in IFRS 9 and IFRS 17. The amendments introduce a classification overlay under which a financial asset is permitted to be presented in the comparative period as if the classification and measurement requirements of IFRS 9 had been applied to that financial asset in the comparative period. The classification overlay can be applied on an instrument-by-instrument basis. IFRS 17 Insurance Contracts has not yet been adopted by the FReM. Adoption in the FReM is expected to be from April 2025; early adoption is not permitted. Page 119
Page 120
42 Appendix B: Current year updates, forthcoming accounting & other issues Applicable for IFRS Reporters Current and forthcoming accounting issue (continued) New standards and amendments (continued) Effective for accounting periods beginning on or after 1 January 2024 The information detailed on this slide is for wider IFRS information only. They will be subject to inclusion within the FReM and Code as determined by FRAB. Amendments to IAS 1 Presentation of Financial Statements: Classification of Liabilities as Current or Non-current (Issued January 2020), Deferral of Effective Date (Issued July 2020) and Non-current Liabilities with Covenants (Issued October 2022) • The January 2020 amendments clarify the requirements for classifying liabilities as current or non-current in IAS 1 by providing clarification surrounding: when to assess classification; understanding what is an ‘unconditional right’; whether to determine classification based on an entity’s right versus discretion and expectation; and dealing with settlements after the reporting date. The October 2022 amendments specify how covenants should be taken into account in the classification of a liability as current or non-current. Only covenants with which an entity is required to comply with by the reporting date affect the classification as current or non-current. Classification is not therefore affected if the right to defer settlement of a liability for at least 12 months is subject to compliance with covenants at a date after the reporting date. These amendments also clarify the disclosures about the nature of covenants, so that users of financial statements can assess the risk that non-current debts accompanied by covenants may become repayable within 12 months. Amendments to IAS 16 Leases: Lease Liability in Sale and Leaseback (Issued September 2022) • The amendments include additional requirements to explain how to subsequently measure the lease liability in a sale and leaseback transaction, specifically how to include variable lease payments. For further information, please refer to our blog article: Amendments to IFRS 16 Leases – Lease Liability in a Sale and Leaseback Amendments to IAS 7 Statement of Cash Flows and IFRS 7 Financial Instruments: Disclosures: Supplier Finance Arrangements (Issued May 2023) • The amendments introduce changes to the disclosure requirements around supplier finance arrangements with the intention of providing more detailed information to help users analyse and understand the effects of such arrangements. The amendments provide an overarching disclosure objective to ensure that users of financial statements are able to assess the effects of such arrangements on an entity’s liabilities and cash flows, as well as some additional disclosure requirements relating to the specific terms and conditions of the arrangement, quantitative information about changes in financial liabilities that are part of the supplier financing arrangement, and about an entity’s exposure to liquidity risk. For further information, please refer to our blog article: IASB publishes final amendments on supplier finance arrangements Page 120
Page 121
Mazars Mazars is an internationally integrated partnership, specialising in audit, accountancy, advisory, tax and legal services*. Operating in over 90 countries and territories around the world, we draw on the expertise of 40,400 professionals – 24,400 in Mazars’ integrated partnership and 16,000 via the Mazars North America Alliance – to assist clients of all sizes at every stage in their development. *where permitted under applicable country laws. Mark Outterside (Audit Director) 26 Mosley Street Newcastle upon Tyne NE1 1DF Follow us: LinkedIn: www.linkedin.com/company/Mazars Twitter: www.twitter.com/MazarsGroup Facebook: www.facebook.com/MazarsGroup Instagram: www.instagram.com/MazarsGroup WeChat: ID: Mazars Page 121
Page 122
This page is intentionally left blank
Page 123
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE CUSTOMER SUPPORT SERVICES 13 June 2024 LOCAL GOVERNMENT BENCHMARKING FRAMEWORK (LGBF): 2022/23 1. INTRODUCTION 1.1 This report provides a high-level summary of Argyll and Bute’s performance as reported in the Local Government Benchmarking Framework data. 1.2 The report also outlines work currently underway with regard to the LGBF and how we may wish to use the data most effectively in the future. This work is being carried out as part of the wider Performance Excellence Project. 2. RECOMMENDATIONS It is recommended that the Audit and Scrutiny Committee: 2.1 Considers the contents of this report and notes the trend of net improvement across the council’s functions. 2.2 Notes the ongoing work being carried out as part of the wider Performance Excellence Project. 3. DETAIL 3.1 All Scottish Councils engage with the Local Government Benchmarking Framework (LGBF), which is managed by the Improvement Service. The purpose of the LGBF is to enable local authorities to improve their performance through benchmarking and the sharing of good practice. 3.2 In an effort to produce more timely data, the Improvement Service has recently made changes to its publication schedule. Its ambition is to improve the timeliness of the LGBF data. Six indicators are now being updated monthly. However, for the purposes of this report, data for the most recent full year for which data is available (2022/23) has been used, with comparisons being made with previous years. Page 123 Agenda Item 9
Page 124
3.3 The number of indicators within the LGBF has grown over time from 55 in 2010/11 to the current 108 (see Appendix 1). The breadth of areas covered by the indicators has also expanded and now encompasses the following service areas. • Corporate services • Social Work services • Culture and Leisure • Environmental Services • Housing Services. (Argyll and Bute does not submit any data in this area.) • Corporate Assets / property • Economic Development • Financial Sustainability • Tackling Climate Change 3.4 The geography and demography of our area impact on indicators in a variety of ways. For some indicators, we recognise we cannot improve our performance relative to other councils (for example the cost of providing pre-school, primary, and secondary education per pupil, and indicators relating to roads conditions, where we consistently perform toward the bottom of the fourth quartile.) 3.5 Despite the caveats around our population profile and geography, the proportion of indicators in the bottom performance quartile has been decreasing over time. 3.6 Figures 1 and 2 show an overall pattern of relative improvement in recent years, with the percentage of our indicators in quartile 4 halving over the last five years. The use of quartiles allows us to compare our performance with the other Scottish local authorities. 3.7 The data needs to be treated with a degree of caution as it does not show continuous improvement by individual indicators. Performance of a single indicator may fluctuate from year to year; also the number of indicators reported varies from year to year. Rather, the figures show the percentage of indicators within each performance quartile to give a high-level overview of the council’s performance relative to other local authorities. This profile of indicators has shifted to suggest a pattern of relative improvement. Where our performance falls within the quartiles 1 and 2, our performance is above the Scottish average. Page 124
Page 125
Figure 1: Performance by quartile (2021/22 and 2022/23). Figure 2: Percentage of indicators in each LGBF performance quartile over the past five years. Page 125
Page 126
3.8 A comparison of the data for the years 2021/22 and 2022/23 shows that, for the 97 indicators for which comparison can be made: • 34 indicators moved to a higher quartile, suggesting improved relative performance. • 34 indicators stayed within the same quartile. • 29 indicators moved to a lower quartile, suggesting worsening relative performance. • Notably, 15 indicators moved out of quartile four, compared with 6 moving into that quartile, a net upwards movement of 9 indicators. (12 indicators were in quartile 4 in both years. These included the previously mentioned indicators relating to cost of pre-school, primary and secondary education per pupil and roads conditions.) 3.9 For further information about how councils are collectively performing across Scotland, and how challenges facing local authorities have impacted on performance, see the National Benchmarking Overview Report 2022-23. 3.10 For further information about performance for individual indicators and comparisons with our ‘family groups’ of councils, see the Improvement Service’s Local Government Benchmarking Framework Dashboard. 3.11 As part of the Performance Excellence Project, we have carried out a survey with managers to understand how they use the LGBF. We are following this up by considering how the LGBF may be used more effectively and efficiently, and in conjunction with other benchmarking activity. This work will shape the project’s final proposals around performance management arrangements. 3.12 To ensure future benchmarking activity aligns with the new administration’s corporate plan and updated set of corporate outcomes/priorities, we need to understand better which indicators are important to the council, and how these can best be used. The need to focus on the indicators which are most important to us is compounded by the increasing number of indicators within the LGBF dataset. 3.13 We are mindful of the longstanding concerns around the sample size and representativeness of satisfaction measures included in the LGBF. To address these issues, we are developing our own survey which will enhance our understanding of satisfaction with council services and allow for monitoring over time. 4.0 CONCLUSION 4.1 This report has outlined our performance position relative to other Scottish local authorities as revealed by the Local Government Benchmarking Framework data. Overall, the picture is a positive one, suggesting net overall improvements in performance. Page 126
Page 127
4.2 Work to improve the effectiveness and efficiency of how we use the Local Government Benchmarking Framework data as part of our wider benchmarking activity will continue as part of the Performance Excellence Project. 5.0 IMPLICATIONS 5.1 Policy: none arising directly from this report. 5.2 Financial: none arising directly from this report. 5.3 Legal: none arising directly from this report. 5.4 HR: none arising directly from this report. 5.5 Fairer Scotland Duty: 5.5.1 Equalities - protected characteristics: none arising from this report. An EqSEIA is not required for performance reporting. 5.5.2 Socio-economic Duty: none arising from this report. An EqSEIA is not required for performance reporting. 5.5.3 Islands none arising from this report. An EqSEIA is not required for performance reporting. 5.6 Climate Change: none arising from this report. 5.7 Risk: none arising from this report. 5.8 Customer Service: none arising from this report. 5.9 The Rights of the Child (UNCRC): none arising from this report. Kirsty Flanagan Executive Director with responsibility for Customer Support Services. Cllr Mark Irvine Policy Lead for Community Planning and Corporate Services Report prepared: 17 May 2024 For further information contact: Jane Fowler, Head of Customer Support Services Chris Carr, OD Project Officer Page 127
Page 128
APPENDICES Appendix 1: List of Local Government Benchmarking Framework indicators Page 128
Page 129
Appendix 1: List of Local Government Benchmarking Framework indicators. Indicator Code Indicator Title Service Area C&L01 Cost per attendance at Sports facilities Culture & Leisure Services C&L02 Cost per Library Visit Culture & Leisure Services C&L03 Cost per Museum Visit Culture & Leisure Services C&L04 Cost of Parks & Open Spaces per 1,000 Population Culture & Leisure Services C&L05a Proportion of adults satisfied with libraries Culture & Leisure Services C&L05b Proportion of adults satisfied with parks and open spaces Culture & Leisure Services C&L05c Proportion of adults satisfied with museums and galleries Culture & Leisure Services C&L05d Proportion of adults satisfied with leisure facilities Culture & Leisure Services CHN01 Cost per Primary School Pupil Children's Services CHN02 Cost per Secondary School Pupil Children's Services CHN03 Cost per Pre-School Education place Children's Services CHN04 % of Pupils Gaining 5+ Awards at Level 5 Children's Services CHN05 % of Pupils Gaining 5+ Awards at Level 6 Children's Services CHN06 % of Pupils from 20% most Deprived Areas Gaining 5+ Awards at Level 5 Children's Services CHN07 % of Pupils from 20% most Deprived Areas Gaining 5+ Awards at Level 6 Children's Services CHN08a Gross Costs of 'Children Looked After' in residential-based services per child per week Children's Services CHN08b Gross Cost of "Children Looked After" in a community setting per child per Week Children's Services CHN09 Proportion of children being looked after in the community Children's Services CHN10 Proportion of adults satisfied with local schools Children's Services CHN11 Proportion of pupils entering positive destinations Children's Services CHN12a Overall Average Total Tariff Children's Services CHN12b Average Total Tariff SIMD Quintile 1 Children's Services CHN12c Average Total Tariff SIMD Quintile 2 Children's Services CHN12d Average Total Tariff SIMD Quintile 3 Children's Services CHN12e Average Total Tariff SIMD Quintile 4 Children's Services CHN12f Average Total Tariff SIMD Quintile 5 Children's Services CHN13a % of P1, P4 and P7 pupils achieving expected CFE level in Literacy Children's Services CHN13b % of P1, P4 and P7 pupils achieving expected CFE level in Numeracy Children's Services CHN14a Literacy Attainment Gap (P1,4,7 Combined) Children's Services CHN14b Numeracy Attainment Gap (P1,4,7 Combined) Children's Services CHN17 Proportion of Children meeting developmental milestones Children's Services CHN18 Proportion of funded early years provision which is graded good/better Children's Services CHN19a School attendance rates (per 100 pupils) Children's Services CHN19b School attendance rates (per 100 'looked after pupils') Children's Services CHN20a School exclusions rates (per 1,000 pupils) Children's Services CHN20b School exclusions rates (per 1,000 'looked after pupils') Children's Services Page 129
Page 130
Indicator Code Indicator Title Service Area CHN21 Participation rate for 16-19 year olds (%) Children's Services CHN22 Proportion of Child Protection re-registrations within 18 months Children's Services CHN23 Proportion of LAC with more than 1 placement in the last year Children's Services CHN24 Proportion of children living in poverty (after housing costs) Children's Services CLIM01 CO2 emissions area wide per capita Tackling Climate Change CLIM02 CO2 emissions area wide: emissions within scope of LA per capita Tackling Climate Change CLIM03 CO2 emissions from Transport per capita Tackling Climate Change CLIM04 CO2 emissions from Electricity per capita Tackling Climate Change CLIM05 CO2 emissions from Natural Gas per capita Tackling Climate Change CORP01 Support services as a percentage of Total Gross expenditure Corporate Services CORP03b Proportion of the highest paid 5% of employees who are women Corporate Services CORP03c Gender pay gap (%) Corporate Services CORP04 Cost per dwelling of collecting Council Tax Corporate Services CORP06a Sickness absence days per teacher Corporate Services CORP06b Sickness absence days per employee (non-teacher) Corporate Services CORP07 Percentage of income due from Council Tax received by the end of the year Corporate Services CORP08 Percentage of invoices sampled that were paid within 30 days Corporate Services CORP09 Proportion of SWF Crisis Grant decisions within 1 day Corporate Services CORP10 Proportion of SWF Community Care Grant decisions within 15 days Corporate Services CORP11 Proportion of SWF budget spent Corporate Services CORP12 Proportion of DHP funding spent Corporate Services CORP- ASSET01 % of operational buildings that are suitable for their current use Corporate Services CORP- ASSET02 % of internal floor area of operational buildings in satisfactory condition Corporate Services ECON01 Percentage of Unemployed People Assisted into work from Council Programmes Economic Development ECON02 Cost of Planning & Building Standards per planning application Economic Development ECON03 Average time per business and industry planning application (weeks) Economic Development ECON04 Proportion of procurement spent on local enterprises Economic Development ECON05 No of business gateway start-ups per 10,000 population Economic Development ECON06 Investment in Economic Development & Tourism per 1,000 population Economic Development ECON07 Proportion of people earning less than the living wage Economic Development ECON08 Proportion of properties receiving Superfast Broadband Economic Development ECON09 Town Vacancy Rates Economic Development ECON10 Immediate available employment land as a % of total land allocated for employment purposes Economic Development ECON11 Gross Value Added (GVA) per capita Economic Development Page 130
Page 131
Indicator Code Indicator Title Service Area ECON12a Claimant Count as a % of Working Age Population Economic Development ECON12b Claimant Count as % of 16-24 Population Economic Development ENV01a Net cost per Waste collection per premises Environmental Services ENV02a Net cost per Waste disposal per premises Environmental Services ENV03a Net cost of street cleaning per 1,000 population Environmental Services ENV03c Street Cleanliness Score Environmental Services ENV04a Cost of roads per kilometre Environmental Services ENV04b Percentage of A class roads considered for maintenance treatment Environmental Services ENV04c Percentage of B class roads considered for maintenance treatment Environmental Services ENV04d Percentage of C class roads considered for maintenance treatment Environmental Services ENV04e Percentage of unclassified roads considered for maintenance treatment Environmental Services ENV05 Cost of Trading Standards and environmental health per 1,000 population Environmental Services ENV05a Cost of Trading Standards, Money Advice & Citizens Advice per 1,000 population Environmental Services ENV05b Cost of environmental health per 1,000 population Environmental Services ENV06 Proportion of total household waste arising that is recycled Environmental Services ENV07a Proportion of adults satisfied with refuse collection Environmental Services ENV07b Proportion of adults satisfied with street cleaning Environmental Services FINSUS01 Total useable reserves as a % of council annual budgeted revenue Financial Sustainability FINSUS02 Uncommitted General Fund Balance as a % of annual budgeted net revenue Financial Sustainability FINSUS03 Ratio of Financing Costs to Net Revenue Stream - General Fund Financial Sustainability FINSUS04 Ratio of Financing Costs to Net Revenue Stream - Housing Revenue Account Financial Sustainability FINSUS05 Actual outturn as a percentage of budgeted expenditure Financial Sustainability HSN01b Gross rent arrears (all tenants) as a percentage of rent due for the year Housing Services HSN02 Proportion of rent due in the year that was lost due to voids Housing Services HSN03 Proportion of council dwellings meeting Scottish Housing Quality Standards Housing Services HSN04b Average number of days taken to complete non-emergency repairs Housing Services HSN05a Proportion of council dwellings that are energy efficient Housing Services SW01 Home care costs per hour for people aged 65 or over Adult Social Care Services SW02 SDS (DP + MPB) spend on adults as a % of total adult social work spend Adult Social Care Services SW03a % of people 65+ with long-term care needs who are receiving personal care at home Adult Social Care Services Page 131
Page 132
Indicator Code Indicator Title Service Area SW04b % of adults supported at home who agree that their services and support had an impact in improving or maintaining their quality of life Adult Social Care Services SW04c % of adults supported at home who agree that they are supported to live as independently as possible Adult Social Care Services SW04d % of adults supported at home who agree that they had a say in how their help, care or support was provided Adult Social Care Services SW04e % of carers who feel supported to continue in their caring role Adult Social Care Services SW05 Residential costs per week per resident for people aged 65 or over Adult Social Care Services SW06 Rate of readmission to hospital within 28 days per 1,000 discharges Adult Social Care Services SW07 Proportion of adult care services graded good or better Adult Social Care Services SW08 Number of days people spend in hospital when they are ready to be discharged, per 1,000 population (75+) Adult Social Care Services Page 132
Page 133
Audit & Scrutiny Committee Work Plan 2022 – 2023 This is an outline plan to facilitate forward planning of reports to the Audit & Scrutiny Committee Report Lead Service Regularity 13 June 2024 Reports to Committee Services by 20 May 2024 Internal Audit and Counter Fraud Summary of Activities Chief Internal Auditor Quarterly Internal Audit Report Follow Up Chief Internal Auditor Quarterly Internal Audit Reports to Audit and Scrutiny Committee Chief Internal Auditor Quarterly Verbal Update by Chair(s) of Scrutiny Panel Chair and Vice Chair of Audit & Scrutiny Committee Quarterly Internal Audit 2024-25 Annual Report Chief Internal Auditor Annual Review of Code of Corporate Governance Governance, Risk and Safety Manager Annual External Audit – 2024/25 Annual Plan Mazars Annual Audit Strategy Memorandum Mazars Annual Local Government Benchmarking Framework Report Head of Customer Support Services/HR & OD Manager Annual Unaudited Financial Accounts Head of Financial Services Annual Statement of Governance and Internal Control Governance, Risk and Safety Manager Annual 5 September 2024 Reports to Committee Services by 12 August 2024 Internal Audit and Counter Fraud Summary of Activities Chief Internal Auditor Quarterly Internal Audit Report Follow Up Chief Internal Auditor Quarterly Internal Audit Reports to Audit and Scrutiny Committee Chief Internal Auditor Quarterly External Audit Update Mazars Quarterly Verbal Update by Chair(s) of Scrutiny Panel Chair and Vice Chair of Audit & Scrutiny Committee Quarterly PSIAS Self-Assessment Chief Internal Auditor Annual Page 133 Agenda Item 11
Page 134
Audit & Scrutiny Committee Work Plan 2022 – 2023 Corporate Complaints Annual Report 2024-25 Governance, Risk and Safety Manager Annual Freedom of Information Annual Report 2024-25 Governance, Risk and Safety Manager Annual Local Government in Scotland – Overview 2024 Audit Scotland (Lynsey to see if available and download for agenda pack – see agenda June 2023) Annual Audit & Scrutiny Committee 2024/25 Annual Report Audit & Scrutiny Committee Chair Annual Strategic Risk Register – Assurance Mapping Chief Internal Auditor Annual Strategic Risk Register Update Chief Executive Annual External Audit 2024/25 Management Report Mazars Annual Proposed Approach to Consultations Scrutiny Review Chief Internal Auditor One-off Audit Scotland Digital Exclusion National Performance Audit Head of Customer Support Services (Audit Scotland/Mazars) One-off 17 December 2024 Reports to Committee Services by 22 November 2024 Internal Audit and Counter Fraud Summary of Activities Chief Internal Auditor Quarterly Internal Audit Report Follow Up Chief Internal Auditor Quarterly Internal Audit Reports to Audit and Scrutiny Committee Chief Internal Auditor Quarterly Audit Progress Report Mazars Quarterly Verbal Update by Chair(s) of Scrutiny Panel Chair and Vice Chair of Audit & Scrutiny Committee Quarterly Performance Reporting Update (to include reference to LGBF) Chief Executive/Head of Customer Support Services/HR & OD Manager Quarterly Council Annual Report 2024/25 Head of Customer Support Services Annual 13 March 2025 Reports to Committee Services by 17 February 2025 Internal Audit and Counter Fraud Summary of Activities Chief Internal Auditor Quarterly Internal Audit Report Follow Up Chief Internal Auditor Quarterly Internal Audit Reports to Audit and Scrutiny Committee 2024/25 Chief Internal Auditor Quarterly Verbal Update by Chair(s) of Scrutiny Panel Chair and Vice Chair of Audit & Scrutiny Committee Quarterly RIPSA Annual Report Governance and Risk Manager Annual Page 134
Page 135
Audit & Scrutiny Committee Work Plan 2022 – 2023 Internal Audit 2025/26 Plan Chief Internal Auditor Annual 2024/25 Unaudited Annual Accounts Preparation Plan and Timetable Head of Financial Services Annual Treasury Management Strategy and Annual Investment Strategy Head of Financial Services Annual Progress against Best Value Action Plan Update Chief Executive/Head of Customer Support Services/HR&OD Manager Annual Internal Audit Charter and Internal Audit Manual Chief Internal Auditor Annual Scrutiny Manual and Framework Update Chief Internal Auditor Annual Audit Scotland Report – Financial Overview 2024/25 Head of Financial Services Annual Page 135
Page 136
This page is intentionally left blank
Page 137
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 13 JUNE 2024 INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2023/2024 1. EXECUTIVE SUMMARY 1.1 There are six audits being reported to the Audit and Scrutiny Committee. 1.2 The table below provides a summary of the conclusions for the audits performed. The full reports are included as appendices to this report. Audit Name Level of Assurance High Actions Medium Actions Low Actions VFM Actions Financial Ledger Substantial 0 0 0 0 Learning and Physical Disability Care Packages Reasonable 0 7 0 0 Scottish Social Services Council (SSSC) Registration Substantial 1 1 4 0 Freedom of Information (FOI) High 0 0 4 0 Cloud Based Computer Services Substantial 0 4 1 0 Client Funds – Progress Review (EXEMPT) Reasonable 0 3 0 0 1.3 Internal Audit provides a level of assurance upon completion of audit work. A definition for each assurance level is documented in each audit report. 2. RECOMMENDATIONS 2.1 Audit and Scrutiny Committee to review and endorse this summary report and the detail within each individual report. 3. DETAIL 3.1 A high level summary of each completed audit report is noted below: Financial Ledger: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. After the initial delay of the start date, Fusion became operational in June 2022. Whilst fully operational it is recognised that some functionality has been lost which was previously available in Oracle EBS 12.1 resulting in the requirement to use Page 137 Agenda Item 12a
Page 138
manual interventions. However, it is reported that the manual interventions are functioning well and in relation to time do not add significant additional work. All feeder systems within the Financial Ledger are operating effectively. Interface feeder system reports are run by the system administration team. Cash and debtors interface reports are produced every day, however, others are generated when staff members process them – for example payroll (around the same timings every month). OTBI (Oracle Transactional Business Intelligence) Self Service is the replacement for Discoverer viewer. There is now no longer a need to build reports as a standard set of reports are available for users, although a number of users have full licences to allow them to write reports. Users of Fusion reported a more user friendly reporting tool, however, commented that there had been a loss of some functionality which was available in Discoverer Viewer. The work around for the loss of functionality now requires manual processes. It was reported that whist it does create additional work, this is not a time consuming job. Learning and Physical Disability Care Packages: this audit provided a reasonable level of assurance. Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Care Assessment policies and procedures are in place with a number of key documents provided for review, although these may not refer current practice and refer to Carefirst. Assessment and Care Planning Procedures’ (V1) details that the purpose of the policy, procedures and practice guidance is to improve outcomes for service users and carers by providing clear guidance for social work staff about assessment and planning with individuals. Case reviews are undertaken when there are significant changes to the client’s care needs. Children with Learning Disabilities are provided with a full care assessment when they move to Adult Services. We reviewed a 9% sample size of Learning Disability high value care packages. Clients are assigned a case manager, although heavy reliance is placed on the care providers reporting and updating the case manager on a regularly basis. Where case managers were not assigned, this was due to the allocated Social Worker moving on to different positions and the case was assigned to the specific team for Learning Disability. Case notes are maintained on Eclipse, the replacement client database for Carefirst. It was noted that case notes were not always maintained and up to date. A previous audit report highlighted the fact that client records were stored in multiple locations, including on the Council’s network drive. A Resource Allocation framework is in place based on a prioritisation of needs process. The prioritisation of all referrals is based primarily on the information received at the time of referral including any relevant background information held on CareFirst/Eclipse and is prioritised according to risk. Roles and Responsibilities are outlined in the various policies and procedures. The “Assessment and Care Planning procedures” outlines the roles and responsibilities for each of the staff categories. Scottish Social Services Council (SSSC) Registration: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Policies, procedures and guidance are available to support employees in their roles, however, some of these are overdue for review or lack version control. Recruitment follows a robust and consistent corporate Page 138
Page 139
process with a comprehensive induction programme in place, this includes provision of guidance on expected conduct of employees in undertaking their duties, there is no documentation regarding expected conduct of service users towards employees. SSSC registration status is regularly monitored by managers and centrally by the Council’s HR team to identify any issues to be addressed. Training needs, SVQ progress and continuous professional learning requirements are identified and discussed between managers and employees and overseen by the Social Work Training Board, additionally, feedback is gathered from service-users and employees to inform both individual and service level improvement plans. The supervision policy requires a significant time commitment from all involved, is applied inconsistently across care homes and contains no evidence of review since creation in 2011. Concerns raised regarding an employee’s fitness to practice are managed in accordance with the SSSC Codes of Practice and Council policies with support provided by the Council’s HR Officers. Freedom of Information: a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. The Council has an overarching procedure note for the collection and response to Information requests, this is published on the Council’s Intranet but is not up to date and does not reflect current working practices. Mandatory training for all staff is available on the LEON system, which also records and monitors completion. Additional training is provided to designated Service FOI representatives, who are responsible for ensuring that actions and correspondence in relation to the request are logged on the tracking database. There is a Teams Channel where FOI Service reps can access training and other materials. Key contact details, on the Hub, for staff involved in the collection and response to Information requests are not up to date. A review of the Council’s Publication scheme should be undertaken, including checking that any links to information are still working. The Compliance and Regulatory team provide monthly updates to the Chief Executive, the Chief Officer, Directors, Heads of Service and the departmental FOI reps. Quarterly reports are provided to all DMTs and on an annual basis to the Audit and Scrutiny Committee. The information in the reports is clear and relevant. The recent addition of a second tab provides Senior Managers with a detailed breakdown of the late responses and the reasons for such which further highlight specific areas for improvement. To highlight the number of marginally late responses, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. Cloud Based Computer Services: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. ICT and procurement teams assist services implement new systems following robust due diligence processes. Contracts and supporting documentation reviewed contained details of arrangements for business continuity, data recovery, change management and performance targets and appropriate oversight takes place. The ICT contracts application did not, however, contain records pertaining to all systems contained on a list provided. Cloud service providers have measures in place to protect the Council’s data in transit and at rest from unauthorised access, however multi-factor Page 139
Page 140
authentication (MFA) was not utilised for two systems reviewed, new users were not appropriately authorised in three instances and leavers are not always promptly notified to systems administrators. Whilst the cloud service providers have arrangements in place to ensure ongoing availability of services and customer data, the Council also has responsibilities and as such has a comprehensive overarching cyber-incident response plan in place. Specific cloud service disaster recovery plans/run books require to be prepared, updated and/or finalised and tested. Client Funds – Progress Review (EXEMPT): provided a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. The scope of the audit was to undertake a high level review of the agreed actions for the introduction and implementation of client fund accounts held on behalf of clients who lack capacity, noting progress and providing a revised action plan and dates for completion. The February 2023 report highlighted 8 high priority and 2 medium priority recommendations where there was scope to strengthen the control and governance environment. There have been significant resources deployed to enable the good progress so far, with 8 of the 10 recommendations now complete, and the 2 delayed and rescheduled actions rely on input from other services before they can be completed. There are 3 medium recommendations arising from this review. Argyll and Bute Health and Social Care Partnership (HSCP) have developed the Managing Service User’s Money Policy which sets out detailed processes and underlying operational procedures to ensure the management of client funds, however, these are not yet fully operational. Amendments have been added to the contracts of 3rd party providers of services in the community, recognising the need for providers to maintain appropriate financial records for clients and create the right for the Council to carry out independent reviews of records. A schedule for internal and external independent reviews is being developed. There is now a SharePoint site, which has been created to store information and records relating to the financial management of clients’ funds in one location. 4. CONCLUSION 4.1 Management has accepted each of the reports submitted and have agreed responses and timescales in the respective action plans. 5. IMPLICATIONS 5.1 Policy – None 5.2 Financial – None 5.3 Legal – None 5.4 HR – None 5.5 Fairer Scotland Duty – None 5.5.1 Equalities – protected characteristics – None 5.5.2 Socio-economic Duty – None 5.5.3 Islands – None 5.6 Climate Change – None 5.7 Risk – The implementation of recommendations contained in audit reports may help mitigate the risk to the Council. 5.8 Customer Service – None Page 140
Page 141
5.9 The Rights of the Child (UNCRC) – None Paul Macaskill Chief Internal Auditor 13 June 2024 For further information contact: Paul Macaskill, Chief Internal Auditor Tel: 01546 604108 Email: paul.macaskill@argyll-bute.gov.uk APPENDICES 1. Financial Ledger 2. Learning and Physical Disability Care Packages 3. Scottish Social Services Council (SSSC) Registration 4. Freedom of Information Requests 5. Cloud Based Computer Services – To Follow 6. Client Funds – High Level Progress Review Page 141
Page 142
This page is intentionally left blank
Page 143
Argyll and Bute Council Internal Audit Report April 2024 FINAL High Medium Low VFM Number of Findings 0 0 0 0 Financial Ledger Audit Opinion: Substantial Page 143
Page 144
2 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 2. Objectives and Summary Assessment ........................................................................................... 4 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Audit Opinion ................................................................................................................. 10 Contact Details Internal Auditor: Moira Weatherstone Telephone: 01546 604146 e-mail: moira.weatherstone@argyll-bute.gov.uk www.argyll-bute.gov.uk Page 144
Page 145
3 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 1. Executive Summary Introduction 1. As part of the 2023/24 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to the Financial Ledger. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. The main purpose of a general ledger system is to record the financial activity of the council and to produce financial and management reports to help council employees make decisions. Oracle Fusion General Ledger enables its users to: Record and review accounting information Enter journals to record actual entries directly into the General Ledger Review account balances online or through reports using OTBI and OTBI Self Service Analyse, correct, and adjust accounting information Use Oracle Fusion ADFDI (Application Development Framework Desktop Integration) to upload journals 5. The main system used by Financial Services to manage the General Ledger and Accounts Payable functions was Oracle EBS 12.1. Oracle ended support for this version of EBS in December 2021. For reasons of PSN and Cyber Essentials Plus compliance, and also broader cyber-security protection of a business critical system the council depends on, it was not practical for Finance to use this system beyond the end of June 2022. 6. The new solution (Fusion) and consultancy were procured following the Councils Procurement rules with Procurement being involved in the project from the start with contracts let with Oracle for the solution and Evosys for the implementation services. 7. OTBI (Oracle Transactional Business Intelligence) Self Service is the replacement for Discoverer viewer. OTBI is accessed through the Fusion system which is the replacement for Oracle. Page 145
Page 146
4 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 Scope 8. The scope of the audit is a post implementation review to determine how the system is operating paying particular attention to feeder systems, reporting functionality, procedures and training as outlined in the Terms of Reference agreed with the Head of Financial Services on 15 December 2023. Risks 9. The risks considered throughout the audit were: Audit Risk 1: Failure to ensure systems are operating effectively Audit Risk 2: Failure to ensure feeder systems are working effectively Audit Risk 3: failure to ensure that procedures are in place and staff are fully trained in systems Audit Opinion 10. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 1 to this report. 11. Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Recommendations 12. There are no recommendations as a result of this audit. 13. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 14. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Fusion and associated systems are fully operational Audit Risk 1: Substantial Oracle ended support for EBS 12.1, the General Ledger and Accounts Payable system in December 2021. For reasons Page 146
Page 147
5 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 with post implementation reviews being undertaken of PSN and Cyber Essentials Plus compliance, and also broader cyber- security protection of a business critical system the council depends on, it was not practical for Finance to use this system beyond the end of June 2022 and therefore Fusion, the replacement had to be in place and fully operating by that date. After the initial delay of the start date, Fusion became operational in June 2022. Whilst fully operational it is recognised that some functionality has been lost which was previously available in Oracle EBS 12.1 resulting in the requirement to use manual interventions. However, it is reported that the manual interventions are functioning well and in relation to time do not add significant additional work. 2 Feeder systems within the Financial Ledger are operating effectively and in a timely manner Audit Risk 2 Substantial All feeder systems within the Financial Ledger are operating effectively. Interface feeder system reports are run by the system administration team. Cash and debtors interface reports are produced every day, however, others are generated when staff members process them – for example payroll (around the same timings every month). Reports are checked by the system administration team to ensure that they are successful. Payables is checked by the Creditors Supervisor. 3 Reporting systems within the Financial Ledger are functioning effectively Audit Risk 1 Substantial OTBI (Oracle Transactional Business Intelligence) Self Service is the replacement for Discoverer viewer. OTBI is accessed through the Fusion system. Running reports on OBTI is very different to Discoverer Viewer. There is now no longer a need to build reports as a standard set of reports are available for users, although a number of users have full licences to allow them to write reports. Users of Fusion reported a more user friendly reporting tool. However, commented that there had been a loss of some functionality which was available in Discoverer Viewer. The work around for the loss of functionality now Page 147
Page 148
6 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 requires manual processes. The main report run is year to date budget v actual. Although not as simple as Discoverer Viewer in terms of the ability to produce a report that shows controllable costs only, it still is considered an effective reporting tool. 4 Procedures are in place and relevant training has been provided to staff Audit Risk 3 High Training sessions were delivered by Evosys. Further training was provided through peer support as required. In addition training was backed up by manuals/guides provided by Evosys, however these have been amended to make them more focussed for Council staff to use. 15. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings Fusion and associated systems are fully operational with post implementation reviews being undertaken 16. Oracle ended support for EBS 12.1, the General Ledger and Accounts Payable system in December 2021. For reasons of PSN and Cyber Essentials Plus compliance, and also broader cyber-security protection of a business critical system the council depends on, it was not practical for finance to use this system beyond the end of June 2022 and therefore Fusion, the replacement had to be in place and fully operating by that date. After an initial delay in the start date, Fusion became operational in June 2022. 17. All functions have been moved over to Oracle Fusion, a supported platform which receives quarterly updates. All interfaces were in place, after being tested when Fusion went live in June 2022. Some issues were found after go live, but these have been resolved. All usual regular processes have been checked, including monthly processes. 18. Whilst the system is functioning well and users continue to adapt to Fusion it has not fully delivered on the expectations the users may have had in terms of delivering efficiencies. A small number of the processes that could previously be undertaken by Oracle EBS 12.1 are no longer supported on Fusion resulting in additional work through manual interventions. 19. Fusion doesn’t allow staff to build the Council’s support service model based on Budgets, this now requires manual intervention with the use of spreadsheets to run the model. It is noted that at present Fusion cannot be adjusted to run the support service model and that the manual interventions are reported to be working well. 20. Fusion has all appropriate accounts payable processes in place and is able to pay all due accounts. However, it was highlighted that there were ongoing issues with recurring payments Page 148
Page 149
7 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 and whereby Oracle EBS 12.1 was able to process these, Fusion requires monthly intervention to complete the process. This functionality is currently being reviewed in order to find appropriate solutions. 21. During the course of the audit we met with users of the system from various sections in Financial Services, including Creditors staff. It was highlighted by staff that there were a number of issues identified due to the fact that Fusion does not work the same way Oracle EBS 12.1. However, all reported satisfactory work around solutions. 22. An end of project report was issued in November 2022, by the Project Leaders to the Project Board. This report highlighted what went well with project, how the project performed against the PID, including the planned budget costs, schedule and any defined tolerances. It also covered any changes which were agreed during the life of the project. In addition there were identified follow-up action points and lessons learned. It was noted that there were a few action points still to be concluded. Feeder systems within the Financial Ledger are operating effectively and in a timely manner 23. All feeder systems within the Financial Ledger are operating effectively, interface feeder system reports are run by the system administration team. Cash and debtors interface reports are produced every day, however, others are generated when staff members process them – for example payroll (around the same timings every month). Reports are checked by the system administration team to ensure that they are successful. Payables is checked by the Creditors Supervisor. 24. Work on Fusion is undertaken as part of the continuous monitoring programme and reliance is placed on this with reports being reviewed as part of this audit. Reporting systems within the Financial Ledger are functioning effectively 25. OTBI (Oracle Transactional Business Intelligence) Self Service is the replacement for Discoverer viewer. OTBI is accessed through the Fusion system. Running reports on OBTI is very different to Discoverer Viewer. There is now no longer a need to build reports due to the fact that there are a standard set of reports are available for users, although a number of users have full licences to allow them to write reports. Users of Fusion reported a more user friendly reporting tool. 26. The main report run is year to date budget v actual. Although not as simple as Discoverer Viewer in terms of the ability to produce a report that shows controllable costs only, it still is considered an effective reporting tool. Reports written using the hierarchies were originally written by EVOSYS and adapted by the Council’s internal IT and present staff do not have the ability to write new ones at this point in time. It may be possible in the future to get a report written which only shows controllable costs however as it stands at the current time this would require IT resource and is not a priority at this time. OTBI reports don’t allow us to report on the hierarchies. With the lack of ability to run a report showing only the controllable costs the reports now require ‘lookups’ and pivot tables. It was reported that whist it does create additional work, this is not a time consuming job. Page 149
Page 150
8 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 Procedures are in place and relevant training has been provided to staff 27. A procurement exercise was undertaken to then find an implementation partner to support the process during the setup, go live and post go live. The contract being awarded to Evosys. Training sessions were delivered by Evosys. Further training was provided through peer support as required. Additionally, training for users was provided by internal staff. 28. Training was backed up by manuals / guides provided by Evosys, however these have been amended to make them more focussed for Council staff to use. Page 150
Page 151
In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM). Page 151
Page 152
10 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 Appendix 1 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues. Page 152
Page 153
Argyll and Bute Council Internal Audit Report April 2024 FINAL High Medium Low VFM Number of Findings 0 7 0 0 Learning and Physical Disability Care Packages Audit Opinion: (Reasonable) Page 153
Page 154
2 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 5 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 7 Appendix 1 – Action Plan ..................................................................................................................... 12 Appendix 2 – Audit Opinion ................................................................................................................. 16 Contact Details Internal Auditor: Moira Weatherstone Telephone: 01546 604146 e-mail: moira.weatherstone@argyll-bute.gov.uk www.argyll-bute.gov.uk Page 154
Page 155
3 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 1. Executive Summary Introduction 1. As part of the 2023/24 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Learning and Physical Disability Care Packages. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. Learning Disability services provide essential person centred support for individuals by helping people with learning disabilities and complex conditions to access and continue education and development, paid employment opportunities, life skills development and meaningful activities, achieve their desired outcomes and become more involved in their communities. They also promote and support independent living skills. 5. Providing effective support for people with learning in ways that address their personal outcomes is a priority for the HSCP. However, with a shrinking population, recruitment and retention of health and social care staff and rurality of Argyll and Bute, this presents many challenges to the delivery of services. Whenever possible, the HSCP support people to live healthily and well within their local communities, with their families and friends. 6. Care Management is a term applied to an approach to intervention whereby a professionally qualified social work officer undertakes assessment, planning, monitoring and reviewing activity. The assessment process for services involves engaging and communicating with individuals to identify their strengths, needs, risks, capacity and aspirations with a view to determining how social work intervention could assist in meeting desired outcomes. Central to the process is the collation, analysis and interpretation of information. This approach has a strong focus on managing risk, the use of specific interventions and /or significant complexity will exist e.g. legal matters. It is only applicable to people who are most vulnerable, have complex or frequently changing needs or who present public protection concerns. 7. There are approximately 377 Adults living with a learning disability and/or autism spectrum diagnosis known to Argyll & Bute Health and Social Care Partnership (HSCP) within Argyll and Bute. Both nationally and locally the number of people with learning disabilities living into older age is increasing, with many presenting with a diverse range of complex and multiple interrelated health conditions. This growing population with complex health needs brings about Page 155
Page 156
4 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 new challenges for health professionals and social care services. The planning and provision of quality health and social care is crucial to improving the health and quality of life of people with learning and physical disabilities across Argyll and Bute. In addition the Council faces challenges, particularly in more rural locations due to the limited number of care providers who are able to provide the required services. 8. A defined amount of money is set aside in the budget for the provision of care services and resources are allocated according to a priority of needs. There are currently 63 Learning Disability/Physical Disability and Mental Health packages in excess of £100k per year and for the financial year ended 31 March 2023 this amounted to approximately £9.190m, just under half of the overall £20.206m spent on care packages in 2022/23. 9. There are currently 50 individuals placed out with Argyll and Bute with care packages totalling approximately £5 million per annum. Compared to a number of other local authorities there is likely to be a higher number of out of area placements due to the lack of service provision across the Council’s remote and rural geographic area. Scope 10. The scope of the audit was to review of the management and governance of learning disability high cost packages as outlined in the Terms of Reference agreed with the Head of Adult Services (Mental Health, Acute and Complex Care) on 30 August 2023. Risks 11. The risks considered throughout the audit were: SRR07: Failure of the HSCP to deliver on its Strategic Priorities results in deteriorating health and wellbeing outcomes for the population and / or reduced access to appropriate health and social care services. This could also result in financial and reputational risk to the Council Audit Risk 1: Failure to meet our statutory requirements Audit Risk 2: Failure to provide an effective assessment and review process Audit Opinion 12. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 13. Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Page 156
Page 157
5 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 Recommendations 14. We have highlighted 7 medium priority recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: Policies and procedures should be reviewed to ensure they are up to date, relevant and reflect the new practices within Eclipse; An induction pack is in the process of being developed and this will include an introduction to policies and procedures. The induction pack should be completed and circulated to all new staff; Staff should be reminded of the importance of keeping case notes and contact notes up to date; Client records should be maintained in a consistent way across the Council, minimising the number of locations where records are maintained. The Business Case for the roll out of the client record keeping project onto CIVICA, with links provided in Eclipse should be implemented; Robust measures should be put in place for the decision making processes for allocating resources for Learning Disability Care packages, including processes for recording those decisions; Systems, processes and commissioning contracts must be put in place to ensure the equity of access to personal care services for Learning Disability Services; A robust system of identifying and recording unmet needs with regards to Learning Disability clients should be put in place. 15. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 16. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Care Assessment policies and procedures are in place SRR07 Audit Risk 1 Audit Risk 2 Reasonable Care Assessment policies and procedures are in place with a number of key documents provided for review, although these may not refer current practice and refer to Carefirst. Assessment and Care Planning Procedures’ (V1) details that the purpose of the policy, procedures and practice guidance is to improve outcomes for service users and carers by providing clear guidance for social work staff about assessment and planning with individuals. This guidance applies to community services service users and is applicable Page 157
Page 158
6 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 across all settings. An induction pack is in the process of being developed and this will include an introduction to policies and procedures. 2 All cases have been assigned a Case Manager and case reviews are being undertaken in accordance with policies and procedures Audit Risk 2 Reasonable High value care packages generally relate to those who require lifelong support either in a residential setting or supported within their communities, therefore there is very little change to their care packages. Both nationally and locally the number of people with learning disabilities living into older age is increasing, with many presenting with a diverse range of complex and multiple interrelated health conditions. Case reviews are undertaken when there is significant changes to the client’s care needs. Children with Learning Disabilities are provided with a full care assessment when they move to Adult Services. We reviewed a 9% sample size of Learning Disability high value care packages. Clients are assigned a case manager, although heavy reliance is placed on the care providers reporting and updating the case manager on a regularly basis. Where case managers were not assigned, this was due to the allocated Social Worker moving on to different positions and the case was assigned to the specific team for Learning Disability. Case notes are maintained on Eclipse, the replacement client database for Carefirst. It was noted that case notes were not always maintained and up to date. A previous audit report highlighted the fact that client records were stored in multiple locations, including on the Council’s network drive. Evidence obtained during the audit suggests that client records are still being maintained on the network drive with historical records stored in orange client files. A pilot project in the Mid Argyll area was undertaken to scan records onto CIVICA, which would have links from Carefirst (now Eclipse). 3 Resources are allocated in SRR07 Audit Risk 1 Reasonable A Resource Allocation framework is in place based on a prioritisation of needs Page 158
Page 159
7 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 accordance with policies and procedures and reviewed on a regular basis process. The prioritisation of all referrals is based primarily on the information received at the time of referral including any relevant background information held on CareFirst/Eclipse and is prioritised according to risk. We were provided with a Terms of Reference for the “Adult Care Allocation Group (ACAG)”. The main objective for the group is to review and approve total cost packages for both existing and new cases over 29 hours per week. However, we were advised that this group has been suspended as it was felt there was no added value to having a single ACAG as the majority of Learning Disability care packages were already over the threshold, and the wider ACAG members had no expertise or input in Learning Disability. In addition, how and where the decisions on resource allocations are taken and recorded has not yet been confirmed. Due to the pressures commissioning, Learning Disability have requested that a small number of packages be placed on the unmet need/waiting list for Care at Home services where they require personal care only. This has not yet been agreed by management and at present there is no overview of the total unmet need and available resources across each of the localities, we have been advised that services are working in silos. 4 Roles and responsibilities have been documented and assigned Audit Risk 2 Substantial Roles and Responsibilities are outlined in the various policies and procedures. The “Assessment and Care Planning procedures” outlines the roles and responsibilities for each of the staff categories. 17. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings Care Assessment policies and procedures are in place Page 159
Page 160
8 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 18. Care Assessment policies and procedures are in place with a number of key documents provided for review, however, these may not refer current practice and make reference to Carefirst (the Council’s client record management system), which has now been replaced by Eclipse. 19. Assessment and Care Planning Procedures’ (V1) details that the purpose of the policy, procedures and practice guidance is to improve outcomes for service users and carers by providing clear guidance for social work staff about assessment and planning with individuals. This guidance applies to community services service users and is applicable across all settings. It states that it should be adopted by all staff. 20. The Assessment and Care Planning Procedures (V1) covers a broad range of information from descriptions of terminology, explanations of care management and what it should achieve, approaches to monitoring and review, team review, service co-ordination. It documents the procedures to be followed from the referral stage in the process. It advises what information should be recorded and how it should be recorded on Carefirst, including how ongoing records are maintained. An additional policy: Recording & Reflective Practice Policy, Procedures & Standards was available to review. The aim of this document is to provide clear and concise information which outlines the approach to recording and reflective practice by the Social Work service. 21. A further policy entitled “Funding High Cost Care at Home Packages Procedural Guidance for Staff and Managers” was available for review. This is Version 2, dated December 2021. It details that the eligibility criteria for service is based on the identified needs of the assessment matched to the prioritisation framework. Action Plan 1 22. Staff have access to relevant policies and procedures, including access to relevant training. All staff have a session with the Carefirst/Eclipse support team to learn to navigate their way through the systems. There are guidance notes available on SharePoint and a generic email address for any requests for support staff may have. The Learning Disability Day Services/ Resource Centres redesign resulted in an action plan being drawn up, this included a training plan being identified. 23. We were advised that over the years, the finance team have provided advice and guidance on the management of budgets for packages, mainly for Team Managers. From a Social Work perspective, training on Self Directed Support has been delivered and this is as and when required. This focuses on outcomes for individuals and how those outcomes are being met. 24. An induction pack is in the process of being developed and this will include an introduction to policies and procedures. There is an expectation that trained staff will know the theories behind assessment, review and legislation, however, the induction process will assist new staff members to understand the systems and processes within the Council. Action Point 2 All cases have been assigned a Case Manager and case reviews are being undertaken in accordance with policies and procedures Page 160
Page 161
9 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 25. High value care packages generally relate to those who require lifelong support either in a residential setting or supported within their communities, therefore there is very little change to their care packages. Both nationally and locally the number of people with learning disabilities living into older age is increasing, with many presenting with a diverse range of complex and multiple interrelated health conditions. Case reviews are undertaken when there is significant changes to the client’s care needs. Children with Learning Disabilities are provided with a full care assessment when they move to Adult Services. 26. We reviewed a 9% sample size of Learning Disability high value care packages, this included cases within residential settings, placed out with the authority and cases looked after within the community in Argyll & Bute. Clients are assigned a case manager, although heavy reliance is placed on the care providers reporting and updating the case manager on a regularly basis. Where case managers were not assigned, this was due to the allocated Social Worker moving on to different positions and the case was assigned to the specific team for Learning Disability rather than a named case manager. Care providers are advised to allow regular contact and updates to be provided. During testing we were advised that some providers will update on a weekly basis, even if this is just to advise that all is well. 27. Regular contact is maintained with care providers and where the placement is out with the authority, 6 monthly reviews are undertaken with the Social Worker travelling to the residential unit to undertake the review. 28. Case notes are maintained on Eclipse, the replacement client database for Carefirst. It was noted that case notes were not always maintained and up to date. However, reassurance was provided that this was due to capacity and that although not updated regarding contact notes, regular contact was maintained with providers. Action Plan 3 29. A previous audit report highlighted the fact that client records were stored in multiple locations, including on the Council’s network drive. Evidence obtained during the audit suggests that client records are still being maintained in multiple locations, including on the network drive with historical records stored in orange client files. A pilot project in the Mid Argyll area was undertaken to scan records onto CIVICA (the Council’s document management system), which in turn would link to CareFirst – now Eclipse. This project was considered to be a success and there is a strong opinion that it should be rolled out to the rest of the Council areas. A proposal has been submitted requesting funding in order to roll this project out, firstly across Social Work Services, then when completed across Health. Action Plan 4 Resources are allocated in accordance with policies and procedures and reviewed on a regular basis 30. A Resource Allocation framework is in place based on a prioritisation of needs process. The prioritisation of all referrals is based primarily on the information received at the time of referral including any relevant background information held on CareFirst/Eclipse and is prioritised according to risk. Page 161
Page 162
10 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 31. We were provided with a Terms of Reference for the “Adult Care Allocation Group (ACAG)”. The main objective for the group is to review and approve total cost packages for both existing and new cases over 29 hours per week and above for any cases falling into one of the following categories: Adult Social Care (includes all Self Directed Support options and residential care for under 65’s) NHS Complex Clinical Care – following approval at the Argyll and Bute NHS Complex Clinical Care Group Complex care We were advised that this group has been suspended as it was felt there was no added value to having a single ACAG as the majority of Learning Disability care packages were already over the threshold, and the wider ACAG members had no expertise or input in Learning Disability. It was felt that all the required expertise to make decisions on high cost care packages for Learning Disability sat with the new CRG, along with the appropriate budget holders. Learning Disability also have an additional Complex Care Group meeting where care packages are requesting an element of funding from Health. In addition, how and where the decisions on resource allocations are taken and recorded has not yet been confirmed. Action Plan 5 32. The large majority of Learning Disability services are commissioned under the Supported Living contract and Older People services are commissioned under Care at Home contract. There are a few anomalies where some providers of Care at Home services are commissioned to provide support outside of their normal client group (majority in rural areas where it’s difficult to commission). We were advised that the question regarding prioritisation of personal care in each locality has been raised several times over the last few months. Due to the pressures on both sides for commissioning, Learning Disability have requested that a small number of packages be placed on the unmet need/waiting list for Care at Home services where they require personal care only. This has not yet been agreed by management. A paper was submitted to management for comment and response in November but there has been no feedback as of yet. Action Plan 6 33. Unmet need for Older People Care at Home is collated by the resources team on a weekly basis, this is then submitted to Performance and Improvement Team, and is reported to Scottish Government. This data is available on the HSCP SharePoint site. The data for Learning Disability is not currently recorded formally and not included in the above, increasing the risk that individuals remain in the community without the required support in place to meet their needs, particularly around personal care needs. At present there is no overview of the total unmet need and available resources across each of the localities, we have been advised that services are working in silos. Action Plan 7 34. The Coming Home Implementation Report, published by the Scottish Government, focusses on improving care for people with complex needs and learning disabilities. As part of the Coming Home Implementation work, the Scottish Government is working to improve monitoring of the Page 162
Page 163
11 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 experiences of people with learning disabilities and complex care needs who are in hospital, who are in out-of-area placements and/or whose current support arrangements are at risk of breaking down. This is to avoid people living in hospitals or in inappropriate out-of-area placements that they and their family have not chosen. Through the Coming Home Implementation Memorandum of Understanding between the Scottish Government and COSLA, it has been agreed that Integration Authorities will use and operate a local Dynamic Support Register. The Dynamic Support Register is designed to improve outcomes. The Register records information about people with learning disabilities and complex care needs who are in hospital, in out-of-area placements or whose current support arrangements are at risk of breaking down. The HSCP reports data quarterly from their Register using a new national reporting process delivered by Public Health Scotland (PHS). Roles and responsibilities have been documented and assigned 35. Roles and Responsibilities are outlined in the various policies and procedures. The “Assessment and Care Planning procedures” outlines the roles and responsibilities for each of the staff categories, including Service Managers/ Area Service Managers/Team Leaders, First Line Managers, Practitioners and Administration staff. Financial processes and budget information is provided in the document with guidance on responsibilities for budgets outlined. Page 163
Page 164
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Medium 1 Policies and Procedures Care Assessment policies and procedures are in place with a number of key documents provided for review. The documents provided refer Carefirst. With the implementation of the new client database recording system – Eclipse these require to reviewed and updated. Policies and procedures may not reflect current practice Policies and procedures to be updated as part of the Eclipse Implementation Program Head of Strategic Planning, Performance and Technology 30 June 2024 Medium 2 Induction Pack Staff have access to relevant policies and procedures, including access to relevant training. All staff should have a session with the Carefirst/eclipse support team to learn to navigate their way through the systems. An induction pack is in the process of being developed and this will include an introduction to policies and procedures. New staff may not be aware of how to access policies and procedures leading to inconsistencies in practice Incorporate Eclipse Training into the HSCPs induction program Facilitate training sessions as part of the Eclipse Implementation Program Head of Strategic Planning, Performance and Technology 30 June 2024 Medium 3 Case Notes Case notes are maintained on Eclipse, the replacement client database for Carefirst. It was noted that case notes were not always maintained and up to date. Records not maintained and up to date Record keeping session(s) to be delivered by professional lead Senior Managers to implement case note audit within their respective services – this should be linked to individual practitioner supervision Senior Managers (Adult Services) 30 June 2024 Page 164
Page 165
13 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 No Finding Risk Agreed Action Responsibility / Due Date Medium 4 Client Records A previous audit report highlighted the fact that client records were stored in multiple locations, including on the Council’s network drive. Evidence obtained during the audit suggests that client records are still being maintained in several locations. A successful pilot project was run in Mid Argyll transferring all records onto CIVICA. A proposal has been submitted to roll this out across all other areas in Argyll. Lack of consistency in the recording of client records which may lead to inaccurate record management or loss of information Ensure that a standardised and compliant electronic recording system is implemented across HSCP services – this should be achieved via the Eclipse Implementation Program Head of Strategic Planning, Performance and Technology 30 June 2024 Medium 5 Resource Allocation Group We were provided with a Terms of Reference for the “Adult Care Allocation Group (ACAG)”. We were advised that this group has been suspended as it was felt there was no added value to having a single ACAG as the majority of Learning Disability care packages were already over the threshold, and the wider ACAG members had no expertise or input in Learning Disability. In addition, how and where the decisions on resource allocations are taken and recorded has not yet been confirmed. Inconsistencies in allocation or resources and a lack of transparency of resource allocation decisions Develop a Terms of Reference for the Acute and Complex Care directorate’s Care Allocation Group that meets fortnightly and is chaired by the Head of Service Head of Adult Services (Complex and Critical Care) 30 June 2024 Medium 6 Allocation of Resources The large majority of Learning Disability services are commissioned under the Supported Living contract and Older People services are commissioned under Care at Home contract. There are a few anomalies where some providers of Care at Home services are commissioned to provide support outside of their normal client group, however it was found that priority was given to older peoples services with Learning Disability clients remaining on a waiting list for personal care services. Inequity of service provision Review the Care at Home contract as a matter of priority to ensure that there is personal care provision across the authority for those under the age of 65 with complex needs, who do not require more intensive care such as that provided via Supported Living. Head of Adult Services (Health & Community Care) Chief Finance Officer 30 June 2024 Page 165
Page 166
14 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 No Finding Risk Agreed Action Responsibility / Due Date Medium 7 Unmet Need Unmet need for Older People Care at Home is collated by the resources team on a weekly basis, this is then submitted to Performance and Improvement Team, and is reported to Scottish Government. The data for Learning Disability is not currently recorded formally and not included in the above. Clients’ needs may not be met Include the data re unmet need for those under 65 in the weekly reporting format already in place for Older People Head of Strategic Planning, Performance and Technology Head of Adult Services (Health & Community Care) 30 June 2024 Page 166
Page 167
15 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM). Page 167
Page 168
16 Argyll and Bute Council – Internal Audit Report – Learning and Physical Disability Care Packages April 2024 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues. Page 168
Page 169
Argyll and Bute Council Internal Audit Report May 2024 FINAL High Medium Low VFM Number of Findings 1 1 4 0 Scottish Social Services Council (SSSC) Registration Audit Opinion: Substantial Page 169
Page 170
2 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 12 Appendix 2 – Audit Opinion ................................................................................................................. 16 Contact Details Internal Auditor: Mhairi Weldon Telephone: 01546 604294 e-mail: mhairi.weldon@argyll-bute.gov.uk www.argyll-bute.gov.uk Page 170
Page 171
3 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 1. Executive Summary Introduction 1. As part of the 2023/24 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Scottish Social Services Council (SSSC) Registration. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. The SSSC are the regulator for the social work and social care workforce in Scotland, they protect the public by registering social care workers, social workers, social work students and children and young people workers in a range of care services including residential and day centres, community facilities and in people’s homes. The SSSC Register was set up under the Regulation of Care (Scotland) Act 2001 to regulate social service workers and to promote their education and training. 5. The SSSC set standards for work practices, conduct, training and education and supports professional development, their regulatory function means that services are provided by a trusted, skilled, confident and valued workforce. Where workers fail to meet the standards of practice and conduct required, the SSSC can investigate and take action. 6. Registration with the SSSC depends on the employee’s role and responsibilities of their post and formal qualifications must be achieved within the timeframe outlined by the SSSC. Employers and employees are legally bound by these requirements and therefore unable to provide registered services with unregistered staff. 7. The Council must meet the following responsibilities as set out within the SSSC Codes of Practice (prior to the new codes published on 1 May 2024): Make sure people are suitable to be social service workers and that they understand their roles and responsibilities Have the culture and systems in place to support social service workers to meet their code of practice Provide learning and development opportunities to enable social service workers to strengthen and develop their skills and knowledge Have written policies and procedures in place to protect people who use services and carers, and to support social services workers Page 171
Page 172
4 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 Publicise and promote the Code of Practice for Social Service Workers to people who use services and carers and cooperate with SSSC in their proceedings 8. As at 01 November 2023, within the Health and Community Care service area of the Health and Social Care Partnership (HSCP) there are 386 employees, 314 of whom require to be SSSC registered. There are a further 270 employees within other service areas of the HSCP and 335 within Education nurseries and schools who also require to be SSSC registered. 9. The policies, procedures and processes to support SSSC requirements are standardised across all Council areas, a sample of care homes was selected to evidence the application of these and any areas of best practice identified or recommendations raised as a result of this review will be communicated across all relevant service areas. Scope 10. The scope of the audit was to assess the arrangements for evidencing SSSC registration, monitoring and renewals within the Council as outlined in the Terms of Reference agreed with the Head of Adults – Health & Community Care on 21 November 2023. Risks 11. The risks considered throughout the audit were: Audit Risk 1: The Council does not meet it responsibilities as set out in section 53 of the Regulation of Care (Scotland) Act 2001 and the SSSC Codes of Practice Audit Risk 2: The Council is unable to provide a full range of services required or provides services with unregistered employees Audit Opinion 12. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 13. Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that internal control, governance and the management of risk is sound, however, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Recommendations 14. We have highlighted one high priority recommendations, one medium priority recommendations and four low priority recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: Version control should be applied to the SSSC Registration Policy and Guidance Documents Corporate HR Policies, procedures and guidance documents should be reviewed to ensure content is up-to-date. Page 172
Page 173
5 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 Service user documentation should be updated to advise that instances of violence, threats or abuse directed towards employees is not acceptable. The Supervision Policy should be reviewed and updated to ensure it incorporates up-to- date needs and requirements of service delivery. The updated Supervision Policy should be circulated to managers with an instruction to comply with the content in a consistent manner. The content of care home handbooks should be updated to ensure complaints contact details are consistently provided. 15. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 16. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Appropriate policies and procedures have been prepared and communicated to guide management and employees in meeting the requirements as set out in the SSSC Codes of Practice. Audit Risks 1 & 2 Substantial Policies, procedures and guidance have been prepared and made available to all employees, however, some of these are overdue for review or lack application of version control. A comprehensive induction process is in place to guide employees in their new role in terms of duties and conduct, however, there was no information to service users regarding conduct towards employees and only one care home advised visitors of expected conduct in their handbook. 2 Processes are in place and being followed to ensure compliance with SSSC Codes of Practice. Audit Risks 1 & 2 Substantial Records of SSSC registration status are maintained both locally and online with the SSSC. Recruitment follows a robust and consistent corporate process with appropriate checks in place. The Supervision policy is dated November 2011, it is applied inconsistently across the care homes reviewed and requirements documented are considered to be resource intensive. Feedback is gathered from service users and employees and used to inform improvements, both on an individual and service level. A Social Work Training Board has been established to oversee training across all Social Work services to identify needs, discuss progress through SVQ Page 173
Page 174
6 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 achievements and CPL requirements and monitor the assigned budget. Support is provided to managers and employees via corporate processes. 3 Reporting arrangements are in place to inform management of risks/issues identified that may require action to be taken. Audit Risks 1 & 2 Substantial Employees SSSC registration status is recorded both locally and on the SSSC database, these are monitored and updated by managers, HR provide a six- monthly SSSC Registration status report for Senior Management oversight. Concerns may be reported both informally and formally to management or via the Council’s “Whistleblowing” policy. Reporting arrangements are in place to notify the Care Inspectorate with staffing reports and referrals to SSSC where an employee is considered unfit to practice. 17. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings Appropriate policies and procedures have been prepared and communicated to guide management and employees in meeting the requirements as set out in the SSSC Codes of Practice. 18. The Council’s Scottish Social Services Council (SSSC) Registration Policy and associated guidance have been prepared to support compliance with SSSC requirements and made available to all Council employees on the Council’s intranet site (The Hub) for those with a corporate email address and on the employee website (My Council Works) available to all. Printed copies are also made available at Council offices and residential locations. 19. The content of both documents is comprehensive, easy to use and outlines the duties of the employer and employee in terms of maintaining registration. These documents, however, are not dated and there is no evidence of any review date having been considered. Action Plan 1 20. There are several additional policies, procedures and guidance that also support compliance with SSSC requirements, most of which apply corporately and are prepared and updated by Human Resources (HR): Dignity at Work Policy (Bullying & Harassment) Equality & Diversity Policy Equality and Socio-Economic Impact Assessment Grievance Procedure Disciplinary Procedures and Code of Practice Managers guide to recruitment & Selection Page 174
Page 175
7 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 Phased Return to Work and Other Reasonable Adjustments: managers guide Employee Code of Conduct Social Work Complaints Procedure These documents are comprehensive and provide specific information regarding SSSC requirements where appropriate, several of these documents, however, do not exhibit evidence of updates or review within either the stated or a reasonable timescale and some embedded links to source further information are no longer active. Action Plan 1 & 2 21. The Council also provides Health, Safety and Wellbeing services and resources as well as an Employee Assistance Programme for any employee to access should a need for specific support be identified. 22. Newly employed or transferring social workers/social care workers undertake an induction programme under the guidance of their new line manager. This is largely a corporate programme supplemented with service and location specific information. The specific roles and requirements of each post are articulated by managers and colleagues as well as being documented in the formal job descriptions and person specifications. 23. As part of the induction process, new employees are informed that bullying, harassment and discrimination is not tolerated and formal action under the Council’s Disciplinary Procedures and Code of Practice will be taken to deal with such behaviour. 24. In addition to the formal policies and procedures noted above, the Council also operates a Public Interest Disclosure (“Whistleblowing”) Policy whereby employees as well as the general public can bring their concerns regarding social workers/social care workers to the attention of management, including impairment of fitness to practice; exploitation, dangerous, discriminatory or abusive behaviour/practice or cause of physical, emotional financial or material harm/loss. 25. Social workers/social care workers are clearly informed that violence, threats or abuse are not acceptable via their terms and conditions of employment, employee codes of conduct and dignity at work policy. The Health and Social Care Standards advise service users and their family, friends and non-Council carers of the principles based quality of care they can expect to be provided. There is no content within these documents to acknowledge that violence directed towards employees from service users or their family, friends or non-Council Carers are not acceptable. The Resident and Family Handbook prepared for Ardfenaig does, however, advise visitors that their conduct should allow employees to undertake their duties free from threat or perceived threat of violence or intimidation. Action Plan 3 26. Policies, procedures and eLearning materials are in place and made available on both the Hub and My Council Works to support wellbeing and equality of social workers/social care workers and respect diversity. Page 175
Page 176
8 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 Processes are in place and being followed to ensure compliance with SSSC Codes of Practice. 27. Line managers maintain a record of registration status relevant to their teams and have access to view the SSSC registration database for Council employees to help keep this up-to-date. The Council’s Human Resources (HR) team also have access to the SSSC registration database and conduct a six-monthly exercise to monitor status and identify any anomalies, this is then passed to Heads of Service for oversight and action as necessary. As at September 2023, there were 76 employees registered, 46 registered with conditions and one application submitted for registration within the Acute and Complex Care Service. 28. Recruitment of social workers/social care workers follows a robust process that is applied corporately using the TalentLink service. This ensures that a standardised approach is followed when filling a post following approval by management. Each post is advertised and short-listed by reviewing the application provided to assess suitability in terms of knowledge, skills, attitude and values, an interview panel of at least two persons is then appointed to select the successful candidate on a competitive basis. Information for managers regarding the recruitment process is available on the Hub to support this process. 29. Criminal conviction checks, membership of the Disclosure Scotland Protection of Vulnerable Groups (PVG) scheme and references are required as part of the recruitment process. A sample of ten employees was selected from the registration lists provided and checked to HR records where all ten were found to comply with the requirements. 30. The Council has a Supervision Policy in place to ensure high standards of professional care are maintained, areas for improvement are identified and employees are supported when undertaking their duties. The Policy provided is dated November 2011 with no evidence of review or update and evidence of compliance with the policy, where provided, was limited and inconsistent with the embedded templates. Discussions with two managers reveal that they are unable to fully comply with the requirements of the Policy and consider these to be unrealistic in terms of current available resources. Action Plan 4 & 5 31. Feedback is gathered from service users at residents or focus group meetings with representatives attending from the different staff groups to gather opinions and thoughts on the care and facilities provided and consider where service improvements can be made. Review meetings are also carried out for individual residents to gather feedback on more personal requirements to help inform revisions to care plans and specific individual needs. 32. Managers support employees to various extents depending on their specific training, continuous professional learning (CPL) needs and current operational demands. The various needs and opportunities for training are discussed collectively at staff meetings and individually at supervision meetings or during career conversations, observational monitoring also takes place to identify any additional areas for improvement or further training. SVQ assessors visit learners where possible or conduct interviews online using Teams. 33. Employees from other professions such as nursing or teaching are considered to be equally supported to meet the requirements as set out within their codes of practice. 34. There is a robust induction process in place for new employees with guidance provided both verbally and via access to formal documentation covering a range of both corporate and service Page 176
Page 177
9 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 specific information. There are four stages to the induction process, each with specific goals to be met within the first few days, first week, six weeks and six months. 35. Training opportunities are available to permanent employees wishing to progress through formal SVQs and are tailored to their individual needs identified at recruitment or via supervision meetings and career conversations. 36. The Social Work Training Board has been established to oversee training across all Social Work and Social Care services. This Board identifies needs, discusses SVQ attainment progress and monitors the assigned budget to ensure service delivery is aligned with strategic priorities and staff are appropriately developed to meet their registration conditions and CPL requirements. Training opportunities focus on permanent employees, casual employees cannot be retained after five years without receipt of training to meet registration conditions resulting in loss of experienced employees. Discussions have taken place regarding provision of support to casual employees to obtain qualifications, however, with limited budget, permanent employees must be prioritised. 37. Managers and colleagues support employees who feel unable or unprepared to carry out their work wherever possible to ensure an acceptable standard of service is provided, this will vary from person to person. A corporate Performance Improvement Procedure has been prepared and made available to all on the Hub should a more formal approach be required. Protected conversations and allocation of a mentor to provide closer support may also be provided and where support of a more personal nature is required the employee and eligible family members have access to the Employee Assistance Programme (EAP) for independent and confidential support and information. 38. Reflective practice identifies development and improvement opportunities and takes place daily at hand-over between teams and at scheduled team meetings, supervision sessions and career conversations. 39. Employees who have experienced violence or trauma in the work place are provided with peer support and opportunities to talk about issues identified. Stress risk assessments are also used and an accompanying action plan prepared to manage future work. Where the experience has led to a period of employee absence, the corporate Phased Return to Work Procedure may be used and occupational health referrals made. The EAP may also be accessed to provide support in these circumstances. 40. Where an employee’s fitness to practice is considered to be impaired, they are provided with clear communications and documentation to ensure processes are followed through and wellbeing support is provided. In some instances the employee may be redeployed or suspended pending investigation and subsequent findings. 41. The care and safety of service users is prioritised while employees are receiving additional support and adhere to the Adult Support and Protection (Scotland) Act 2007 and the new Health and Care (Staffing) (Scotland) Act 2019 to ensure that “suitable qualified and competent individuals are working in such numbers as are appropriate for the health, wellbeing and safety of people using the service”. A staffing level calculation tool is used to ensure there are sufficient suitably qualified and competent employees present to provide services. 42. Copies of the SSSC Code of Practice are provided to employees as part of their induction process, made available within their service location and freely available on the SSSC website. All Social Page 177
Page 178
10 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 Workers/Social Care Workers are required to read and comply with the content in addition to the content of the Registration Policy and guidance. 43. The SSSC Codes of Practice are available online and at care homes for service users and visitors to view. They are also advised that employees are appropriately qualified (or working towards a qualification), skilled and competent to carry out their duties and made aware that there is a complaints procedure in place to report any concerns. Two of the three handbooks provided contained details of how to communicate any concerns. Action Point 6 44. The Council’s Employee relations team provide support to lead managers via the corporate disciplinary process when concerns are raised about an employee’s fitness to practice. As part of this support, lead managers are provided with a suite of documents including templates and a worked example to ensure the process is conducted in a fair and consistent manner, they are also provided with guidance on when to refer the employee to the SSSC or other relevant professional body. Documentation reviewed indicated that the process had been followed accordingly. Managers are also able to contact the relevant professional body directly for specific advice prior to any referrals being made. 45. The Chief Social Worker is the first point of contact within the HSCP where the SSSC, other relevant professional body or authority require assistance when investigating an employee’s fitness to work, this could be in the form of documentation, attendance at hearings or responses to enquiries. Employees are enabled and supported to assist in these instances e.g. attend hearings or provide witness statements. Reporting arrangements are in place to inform management of risks/issues identified that may require action to be taken. 46. Management information regarding employee’s registration status is maintained locally via spreadsheets and online access to the SSSC registers. This information enables managers to ensure records reflect current employee status, monitor progress in meeting any conditions set and take action where registrations have or are about to expire. The Council’s HR service also undertake a six-monthly exercise to assess registration status and renewal position and flag individuals appearing on the list who no longer work for the Council. 47. Where allegations of harm or abuse are received, the Council’s formal disciplinary process is followed by management with support from the HR service and this includes appropriate investigation and reporting. 48. Employees may approach managers at any time to report and discuss concerns they may have regarding inadequate resources, difficulties in delivering care or inappropriate/unsafe working practices, they are also aware of the overarching management structure should they feel issues need to be escalated. The Council’s “Whistleblowing” policy provides an additional avenue for concerns to be reported. 49. Weekly notifications are submitted to the Care Inspectorate on staffing issues including absences and vacancies that may have an impact on service delivery. Any concerns are raised with senior management as they arise and are carefully monitored and managed via resident’s dependency analysis. Page 178
Page 179
11 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 50. Managers are aware of their responsibility to make referrals regarding employees who are unfit to practice to the appropriate authorities and are fully supported by the Council’s HR Service to do so when the need arises. Page 179
Page 180
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Low 1 SSSC Registration Policy and Corporate HR Policies and Guidance Documents Finding: The SSSC Registration Policy and guidance document are not dated and there is no evidence of review date having been considered. Finding: Several of the corporate policy and guidance documents reviewed contained no evidence of update or review in a reasonable timescale. Recommendation: Management should apply version control and review schedules to the SSSC Registration and wider Corporate HR Policy and Guidance documents. Management and employees may use superseded versions containing outdated information, legislation, regulations or standards. SSSC Registration Policy and Guidance are currently under review to reflect revised SSSC Codes of Practice 1 May 2024, version control will be applied during this review. An exercise will be undertaken to apply review dates to corporate HR policy and guidance documents and these reviews will be scheduled to take place. HR Officer HR Manager - Operations 30 September 2024 Low 2 Corporate HR Policy and Guidance Documents Finding: Embedded links within policy and guidance documents were no longer active in some instances. Recommendation: Links provided within documentation should be reviewed and updated as necessary to ensure they are returning expected information for employees. Links fail to provide further information to assist employees. Links provided in policy and guidance documents will be reviewed and updated where found to be no longer working. HR Manager - Operations 30 September 2024 Low 3 Service-user information Finding: Service-users and their family, friends and non- Council carers are advised that violence, threats or abuse towards them from Council employees will not be tolerated, however, only one handbook provided advised visitors on expected conduct regarding violence, threats or abuse towards employees. There was no documentation containing information regarding conduct of service users towards employees. Lack of awareness that violence, harm or abuse directed at Council employees from service-users or their family, friends or non-Council carers is not acceptable. Review all social work and social care service user documentation in adult services. Senior Manager – Resources/ Professional Lead – Social Work 31 August 2024 Page 180
Page 181
13 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 No Finding Risk Agreed Action Responsibility / Due Date Recommendation: Service-user documentation should be revised to advise that instances of violence, threats or abuse directed towards employees is not acceptable. Medium 4 Supervision Policy Finding: The Supervision Policy is dated November 2011 with no evidence of review or update, additionally, the requirements in terms of frequency and duration of supervision meetings are considered by mangers to be unrealistic in terms of current available resources. Recommendation: The Supervision Policy be reviewed and updated to ensure it incorporates up-to-date needs and requirements of service delivery. Supervision Policy does not reflect current SSSC or Council requirements. Develop a social work and social care supervision policy. Professional Lead – Social Work 31 August 2024 High 5 Compliance with Supervision Policy Finding: evidence of compliance with the supervision policy was limited and embedded templates were not being consistently used. Recommendation: Following review of the Supervision Policy, Managers should be reminded of the need to schedule supervision meetings with employees in advance and retain records in an appropriate and consistent format. Failure to comply with the Council’s Supervision Policy. Appropriate documentation will be provided following development of social work and social care supervision policy. Professional Lead – Social Work 31 August 2024 Low 6 Care Home Handbook Finding: Details of how to communicate concerns/complaints were provided in two out of three handbooks provided. Service users and visitors are unable to escalate unresolved concerns to the appropriate bodies. Review all care home complaints/concerns processes. Lead Nurse (Care Homes) 31 July 2024 Page 181
Page 182
14 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 No Finding Risk Agreed Action Responsibility / Due Date Recommendation: Review and update content of care home handbooks to ensure complaints contact details are consistently provided. Page 182
Page 183
15 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM). Page 183
Page 184
16 Argyll and Bute Council – Internal Audit Report – SSSC Registration, May 2024 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues. Page 184
Page 185
Argyll and Bute Council Internal Audit Report April 2024 FINAL High Medium Low VFM Number of Findings 0 0 4 0 Freedom of Information Audit Opinion: High Page 185
Page 186
2 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 Contents Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 1. Objectives and Summary Assessment ........................................................................................... 5 2. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 11 Appendix 2 – Audit Opinion ................................................................................................................. 13 Contact Details Internal Auditor: Annemarie McLean Telephone: 01700 501354 e-mail: annemarie.mclean@argyll-bute.gov.uk www.argyll-bute.gov.uk Page 186
Page 187
3 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 Executive Summary Introduction 1. As part of the 2023/24 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Freedom of Information. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. There are three main pieces of legislation that provide rights of access, subject to certain exceptions or exemptions, to most of the information held by Scottish Public Authorities. These are: The Freedom of Information (Scotland) Act 2002 (FOISA), the main Act; The Environmental Information (Scotland) Regulations 2004 (EIRs); And The Data Protection Act 2018 (DPA), which updated data protection law in the UK, to complement the European Union's General Data Protection Regulation (GDPR). 5. The Freedom of Information (Scotland) Act 2002 (FOISA) came into force on the 1st of January 2005 and gives everyone a legal right to request information held by a Scottish Public Authority. The Act is regulated by the Scottish Information Commissioner and aims to increase openness and accountability across the public sector. Any information recorded by the Council on paper, electronically, and other methods, which cannot otherwise be withheld under the exemptions contained in the legislation, can be requested and obtained. 6. The Act requires Scottish public authorities to produce and maintain a publication scheme which tells the public, the classes of information that the authority makes routinely available, how to access the information and what it might cost. All Scottish authorities have adopted the Model Publication Scheme produced by the Scottish Information Commissioner. 7. The purpose of the publication scheme document is to make it easier for people to find information directly, without having to request it from the authority, setting out classes of information. Argyll and Bute Council (the Council) has listed on its website, all the information it currently publishes within each class and encourages The classes are shown below; About Argyll and Bute Council How we deliver our functions and services How we take decisions and what we have decided Page 187
Page 188
4 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 What we spend and how we spend it How we manage our human, physical and information resources How we procure goods and services from external providers How we are performing Our commercial publications 8. The Council encourages anyone looking for information from the Council, to check the publication scheme first, as it may be available people to access directly. Information that is not available from the publication scheme can be requested via a FOI online request form, with the Act requiring responses to be issued within 20 working days of receipt of the request. 9. The Environmental Information (Scotland) Regulations 2004 (EIRs) sit alongside the FOI Act, and govern access to environmental information held by Scottish public authorities. The EIRs require every Scottish public authority to publish environmental information, and make it available on request. 10. The Data Protection Act 2018 (DPA), incorporating GDPR, provides a right of access to any an individual’s personal information, via Subject Access Request (SAR) and must be responded to under data protection law, which is overseen and enforced by the UK Information Commissioner's Office (ICO). Scope 11. The scope of the audit was to review of the processes and procedures for the collection and response to FOI requests and assess the response times across the Council, as outlined in the Terms of Reference agreed with the Governance, Risk and Safety Manager on 17 July 2023. Risks 12. The risks considered throughout the audit were: Audit Risk 1: Failure to comply with the FOI legislation Audit Risk 2: Requested information is not provided within the statutory timescales Audit Opinion 13. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 14. Our overall audit opinion for this audit is that we can take a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Recommendations 15. We have highlighted four low priority actions where we believe there is scope to strengthen the control and governance environment. These are summarised below: Page 188
Page 189
5 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 The FOI/EIR procedure note requires to be updated to reflect current working practices Key contact details for staff involved in the collection and response to information requests are not up to date. A review of the Council’s Publication scheme should be undertaken, including checking that any links to information are still working. To highlight the number of marginally late responses, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. 1. Objectives and Summary Assessment 16. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 The Council has processes and procedures in place for the collection and response to FOI requests Audit Risk 1 High The Council has an overarching procedure note for the collection and response to Information requests, this is published on the Council’s Intranet but is not up to date and does not reflect current working practices. Mandatory training for all staff is available on the LEON system, which also records and monitors completion. Additional training is provided to designated Service FOI representatives, who are responsible for ensuring that actions and correspondence in relation to the request are logged on the tracking database. There is a Teams Channel where FOI Service reps can access training and other materials. Key contact details, on the Hub, for staff involved in the collection and response to Information requests are not up to date. A review of the Council’s Publication scheme should be undertaken, including checking that any links to information are still working. 2 The Council has arrangements in place to monitor its FOI performance. Audit Risk 2 High The Compliance and Regulatory team provide monthly updates to the Chief Executive, the Chief Officer, Directors, Heads of Service and the departmental FOI reps. Quarterly reports are provided to all DMTs and on an annual basis to the Audit and Scrutiny Committee. The information in the reports is clear and relevant. The recent addition of a second Page 189
Page 190
6 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 tab provides Senior Managers with a detailed breakdown of the late responses and the reasons for such which further highlight specific areas for improvement. To highlight the number of marginally late responses, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. 17. Further details of our conclusions against each control objective can be found in Section 3 of this report. 2. Detailed Findings The Council has processes and procedures in place for the collection and response to FOI requests 18. The Council has processes and procedures in place for the collection and response to Freedom of Information (FOI) requests. The access to information page on the Council’s Intranet site, the Hub, publishes the FOI and Environmental Information (EIR) requests procedure note, along with a list of the contact details for the Service FOI representatives. 19. The Compliance and Regulatory team within Legal and Regulatory Support Services are the Council’s experts on the legislation, that provide advice on the rights of access, subject to certain exceptions or exemptions, to most of the information held by the Council. They are responsible for overseeing compliance by the Council Services/Departments with regard to their statutory responsibilities in relation to information requests, providing training and support as required, and reporting upon performance. 20. The FOI/EIR procedure is the overarching guide for all Council staff. It sets out the procedure for dealing with and answering Information requests while emphasising the Council’s duties which include: proactively publish as much information as possible, respond to requests in within the statutory timescale of 20 working days for FOI requests and up to 40 days for more complex EIR requests to provide an adequate audit trail follow best practice guidelines 21. The document clearly defines the roles and responsibilities of staff by providing step by step instructions to be used by staff during collection and response for information, and the timescales for these, including: how staff should respond to these, checking if the information can be supplied using the Council’s Publication Scheme checking to see if the information has already been requested as part of another FOI request the documents/forms to use when collating information Page 190
Page 191
7 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 22. While the FOI/EIR procedure is comprehensive and takes cognisance of the legislation, testing of requests highlighted that it does not reflect all current working practices. The Compliance and Regulatory team are currently exploring options to see how the use of technology can streamline the collection and response to Information requests. A review of all procedure notes will be undertaken during this process. Action Plan 1 23. To ensure that staff comply with current policies and legislation and that knowledge is up to date, the Council has mandatory Freedom of Information module available on the LEON system. Monitoring of this mandatory training is automated now with LEON sending emails to staff with a link to the course two months before the training is due to expire. Reminders are sent to staff and their manager until the training has been completed. We regard this as an area of good practice. 24. Specific training is provided to the designated Service FOI representatives, by the Compliance and Regulatory Officer. Support is also offered during Reps meetings. In order to ensure business continuity, services identify staff to provide cover for holidays/ absence. Whenever new representatives are identified a training session is set up and invites are issued to all Service FOI representatives. There is a dedicated Teams Channel where the Reps can access training and other relevant materials as and when they need. 25. The Compliance and Regulatory Officer maintains a list of the current Service FOI Reps, a review of which found that it does not match those listed on the Councils Intranet Hub site. Additionally, at the time of the review there were ongoing staff changes within the Compliance and Regulatory team. The result is that key contact details on the Hub, for staff involved in the collection and response to information requests, are not up to date. It is expected that the staff recruitment process will be completed very soon, at which point the contact details on the Hub will be updated. Action Plan 2 26. The majority of FOI requests are in an electronic form, either email or web form, both these formats arrive via the FOI inbox. Where the request meets the legislative requirements, these are logged on the central database system, AXLR8, by staff within the Compliance and Regulatory Team. Requests are mostly distributed to the Services with the exception of more complex requests, for example where a response requires information from multiple services, it will be collated and monitored by staff within the Compliance and Regulatory team. 27. Services have ultimate responsibility for collating the requested information and responding to the requests. The designated Service FOI Reps administer this process, liaising with the staff tasked with gathering the information, monitoring the time taken, updating the case log where applicable, checking and issuing the response to the request to ensure it answers the questions and closing the log. 28. The Council uses the AXLR8 system when collecting and responding to requests for information to ensure that it can evidence that it is meeting its legislative requirements. The system is used to log requests, allocate these to the relevant services, monitor the timeframes, record when exemptions/exceptions have been used and record the response issued. Page 191
Page 192
8 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 29. There are built in email templates for responding to requestors to acknowledge the request and eleven response templates to choose from to cover various legislative options for response, examples include: Section 25 – Otherwise Accessible –where requested information is already published. Section 27 – Intended for future publication – where the information is held but there has been a decision to publish this prior to the request being received e.g. this could be a timing issue, where a procurement tender process is being undertaken the results and details of which will be published after the contract has been awarded. Section 38 – Personal Information – Disclosure would contravene data protection. 30. The decision on whether to apply an exemption/exception is taken by the Service when issuing a response with the specific exemption/exception applied recorded on the system and the appropriate standard template response used. It is the responsibility of Services to ensure any required quality assurance checks are carried out, the Compliance & Regulatory team are available should they have any queries or require further advice. 31. A sample of 31 requests were selected for testing, the conclusion is that the Council has robust procedures in place for the collection and response to requests for information. As noted above the procedure note needs to be updated to reflect current working practices and any recommendations as a result of this review. 32. As outlined in the background information above, legislation requires that all Scottish public authorities must adopt and maintain a "publication scheme", publish information in accordance with it and review the scheme from time to time. The Council’s publication scheme is easily accessible on its website but has not been updated since May 2021. The Council launched an updated website in 2023. A review of the Council’s Publication scheme should be undertaken, to ensure Services are publishing as much information as possible, this should include checking that any links to information are still valid and working as intended. Action Plan 3 33. The legalisation provides Councils with the choice of whether to publish and maintain a Disclosure Log. This is a list of the information that has been released in response to FOI/EIR requests. The Council has currently chosen not to have a Disclosure List, as the resources required to redact and publish responses and maintain the log would not be offset by a reduction in requests. The Council can evidence this by the volume of responses issued with the “otherwise accessible” exemption. The Council has arrangements in place to monitor its FOI performance 34. The Council has arrangements in place to monitor performance relating to the collection and response to information requests, at various stages during the process of gathering the requested information, prior to the response being issued and after to report upon uses of exemptions/exceptions and compliance with the statutory timescales and to further raise awareness where this has not been possible. 35. Performance relating to how Council collects and responds to requests for information has a high profile. Using information from the AXLR8 system, the Compliance and Regulatory team provide monthly updates to the Chief Executive, the Chief Officer, Directors, Heads of Service Page 192
Page 193
9 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 and the Service FOI Reps. These performance reports provide details of the number of responses, the responses submitted on time and those which were late, for each service/ department. 36. Quarterly reports, with this same information, are provided to all Departmental Management Team (DMT) meetings and the FOI annual report is presented to the Audit and Scrutiny Committee at its September meeting. Externally, quarterly statistical reports are submitted to the Office of Scottish Information Commissioner (OSIC) returns. 37. The statutory requirements are that FOI requests should be responded to within 20 days and up to 40 days for more complex EIR requests. Internally the Compliance and Regulatory team promote the aim to respond within 10 days where possible. As an aide, triggers have been built into the AXLR8 system to generate email reminders to the Service FOI reps which will reach the allocated inbox on the morning of day 10 and day 15. These should then be forwarded to those staff tasked with gathering the required information. Testing could not establish whether this happens consistently. 38. Overall, the Council has a very good within timescale response rate, which has increased slightly from 93% in 2021/22 to 94% in 2022/23 with many service areas achieving a very high level of performance, between 97-100%. The quality of the responses also appears to be high, with only 31 requests for reviews were received from a total of 1495 requests, which is less than 2%. 39. An analysis of responses was undertaken using the 2022/23 data with a summary by service, of the late responses broken down into 1 Day, 2 Day & 3 Days plus. The table below highlights the number of marginally late (1 or 2 days) responses: Dept / Service Total rec’d RESPONSES Days Late and percentage of total late responses In time % in time Late % Late 1 day late % 2 days late % 3 days + % Chief Exec Financial 98 97 99% 1 1% 0 0% 0 0% 1 100% Community P&D 1 0 0% 1 100% 0 0% 0 0% 1 100% Customer Services Education 254 251 99% 3 1% 2 67% 1 33% 0 0% L & RS 400 388 97% 13 3% 2 15% 1 8% 10 77% Commercial 44 44 100% 0 0% 0 0% 0 0% 0 0% D & I D & EG 246 204 83% 42 17% 4 10% 6 14% 32 76% R & IS 206 184 89% 22 11% 10 45% 5 23% 7 32% Customer Services 106 104 98% 2 2% 1 50% 0 0% 1 50% HSPC IJB 0 0 0% 0 0% 0 0% 0 0% 0 0% Adult Care 78 76 97% 2 3% 1 50% 0 0% 1 50% C & F / CJ 42 40 95% 2 5% 1 50% 0 0% 1 50% Live Argyll Live Argyll 20 16 80% 4 20% 1 25% 0 0% 3 75% TOTALS 1495 1404 94% 92 6% 22 24% 13 14% 57 62% Page 193
Page 194
10 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 40. If the number of 1 day and 2 day late responses were answered on time, this would have significant impact upon the Councils response time, which using the data above would rise by 1% for each day: PROJECTION Total rec’d RESPONSES In time % in time Late % Late If 1 day late was responded to on time 1495 1426 95% 70 5% If 2 day late was responded to on time 1495 1439 96% 57 4% 41. To raise awareness and to try and reduce the number of marginally late responses the Compliance and Regulatory team have taken the undernoted steps: Updating training notes for Service FOI reps advising that Third Tier Managers be copied into the 10 day reminder and Head of Service copied into day 15 reminder emails when these are issued by Service FOI representatives to those gathering the information. Introduced a second tab on the monthly and quarterly performance reports. This provides Senior Managers with a breakdown of the late responses and the reasons for such which highlights specific areas for improvement. This also brings the report format in line with the FOI Annual Report provided to Audit & Scrutiny Committee. 42. To highlight marginal late responses at Senior Manager level, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. Action Plan 4 43. The Council are required to submit statistical quarterly returns to OSIC, providing details which include reporting on the number and category of exemption and exception used. The Compliance and Regulatory Team submit these on behalf of the three bodies required by OSIC. These are: Argyll and Bute Council – which includes all of the information relating to the Council, the HSPC and LiveArgyll. The Integrated Joint Board (IJB) The Argyll and Bute Licensing Board. 44. Our review found these are submitted on time and with no issues arising which require to be brought to management’s attention. Page 194
Page 195
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Low 1 FOI/EIR Procedure Note The FOI/EIR Procedure Note is the overarching procedure note for the collection and response to information requests, is not up to date and does not reflect current working practices. The Compliance and Regulatory team are currently exploring options to see how the use of technology can streamline the collection and response to Information requests. A review of the procedure notes will be undertaken during this process. Potential for confusion as procedure note does not reflect current working practice Review and Update procedure, publish on HUB and provide copy to Audit Compliance & Regulatory Officer 31 March 2025 Low 2 Contact Details Key contact details, on the Hub, for staff involved in the collection and response to Information requests are not up to date. This is a known issue due to ongoing recruitment. Once this process is complete the contact details will be reviewed and the Hub updated. Potential for delays if information and departmental contact details are not be up to date. Update Hub and provide link to audit Compliance & Regulatory Officer 30 June 2024 Low 3 Publication Scheme The Council’s Publication scheme not updated since May 2021, and the Council’s website was updated in 2023. A review of the Council’s Publication scheme should be undertaken, including checking that any links to information are still working. The Publication Scheme is not be up to date and may contain outdated links to information. This may contribute to a rise in requests for information and staff time dealing with these. Review and Update Publication Scheme, publish on Website and provide link to Audit Compliance & Regulatory Officer 31 March 2025 Low 4 Performance Reports To highlight the number of marginally late responses, consideration should be given to including a more detailed summary in reports to DMT/other relevant meetings. Potential that marginally late responses by services reduce the Councils overall response rate. Copy of 2024/25 FQ1 covering report to be provided to Audit Compliance & Regulatory Officer 30 Sept 2024 Page 195
Page 196
12 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM). Page 196
Page 197
13 Argyll and Bute Council – Internal Audit Report – Freedom Of Information April 2024 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues. Page 197
Page 198
This page is intentionally left blank
Page 199
Argyll and Bute Council Internal Audit Report May 2024 FINAL High Medium Low VFM Number of Findings 0 4 1 0 Cloud Computing Services Audit Opinion: Substantial Page 199
Page 200
2 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Key Dates ................................................................................................................................................ 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 5 Recommendations ................................................................................................................................. 5 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 7 Appendix 1 – Action Plan ..................................................................................................................... 11 Appendix 2 – Audit Opinion ................................................................................................................. 14 Contact Details Internal Auditors: Mhairi Weldon and Annemarie McLean Telephones: 01546 604294 and 01700 501354 e-mails: mhairi.weldon@argyll-bute.gov.uk and annemarie.mclean@argyll-bute.gov.uk Website: www.argyll-bute.gov.uk Page 200
Page 201
3 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 1. Executive Summary Introduction 1. As part of the 2023/24 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Cloud Computer Services. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. Cloud services are described by the National Cyber Security Centre (NCSC) as “an on-demand, massively scalable service, hosted on shared infrastructure, accessible via the internet”. These services are therefore located outside the Council’s network environment and typically provide data storage, processing and pre-defined user functionality. The NCSC advises that public sector organisations select a provider using their cloud security principles. 5. The NCSC states that cloud usage has steadily grown in recent years and is now the preferred option when organisations purchase new IT services in alignment with the UK and Scottish Government’s Cloud First Policies. 6. The Council’s ICT and Digital Strategy aligns to the Digital Strategy for Scotland and promotes improvement and sustainability through digital innovation to deliver efficiencies, savings and improved services for council staff and customers. In particular, the strategy aims to provide systems and applications available to all employees, wherever they work, operating the latest software versions that are fully supported by suppliers. Where applicable, IT solutions will continue to be provided in the cloud where it is economically viable to reduce long term cost and improve on-premises solutions. 7. The 2022 Society for Innovation, Technology and Modernisation (SOCITM) Benchmarking report indicated that the Council is one of the most cost effective and highest performing Local Authority ICT services out of 31 participating across the UK, it is also indicated that the Council use cloud computing more than most other Councils. 8. The adoption of cloud services aims to generate efficiencies, improve operations and reduce the overall cost of ownership for the Council. The main benefits of migrating to the Cloud include: Reduced operational and maintenance costs Rapid deployment Scalability to address demand fluctuations Page 201
Page 202
4 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 Security capabilities to protect data and infrastructure Resilience in system availability 9. The Council requires access to the Public Services Network (PSN) on an ongoing basis which requires security assessments to have been conducted against Cloud Security guidance from the National Cyber Security Centre (NCSC), including protective monitoring, identity and authentication, separation between consumers and secure consumer management. 10. Back-up data is a copy of primary data made at a point in time that can be used to reinstate primary data should it be lost as a result of hardware or software failure, data corruption, malicious attack or human error. This data must be retained in a secure, secondary location to maintain its integrity and validity for use should it be required. As part of their service provision, cloud service providers create back-up copies of customer’s data, they may also/alternatively implement continuous replication to provide a more up-to-date copy of data. 11. The overall responsibility for service provision and data security remains with the Council rather than with the Cloud service provider. Scope 12. The scope of the audit was to review systems and processes in place to support security and data integrity of cloud-based computer services as outlined in the Terms of Reference agreed with the Head of Customer and Support Services on 2 May 2024. Key Dates 13. The Terms of Reference provided provisional timescales for the review to take place, the actual dates are noted below. Exhibit 1 – Key Dates Stage Actual Date Terms of Reference agreed 2 May 2024 Fieldwork Commencement 11 April 2024 Draft Report issued 27 May 2024 Management Comments received 30 May 2024 Final Report issued 30 May 2024 Audit and Scrutiny Committee 13 June 2024 Risks 14. The risks considered throughout the audit were: SRR11: Service Delivery – Cyber Security KF ORR35: Cyber security breach and associated cyber attack CSRR12: Security information and event management (SIEM) CSRR18: Password Security CSRR19: Account Management CSRR31 & 39: Backups CSRR33: Critical Infrastructure Security CSRR38: Multi-factor Authentication (MFA) Page 202
Page 203
5 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 CSRR42: Cloud Security Audit Risk 1: Failure to comply with Public Services Network (PSN) and Cyber Essentials Plus certification requirements Audit Risk 2: The Council has limited control over access to systems and data Audit Risk 3: Information stored in Cloud services is not appropriately segregated from that of other organisations resulting in data protection and commercial failings Audit Opinion 15. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that internal control, governance and the management of risk is sound, however, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Recommendations 16. We have highlighted 4 medium priority recommendations and one low priority recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: Review content of ICT Contract Application and cloud services asset register to ensure all systems are included with links to all associated documentation. ICT officers investigate why access to one system was achieved using a personal device and seek resolution to prevent recurrence. Appropriate authorisation should be sought for all new system users. Periodic review of users takes place to remove leaver access in a timely manner. ICT services prepare, update or finalise disaster recovery documentation and implement testing. 17. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 18. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Page 203
Page 204
6 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Contract/SLAs are in place and include security and related performance monitoring arrangements. SRR11 KF ORR35 CSRR12, 31, 33, 39 & 42 Audit Risk 1, 2 & 3 Substantial ICT and procurement teams assist services implement new systems following robust due diligence processes. Documentation requested for review was retained, however, this proved challenging to gather at the outset of the audit. The list of cloud based systems provided did not fully align with the contracts held on the ICT application. Arrangements for business continuity, data recovery, change management and performance targets were found to be present and appropriate oversight takes place. 2 Access to systems and data is properly authorised and held securely. SRR11 KF ORR35 CSRR18, 19, 38 & 42 Audit Risk 2 & 3 Substantial Each system reviewed was multi-factor authentication (MFA) compatible, however, this was not utilised in two of the systems. New users were not always appropriately authorised and leavers are not being promptly notified for one system. Training in the use of each system has been provided and/or appropriate guidance made available. Service providers have implemented measures to protect the Council’s data in transit and at rest within the Cloud systems and prevent unauthorised access from their employees and other customer organisations. 3 Business continuity/disaster recovery arrangements are in place to ensure back-ups of data have been created, are securely stored and are accessible and usable should they be required. SRR11 KF ORR35 CSRR12, 31, 39 Audit Risk 2 Reasonable Cloud service providers have arrangements in place to backup and/or replicate Council data to ensure its ongoing availability. A comprehensive overarching Cyber- incident response plan has been prepared, however, system specific disaster recovery plans and/or run books require to be prepared, updated and/or finalised and tested for specific cloud systems. 19. Further details of our conclusions against each control objective can be found in Section 3 of this report. Page 204
Page 205
7 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 3. Detailed Findings Contract/SLAs are in place and include security and related performance monitoring arrangements 20. New or improved technology services are implemented following identification of a business need and completion of an options appraisal to identify the solution best suited to the needs and demands of the Council. ICT Client Liaison Officers often assist throughout the processes involved including, contributing to composition of the business case, providing a project management role, representation on the Project Board and providing technical expertise. The successful system is selected based on a number of elements including functionality, performance and best value and may be either on premise or in the cloud, although there has been a significant move towards cloud services in recent years. 21. A significant amount of due diligence takes place in the forming of contract to ensure the Council’s specific requirements are met, this includes: Preparation of a business case with justification, rationale and approval for the procurement project. (business objectives, scope, options appraisal, costs and budget, risks timeline etc.) Tender specifications requirements and response for inclusion within the final contract (covers technical and security functionality, outcomes or both) Tender evaluation and scoring ICT Security Assessment Financial Checks to ensure integrity of supplier organisation Formation of a project board and sponsor for management, oversight purposes and to decide the most appropriate option. (This is primarily service led) Data Protection Impact Assessment 22. A sample of four cloud services was selected for review from a list of current providers, for the purpose of this report we will refer to these systems as A, B, C and D to protect the Council from potential harm following identification of areas for improvement. 23. The Council’s ICT services maintain an ICT contract application containing detailed documentation in respect of systems and services procured, however, this application did not contain documentation pertaining to all of the systems identified in the list of current cloud service providers. 24. Contract documentation and supporting information was requested to evidence contract arrangements were in place for the four systems selected for review in order to manage information security and data integrity in line with the agreed scope of the audit. Documents were found to have been retained safely and were provided by ICT officers, however, coordination of a number of officers was required to identify and collate information for audit purposes. Action Plan 1 25. The documentation and publicly available terms and conditions reviewed stated that there were measures in place to ensure ongoing service availability and security of data stored within each of the provider’s data centres. The security responsibilities of each party to the contracts were also outlined. Page 205
Page 206
8 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 26. Arrangements for business continuity and data recovery were in place for each of the systems and included solutions such as replication of data at additional data sites, frequency of data back-up routines and for system C, provision of periodic copies of back-ups to customers for additional resilience. Recovery time objectives were present for systems A, C and D and system B stated recovery in a timely manner. 27. Arrangements are also in place to make provisions for modifications to cloud systems to ensure they reflect any changes in the business environment (e.g. legal/regulatory updates) and ensure ongoing functionality and availability. 28. Performance targets are represented in a Service Level Agreement (SLA). Council services (system users) undertake the role of performance monitoring with support provided by ICT Client Liaison Officers if required, where issues are identified, the Council’s procurement team may step in to assist with resolutions and details are reported to Department Management Teams and Information Technology Management Team for escalation and oversight purposes. Access to systems and data is properly authorised and held securely 29. Access to cloud services is managed by multi-factor authentication (MFA) for systems B and C, it appears to be available for systems A and D but has not been switched on. Access to system A was found to be achievable by use of a personal device during the course of audit testing. Although not selected for testing, we have been made aware of a further system that can also be accessed by personal device, we understand that this is a supplier issue and affects all users, not just Argyll and Bute Council. Action Plan 2 30. User access to data held on the cloud service is managed by systems administrators. A sample of ten users was selected from systems A, B and C to assess if authorisation was appropriately provided, system D is managed by a small team of users within ICT itself. All ten users were appropriately authorised in systems A and C, however, three users from system B had submitted the new user form themselves without authorisation being evident from their line managers, checks undertaken by the Council service’s systems administration team are limited to ensuring that the request has been sent from a valid domain email address (Council or partner organisation). Action Plan 3 31. Systems A, B and C were also reviewed to assess if timely notification of leavers is received to ensure prompt removal of access to data. System C was provided with weekly updates from the Council’s HR service to remove users from the Council’s overarching network infrastructure that provides system access and system A undertook a quarterly review of all users to identify and remove leavers. System B relies on the Council service’s systems administration team receiving notifications from line managers that users are no longer required to have access, testing found that eight recent leavers had not had their access removed. Whilst there is some comfort in the fact that this system is also dependent on network access, it does not prevent unauthorised access when an employee transfers to another service area of the council or partner organisation, additionally, there is currently no leaver notification received from HR and there has been no user review since implementation of the system in June 2023. Page 206
Page 207
9 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 Action Plan 4 32. Training in the use of the cloud services was provided to key individuals prior to implementation and cascaded to other authorised users. Documented guidance and training modules are also available to support users via the systems administrators, the Council’s intranet or LEON training platform. 33. Cloud service providers are required to provide assurance that their employees and other organisations who use the services provided (tenants) are unable to access the Council’s data. Documentation reviewed indicated that strong security measures are in place in each of the four systems reviewed to segregate Council data from that of other organisations to prevent unauthorised access. Where the provider’s employees are legitimately required to access data for maintenance or resolution of issues identified, specific permission is sought and approved by the Council to do so, additionally, immutable audit trails are maintained of any changes that do take place. 34. Documentation also indicated that standard encryption technologies and options to protect data while in transit or at rest are in place. Data held within each of the systems is held in accordance with the Data Protection Act with the Council acting as data controller and the cloud service provider the data processor. Business continuity/disaster recovery arrangements are in place to ensure back-ups of data have been created, are securely stored and are accessible and usable should they be required 35. Provisions have been made within materials reviewed to ensure data is backed-up or replicated at secure sites to ensure availability in the event of a disaster or cyber incident. 36. A cloud based solution is not currently utilised for the Council’s on premise systems, however, other robust means of providing resilience are employed. 37. The Council has prepared a generic Cyber Incident Response Plan that aligns to the Scottish Public Sector Cyber Incident Central Notification and Co-ordination Policy. This is a comprehensive document including details of what constitutes an incident, how it should be managed and the roles and responsibilities of parties required to contribute should the need arise. 38. The Council operates many systems, including both on premise and cloud based. In the event of a cyber-incident, it would not be possible to restore all systems simultaneously, therefore a process has taken place to categorise all systems into four tiers with each being completely restored in numerical order prior to moving on to the next. A further prioritisation exercise has taken place to ensure that the most critical systems are addressed earliest within each tier. 39. ICT services have developed a disaster recovery planning storage area with an array of comprehensive plans and run books to aid recovery of data in the event of a disaster or cyber- incident. Whilst it is deemed that the cloud service providers have adequate disaster recovery arrangements in place, there is a further need to include regular review of the provider’s plans and activities in addition to being assured that disaster recovery is appropriate. 40. Cloud service providers have disaster recovery plans in place, however, the Council also has responsibilities to ensure these plans adequately address our needs and the services can be accessed in the event of a disaster situation. A disaster recovery plan has been drafted for Page 207
Page 208
10 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 system A and a run book has been prepared for system C, however, it is considered that this run book requires to be updated to reflect additional information specific for cloud restore. A disaster recovery plan is being prepared for system B and there was no evidence of documentation for system D. Action Point 5 41. Each of the systems websites were reviewed to establish if independent assurance could be provided in terms of security and performance and all were found to have several third party accreditations in place. Page 208
Page 209
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Low 1 Contract Application and Cloud Services Asset Register Finding: The ICT Contract Application did not contain all systems contained on a list provided by ICT Project & Liaison Manager. Recommendation: Review content of ICT Contract Application and cloud services asset register to ensure all systems are included with links to all associated documentation. ICT may be unable to track and manage systems and their risks, ensure licence compliance and plan upgrades/replacements. The ICT Contract Register will be reviewed and will include a Cloud Asset Register to ensure all systems are included with links to all associated documentation. ICT and Digital Manager 31 August 2024 Medium 2 Multi-factor Authentication Finding: access to one system was found to be achievable using a personal device during the course of audit testing. An additional system not included within the sample selected for review is also known to allow access from a personal device. Recommendation: ICT officers investigate why a personal device was able to access the system and implement suitable means to restrict such access. Council data may be accessed inappropriately, including by recent leavers of the Council. ICT Engineers will work with the supplier of System A to ensure only council managed devices can access the system. ICT Engineers will investigate whether the supplier of the national system referred to in the report (which is used by almost all public sector organisation in Scotland with built in access from personal devices), can switch off access to the Council’s instance from non-council devices. ICT and Digital Manager 31 August 2024 Medium 3 User Authorisation Finding: for one system reviewed, user access was not appropriately authorised by line management in all instances. Recommendation: service systems administration implement a procedure insisting that appropriate authorisation to access sensitive data is obtained for all new users. Unauthorised access to sensitive data The System B team will send reminders to all users, emphasising that Line Managers must approve all requests for system access. Additionally, they will conduct quarterly reviews of a random sample of (5) request forms to ensure quality assurance. Systems Support Officer 30 May 2024 Completed Page 209
Page 210
12 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 No Finding Risk Agreed Action Responsibility / Due Date Medium 4 User Revocation Finding: for one system reviewed, we found that systems administrators are not always promptly informed when users leave or no longer require access. Termination of network access provides some comfort where leavers are concerned, however, this does not prevent users gaining continued access when transferring to another service area. Recommendation: periodic review of user status takes place by service systems administration to ensure access to sensitive data is restricted to those with current and legitimate service needs. Unauthorised access to sensitive data The System B Team will promptly implement a monthly procedure to identify and deactivate accounts that have not been used within the month. Systems Support Officer 30 June 2024 Medium 5 Disaster Recovery Plans and Run books Finding: Disaster recovery plans/run books are not in place for all systems reviewed and therefore not tested to cover any potential disaster affecting the Council’s ability to access these systems. Recommendation: ICT services prepare, update or finalise disaster recovery documentation and implement testing. Disaster Recovery Plans/Run Books are not available or up to date to provide the necessary information in the event of a cyber-incident. ICT will prepare, update and finalise disaster recovery documentation and implement testing for those recently introduced cloud systems not already documented. ICT and Digital Manager 31 October 2024 Page 210
Page 211
13 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM). Page 211
Page 212
14 Argyll and Bute Council – Internal Audit Report – Cloud Computing Services, May 2024 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues. Page 212
Page 213
Document is Restricted Page 213 Agenda Item 12bNOT FOR PUBLICATION by virtue of paragraph(s) 6 of Schedule 7A of the Local Government(Scotland) Act 1973
Page 214
This page is intentionally left blank