202223_InternalAudit_BuildingStandards_FinalReport
Argyll and Bute Council · 20 June 2023
Back to Audit and Scrutiny Committee — 20 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Report March 2023 FINAL High Medium Low VFM Number of Findings 0 0 1 1 Building Standards Audit Opinion: High
Page 2
2 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 11 Appendix 2 – Audit Opinion ................................................................................................................. 13 Contact Details Internal Auditor: Mhairi Weldon Telephone: 01546 604294 e-mail: Mhairi.weldon@argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 www.argyll-bute.gov.uk 1. Executive Summary Introduction 1. As part of the 2022/23 internal audit plan, approved by the Audit & Scrutiny Committee in March 2022, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Building Standards. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. The Building (Scotland) Act 2003 and secondary legislation set out the role of Local Authority Verifiers of the Scottish building standards system. In appointing verifiers, Scottish ministers consider qualifications, competence, accountability to the public and impartiality. Verifiers are appointed to administer the building standards system for their own geographic area on the condition that they meet the verification Operating Framework and Performance Framework 2017. 5. The principal aim of building standards is to ensure the health, safety and welfare of people in and around buildings, the conservation of fuel and power and the encouragement of sustainability in buildings. This is achieved through the processing of warrant applications and issuing/acceptance of completion certificates to ensure compliance with the building standards. 6. The building standards system in Scotland is administered by Local Authority verifiers appointed by the Minister for Local Government, Housing and Planning. Verifiers carry out the important function of protecting the public interest by providing an independent check of applications for building warrants to construct or demolish buildings, to provide services, fittings or equipment in buildings or building conversions. They check the work during the design phase before granting a building warrant and during the construction phase before accepting a completion certificate. There are five key stages of the customer’s journey, these are: Project scoping and pre-application Application for building warrant Granting of building warrant Building work starts (or conversion takes place) Submission and acceptance of completion certificate
Page 4
4 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 7. Argyll and Bute Council (The Council) Building Standards Team have successfully secured their annual re-accreditation assessment for the Customer Service Excellence standard in May 2022. This is the only Government endorsed standard in the UK comprising of 57 compliance elements. The team have achieved compliance with all 57 elements with Compliance+ status in 23 elements to demonstrate ongoing improvements and increasing levels of customer service. This falls to be reassessed in May 2023. 8. The Council received the Local Authority Building Standards Scotland (LABSS) award for outstanding service and commitment in customer focus on 16 September 2022. 9. The Building Standards Team undertakes verification work on behalf of 2 other local authorities on a commercial basis and overall is self-funding with a net income of £52k achieved in 2021/22. Scope 10. The scope of the audit was to review the systems and processes in place to support compliance with the verification scheme as outlined in the Terms of Reference agreed with the Head of Development and Economic Growth on 31 January 2023. Risks 11. The risks considered throughout the audit were: ORR04: Resource availability: Building Warrant fee shortfalls ORR06: Resource availability: One third of the existing Building Standards team are due to retire within the next five years Audit Risk 1: Failure to comply with regulations resulting in loss of verifier licence and subsequent income stream Audit Opinion 12. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 13. Our overall audit opinion for this audit is that we can take a high level of assurance. This means that Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Recommendations 14. We have highlighted one low priority and one value for money recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: A record of systems training provided should be maintained.
Page 5
5 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 Building Standards services should revisit the reporting functionality of the IDOX system and assess if historical issues have been addressed and raise any outstanding anomalies with the system provider. This will provide contingency for MS Access reporting. 15. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 16. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 The Council provides an efficient and effective service across all aspects of building standards verification work All Risks High There is a clear commitment to providing a fully digital verification service with systems and processes in place to support processing of information, supervision and provision of performance information for management and also for statutory publication. Information and guidance is available to the public via the Council’s website or via links provided and appropriate benchmarking activity takes place. 2 Funds and resources are managed efficiently and effectively to maintain productivity and reliable ICT infrastructure All Risks Substantial Staff are appropriately trained and qualified and formal partnership arrangements are in place to provide specialist support. Capacity issues are regularly discussed and resilience measures are in place across the Council area. Systems are managed by the Council’s ICT services and administered by Building Standards. Users are appropriately managed with access rights in place to reflect respective roles, in-house systems training is provided however there is no record maintained. Performance information is extracted using additional software to interrogate data and may be subject to additional licencing costs in the future. Regular meetings take place with the appointed finance contact to identify and address any concerns that arise, the budgeted income for the year is on track to exceed verification service costs.
Page 6
6 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 3 Verifier actions are in alignment with the performance framework and undertaken in a consistent manner Audit Risk 1 High Applications are assessed and allocated to officers on a competence basis with appropriate supervision and review in place. Performance information is accurately reflected in reports submitted to Scottish Government and published on the Council’s website. 4 The Building standards service demonstrates a commitment to continuous improvement and partnership working Audit Risk 1 High Areas for improvement are identified by appropriate means, they are added to a log published on the Council’s website along with progress in implementation. Collaborative working takes place with other verification authorities to share best practice and discuss matters arising. 17. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings The Council provides an efficient and effective service across all aspects of building standards verification work 18. Applications for building warrants are made via an online portal provided by Scottish Government which sends the information to the Council’s IDOX case management system via a series of technical scripts to ensure that both systems contain the same information. A very small amount of applications are received in paper format and these are input to the portal by officers to ensure all applications are consistently processed, this also demonstrates a clear commitment to promoting the digitisation of verification services. Alongside the IDOX system sits the CIVICA, document management system that stores all associated documents issued and received as well as providing the various workflows that officers are required to follow to ensure work is carried out in compliance with requirements. 19. Fees associated with the application are paid to the Council directly via a link provided within the Scottish Government Portal or sent directly to the Council’s office at Manse Brae. 20. A walkthrough of system functionality was provided by the Systems Administrator which demonstrated a robust, logical and transparent process with each staged process generated by responses from the previous on CIVICA. Process maps and procedures are available to all using CIVICA with additional copies available on a SharePoint site, these are regularly reviewed and team members made aware of any updates. The Procedural Handbook provided by Scottish Government is published on the internet and available to the public. The Council’s fees and charges schedule is consistent with fees published in the Procedural Handbook and standard document templates generated by CIVICA are currently being reviewed. 21. Both IDOX and CIVICA are interrogated monthly to provide statistical information to team leaders and quarterly to provide performance information for reporting purposes. 22. A set of Key Performance Outcomes (KPOs) have been published by the Scottish Government which are required to be adopted by all Building Standards units providing a verification service.
Page 7
7 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 The KPOs have been implemented and results are published on the Council’s website in the Annual Verification Performance Report that is updated quarterly. Where appropriate, the targets and results for KPOs are also updated quarterly on Pyramid, the Council’s performance management system. 23. The Annual Verification Performance Report includes the details of the verification services provided by the Council and contextual details of the related performance measures and results achieved. 24. Performance targets set are mostly aligned with requirements stipulated in the Scottish Government KPOs, one exceeds the requirement but will revert to match in the new financial year to ease pressure on officers and allow additional focus on commercial work. 25. The Council participates in benchmarking activity with the Clyde Valley Consortia and nationally across all 32 Scottish Councils which contributes to a national report published on the Scottish Government Website. Wider information sharing also takes place with the Local Authority Building Standards Scotland (LABSS) to share good practice and address any common issues. 26. The Council is required to make information and guidance available to the public including, Building Standards Register, copy documents, Customer Charter, performance reports, appeals and complaints procedure and general information. All were found to be available on the Council’s website or via additional links provided with the exception of copy documents that are only available to current or prospective owner, occupier or tenant by legislation and these can be requested by completing an online application form. Funds and resources are managed efficiently and effectively to maintain productivity and reliable ICT infrastructure 27. Professional staff are required to be educated to degree level and hold professional membership of a relevant organisation such as the Royal Institute of Chartered Surveyors (RICS). Assistants are in training and shadow professional members of staff who review and verify their work. Officers are responsible for meeting their own continuing professional development (CPD) as required to maintain their respective professional designations although some training is available in-house e.g. via team meetings or the Council’s eLearning platform LEON. Any issues identified in the recording of information is also discussed at team meetings to reinforce training previously provided. The council participates in a national competency framework that is in place across all Local Authorities in Scotland with good results. 28. A staff register of interests is not currently maintained, however, officers are aware of the need to advise management of any conflict of interest and request reallocation to another officer or area team. Officers are permitted to undertake private work in their own time, with prior consent from the Regulatory Services and Building Standards Manager, as long as it is out-with the Council area and does not impact on Council work. 29. Formal partnership arrangements are in place with Glasgow Caledonian University and ATK Partnership to address specialist subject matter where there is no in-house expertise, both of these arrangements are currently operating under extensions. 30. A Critical Activity Recovery Plan (CARP) is in place which outlines arrangements that can be implemented within each local area should the need arise. There is ongoing resilience within the team across the Council as any officer can process applications for any area, however, wherever possible, any visits required are undertaken by local officers to save on travel time and costs.
Page 8
8 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 31. Capacity issues are regularly discussed at weekly team meetings or with Regulatory Services and Building Standards Manager as required. Discussions may result in a decision to de-prioritise commercial work to ensure the Council’s own statutory requirements are met. 32. The IDOX and CIVICA systems as well as Server and SharePoint data are managed by the Council’s ICT services and are regularly backed-up as part of a corporate process. Patches to maintain security and optimum functionality are applied out with working hours where possible unless the update is urgent. System upgrades are tested by the systems administrator on a separate test system prior to implementing on the live system upon acceptance. Copies of all templates used are retained on a server to allow manual communications to take place should IDOX and CIVICA be unavailable for extended periods of time, these would be updated on both systems retrospectively. 33. Systems and servers are accessed by all members of the Building Standards team upon recruitment and completion of the corporate Acceptable Use Policy. Access rights are commensurate with levels of responsibility and user access is promptly removed when no longer required upon transfer or resignation. Although the Council undertakes some commercial work, this work cannot be accessed by other Local Authorities. A list of current system users was reviewed and found to be appropriate. 34. The systems administrator provides user training to all officers and administrative staff upon recruitment and following upgrades that result in system changes or additional functionality. Customer Service Centre staff who are expected to attend to planning and building standards matters are also trained by the systems administrator and an instruction note provided. A record of systems training is not currently maintained. Action Plan 1 35. The IDOX system is required to contain a range of fields from which KPO information can be reported, screen sharing technology was used to test the system and it was found that all required fields were available and were being used. 36. Quarterly performance reports are provided to Scottish Government and published on the Council’s website in the month following the end of the reporting quarter. Data to inform these reports is extracted from the IDOX system using MS Access due to historical issues in obtaining good quality reports from IDOX. Ad-hoc management information can be also be extracted and any revisions to reporting requirements imposed by Scottish government can be implemented promptly by the Systems Administrator who can update or create bespoke reports on MS Access without the need to liaise with the IDOX system supplier. 37. The Council is moving to use MS Office 365 across all services, however, MS Access is not included within this package and therefore not covered by that licence agreement. MS Access 2013 will cease to be supported by Microsoft from 31 March 2023 and will therefore be removed from the Council’s software estate, MS Access versions from 2016 to 2021 will be available under existing licence arrangements until 2026, thereafter, additional licence fees would be applicable. Following discussions with the Systems Administrator, an exercise has commenced to compare content of IDOX reports with those produced via MS Access to asses if historical issues have been addressed by the system supplier. Action Plan 2
Page 9
9 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 38. Regular meetings take place with the Finance Officer assigned to the building standards service where trends are reviewed over a 5 year period and projections are calculated for the current year. The analysis provided for January 2023 indicates that the income is expected exceed the budget value although the target may require to be reduced. Verifier actions are in alignment with the performance framework and undertaken in a consistent manner 39. All applications received are assessed by a Team Leader who will look at the type and value of works to determine who will undertake the work based on qualification and competence of surveyor or assistant. The risk level of an application is consistent with the allocation process, however, the risk level is not entered to the system for all applications, only those that are included within the quality assurance process. 40. The quality assurance process requires that a minimum of 5% of all applications are reviewed by a professional officer. Two possible checks take place, the first for issue of a points letter and the second for issue of a building warrant, both checks are for separate processes and are independent of each other. The sample selected for review is predominantly random augmented with some targeted sampling. The IDOX system contains details of checks that have taken place and associated documentation is generated in CIVICA. Data extracted from IDOX indicates that between 8.3% and 14.5% of applications have been checked over the last 4 years due to nature of applications received and staff competencies, therefore exceeding the target. 41. Quarter 3 performance information was reviewed to assess if the data included within the quarterly report was accurate: KPO1 – requires the service to minimise the time taken to issue a first report, building warrant or amendment, data extracts from the IDOX system were reviewed to verify the figures reported in support of time taken to issue the stated documentation and these were found to be accurate. KP05 – requires the service to maintain financial governance, for the purpose of this KPO only verification work is permitted for inclusion, other statutory work is excluded. A historical calculation of 87% time spent on verification work has been applied and considered to remain appropriate although there may be immaterial fluctuations. Reports were run from the Council’s financial management system (FMS) to verify cost figures reported. The income figures were verified using data extracted from IDOX to exclude income from commercial work undertaken as this is not recorded separately on the FMS. Both figures reported were found to be accurate. KPO6 – requires the service to commit to eBuilding Standards, the Council’s website provides a great deal of information for the public along with links to the Scottish Government’s Portal to submit their application electronically, any applications that are received manually are input to the system by officers thereby ensuring that all processes are managed electronically. KPO7 – requires the service to commit to objectives outlined in the annual verification performance report, this report is published on the Council’s website with quarterly updates, and each report shows summary of last 4 quarters and therefore equivalent to an annual report. There is no separate annual report.
Page 10
10 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 42. The Building Standards service has not set a target for KPO2 although this is currently being considered. Additionally, the service was successfully assessed against Customer Service Excellence (CSE) standards with the most recent report dated 9 June 2022, therefore KPOs 2, 3 and 4 were not included in the Q3 review of supporting data. The Building standards service demonstrates a commitment to continuous improvement and partnership working 43. Areas for improvement are identified by a number of means such as the annual CSE review, review of complaints received, discussions at team meetings and information sharing via networking arrangements. 44. Areas for improvement that have been identified are added to a service improvement log which is published on the Council’s website. This has been maintained since 2007 and last updated February 2023, it indicates the benefits achieved as well as a description of each improvement identified, the reason, who suggested it and when the improvement was introduced. 45. There is strong evidence of collaborative working taking place, this includes, Scottish Government to maintain compliance with national requirements, the Clyde Valley Building Standards Consortia and LABSS to consider common issues, aid consistency and share best practice, Area Property Action Groups which consider the Council’s position in respect of properties, land or buildings, external suppliers to undertake specialist assessments and commercial arrangements with two other Local Authorities.
Page 11
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Low 1 Systems Training Record Finding: A record of systems training that has been provided is not currently maintained. Recommendation: A record of systems training provided should be maintained. Management is unable to obtain information in support of training provided and staff competence in system usage. Establish the training record for systems training and arrangements for maintaining the records. Principal Team Lead – Building Standards 30 April 2023 VFM 2 KPO Reporting Finding: MS Access is used to extract data from the IDOX system for KPO reporting, however, a move to corporate use of MS Office 365 means that MS Access is not included within that licence agreement. Support for MS Access 2013 will expire 31 March 2023 and newer existing versions by 31 March 2026 thereafter additional arrangements and licences will be required. Recommendation: Building Standards services should revisit the reporting functionality of the IDOX system to assess if historical issues have been addressed and raise any outstanding anomalies with the system provider. This will provide contingency for MS Access reporting. This will provide contingency for MS Access reporting. Use of MS Access may require additional licencing fees from 2026. 1. Run all 7 IDOX standards reports and compare with the services MS Access reports 2. Identify and investigate differences 3. Report findings to IDOX and request feedback 4. Evaluate feedback and consider issues to service 5. Decide whether to continue with existing MS Access Reports or to migrate to IDOX suite of standard reports. Actions 1 – 3 Building Standards Data Systems Technician 30 June 2023 Actions 4 – 5 Regulatory Services and Building Standards Manager 31 December 2023
Page 12
12 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 13
13 Argyll and Bute Council – Internal Audit Report – Building Standards, March 2023 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.