Internal Audit Reports to Audit and Scrutiny Committee 2023/2024
Argyll and Bute Council · 20 June 2023
Back to Audit and Scrutiny Committee — 20 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 20 JUNE 2023 INTERNAL AUDIT REPORTS TO AUDIT AND SCRUTINY COMMITTEE 2023/2024 1. EXECUTIVE SUMMARY 1.1 There are ten audits being reported to the Audit and Scrutiny Committee. 1.2 The table below provides a summary of the conclusions for the audits performed. The full reports are included as appendices to this report. Audit Name Level of Assurance High Actions Medium Actions Low Actions VFM Actions Purchasing Cards Reasonable 0 9 4 0 Building Standards High 0 0 1 1 Cyber Security Substantial 0 5 1 0 Management of Debt & Debt Recovery Reasonable 0 4 3 1 Burial Records Reasonable 1 3 2 0 Counselling in Schools Substantial 0 0 2 0 Equality and Socio-Economic Impact Assessment Substantial 0 1 4 0 Payroll Reasonable 0 5 0 0 LiveArgyll – Lochgilphead Community Centre High 0 0 0 0 LiveArgyll – Mid-Argyll Sports Centre High 0 0 0 0 1.3 Internal Audit provides a level of assurance upon completion of audit work. A definition for each assurance level is documented in each audit report. 2. RECOMMENDATIONS 2.1 Audit and Scrutiny Committee to review and endorse this summary report and the detail within each individual report. 3. DETAIL 3.1 A high level summary of each completed audit report is noted below: Purchasing cards: Our overall audit opinion for this audit is that we can take a reasonable level of assurance. Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. At times, procurement
Page 2
procedures are not being followed and procurement teams are not consulted prior to purchases in excess of £1,000. Testing of payments in excess of £10,000 identified transactions with a total value of expenditure with one company exceeding £50,000. Transactional testing was unable to obtain evidence of prior approval for 42% of transactions, some approval is verbal or via retrospective purchase orders. There is currently no formal process in place to ensure that the budget holder has approved amendments to card limits. The Education Purchasing Team (EPT) was reinstated in 2020 and has been extended to March 2025 supporting Head Teachers and central education staff to deliver an increase in contracted spend. While the review identified that there is still work to be done in this area there are positive indications that there is a shift in culture towards engaging with EPT. The Procurement Team set up a Council Amazon Business account. This process is working well and has already delivered significant savings which are reported by Procurement Team. While the testing of the imprest account process is not within the scope of this review, we identified situations where staff other than the cardholder withdraw cash using their purchase card. Receipts and invoices are not always added to the banking system. Staff working remotely, or in non-Council networked properties may not have access to appropriate technology or have been provided guidance on alternative ways to upload this information. Building standards: This audit has provided a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. There is a clear commitment to providing a fully digital verification service with supporting information available to the public via the Council’s website. Staff are appropriately trained and qualified with formal partnership arrangements in place to provide specialist support. Officers are allocated work on a competence basis and are appropriately supervised. Systems are managed by the Council’s ICT Services and administered by Building Standards who train and support users. Performance information is extracted from the Building Standards system, reported to Scottish Government and published on the Council’s website in a timely manner, however, this employs additional software which may be subject to additional costs in the future. Regular meetings take place with the finance contact and the service income is on track to exceed costs incurred. Areas for improvement are identified by appropriate means and published on a log along with details of progress made. Collaborative working take place with other verification authorities to discuss issues and share best practice. Cyber security: This audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. An Acceptable Use Policy was updated in October 2021 and provides instructions and guidance to employees to ensure responsible use of systems and data, however, the Cyber Security Policy has not yet been completed. The Council’s Strategic Management Team (SMT) review and update cyber risks on a 6- monthly cycle as part of the review of the Strategic Risk Register, however they do not receive regular updates from the ICT Compliance and Security Officer (ICT-CSO) regarding newly identified risks and statistics indicating the volume of cyber attacks deterred by the service. The Council has achieved compliance
Page 3
with the Public Sector Network (PSN) code of connection as well as Cyber Essentials+ reaccreditation. Networking takes place with other local authorities to share information and conferences are attended to learn from subject experts. The ICT-CSO holds the CompTIA Security+ certification and is responsible for cyber security in addition to other duties and is designated as manager in the cyber incident response plan. There is no depute appointed to cover in the absence of the ICT-CSO and with the increasing workload advised by the National Cyber Security Centre (NCSC) it would appear that the Council is under-resourced in this high risk field of expertise in comparison to other local authorities where the majority contacted have teams in place. Periodic reminders of safe cyber practices are issued to employees and brief training videos are issued monthly, however, these are not completed by all users. A comprehensive Cyber Incident Response Plan, Playbooks and Disaster Recovery Plans have been prepared and tested with positive feedback recorded following a corporate exercise in March 2022. Management of debt and debt recovery: This audit provided a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. This review covered the management and recovery of debt over four areas – Council Tax, Non Domestic Rates, Housing Benefit Over Payments and Sundry Debtors, which are invoices raised by Services. We found no significant issues in relation to processes and procedures for Council Tax, Non Domestic Rates and Housing Benefit Over Payments, most of which are covered by legislation and are working well. The contents of this report largely covers findings regarding the management and recovery of Sundry Debtors. The Corporate Debt Policy and the Debtors Procedure Manuals have not been updated since 2017 and do not reflect the current Council organisational structure nor current working practices. A Business Process Review (BPR) is currently being undertaken, this includes a review of debt management and recovery policies and procedures. Our overall conclusion is that debt management and arrears follow-up procedures relating to Sundry Debtor invoices are not carried out in accordance with procedures. Testing identified a number issues which are detailed in the body of report. A full review of the processes and procedures for Sundry Debtors relating to the management, arrears, follow-ups and bad debt write offs should be carried out. There are no performance measures in place to monitor recovery of Sundry debt. Quarterly meetings with Legal Services to discuss recovery of Sundry Debtors were postponed during the pandemic, these have not been re-instated. The value of debt being actively managed is not easily quantifiable. Management information relating to Sundry Debtors is not made widely available. Provisions for Bad Debt are set in accordance with procedures. Burial Records: This audit has provided a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Policies and procedures are in place, however, these require to be reviewed on a regular basis, additionally, there is no procedure for managing records resulting in some inconsistencies across the service area locations. The BACAS electronic burial register is updated promptly upon receipt of details and
Page 4
traditional registers updated soon afterwards. There is no record of private home burials and documentation in support of exhumations was not available at the time of the review. The BACAS system is installed on a terminal server that is accessed remotely by users via network credentials, however, there is no further authentication required to logon to the system to prevent unauthorised access. Traditional registers are stored safely in locked rooms, safes and filing cabinets, saved electronic forms are securely managed on shared drives and printed documents are managed by the Council’s secure printing service. Burial registers are not made available to the public to view to maintain compliance with GDPR, however, extracts of information can be provided upon request and payment of the appropriate fee. Counselling in schools: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Temporary funding provided to the Council was utilised to develop a counselling in schools service which has been in place since January 2021. The Council did not have an existing counselling service therefore there were delays in the commencement of the service resulting in Year 1 funding being underspent. After discussions with partners and careful consideration it was agreed that the counselling service would be delivered by the HSCP with funding transferring from Education to the NHS. There are no records to support the appraisal and decision making process for the delivery of counselling services. Over 729 young people engaged with the service during the period of funding to December 2022. Whilst we can draw a substantial level of assurance that young people have benefited from the delivery of an effective counselling service based on the outcomes measured against the ten nationally agreed core principles, the funding provided by the Scottish Government was not fully utilised and has carried forward an underspend to a new project. The impact of counselling is assessed using the Strengths and Difficulties Questionnaire (SDQ) and the Young Persons CORE 10 (YP-CORE 10) which are both assessment tools used to evaluate progress. The outcomes set were in line with the Scottish Governments Core Principles and reporting requirements. Councils were required to submit regular reports on a six monthly basis to the Scottish Government detailing outcomes over the period, this was done on a standard template. Equality and Socio-economic impact assessments: this audit provided a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Equality and Socio-Economic Impact Assessment processes are in place which reflect current legislative and regulatory requirements. The Council have published guidance for staff entitled ‘Argyll and Bute Equality and Socio-Economic Impact Assessment (2020) Guidance’. This guidance sets out the council’s Equality and Socio-Economic Impact Assessment (EqSEIA) process, why we have one, and how it is used. EqSEIAs are being undertaken, however, there are inconsistencies in practice across the Council. We reviewed papers submitted to Committees for decision and the budget pack, specifically looking to ensure that when required the EqSEIAs had been completed. The review of papers submitted indicate that a number of EqSEIAs had been missed by the responsible service. The Council
Page 5
is required to publish, at intervals of not more than two years, a report on the progress it has made to make the general equality duty integral to the exercise of its functions. The Council have published and made available on the Council’s website the ‘Equalities Mainstreaming Report and Equality Outcomes’ every two years since 2013, the most recent report in 2021. Payroll: This audit has provided a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Payroll are dependent on the systems and processes in place which inform them of additions or changes within the payroll system. The efficiency of the whole process is heavily reliant on managers within the services inputting the correct information and uploading all the relevant paperwork in a timely manner. Whilst there are well understood processes and procedures in place for the management of payroll updates, the whole process is hugely inefficient. Each step of the process requires considerable amounts of manual intervention with the same basic information requiring to be keyed in separately by HR&OD and payroll, increasing the risk of error. A combination of the challenges that can be experienced at times, include payroll not being updated in a timely manner. Payroll have established timetables which are available on the HUB for staff to view. The number of payroll errors and late submissions to payroll are tracked on a spreadsheet and reported each quarter. Reliance was placed on work undertaken as part of the continuous monitoring process. Staff are restricted from certain areas of the systems and can only access data/areas that fall within their job remit. User lists and access right are reviewed on a monthly basis and are updated as and when Payroll are notified of any leavers. LiveArgyll – Lochgilphead Community Centre: This audit has provided a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Audit testing on LiveArgyll establishments are predominantly observational, therefore, any issues that are highlighted are based on what was witnessed on the day of the visit. Recommendations are not included in the reports and LiveArgyll management determine whether any corrective action is required. Under any ‘areas for consideration’ management will take appropriate action. (For Information only) LiveArgyll – Mid-Argyll Sports Centre: This audit has provided a high level of assurance. This means that internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Audit testing on LiveArgyll establishments are predominantly observational, therefore, any issues that are highlighted are based on what was witnessed on the day of the visit. Recommendations are not included in the reports and LiveArgyll management determine whether any corrective action is required. Under any ‘areas for consideration’ management will take appropriate action. (For Information only)
Page 6
4. CONCLUSION 4.1 Management has accepted each of the reports submitted and have agreed responses and timescales in the respective action plans. 5. IMPLICATIONS 5.1 Policy - None 5.2 Financial - None 5.3 Legal - None 5.4 HR – None 5.5 Fairer Scotland Duty - None 5.5.1 Equalities – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands Duty – None 5.6 Climate Change – None 5.7 Risk – The implementation of recommendations contained in audit reports may help mitigate the risk to the Council. 5.8 Customer Service – None Paul Macaskill Chief Internal Auditor 20 June 2023 For further information contact: Paul Macaskill, Chief Internal Auditor Tel: 01546 604108 Email: paul.macaskill@argyll-bute.gov.uk APPENDICES 1. Purchasing Cards 2. Building Standards 3. Cyber Security 4. Management of Debt/Debt Recovery 5. Burial Grounds 6. Counselling in Schools 7. Equality and Socio-Economic Impact Assessment 8. Payroll 9. LiveArgyll – Lochgilphead Community Centre 10. LiveArgyll – Mid-Argyll Sports Centre