2023_2024_Pupilregistration_Report FINAL
Argyll and Bute Council · 19 December 2023
Back to Audit and Scrutiny Committee — 19 December 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Report October 2023 FINAL High Medium Low VFM Number of Findings 0 0 3 1 Pupil Registration Audit Opinion: High
Page 2
2 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 5 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 11 Appendix 2 – Audit Opinion ................................................................................................................. 13 Contact Details Internal Auditor: Annemarie McLean Telephone: 01700 501354 e-mail: annemarie.mclean@argll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 1. Executive Summary Introduction 1. As part of the 2023/24 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Pupil Registration 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. The Education (Scotland) Act 1980 sets out the basic legal framework for the provision of education in Scotland including the duties of local authorities and rights of parents. It places a duty on local authorities to secure provision of school education, including early learning and childcare, in their area, for children aged 5 to 16. 5. Children normally start school in the August when they are aged between four-and-a-half and five-and-a-half, and transfer to secondary school in the August when they are between eleven- and-a-half and twelve-and-a-half. 6. Children are eligible to attend their catchment primary school in August if their fifth birthday falls between 1 March of that year and the last day of February of the following year. From August 2023, parents/carers of children who will turn 5 between the second day of the school year in August and the end of February, are entitled to request an additional year of funded Early Learning Childcare (ELC). Children due to start school, who have their fifth birthday between 1st March and 31st July, can still apply for an additional year of funded ELC, however this is at the discretion of a Deferred Entry Panel. 7. In Scotland, there’s a ‘presumption of mainstreaming’ – this means that children and young people have the right to an education in a mainstream school, unless their needs can’t be specifically met in that location there. Every mainstream Scottish school has a ‘catchment area’ fixed by the local authority. Children living within a catchment area are normally provided with a place at the school serving that area. A group of primary schools in an area is normally associated with a single secondary school. Parents can make a request to place their child in any school under the management of the education authority. This is known as a placing request. Parents are responsible for the transport to the school in the placing request if it is not in their catchment area, as the education authority does not provide transport for those pupils in receipt of a placing request.
Page 4
4 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 8. Children or young people may require additional support for a variety of reasons, either for short periods of time or throughout their education. For children with additional support needs (ASN), where mainstreaming does not meet the needs of the child, they may be educated in a learning centre based in a school. In the event that more complex or severe needs concerning a learning difficulty or a physical impairment is evident, then a separate day school or residential school may better address the specific needs of the child or young person. 9. Within Argyll and Bute, pupil registration is by way of an online application form via the Council’s website which contains up-to-date information on all schools across Argyll and Bute, including denominational and Gaelic Medium Education. 10. SEEMiS is an education Management Information System, set up to support electronic education administration. The system is provided by the SEEMiS Group, which is a limited liability partnership owned and managed by Scotland's 32 local authorities. It is used by all local authorities, their associated schools, and Early Years settings, throughout Scotland to deliver their statutory and discretionary responsibilities to hold, store and manage pupil data and is considered a secure environment for holding such data. 11. SEEMiS and Council networks include data that meets the definition of personal sensitive data outlined in relevant data protection legislation (The Data Protection Act and UK GDPR) as it will include information on racial and ethnic origins, religious or other beliefs, physical and mental health. Reports generated from both systems are also produced to support management decision making and are provided to the Scottish Government. Scope 12. The scope of the audit was to review the arrangements for the new online registration system for pupils going to school, as outlined in the Terms of Reference agreed with the Head of Education, Performance and Improvement on 25 July 2023. Risks 13. The risks considered throughout the audit were: ORR 11: Failure to ensure Council compliance with governance and information management arrangements Audit Risk 1: Insufficient arrangements to register children for school Audit Opinion 14. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 15. Our overall audit opinion for this audit is that we can take a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently.
Page 5
5 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 Recommendations 16. We have highlighted three low priority and one value for money recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: Education Management Circulars should be updated to reflect the August 2023 legislative changes and current digitalised working practices. The Parent Information Leaflet, the information circulated to schools and ELC establishments and standard email/letter templates should be reviewed to ensure they reflect current legislation, terminology and working practices. Staff Procedure Notes should be updated to reflect current/revised working practices. Expanding the use of Oracle CRM throughout the pupil registration process could further digitalise and streamline processes and provide a more simplified audit trail. 17. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 18. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 The Council has arrangements in place to register children for school Audit Risk 1 High Education Management Circulars (EMC) set out the arrangements to register children for school. These are currently being revised to reflect legislative changes effective from August 2023 which provides access to an additional year of ELC for eligible children, but have not been updated since 2018 and do not reflect the current digitalised working practices. The Council widely promotes and publicises the arrangements for the school registration process. Information documents and standard letter/email templates, provided to parents, carers, schools and ELC establishments should be reviewed to ensure they reflect current legislation, terminology and working practices. Parents and carers are able to register children for school, in an easy and accessible manner, without barriers. 2 Procedures and protocols are in place to gather, ORR 11 High The Education Data Timeline document details events, actions
Page 6
6 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 store and process information, about children due to register for school and for sharing this with the relevant schools required and who is responsible throughout the year. Staff have written procedure notes and have held lessons learned meetings but due to workload, these have not been updated. The functionality of Oracle CRM as a records management system, is not being fully utilised. A master spreadsheet is used to manage the process with email correspondence being stored either in the shared email folder or in the Education drive. Expanding the use of Oracle CRM throughout the pupil registration and placing request processes could further digitalise and streamline processes and provide a more simplified audit trail. Testing confirmed that children have been registered at the school requested. 3 The processes and controls applied by services ensure that personal sensitive records maintained on the Council’s network are appropriately protected. Audit Risk 1 High The Council in its Education and Customer Support Services have appropriate logical access and cyber security processes and controls to ensure that personal sensitive records maintained on the Council’s network are appropriately protected during the pupil registration process. 19. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings The Council has arrangements in place to register children for school 20. The Council, within its Education Management Circulars (EMC) sets out the authority’s arrangements to register children for school, in accordance with legislative requirements, these are: Education Management Circular No.3.01 – Admission to Primary Schools, which sets out the arrangements in place to register children for school. Education Management Circular 3.07 – Transfer of children from primary to secondary school, which sets out the authority's arrangements for the transfer of children and young people from primary to secondary schools.
Page 7
7 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 21. The EMC documents take cognisance of relevant legislation, but have not been updated since 2018 and do not reflect the current digitalised working practices. There is a legislative change, effective from August 2023, which automatically entitles all children with birth dates between 1st August and 28th February, to receive an extra year of funded ELC, which is not yet referred to in EMC No.3.01. This legislative change has successfully been built into the online Primary one (P1) pupil registration process for this academic year of 2023/2024 and staff are in the process of updating the EMC to reflect this. Action Plan 1 22. For children who have additional support needs and/or who require a targeted intervention, the Council’s Staged Intervention Framework document sets out the legislative context, this outlines the continuum of support for the child and the agreed process used to identify, plan for and support. This is a service or particular support which is targeted at addressing particular wellbeing needs or more specialist, and is therefore not made available generally to all children. 23. Staged intervention is a flexible approach, used as a means of identification, assessment, planning, recording and review to meet the learning needs of children and young people. It provides a solution-focused, sometimes multi agency, approach to meeting needs at the earliest opportunity, usually within the ELC settings, and with the least intrusive level of intervention to get it right for every child (GIRFEC). 24. The school registration process takes place annually in January and was previously carried out predominately by the individual schools, who would deal in person with parents/carers and process the paper based registration forms. In order to take cognisance of Covid requirements, the Council had to develop an online registration form, which links into the Oracle Customer Relationship Management (CRM) system. The process is now centralised and is co-ordinated by staff, who administer the SEEMiS system, within the School Services Support Team. 25. The Council widely promotes and publicises the arrangements for the school registration process, and provides a link to the online form, via various channels including: Adverts placed in local newspapers and promoted via Council Social Media On the education pages on Council website; Emails are issued to parents/carers of eligible children currently receiving Early Learning Childcare, taken from Council ELC provider information; Promotions/posters displayed in Partner providers’ Early Learning Establishments to encourage parents/carers to engage with the process In schools, who have copies of the information sent to parents/carers so they can assist with registrations if approached 26. Parents and carers are provided with the Parent Information Leaflet – Sending your child to school and an FAQ which are comprehensive documents which provide clear information regarding: Choosing a school, including denominational and Gaelic medium schools; An overview of who to contact for guidance and support, if the child has additional support needs, Pupil travel and accommodation; School catering and clothing grants (with links); Information regarding early entry and deferring entry to P1 (as per the new legislation);
Page 8
8 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 Placing Requests – where a request is made to register a child in a school other than their post code catchment school. Contact Us details 27. A review of the Placing Request acceptance letters found that in each of these the class number was not completed. There would be benefit to reviewing the Parent Information Leaflet, the information circulated to schools and ELC establishments and standard email/letter templates, to ensure they reflect current legislation, terminology and working practices. Action Plan 2 28. Children whose needs can be met in mainstream education register for school using the on line registration form, while the Council’s Education Support Officers take the lead on making the appropriate arrangements for children who have specific requirements. 29. Audit staff were provided with access to the Council test website and Oracle CRM to test the new online P1 registration system. This testing established that; the online form, contains a Privacy Information notice and links to: o Website privacy policy and terms and conditions o Data protection and privacy notices o Accessibility Statement Entering the pupils postcodes provides the name of the catchment school; Parents/carers can choose to make a Placing Request at a school of their choice; Requests for School Transport can be made, with a list of reasons for request; There are options to select registration at Private/independent school; to home educate and to request an additional year of ELC; Parents and carers receive an automatic response which confirms submission and outlines the next steps. 30. The new online system is simple and easy to use and provides parents and carers with an easy and accessible way to register a child for school. Support is available either online, via the central support staff, or face to face in schools for those who would like it. Procedures and protocols are in place to gather, store and process information, about children due to register for school and for sharing this with the relevant schools 31. The Education Support Team have an education data timeline document which contains a calendar and timeline of events, actions required and who is responsible throughout the year. This includes those relating to pupil registration which are predominately carried out by the Administration and Management Information Officer Education Services and the SEEMiS and GDPR Administration Assistant. 32. When a child registers to attend a Council run Early Years establishment a record is created on SEEMiS specifically within the Nursery Application Management section referred to as NAMS. It is at this point that birth certificate identification is taken and uploaded to SEEMiS, meaning that only children who are registering for the first time are asked for identification. Where this is required such information is taken to the school the child is registering for, then uploaded onto SEEMiS.
Page 9
9 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 33. Staff within the Education Support Team, produce a report from NAMS which provides details of the children who will turn 5 before March of the relevant academic year. This is used to contact parents/carers to advise them that the choice of school and registration of infant beginners in primary school process, is open. 34. The Education Support Team have written procedures for the pupil registration process. Evidence of lessons learned meetings has been provided but due to workload staff have not yet had the time/ capacity to update to the procedure note to reflect these updates. Action Plan 3 35. A random sample of 30 online registration incidents was taken from the Oracle CRM system. The system provides staff with a list of all incidents which allows them to process registration requests and provides a simple audit trail summarising the incident. Testing was able to confirm that children have been registered at the school requested during that intake process. 36. The SEEMiS and GDPR Administration Assistant deals with the majority of the administration checks on registrations forms received, this includes contacting parents to clarify information where applicable and a manual double check of post codes and catchment school. There is a look up function built into the Council website that links the postcode entered with the catchment school postcode. This process is being refined as there are some places where postcodes have more than one catchment school e.g. different sides of the same street in Campbeltown where on one side the catchment area is Castle Hill Primary School and the other side is Dalintober. 37. When parents/carers submit a placing request to register a child at a school that is not their catchment school, this is handed over by email to education support staff located within Argyll House, Dunoon. The initial acknowledgement email provided to confirm submission states that an acknowledgement letter will be issued within five working days of a placing request being received. We were unable to establish if this is a legislative requirement or one of the Councils own target dates. Consideration should be given to whether these timescales are still relevant or a metric introduced to monitor compliance with this specific requirement to respond. 38. The move to a centralised online registration process is relatively new and the functionality of Oracle CRM as a records management system, is not being fully utilised during pupil registration and is not the main source of record keeping. Staff currently set up and maintain a master spreadsheet to coordinate and record progress of the pupil registration process. Correspondence with parents/carers, schools and staff within the team who manage placing requests is via email and sometimes stored within the shared email folders or in files on the Education server drive. 39. The Council Customer Call Centre use Oracle CRM to send and record emails received against one record, this provides a full audit trail of interactions with customers. There would be benefit to applying this principle to the pupil registration process as it would provide a more complete audit trail and one source of record keeping, consideration should be given to providing school support staff in Argyll House, who deal with placing requests, with access to Oracle CRM as this may have the potential to further digitalise and streamline the current process by allowing it to be managed within one system. Action Plan 4
Page 10
10 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 The processes and controls applied by services ensure that personal sensitive records maintained on the Council’s network are appropriately protected. 40. The SEEMiS system is used to gather, store and process information, about children due to register for school and for sharing this with the relevant schools. This system is a secure environment for holding such data. There are various systems manuals, protocols and procedure notes for each of the parts of the SEEMiS system. Internal Audit undertook reviews of Logical Access which included reviewing controls and access to SEEMiS, and the Councils Cyber Security arrangements. This current review has placed reliance on the findings contained within these audits. 41. At the beginning of February, once the online registration is closed and the initial checks completed, the Administration and Management Information Officer Education Services and the SEEMiS and GDPR Administration Assistant, update each child’s SEEMiS record, the Provisional (Pre-Admissions) section, with the requested school. 42. An email with a report is sent to each Primary school providing them with the P1 cohort data. There is no personal data sent in this email, instead it is a list of SEEMiS identification numbers, and current ELC placement location, of the children who have been provisionally enrolled at the school and those who have elected to have another year of ELC. Schools can then access information on SEEMiS about children that will be placed on their roll. 43. At the same time, a full report of all children registering for school is emailed to the School Transport team. This report provides details of all pupils who are registering for school, highlighting those who have requested school transport and the reason for the request. The School Transport team carry out an eligibility assessment on all of the pupil’s addresses and ensure that all children who are eligible for Transport are offered a place. 44. The Council’s internal email system has end to end encryption and is a safe and secure method for staff to sharing information. The Council’s ICT Acceptable Use Policy applies to all users of Council devices and outlines the requirements to comply with its content to preserve the confidentiality, integrity, availability of information held and comply with relevant legislation.
Page 11
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Low 1 Education Management Circulars (EMC) EMC No. 3.01 and 3.07 documents take cognisance of relevant legislation, but have not been updated since 2018 and do not reflect the current digitalised working practices. They are currently being revised to reflect legislative changes effective from August 2023 which provides access to an additional year of ELC for eligible children. Key documents and guidance are not up to date and do not reflect current working practices. Update key documents and guidance to reflect current working practices. Susan Tyre, School Support Manager November 23 Low 2 Information leaflets and standard templates. The Parent Information Leaflet, the information circulated to schools and ELC establishments and standard email/letter templates should be reviewed to ensure they reflect current legislation, terminology and working practices. We were unable to establish whether the five working day timeframe from acknowledgment letters was a legislative requirement or one of the Councils own deadlines. Placing request acceptance letters did not have the class number completed. Key documents and guidance may not reflect current legislation, terminology and working practices. Update the parent information leaflet to reflect current legislation and practices Amend the placing request acceptance letters wording Esther Clarke Admin and Information Officer November 23 Low 3 Staff Procedure Notes Evidence of lessons learned meetings has been provided but due to workload staff have not yet had the time/ capacity to update to the procedure note to reflect these. Procedure notes do not reflect current working practice Update staff procedure notes to reflect working practices Esther Clarke Admin and Management Information officer November 23 VFM 4 The functionality of Oracle CRM Expanding the use of Oracle CRM throughout the pupil registration process could further digitalise and streamline processes and provide a simplified audit trail. Consideration should be given whether the Placing Request process could be managed using Oracle CRM by providing access to school support staff in Argyll House. No risk, using Oracle CRM more fully will further digitalise and streamline processes and provide a simplified audit trail. Explore the functionality of Oracle with staff from Customer Support Services Esther Clarke Admin and Management Information officer March 2024
Page 12
12 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 13
13 Argyll and Bute Council – Internal Audit Report – Pupil Registration, October 2023 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.