2023_24_Internal Audit_Risk Management_Final
Argyll and Bute Council · 14 September 2023
Back to Audit and Scrutiny Committee — 14 September 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Report June 2023 Final High Medium Low VFM Number of Findings 0 0 1 0 Risk Management Audit Opinion: High
Page 2
2 Argyll and Bute Council – Internal Audit Report – Risk Management, June 2023 Contents 1. Executive Summary .............................................................................................................. 3 Introduction................................................................................................................................. 3 Background.................................................................................................................................. 3 Scope........................................................................................................................................... 3 Risks ............................................................................................................................................ 3 Audit Opinion .............................................................................................................................. 4 Recommendations ....................................................................................................................... 4 2. Objectives and Summary Assessment.................................................................................... 4 3. Detailed Findings .................................................................................................................. 5 Appendix 1 – Action Plan.............................................................................................................. 7 Appendix 2 – Audit Opinion.......................................................................................................... 9 Contact Details Internal Auditor: David Sullivan Telephone: 01546 604125 e-mail: david.sullivan@argyll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – Risk Management, June 2023 1. Executive Summary Introduction 1. As part of the 2023/24 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Risk Management. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. Local government has seen and will continue to see unprecedented changes. This will lead to significant new risks, as the Council reviews its services and how they are delivered. Risk management will support and enhance the decision making process, increase the likelihood of the Council meeting its objectives and enable it to respond quickly to new pressures and opportunities. 5. Risk management is the planned and systematic process by which key risks are identified, evaluated and managed so as to maximise benefits and minimise potentially negative consequences to the Council and its partners. Risks are significant uncertainties that may affect the Council’s ability to achieve its strategic and operational objectives. Scope 6. The scope of the audit was to assess the adequacy of, and compliance with, the Council’s risk management arrangements as outlined in the Terms of Reference. Risks 7. The risks considered throughout the audit were: CEU ORR 5: Risk management is not embedded as an integral part of decision making process Audit Risk 1: Risk registers are not updated regularly Audit Risk 2: Risks are not properly assessed Audit Risk 3: Risks are not prioritised Audit Risk 4: Risks are not monitored and reported
Page 4
4 Argyll and Bute Council – Internal Audit Report – Risk Management, June 2023 Audit Opinion 8. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 9. Our overall audit opinion for this audit is that we can take a High level of assurance. This means that, internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Recommendations 10. We have highlighted one low priority recommendation where we believe there is scope to strengthen the control and governance environment. These are summarised below: A Copy of the Risk Management Manual on the HUB needs to be replaced with the current version 11. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 12. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion CO1 Risk management is actively supported and promoted by senior officers/elected members ORR 5 Audit Risk 1 High In September 2019 the Audit and Scrutiny Committee agreed that an annual audit of risk management was no longer required and that this would be replaced by an annual strategic risk assurance mapping exercise with an audit of risk management to be conducted at least once every three years. Roles and responsibilities are clearly set out and arrangements for updating risk registers have been defined and are being adhered to. The current version of the Risk Management Manual on the HUB is out of date. CO2 There is a systematic approach to identify and prioritise risks and match them ORR 5 Audit Risk 2 Audit Risk 3 High The Council’s Risk Management Manual clearly set out a systematic approach for identifying and evaluating risks.
Page 5
5 Argyll and Bute Council – Internal Audit Report – Risk Management, June 2023 with appropriate responses CO3 Risks and the action taken to mitigate them are regularly monitored ORR 5 Audit Risk 4 High The Council’s risk registers are being regularly reviewed and updated. 13. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings Risk management is actively supported and promoted by senior officers/elected members 14. In September 2019 the Audit and Scrutiny Committee agreed that an annual audit of risk management was no longer required and that this would be replaced by an annual strategic risk assurance mapping exercise with an audit of risk management to be conducted at least once every three years. The Risk Management Manual was updated to reflect this change with the updated version being approved by the Strategic Management Team (SMT) in November 2020 and Policy and Resources (P&R) in May 2021.The annual risk assurance mapping was carried out in August 2022 and presented to the September 2022 Audit and Scrutiny Committee. The conclusion from the risk assurance mapping exercise was “ this exercise has again confirmed that for the majority of risks in the Council’s strategic risk register there are either sufficient assurances in place or internal audit have scheduled work to fill identified gaps. “ 15. The current Risk Management Manual is comprehensive and sets out: a definition of risk the Council’s approach to managing risk a risk appetite statement roles and responsibilities including senior management and elected members the risk management cycle detailing the stages to undertake to manage risk. 16. The roles and responsibilities of senior management are clearly outlined within the Council Risk Management Manual under “Roles and Responsibilities Section” in regard to: strategic Management Team elected Members heads of Service managers employees audit and Scrutiny Committee Internal Audit. 17. The Council’s Head of Financial Services has operational responsibility for risk management (excluding social care). 18. The operational risk registers (ORR’s) are agreed on a quarterly basis at Departmental Management Team (DMT) meetings and the strategic risk registers (SRR’s) are formally reviewed and updated by SMT on a six monthly basis.
Page 6
6 Argyll and Bute Council – Internal Audit Report – Risk Management, June 2023 19. The Risk Management Manual currently on the HUB reflects a previous version. Action Plan 1 There is a systematic approach to identify and prioritise risks and match them with appropriate responses 20. The Council’s Risk Management Manual sets out a comprehensive process to identify and prioritise risks. In particular how to: identify risk assess the likelihood and impact of the risk prioritise risks (red, amber or green) mitigate and manage the risk. 21. All business activities within the Council have a risk assessment. These are identified within each departments operational risk register. A review of the ORR’s confirmed that risk management is applied to all Council business activities. 22. A review of the Council’s risk registers (both SRR and ORR) confirmed that risks have been assessed and prioritised and mitigating action identified where a decision has been taken to treat the risk. Risks and the action taken to mitigate them are regularly monitored 23. Minutes of the SMT and the three Council Departmental Management Teams confirm that risk registers are being reviewed and updated as per the requirements established by the Risk Management Manual. In addition it is clear the reporting arrangements are being adhered to. Furthermore the Head of Financial Services updates P&R on the Council’s key financial risks as a standard agenda item. 24. A review of the Council’s risk registers confirmed that risks have been assessed and prioritised and mitigating action identified where a decision has been taken to treat the risk. 25. The Council’s Strategic Risk register is reviewed every 6 months and agreed by the Council’s Strategic Management Team and presented to the Audit and Scrutiny Committee by the CIA annually. The next scheduled review will commence in June 2023 with reporting to the Audit and Scrutiny Committee in September 2023.
Page 7
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Low 1 Risk Management Manual The Risk Management Manual on the HUB reflects a previous version. Risk management does not reflect current practice To inform IT to update the HUB with most recent version of the Risk Management Manual. Chief Internal Auditor June 2023
Page 8
8 Argyll and Bute Council – Internal Audit Report – Risk Management, June 2023 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 9
9 Argyll and Bute Council – Internal Audit Report – Risk Management, June 2023 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.