Internal Audit Reports to Audit and Scrutiny Committee 2023/24
Argyll and Bute Council · 19 December 2023
Back to Audit and Scrutiny Committee — 19 December 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 19 DECEMBER 2023 INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2023/2024 1. EXECUTIVE SUMMARY 1.1 There are four audits being reported to the Audit and Scrutiny Committee. 1.2 The table below provides a summary of the conclusions for the audits performed. The full reports are included as appendices to this report. Audit Name Level of Assurance High Actions Medium Actions Low Actions VFM Actions Fleet - Hire of Vehicles Reasonable 0 0 1 4 Compliance Review Substantial 0 5 4 0 Planning Substantial 0 1 3 0 Pupil Registration High 0 0 3 1 Oban Airport High 0 0 0 0 Risk Management (HSCP) Reasonable 0 1 3 0 Financial Management Arrangements (HSCP) Substantial 0 0 1 0 Queens Hall & Library (LiveArgyll) High 0 0 0 0 Riverside Leisure Centre (LiveArgyll) High 0 0 0 0 Helensburgh Leisure Centre (LiveArgyll) High 0 0 0 0 Helensburgh Library (LiveArgyll) High 0 0 0 0 Oban Library (LiveArgyll) High 0 0 0 0 Rothesay Leisure Pool (LiveArgyll), Substantial 0 0 0 0 Rothesay Moat Community Education Centre (LiveArgyll) Substantial 0 0 0 0 Aqualibrium & Library (LiveArgyll) Substantial 0 0 0 0 Campbeltown Museum (LiveArgyll) Substantial 0 0 0 0 Victoria Halls (Helensburgh) (LiveArgyll) Substantial 0 0 0 0 Corran Halls (LiveArgyll) Substantial 0 0 0 0 1.3 Internal Audit provides a level of assurance upon completion of audit work. A definition for each assurance level is documented in each audit report.
Page 2
2. RECOMMENDATIONS 2.1 Audit and Scrutiny Committee to review and endorse this summary report and the detail within each individual report. 3. DETAIL 3.1 A high level summary of each completed audit report is noted below: Planning: Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. All relevant Planning legislation, guidance and circulars are made available to staff and their roles, responsibilities and workflow processes are aligned to these legislative requirements. There is a customer charter in place and the service has achieved Customer Service Excellence (CSE) accreditation in 2019 and 2021. The Council’s website contains an extensive range of information and guidance for the public to assist them submit an application. There is good networking and partnership arrangements in place to share information and discuss common themes. Planning do not currently have in place a training schedule for 2023/24 for planning officers which would support continuous improvement and development, together with a need to implement procedural document covering all aspects of the service to improve resilience. In addition, the need to review the current customer charter and re-introduce customer user forums. Fleet - Hire of Vehicles: Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. The guidance/procedural document requires to be updated to ensure it reflects current practice. Checks that items are not already available for use within the service should be evidenced on the external hire authorisation document. Mechanisms for evaluating financial options such as operating lease or outright purchase should be considered for hires substantially over their expected return date. Reporting on reasons where hires substantially exceed their expected return date should be implemented. Monthly reconciliations are carried out to ensure that all hires captured on Tranman are properly recorded in the financial ledger. Compliance Review – Period Products: Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. The Council has a Statement on Exercise of Functions (the statement) which takes account of the public consultations. The period product provision page on the Council website is not up to date, it does not set out the legislative requirements nor contain a standalone copy of the Statement. Funding for the initial set up and roll out of access to free period products has been distributed annually to Councils. The Scottish Government has a bid process for Council’s to apply for additional
Page 3
monies where the current allocation can be evidenced to be insufficient. Transactions for 2022- 23 should be reviewed to ensure that all costs are included. Period products are easily available in Council establishments. The My Tribe brand has been successfully launched to promote and act as signage for the period product provision across Argyll and Bute. This has a supporting website and an app which have a map of locations where products are freely available. The My Tribe School Champion role has been introduced to raise awareness of free provision and issues. Arrangements are in place to maintain stock levels, however, a plan to carry out spot checks on locations has not yet been developed. There is a lack of written procedures in place. A public consultation was underway to evaluate how the Council have implemented the free period products initiative, My Tribe, across the communities. There would be benefit to engaging internally with other services and staff involved in the various processes. Limited evidence of monitoring and evaluation was provided during the time of the review so we cannot provide assurance on this area. There would be benefit in reviewing the Council’s current Statement to ensure it reflects the transition from a ‘start up’ phase to ‘steady state’. Pupil Registration: Our overall audit opinion for this audit is that we can take a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Education Management Circulars (EMC) set out the arrangements to register children for school. These are currently being revised to reflect legislative changes effective from August 2023 which provides access to an additional year of ELC for eligible children, but have not been updated since 2018 and do not reflect the current digitalised working practices. The Council widely promotes and publicises the arrangements for the school registration process. Information documents and standard letter/email templates, provided to parents, carers, schools and ELC establishments should be reviewed to ensure they reflect current legislation, terminology and working practices. Parents and carers are able to register children for school, in an easy and accessible manner, without barriers. Staff have written procedure notes and have held lessons learned meetings but due to workload, these have not been updated. The functionality of Oracle CRM as a records management system, is not being fully utilised. Expanding the use of Oracle CRM throughout the pupil registration and placing request processes could further digitalise and streamline processes and provide a more simplified audit trail. Testing confirmed that children have been registered at the school requested. The Council in its Education and Customer Support Services have appropriate logical access and cyber security processes and controls to ensure that personal sensitive records maintained on the Council’s network are appropriately protected during the pupil registration process. Oban Airport: Our overall audit opinion for this audit is that we can take a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. The audit covered 5 of the 22 operating instructions within the aerodrome operating manual and all were found to be satisfactory. The Manual is updated on an annual basis and no audit issues were raised.
Page 4
Risk Management (HSCP): Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concert which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Risk Management Strategy and Risk Management Process documents have been prepared and were found to include all aspects of risk management, the Strategic Risk Register is actively managed and risks have been timeously evaluated and mitigated against and the Strategic Risk Register is regularly monitored by appropriate committees with a detailed commentary of all risks classified as “very high” being provided by the Chief Officer. We identified areas of improvement such as Operational Risk Registers should be updated and formally agreed by the appropriate committees, boards or senior management teams, version control should be included within both the Risk Management Strategy and Risk Management Process documents and a minimum review period for both documents should be agreed, outstanding audit actions since June 2021 on training should be completed and risk management documents should be available on the HSCP intranet and/or other portal for ease of access. (For information only) Financial Management Arrangements (HSCP): Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. In terms of strengths, we identified, strategic financial management arrangements are in place which are a combination of individual processes and procedures within the NHS and within Argyll & Bute Council to inform the processes and reporting within the Health and Social Care Partnership (HSCP)/Integrated Joint Board (IJB), the NHS and the Council have their own systems and processes in place for financial management and reporting within each organisation, these are understood and working well in terms of requirements, scheduling and presentation of information, reports are prepared on a regular basis by the Head of Finance and Transformation, financial management reports are presented to the Finance and Policy Committee of the HSCP and the IJB, together with the Argyll & Bute Council Savings Review Group meetings take place for each of the services within Social Work. Representatives from the HSCP, the NHS, management, finance and Social Work attend these meetings, allowing each budget holder to discuss progress against savings on a rolling basis. One minor area for improvement related to ensure business continuity, consideration should be given to producing a set of procedures setting out processes and timeframes for the submission of the various financial management reports. (For information only) LiveArgyll – Queens Hall & Library, Riverside Leisure Centre, Helensburgh Leisure Centre, Helensburgh Library, Oban Library: These audits have all been provided with a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Audit testing on LiveArgyll establishments are predominantly observational, therefore, any issues that are highlighted are based on what was witnessed on the day of the visit. Recommendations are not included in the reports and LiveArgyll management
Page 5
determine whether any corrective action is required. Under any ‘areas for consideration’ management will take appropriate action. (For Information only) LiveArgyll – Rothesay Leisure Pool, Rothesay Moat Community Education Centre, Aqualibrium & Campbeltown Library, Campbeltown Museum, Corran Halls, Victoria Halls (Helensburgh): These audits have all been provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements or residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Audit testing on LiveArgyll establishments are predominantly observational, therefore, any issues that are highlighted are based on what was witnessed on the day of the visit. Recommendations are not included in the reports and LiveArgyll management determine whether any corrective action is required. Under any ‘areas for consideration’ management will take appropriate action. (For Information only) 4. CONCLUSION 4.1 Management has accepted each of the reports submitted and have agreed responses and timescales in the respective action plans. 5. IMPLICATIONS 5.1 Policy - None 5.2 Financial - None 5.3 Legal - None 5.4 HR – None 5.5 Fairer Scotland Duty - None 5.5.1 Equalities – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands Duty – None 5.6 Climate Change – None 5.7 Risk – The implementation of recommendations contained in audit reports may help mitigate the risk to the Council. 5.8 Customer Service – None Paul Macaskill Chief Internal Auditor 19 December 2023 For further information contact: Paul Macaskill, Chief Internal Auditor Tel: 01546 604108 Email: paul.macaskill@argyll-bute.gov.uk APPENDICES 1. Fleet - Hire of Vehicles 2. Compliance Review 3. Planning
Page 6
4. Pupil Registration 5. Oban Airport 6. Risk Management (HSCP) 7. Financial Management Arrangements (HSCP) 8. Queens Hall & Library (LiveArgyll) 9. Riverside Leisure Centre (LiveArgyll) 10. Helensburgh Leisure Centre (LiveArgyll) 11. Helensburgh Library (LiveArgyll) 12. Aqualibrium & Library (LiveArgyll) 13. Oban Library (LiveArgyll) 14. Rothesay Leisure Pool (LiveArgyll), 15. Rothesay Moat Community Education Centre (LiveArgyll) 16. Campbeltown Museum (LiveArgyll) 17. Victoria Halls (Helensburgh) (LiveArgyll) 18. Corran Halls (LiveArgyll)