202223_BurialRecords_FinalReport
Argyll and Bute Council · 20 June 2023
Back to Audit and Scrutiny Committee — 20 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Report June 2023 FINAL High Medium Low VFM Number of Findings 1 3 2 0 Burial Records Audit Opinion: Reasonable
Page 2
2 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 7 Appendix 1 – Action Plan ..................................................................................................................... 11 Appendix 2 – Audit Opinion ................................................................................................................. 15 Contact Details Internal Auditor: Mhairi Weldon Telephone: 01546 604294 e-mail: Mhairi.weldon@argyll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 1. Executive Summary Introduction 1. As part of the 2022/23 internal audit plan, approved by the Audit & Scrutiny Committee in March 2022, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Burial Records. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. Argyll and Bute Council (The Council) is a burial authority and as such has a legal duty to provide a burial facility in the Council area. 5. Due to the diverse geography of Argyll and Bute, a single burial ground is not appropriate and as such, the Council operates 131 burial grounds, 68 of which are closed leaving 63 able to take additional burials. As each cemetery nears capacity it is difficult to identify and purchase land which is suitable and cost effective for the purpose of accommodating burials. Five of the 63 operational cemeteries are expected to reach capacity within the next 5 years. A specific report detailing capacity issues has been submitted to the Environment, Development and Infrastructure (EDI) Committee on 2 March 2023. 6. The Council has been utilising a computerised Burial and Cremation Administration System (BACAS) since 2003, to record details of burials and cremations in addition to maintaining manual records at area offices. Burial records prior to 2003 have not been fully transferred to the BACAS to enable information to be accessed remotely. 7. The provision of a burial and cremation service across the Council area involves a wide range of staff in terms of management, administration and operational requirements. Due to an aging workforce, a number of key members of staff have reached or are approaching retirement age and there has been difficulty in recruiting and training replacements for those members of staff. 8. Charges for burial services are reviewed annually and updated as required, the fees charged by other comparable local authorities are similar in some elements and vary significantly in others. There are no charges imposed for burial of under 18s. 9. Income for services provided is not always received in a timely manner, as at 1 March 2023, £155k cemetery income is outstanding, £73k of which has been outstanding for greater than 3
Page 4
4 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 months and has been passed to the Council’s legal services to pursue in accordance with the Council’s corporate process. 10. The overall budget for burial services in the current year (2022-23) is £470k, there are elements of this that are uncontrollable, however, there are no major concerns regarding meeting this target. Scope 11. The scope of the audit was to review the control environment and administration of burial records as outlined in the Terms of Reference agreed with the Head of Roads and Infrastructure Services on 23 March 2023. Risks 12. The risks considered throughout the audit were: SRR 06 – Service Delivery Audit Risk 1 – failure to comply with relevant legislative/regulatory requirements Audit Risk 2 – recruitment and retention of trained workforce (age profile, training and absence) Audit Risk 3 – burial records may not be accessible in an electronic format in support of remote working arrangements Audit Opinion 13. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 14. Our overall audit opinion for this audit is that we can take a reasonable level of assurance. This means that internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Recommendations 15. We have highlighted one high priority recommendations, three medium priority recommendations and two low priority recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: A unified approach to records management should be adopted to establish consistency and provide resilience across the service. Additionally, a sample of burial records should be periodically checked for accuracy. This should be documented in a procedure note and issued to the relevant members of staff. Policies and procedures should be subject to periodic review and updated as required. Updated documents should be promptly circulated to staff and published on the Council’s website where appropriate.
Page 5
5 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 Liaise with the Council’s ICT Service to establish a more secure means of access to BACAS. Management should undertake a review of the BACAS system user requirements and ensure sufficient licences are purchased to maintain service delivery as well as legal compliance. Liaise with system provider and other Local Authorities to establish which additional features would provide benefits to the service. Source temporary additional resource to update historical burial records on BACAS. 16. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 17. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Burial records are complete, accurate and up-to-date. All Risks Reasonable Policies and procedures are in place and made available to staff, however these require to be reviewed on a regular basis. There is no procedure in place to guide staff in maintaining burial records which has resulted in some inconsistencies across the service and unnecessary printing of documentation received electronically. The BACAS system is updated with burial details following receipt of the application for interment. The system has additional functionality that may help deliver efficiencies but are not currently utilised. Traditional registers are updated with appropriate burial information to match BACAS system. Historical information from traditional registers has been updated on BACAS in one area and partially in others when lairs are re-opened, the majority of burial records have yet to be updated. There is no record of private (home) burials outwith registered private burial grounds and documentation in support of exhumations was not available at the time of the review. 2 Burial records are maintained in a safe All Risks Reasonable The BACAS system is installed on a terminal server managed by the
Page 6
6 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 and secure manner to preserve integrity of information stored. Council’s ICT service and supported by the supplier, Clear Skies. Users logon to the terminal server but there is no additional requirement to logon to the BACAS system, therefore any employee with access to the terminal server has unrestricted access to BACAS. The Council has purchased 8 licences for BACAS but it is unclear if this is the optimum number required. There are no supervisory checks in place and no reports are generated to highlight exceptions or management information. Traditional registers are stored securely either in locked rooms, a safe or in locked filing cabinets. Printed application for interment forms and supporting documentation were either stored with the registers or in offices which are locked when unattended. Where retained, electronic versions of the forms and documents are saved on the Council’s secure network drives. 3 Burial records are available to those with authority to access them and a General Data Protection Regulations (GDPR) compliant version made available to the general public upon request. All Risks Substantial The BACAS system is able to restrict user access levels according to level of responsibility but this is not currently used due to the method of access. Whilst this provides resilience across the service it also increases risk of unauthorised access and errors affecting data integrity. Leavers are promptly removed from the Council’s network via a corporate process, however, access may be retained if moving to another post within the Council. Burial registers are not currently made available to the public to view in compliance with GDPR legislation but information can be provided upon request and payment of associated charge. 18. Further details of our conclusions against each control objective can be found in Section 3 of this report.
Page 7
7 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 3. Detailed Findings Burial records are complete, accurate and up-to-date 19. Policies and procedures have been prepared and made available to employees on a SharePoint site, additionally, the Rules for the Management of Burial Grounds and Protocol for provision of cemetery and cremations services are available to the public on the Council’s website in addition to other general information. The documents are clear and concise, relevant to work involved and consistent with legislative requirements, however, there is no evidence that these documents have been subject to regular review. It is noted that an update to the Rules for the Management of Burial Grounds has been presented to the Environment, Development and Infrastructure Committee on 2 March 2023 and endorsed, this document has yet to be circulated to staff and published on the Council’s website. Action Plan 2 20. A system manual has been provided to the system administrator, however, it is not currently available to BACAS users. There are help menus embedded within the system and peer support is available for inputting of data, any system issues are progressed by the system supplier, Clear Skies. 21. There is no procedure document in place to guide staff in maintaining burial records. Whilst the burial registers vary from cemetery to cemetery, the application for interment form and other supporting documentation is consistent across the Council. It was observed at the time of the audit that there are some variances in the filing structure of these documents and updating of the BACAS burial system. Action Plan 1 22. Burials are arranged via phone call from a funeral director or applicant directly and recorded in a manual desk diary, the full details are promptly updated on the BACAS system upon receipt of the application for interment form and other relevant supporting documentation. Unless an existing lair is to be re-opened, lairs will be purchased at this stage and a certificate of right of burial is generated and issued to the applicant. The BACAS system also generates a digging slip which is passed to the appropriate operations team to include the burial service within their work schedule and financial summary to update the debtors system with the charges incurred. 23. The burial registers and lair plans located in Council offices are old and very delicate in some instances, they contain the required fields for recording information and are updated periodically when a few burials have accumulated as they are stored in other parts of the buildings. Where registers are also maintained at cemeteries, these are updated by the operations team when the burials take place. 24. The BACAS system is user friendly and contains all of the required fields for inputting burial information and has additional functionality that is not currently utilised. Users are not aware of any reports being generated to provide management information. Management is aware that other Local Authorities are using the booking function and recording additional information such as when lairs are levelled. It is also possible that the financial information may be extracted to feed the debtors system without the need to duplicate manual input. Action Plan 5
Page 8
8 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 25. BACAS has been used by the Council since 2003, whilst it has been updated with information from the traditional registers in some areas, this has not been possible in all areas due to the volume of work this requires. There has been some effort to update information when lairs are reused and information is to hand. Part 7, section 102 of the Burial and Cremation (Scotland) Act 2016 (The Act) requires “information and registers to be kept in electronic form”, Scottish Government has advised that this section is not yet in force, however, management should prepare for this change and ensure that all information is available electronically when implemented. Action Plan 6 26. A sample of 34 recent burials was selected for audit review and all were found to have been updated on BACAS, however, the applicant tab was not updated in one area as it was considered that the funeral director information was sufficient. Action Plan 1 27. The Application for interment form and supporting documentation is now submitted to the Council via email, a change that was implemented during remote working requirements as a result of Covid and has continued. These documents are then printed and filed within the local area office. Scottish Government has advised that the electronic copy is sufficient. Action Plan 1 28. Private burial grounds are recorded on BACAS, however, home burials are not. Section 23 of The Act requires that “Each local authority must prepare and maintain a register of private burials authorised by the authority”. When an enquiry for a private burial is received, the details are passed to colleagues in Environmental Health to provide information to the applicant. Whilst there is a record of the enquiry, the burial does not appear to be formally authorised or registered. Action Plan 1 29. Section 30 of The Act requires that “Each local authority must prepare and maintain a register containing prescribed information about exhumations of human remains”. When an exhumation is required, both the registers and the BACAS system are updated to reflect the removal of the human remains. In one instance BACAS had not been updated (this was corrected at the time of the audit visit) and we were informed that in another instance the record had been deleted as the remains were no longer within the lair. There is no separate register of exhumations maintained and at the time of the audit we could not be advised of the location of the formal documentation authorising each exhumation. Action Plan 1 30. The sample of 34 recent burials was also reviewed to ensure application for interment and all relevant supporting documentation was available for review at the time of the audit visit: The application for one interment and it’s supporting documentation could not be located in one area. One application did not include the appropriate document for transferring human remains from England to Scotland.
Page 9
9 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 With the exception of one very recent interment, all registers had been updated with the appropriate burial information and lair holders were recorded. Digging slips had been generated by BACAS, passed to the operations team and returned upon completion of the burial. Action Plan 1 Burial records are maintained in a safe and secure manner to preserve integrity of information stored 31. The BACAS system is located on a terminal server managed by the Council’s ICT service and is included within the routine back-up and business continuity processes applied at a corporate level. Users access the terminal server using a shortcut provided by ICT on their assigned laptop and are required to re-enter their network credentials to gain access. The BACAS system has 9 users assigned (one is system support), however, this does not prevent other users from accessing the system as no authentication is required to gain access, therefore, any user with access to the terminal server has full unrestricted access to BACAS. Action Plan 3 32. The Council purchased 8 licences for BACAS when previously installed on stand-alone desktop computers within area offices. At the time of the review it was unclear whether these were user licences or concurrent licences and whether 8 licences was optimum for the number of system installations and users in place. Action Plan 4 33. The BACAS system makes use of compulsory fields to ensure essential data is input and dates are added via a calendar icon. There are no supervisory checks in place and no exception or management information reports are generated. Action Plan 1 34. Registers and lair books were all stored safely in locked rooms, a safe or in a locked filing cabinet. The printed application forms and supporting documents were retained with the registers in one location and partially in another, the remainder were stored in files within the office area which are locked when unattended. Where electronic versions are retained, these are saved in the secure shared drive areas managed by ICT service. Burial records are available to those with authority to access them and a General Data Protection Regulations (GDPR) compliant version made available to the general public upon request 35. The BACAS system is able to apply access restrictions based on specific roles and user location, however, this is not currently implemented due to the method of accessing the system. Unrestricted access for all users of the BACAS system provides resilience across the service but it also increases the risk of unauthorised access and errors affecting data integrity. Action Plan 3 36. Leavers are promptly removed from the BACAS system when leaving the service, however this does not prevent them having access if moving to another post within the Council and network
Page 10
10 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 access is retained. Employees leaving the Council are removed from the ICT network as part of the corporate leaver process. Action Plan 3 37. There is no requirement for specialist stationery for system output. Printing is managed by the corporate print server which requires a personal access code to facilitate printing of documents. 38. It is not possible to make burial registers available to the public to view as the lair holder information may be covered by General Data Protection Regulations (GDPR). Searches can be made on behalf of members of the public upon completion of the lair enquiry form and payment of the associated charge. Officers will provide the applicant with the information requested and exclude any personal information they are not entitled to receive.
Page 11
Appendix 1 – Action Plan No. Findings & Recommendations Risk Agreed Action Responsibility / Due Date High 1 No Procedure for Records Management Finding: There is no consistent approach to updating and managing burial records across the Service. Finding: Private burials on home ground do not appear to be authorised or registered. Finding: Officers are printing documentation provided by funeral directors and applicants via email unnecessarily. Finding: Documentation was missing or could not be located at the time of the audit visit. Recommendation: A unified approach to records management should be adopted to establish consistency and provide resilience across the service. Additionally, a sample of burial records should be periodically checked for accuracy. This should be documented in a procedure note and issued to the relevant members of staff. An offence may be committed under The Act as data may not be fully or accurately populated on the BACAS burial system and lair/burial registers. Records may be misplaced or difficult to locate. A unified approach to records management will be implemented and documented in a procedure note. This will include a requirement for periodic sample checking to take place. Operations Manager, Roads and Infrastructure Services 30 June 2024 Medium 2 Review of Policies and Procedures Finding: Policies and procedures provided to the auditor contained no evidence of recent review or were not dated. Recommendation: Policies and procedures should be subject to periodic review and updated as required. Updated documents should be promptly circulated to staff and published on the Council’s website where appropriate. Policies and procedures may not reflect current working practices. Policies and procedures will be reviewed and updated if required. These will be re-issued to staff and published where appropriate. Operations Manager, Roads and Infrastructure Services 30 June 2024
Page 12
12 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 No. Findings & Recommendations Risk Agreed Action Responsibility / Due Date Medium 3 Access to BACAS Finding: BACAS is located on a terminal server and is available to all employees with access to that terminal server as no further user authentication is required to gain full system access. Recommendation: Liaise with the Council’s ICT Service and system supplier to establish a more secure means of access to BACAS. Unauthorised users may gain access to the BACAS system and affect the integrity and security of the data. The system supplier will be approached to activate the login function within the system to provide an additional layer of security. Operations Manager, Roads and Infrastructure Services 31 December 2023 Medium 4 BACAS Licences Finding: The Council has purchased 8 licences for BACAS, however, it is unclear if these are user or concurrent licences and whether 8 licences are the optimum required. Recommendation: Management should undertake a review of licences for the BACAS system. The council may have the incorrect number of licences in place to access the BACAS system resulting in legal challenge. The Council will liaise with the system supplier to ensure the optimum number of licences are in place to maintain service delivery. Operations Manager, Roads and Infrastructure Services 31 December 2023 Low 5 Additional Functions within BACAS Finding: BACAS system has additional functionality that is not currently utilised to provide efficiencies. Recommendation: Liaise with system provider and other Local Authorities to establish which additional features would provide benefits to the service. BACAS system is not fully- utilised to provide efficiencies and best value. The service will liaise with the system provider and other local authorities to identify useful additional system functionality and arrange training for implementation. Operations Manager, Roads and Infrastructure Services 30 June 2024
Page 13
13 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 No. Findings & Recommendations Risk Agreed Action Responsibility / Due Date Low 6 Historical Register Information Finding: The Burial and Cremation (Scotland) Act 2016 (The Act) requires information to be retained electronically although this is not currently in force it will be at a future date. The BACAS system has been partially updated with historical information recorded in burial registers, it has not been possible to update with all information due to the volume of work involved. Recommendation: Source temporary additional resource to update historical burial records on BACAS. Burial records may not be fully electronic when part 7, section 102 of The Act comes into force. The service will source temporary assistance to update records during Summer 2024. Operations Manager, Roads and Infrastructure Services 30 June 2024
Page 14
14 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 15
15 Argyll and Bute Council – Internal Audit Report – Burial Records, June 2023 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.