Final Audit Plan ABC 24-25
Argyll and Bute Council · 14 March 2024
Back to Audit and Scrutiny Committee — 14 March 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL COMHAIRLE EARRA-GHÀIDHEAL AGUS BHÒID INTERNAL AUDIT PLAN 2024-25
Page 2
2 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Contents Purpose of Internal Audit ................................................................................................................................................................................................................ 1 Public Sector Internal Audit Standards (PSIAS) Requirements ...................................................................................................................................................... 1 Risk Assessment .............................................................................................................................................................................................................................. 2 Strategic Risks .................................................................................................................................................................................................................................. 4 Resourcing the Plan ......................................................................................................................................................................................................................... 4 Confirmation of Independence ....................................................................................................................................................................................................... 5 2024/25 Internal Audit Plan ............................................................................................................................................................................................................ 5 Monitoring the Plan ........................................................................................................................................................................................................................ 5 Quality Assurance and Improvement Programme ........................................................................................................................................................................ 6 Conclusions ...................................................................................................................................................................................................................................... 6 Appendix 1 – 2024/25 Internal Audit Plan ..................................................................................................................................................................................... 7 Appendix 2 – 2024/25Internal Audit Plan by Council Directorate / Head of Service ................................................................................................................. 10 Appendix 3 – Strategic Risk Register (Abridged) .......................................................................................................................................................................... 11 Contact Details Chief Internal Auditor: Paul Macaskill Telephone: 01546 604108 e-mail: paul.macaskill@argyll-bute.co.uk www.argyll-bute.gov.uk
Page 3
1 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Definition of Internal Audit 1. Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. Source: Section 4: Definition of Internal Auditing: Public Sector Internal Audit Standards Purpose of Internal Audit 2. The main objective of internal audit is to provide a high quality, independent audit service to Argyll and Bute Council (the Council) which provides annual assurances in relation to internal controls and overall governance arrangements. In addition to this primary assurance role, internal audit will also: • support the S95 Officer and the Audit & Scrutiny Committee (the Committee) in the discharge of their duties • support the Council’s Monitoring Officer • support the Council’s anti-fraud and corruption arrangements • provide guidance on control implications for new or changed systems where appropriate • support the Council and the Strategic Management Team during key transformational/ change projects. Public Sector Internal Audit Standards (PSIAS) Requirements 3. PSIAS sets out the requirement for the: • Chief Internal Auditor (CIA) to prepare a risk-based audit plan which takes into account the Council’s strategic objectives, associated risks and the views of senior management and the Committee • CIA to review and adjust the plan as necessary in response to changes in the Council’s business, risks, operations and priorities • audit plan to incorporate or be linked to a strategic or high-level statement of how internal audit will be delivered and developed in accordance with the Internal Audit Charter and how it links to the organisational objectives and priorities.
Page 4
2 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Risk Assessment 4. Internal audit’s approach to annual audit planning is risk-based with all areas which may be subject to audit review contained within an audit universe which is subject to formal review, at least annually. This provides a layered approach to obtaining a sufficient profile of the organisation covering Core Assurance, Audit Needs Assessment and Audit Universe. The audit universe includes all significant activities and systems that contribute to the achievement of the Council’s priorities and objectives. This is displayed in the diagrams on page 3 of this report. 5. The audit universe is risk assessed each year to help determine the annual audit plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Note however, that the audit universe, whilst a key factor, is not the only consideration when determining the audit plan. Senior management have been consulted on priority areas for review, and cognisance is taken of the plans of external audit and other statutory agencies, in order to avoid duplication, and increase potential for cross reliance. 6. The audit universe risk assessment is based upon a matrix taking account of scores for each potential audit area in respect of: • materiality (based on expenditure) • sensitivity (Control Environment, Management Concerns, Political Sensitivity, Regulatory Compliance, System Complexity and Extent of Changes – these help to provide a wide understanding of the risks and implications to the organisation in all of its functions) • time elapsed since it was last subject to review • overall audit assessment when it was last subject to review. 7. We employ a risk-based priority audit planning tool to identify those areas where audit resources can be most usefully targeted. This involves scoring a range of systems, services and functions across the whole Authority, known as the “Audit Universe” using a number of factors/criteria. The final score, or risk factor for each area, together with a priority ranking, then determines an initial schedule of priorities for audit attention. Furthermore, our reliance and successful operation is founded upon the need for strong Information Technology arrangements which support key systems across the Council, therefore, it is appropriate that sufficient audit coverage is scheduled in this area based on risk and discussions with management. There has been increased risk across business of cyber-attacks and the substantial implications this could have for those who have been affected by such attacks. We continue to closely monitor this risk and also the any lessons that may arise from the recent cyber-attack at Comhairle nan Eilean Siar (Western Isles Council).
Page 5
3 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan 8. The matrix gives an overall “score” for each area that is used to prioritise audit reviews. The audit plan for the year has been created by: Risks •Consideration of risks identified in the Authority's strategic and operation risk registers Audit Universe •Review and update of the audit universe Senior Management •Discussions and liaison with Directors and Senior Officers regarding the risks which threaten the achievement of corporate or service objectives, inclding changes and/or the introduction of new systems, operations, programmes, and corporate initiatives Previous Reviews •Taking into account results of previous internal audit reviews Internal Audit Insights •Taking into account Internal Audit's knowledge and experience of the risks facing the Authority, including factors and systems that are key to successful achievement of the Council's delivery plans Collaboration •Requirements to provide a "collaborative audit" approach with external auditors
Page 6
4 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Strategic Risks 9. The Strategic Risk Register records the Council’s own assessment of the most potentially damaging risks and their likelihood of occurrence. This document is used to inform the annual audit plan with identified reviews cross referenced to the strategic risk register. An abridged version of the strategic risk register is included in appendix 3 for reference. In addition, Operational Risk Registers are reviewed to identify high risk areas and which we take cognisance of in assessing and scoring the Audit Universe in terms of wider corporate risk which helps to provide a more comprehensive overview of the organisation. Resourcing the Plan 10. Internal audit has a core establishment of five members of staff, we are currently operating with four full time equivalent officers, one contracted and one casual member of staff, three of which are professionally qualified. Available audit days have been calculated as 758 days (including management and administration time), following the deduction of annual leave, training, a small provision for sickness, 50 days to deliver scrutiny work and 50 days to deliver the HSCP internal audit function. This 758 days total includes the CIA’s input to audit reviews and the running of the internal audit team and a contingency in the event of unplanned work. 11. Given the range and complexity of areas to be reviewed it is important that suitably qualified, experienced and trained individuals are appointed to internal audit positions. The CIA, in compliance with PSIAS holds two appropriate professional qualifications (CIPFA and Institute of Internal Audit). Also within the internal audit section we have one contracted CIPFA qualified team member, one casual member of staff who is CIMA qualified, one AAT and Certified Internal Auditor who is studying for the Chartered Internal Auditor qualification, and one training for CIPFA. Two members of staff within the Internal Audit section are undertaking professional training and one further within the Counter Fraud Team – It is anticipated that such training programs will result in formal qualifications which will address the interim staffing position. 12. Internal audit officers identify training needs as part of their annual appraisal process and are encouraged to undertake appropriate training, including in-house courses and external seminars as relevant to support their development. 13. Through an assessment of the mix of knowledge, skills and experience of the audit team, it is considered that the available resources are the minimum to achieve the work outlined in the plan.
Page 7
5 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Confirmation of Independence 14. PSIAS requires internal audit to communicate, on a timely basis, all facts and matters that may have a bearing on our independence. We can confirm that the staff members identified to complete the reviews in the 2024/25 annual audit plan are independent and objectivity is not compromised. 2024/25 Internal Audit Plan 15. Appendix 1 presents the internal audit plan for 2024/25. As our internal audit approach is informed by risks, where appropriate, the plan is cross- referenced to the strategic risk register contained at appendix 3. Appendix 3 also demonstrates the strategic risks that were subject to audit focus in 2023/24 and those we are projecting to cover in the periods 2024/25 and 2025/26. This provides assurance to the Committee that key strategic risks are subject to audit coverage over a three year cycle. Note that the projected timescales in appendix 3 are provisional as these may change to reflect changes in the Council’s risk environment. 16. Appendix 2 presents the 2024/25 internal audit plan in a different format to provide assurance to the Committee that it provides appropriate coverage across all the Council’s directorates and head of service’s areas of service delivery. Monitoring the Plan 17. Internal audit reports on performance to the Committee on a quarterly basis including full copies of audit reports issued, progress implementing audit recommendations, performance against agreed performance indicators and a summary of all internal audit activity in the previous quarter. Paul Macaskill Chief Internal Auditor Moira Weatherstone Auditor Mhairi Weldon Trainee Auditor Annemarie McLean Trainee Auditor Leanne Rennie Audit Assistant
Page 8
6 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Quality Assurance and Improvement Programme 18. The PSIAS require each internal audit service to maintain an ongoing quality assurance and improvement programme (QAIP) based on an annual self- assessment against the Standards, supplemented at least every five years by a full independent external assessment. 19. The Scottish Local Government Chief Internal Auditors’ Group (SLACIAG) has developed a framework for external assessments to be undertaken by member authorities of SLACIAG on a broadly reciprocal arrangement utilising a peer review option. The Council’s internal audit team has participated in this framework and an external validation of its own self-assessment took place during 2022/23 which concluded that we demonstrated full compliance with PSIAS in all 14 areas of the assessment. The next scheduled external assessment is due to be undertaken in 2028. The internal audit service continues to identify ways of improvement in order that it contributes effectively to the governance of the Council and provides appropriate levels of assurance to those charged with governance, specifically, the Audit and Scrutiny Committee. 20. The internal audit team review their QAIP on a quarterly basis and report it to the Committee as part of the standard agenda item ‘Internal Audit Summary of Activities.’ The programme details all improvement activity being progressed by the team. Conclusions 21. The pressures, demands and expectations on Local Authorities in Scotland have increased year on year on the backdrop of challenging financial settlements in which to deliver key services to those across Scotland including Argyll and Bute. This Internal Audit Plan seeks to assist the Council’s Executive Leadership Team (ELT) and senior managers, together with those charged with governance, specifically, the Council’s Audit and Scrutiny Committee that assurance in our systems, approach and outcomes meet the needs of the communities we serve whilst achieving ‘Best Value’ in the use of our finite resources. 22. The resourcing of this plan is based on the existing staff levels and contractual input in order that a balance of qualified and experienced staff can be allocated to audit work which matches their skills base and experience. In addition, such resourcing is considered as the minimum essential in which to deliver this plan across the Council during 2024/25. We would also like to express our gratitude to the Council’s senior managers who have assisted us in the production of this plan.
Page 9
7 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Appendix 1 – 2024/25 Internal Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Cross Cutting Continuous Monitoring Programme Budgeting 15 Cyclical review of key controls over an 18 month programme of audit testing. Council Tax and NDR 20 Creditors 20 Debtors 15 General Ledger 15 Payroll 25 Treasury management 15 VAT 15 Follow–up 45 Compliance Douglas Hendry Education Community Education 20 Review the effectiveness and equity of service provision across Argyll and Bute. SRR01 Education School Funds and Management of Funds 15 Review the process of compliance and conformance to School Circular 1.10 in relation to the management and control of School Funds. In addition, identification of any training gaps that may require to be addressed. Legal and Regulatory Support Trading Standards 20 Review and assess the duties relating to age restrictions on tobacco and vapes (NVP), together with how such restrictions are monitored and enforced by the Council. SRR07 Commercial Services Leasing - Estates 15 Review and assess the arrangements for the compliance with IFRS16 within Estates Management. Commercial Services Asbestos Management 20 Review and assess the arrangements for the management of asbestos across Council establishments. Kirsty Flanagan Roads and Infrastructure Services - Jim Smith Roads and Flood Prevention 20 Review responses to planning applications from both a roads and flood prevention perspective. Consider timeliness of responses and the overall coordination of the Council’s input to the planning application process.
Page 10
8 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Roads and Infrastructure Services Bridges asset management plan and inspection regime 25 Review of data held in the bridges asset management system together with a review of the cyclic bridge inspection process. SRR02 Roads and Infrastructure Services New Roads and Street Works Coordination 20 Review of the coordination and management of road works carried out by third party utilities and directly by the Council. Development and Economic Growth Oban Airport 15 Annual review to provide assurance re compliance with operational manual and assess compliance with the aerodrome operating manual. Development and Economic Growth Short Term Lets 25 To review and assess the processes and controls in place for short term lets and determine whether these support the efficiency and effectiveness of the service. SRR01 Customer Support Services Data Security & Information Security 30 Assess the arrangements for the deployment of the data platform, paying particular attention to access permissions, controls and security. SRR11 Customer Support Services IT Risk Register and Mitigation Processes 20 Review and assess the ICT Service Risk Registers, together with any mitigations in place for day to day operational matters, including Cyber Security. SRR11 Financial Services NDR - to include reliefs and appeals 25 To review and assess the application and administration of NDR relief types. In addition, to include consideration of the current appeals process and whether it is sufficient in terms of the legislation. Financial Services IR35 Off Payroll Working and Compliance 15 To review and assess if the IR35 rules are being applied correctly and consistently, including appropriate and regular checks are in place. Fiona Davies H&SCP Systems Eclipse System – Post Implementation Review 25 To assess the post implementation of the Eclipse system and determine whether the system is performing as expected, access controls are operating and that appropriate training has been provided to staff. H&SCP External Placements External Placements 25 To determine if clear measures and goals of external placements including the actual interventions offered meets the expected long term outcomes and represents Best Value. SRR07
Page 11
9 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Kevin Anderson LiveArgyll Disclosure Checks – Protecting Vulnerable Groups 35 Assess the systems in place for the processing of staff Disclosure Checks for those working with vulnerable individuals. This review will cover all those staff employed by LiveArgyll in such roles. Verification Activity LGBF Accuracy 10 Accuracy of submission. SPT Annual Claim Accuracy 2 Accuracy of submission. Education Maintenance Allowance Accuracy 5 Accuracy of submission. Stores Stock count 5 Assess stock count procedures. Summary & Reconciliation of Days Directorate Contact Number of Days 2024/2025 Cross Cutting – Continuous Monitoring 185 Douglas Hendry 90 Kirsty Flanagan 155 Fiona Davies 50 LiveArgyll 35 Verification Activity 22 Contingency 81 Total Core Audit - Argyll and Bute Council 658 Scrutiny Work and HSCP Audits 100 Total Audit Resource 758
Page 12
10 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Appendix 2 – 2024/25Internal Audit Plan by Council Directorate / Head of Service Douglas Hendry Kirsty Flanagan Fiona Davies Education Legal & Regulatory Support Commercial Services Financial Services Customer Support Roads & Infrastructure Development & Economic Growth Health & Social Care Partnership Community Education School Funds & Management of School Funds Education Maintenance Allowance Trading Standards Estates Management Leasing Asbestos Management Non Domestic Rates Off Payroll Working (IR35) Data Security & Information Security IT Risk Register & Mitigations Roads & Flood Prevention Responses Bridges Asset Management & Inspections New Roads & Street Works Coordination Short Term Lets Oban Airport External Placement Eclipse – Post Implementation Review Live Argyll Protecting Vulnerable Groups – Disclosure Checks 2024-25 Other Activity NFI – Counter Fraud Team Follow Up Local Government Benchmarking Framework
Page 13
11 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan Appendix 3 – Strategic Risk Register (Abridged) No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 1 Population, External Infrastructure and Economic Decline Failure to identify relevant factors contributing to the decline and failure to develop strategies and actions targeting these factors. 20 1. Local outcome improvement plan targets population, infrastructure and economic recovery. 2. Maximise external funding opportunities. 3. Economic Strategy and Recovery Strategy approved. 4. Rural Growth Deal reaching full deal status in 2023/24. 5. UK Shared Prosperity Funding Investment Plan agreed covering 2022/23 to 2024/25. 6. AB Place to B/Promote and Market Argyll and Bute. 7. Taking a place based approach to regeneration including maximising social- eco benefits/community wellbeing via effective procurement strategy, development of the circular economy and partnership working across sectors. 8. Invest in Argyll and Bute Web site established. 16 Treat 1. Lobbying activity in pursuit of regional immigration policies and related strategies. 2. Rural Growth Deal Outline Business Cases and Final Business Cases being worked on and signing of Full Deal Agreement is expected in 2023/24. 3. Levelling Up Bids to be considered for phase 3 once guidance and deadlines are announced by UK Government. Meanwhile consideration to be given to feedback from Government on our phase 2 bids. 4. UK Shared Prosperity Funding Investment Plan is being actioned as per plan. 5. Preparation of a pipeline of projects across Argyll and Bute in order to be able to react to any other bid funding as and when it is announced. 6. Settlement Officer in post focussed on barriers to population growth. 7. Multi-agency approach to 2019/20 (Scrutiny) 2023/24
Page 14
12 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage refugee settlement underway linking with national processes and agendas. 8. The council will continue as a partner of the Highlands and Islands Regional Economic Partnership and lobby for Government investment to realise economic opportunity and address barriers to future sustainable growth. 9. The council working with HIE will deliver a new Economic Strategy for Argyll and Bute together with a SMART Action Plan aligned with CPP and Government economic priorities.
Page 15
13 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 2 Condition and suitability of Infrastructure & Asset Base Infrastructure and asset base does not meet current and future requirements and is not being used or managed efficiently and effectively. 16 1. Asset management board. 2. Robust capital planning and monitoring. 3. Asset management work plan. 4. Business case modelling including sustainability, development and strategic change. 5. Intelligence and best practice sharing via Heads of Property Group. 6. Community Empowerment and Community Asset Transfer – Arrangements in place to evaluate and determine requests. 7. Roads Asset Management Plan. 8. Status and Options Report. 9. RIS control hub and joint operations team now aligned with central team co-ordinating programmes of work based on prioritisation methodology which is delivered by area based teams to ensure a consistency of approach, VfM etc. 10. One Council Property Approach. 11. Continuing to be successful with bidding for external funding including STTS (£10m over the last ten years), the current bridge replacement programme which has secured over £5m and flood prevention works which have secured over £10m etc. 12 Treat 1. Development of finalised capital strategy in 2023. 2. 'Modern Workspace Programme' will review, engage and rationalise property portfolio for future needs of the Council. Changes will take place on phased and town by town basis. Programme will be running for 3 years - April 2024 3. New board created in July 2023 to take forward depot rationalisation 2020/21 2021/22 2022/23 2023/24
Page 16
14 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 3 Financial Sustainability Insufficient resource to meet current and future service requirement. Budget not aligned / does not support business outcomes 16 1. Longer term financial planning and financial strategy. 2. Income generation activity. 3. Robust budget preparation and budget monitoring protocols. 4. Maintaining adequate contingency with reserves. 5. Digital transformation. 6. Effective workforce planning model. 7. Business Outcomes. 8. Financial Services resilience building project including knowledge sharing and development of guidance notes. 12 Treat 1. Rural Growth Deal Outline Business Cases and Final Business Cases being worked on and signing of Full Deal Agreement is not likely until end of 2023 - Government have limited capacity and the business cases have been taking longer than anticipated to complete due to resource issues and the amount of development work required on a number of the projects. 2. Investment in professional training through Grow Our Own Activity. 3. Budget approach for 2023-24 looked at the longer term rather than 1 year focus. This has identified a number of areas for consideration which will be explored over the coming months for the budget setting process beyond 2023-24. 4. Consider the implications and opportunities from the Visitor Levy (Scotland) Bill which could generate additional income from 2026/27. 5. Respond to the Scottish Government's consultation on 2019/20 (Scrutiny) 2020/21 2022/23 2023/24 Ongoing via Continuous Monitoring
Page 17
15 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage Council Tax for second and empty homes and non-domestic rates threshold as this may have opportunities for additional income in future years. 4 Governance and Leadership Governance and leadership arrangements are not conducive to effective working and lead to a lack of strategic direction. 16 1. Administration in place with working majority 2. Members Seminar programmes 3. Mentoring and Coaching Support for policy leads and Senior Management 4. Priorities agreed by Council 5.Corporate Plan sets out objectives 6. Performance Improvement Framework and Service Planning. 7. Leadership development programme. 8. Council constitution regularly reviewed and updated. 9. Established partnership governance arrangements 10. Scrutiny arrangements in respect of Police, Fire and Health. 11. Governance arrangements for scrutiny established 8 Treat 1. Monitor delivery of BV action plan (ongoing date) 2020/21 (Scrutiny)
Page 18
16 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 5 Engagement and Understanding the needs of the Community The Council fails to understand service user needs and emerging demographic trends and does not align service delivery to meet these 12 1. Community Planning partnership 2. Community Engagement Strategy 3.Customer Service Board 4. Operation and development of panels and forums. Young people’s plan, citizens panel 5. Budget Consultation 6.Comprehensive Complaints Protocols 7.Demographic and end user analysis 9 Treat 1. A working group has been established to review our approach to Community Engagement and to develop a Framework. The group has developed a terms of reference and is in the process of carrying out a self-assessment to identify strengths and areas for improvement. Early indications are that we have areas of excellent practice, but a lack of consistency across services. A series of draft outcomes have been identified and an action plan is under development. A collaborative space for sharing engagement activity is being developed. Updates will be reported via Highlight Reports to the Change Programme and to SMT. 2022/23 6 Service Delivery Insufficient resources to ensure effective service delivery 9 1. Performance Improvement Framework 2.Service Improvement plans 3.Argyll and Bute Manager programme 4. Customer needs analysis Protocols 5.Demographic and end user analysis 6.Workforce Planning 7.Internal and External Scrutiny Arrangements 8.Complaints process 6 Treat 1. Monitor progress of performance mgt project and implement recommendations - implementation in 2023/24. 2. Budget approach for 2023-24 looked at the longer term rather than 1 year focus. This has identified a number of areas for consideration which will be 2021/22 2023/24
Page 19
17 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage explored over the coming months for the budget setting process beyond 2023-24. 3. Carry out 3 service self- assessment pilots which should identify opportunities for service delivery in the future. 7 Health and Social Care Partnership Failure of the HSCP to deliver on its Strategic Priorities results in deteriorating health and wellbeing outcomes for the population and / or reduced access to appropriate health and social care services. This could also result in financial and reputational risk to the Council. 20 1. HSCP integration scheme approved by Scottish government. 2. Strategic Plan in place. 3. Performance and Financial reporting arrangements in place. 4. Independent audit arrangements in place. 5. Integrated Joint board with elected member representation including Council Leader. 6. Chief Officer member of ABC Senior Management Team with co-location of officers. 7. Tripartite leadership agreement. 8. Monitoring and improvement of HSCP financial position. 9. Medium term Financial Plan in place. 10. Establishment of Strategic and Tactical Groups with links to HSCP, NHS and national/regional resilience groups. 12 Treat 1. Develop options to deliver sustainability of future years budgets (ongoing). 2. Develop a longer term Financial plan and implement the value for money strategy. 3. Assessment of the financial implications on the Council of services transferring to the NCS when plans are sufficiently developed to enable this. 4. Progression of Service Transformation work, Estates Strategy and long term strategic service development with Hub North. 5. Implementation of the workforce strategy. 6. Remobilisation of services post Covid and improved performance management and reporting processes. 2019/20 2020/21 2022/23 2023/24 Assurance also taken from IJB internal audit function
Page 20
18 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 8 Civil Contingency & Business continuity Arrangements are not effective. 8 1. Emergency Planning Test events 2. Critical Activity Recovery Plans 3. Roll out of Community resilience partnership programme 4. Peer review of major exercises undertaken to provide external validation of planning process 5. West of Scotland local resilience partnership 6.Cross sector expertise and partnership working 7. Emergency Management Support Team (EMST) meetings 8. Training 9. EU Withdrawal Tactical Working Group with arrangements for reporting to the West of Scotland Resilience Partnership 6 Treat 1. The Council’s critical activity recovery plans (Carps) are reviewed annually. The project for the review of Business Continuity processes within the Council is underway and will include a review of the Council’s critical activities and the potential for a software solution which would automate processes and provide a more efficient an effective service and ensure greater resilience for the Council. When the project is completed in 23/24 it will include a programme of testing of the updated Carps. Date 31 March 2024. 2021/22 9 Welfare Reform Implementation of welfare reform is not managed well resulting in increased poverty and deprivation or short term crisis 12 1. Financial Inclusion and Advice Group established 2. Joint working with DWP, CPP and other agencies 3. Child Poverty Planning Group set up and active 4. Flexible Food Fund created. Supporting householders in our area with funds and advice to address food and fuel insecurities 6 Tolerate 1. Extended Flexible Food Fund Contract for a further two years to March 2025. 2. Deliver sustainable school clothing bank across the Argyll and Bute area by March 2025, with support from the UK Shared Prosperity Fund. 3. Continue to support High and Medium priority spends in SWF with funds from Benefits earmarkings if required at March 2024. 2019/20 2023/24
Page 21
19 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 10 Waste Management Unable to dispose of waste in landfill sites due to the implications of the biodegradable municipal waste (BMW) landfill ban in 2025 20 1. Helensburgh and Lomond waste solution available via third party off-takers, higher rates have been accepted by the council and the contract is in place until the end of 2023 with the opportunity to extend 1+1 years. It is likely over the course of 2023 an alternative procurement process will be explored with a view to putting in place a BMW compliant solution at the earliest opportunity. 2. At the EDI committee in December agreement was reached to seek a derogation to continue operating the PPP contract until September 2026. This will be alongside BMW compliant solutions for island settings and Helensburgh and Lomond (i.e all areas out with the PPP contract). Post Sept 2026 it is envisaged that BMW complaint solutions will be in place for all council areas. With there being uncertainty around the derogation request officers are also progressing in tandem a possible contract variation which would change the MBT plants within the PPP contract to become waste transfer stations to facilitate material to be shipped to a suitable off-taker. NOTE: there was a detailed business case appended to the cover report to the Dec EDI committee which sets out the options and the rationale which arrived at those options. 16 Treat 1. Confirmation received that derogation is not available within the current legislation and engagement advised with SEPA to be taken forward. 2. Transition process underway with Renewi to facilitate the end of contract arrangements for Sept 2026. 3. Ongoing workshop sessions to scope out and design future disposal models across all the council area. These models to be in place from 01/01/2026 in line with the BMW requirements. NOTE: whilst there are solutions in place these solutions will have cost implications which are detailed in the options appraisal presented to the Dec 2022 EDI committee. 2021/22 (Scrutiny) 2023/24
Page 22
20 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 11 Service Delivery - Cyber Security Unable to deliver services to customers because of failure of ICT systems following major cyber security breach 20 1. ICT Security & compliance officer in post, producing weekly threat analyses, member of CiSP. 2. PSN and Cyber Essentials Plus accreditations for corporate network. 3. Regular patching regimes in place. 4. ICT Disaster recovery plans tested regularly. 5. All critical activities have recovery plans developed (CARP’s). 6. Mimecast monthly cyber security training videos for all staff. 7. Enforce password changes when found to be weak. 8. Technical cyber exercise completed and Business Continuity Planning exercise conducted with senior management and other staff. 9. Internal Audit on Cyber Security completed in June with the Audit Opinion as substantial. 15 Treat 1. Review will be ongoing on all contingency plans with updated knowledge from SEPA and UHI Cyber Attacks. 2. Work with Scottish Government Cyber Resilience Team to test ICT response. 3. Continued close review of disaster recovery plan and associated tests, finalise and test incident response procedure, and review of mirroring between the 2 data centres (monthly at ITMT) and backup. 4. Review and progress requirements for Education Network to achieve CE+ accreditation. 5. Procure a Security Operations Centre service to improve our 24x7 security posture. 2019/20 2022/23 2023/24 12 Cost of Living Crisis The Council are unable to respond to the implications arising from the 'Cost of Living' crisis 25 1. Financial stability and support to HSCP 2. Social Welfare and Poverty Funding assistance. 3. Focused support and multi-agency approach where risk is highlighted 4. Monitoring of trends in service use to high light any significant change as a result of financial hardship 12 Treat 1. Review and monitor changes in demand for key services which correlate to personal effects arising from financial distress. 2. Extend flexible food and fuel fund to March 2025, apply to Scottish Government for funding to expand the service provision to include outreach, September
Page 23
21 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 5. Targeted measures - for example to those receiving Council Tax reductions - via Gift Cards and Flexible Food and Fuel Fund 2023. 13 Impact of Climate Change The Council or communities are overwhelmed by severe or more frequent flooding, landslides, rainfall, storms, sea level changes or hot weather events due to changes in global temperature caused by climate change 25 1. Continued delivery of Council De- Carbonisation Plan 2. Civil Contingencies Manager liaising/ collaborating with Regional Resilience Partnerships and other resilience partners in terms of storm event, hot weather events, cut off communities, landslides etc. 3. Development and delivery of an integrated approach to decarbonisation and adaptation of Argyll and Bute as a Region via Community Planning Partnership 4. Roads & Amenity Services continue to develop asset management plan and address strategic risks in terms of rising sea levels, bridge repairs, critical infrastructure vulnerability 12 Treat 1. Review of De-Carbonisation Plan December 2024 2. Consideration of all Council Papers with climate change as consideration / implications - ongoing 3. Review scoring of business cases and pipeline of strategic projects with enhanced climate change considerations 2021/22 14 Lack of Housing availability The Council, partner agencies and communities are unable to attract and retain 20 1. Council has declared a Housing Emergency. 2. Housing Strategy and Investment Plan funded and implemented/new housing delivery group established. 3. Islands Programme Award of Funding for 20 1. Explore and develop a series of options in response to the housing emergency. 2. Address key barriers to housing. 3. Consider radical delivery models. 4. Update to the Local Housing
Page 24
22 Argyll and Bute Council – Internal Audit 2024/25 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage working age people due to lack of housing and pricing. infrastructure for worker accommodation on Mull - this is for phase 1 site infrastructure to enable delivery of accommodation for workers and will meet clearly evidenced community need. Strategy to reflect current issues - December 2023. 5. Hold housing summit in collaboration with housing delivery partners - October/November 2023. 6. Housing to attract economic growth is included as a project within the RGD, focus on Tobermory and Bowmore.