Internal and External Audit Report Follow Up 2022-23
Argyll and Bute Council · 20 June 2023
Back to Audit and Scrutiny Committee — 20 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 20 June 2023 INTERNAL AND EXTERNAL AUDIT REPORT FOLLOW UP 2022-23 1.0 INTRODUCTION 1.1 Internal and external audit reports include an action plan with a management response establishing the agreed action, timescale and responsible officer. Internal Audit record these on SharePoint and, on a quarterly basis, follow them up to ensure they are being progressed. 1.2 This report updates the committee on all open actions as at 31 March 2023 including information on actions where the agreed implementation date has been rescheduled. 2.0 RECOMMENDATIONS 2.1 To endorse the contents of the report. 3.0 DETAIL 3.1 The two tables below provide a numerical summary of open audit actions with a split between actions due by and due after 31 March 2023. 3.2 Appendix 1 provides further detail on actions that have either been delayed and rescheduled or for which Internal Audit have received no response from the service to inform this follow up.
Page 2
Table 1 - Actions Due by 31 March 2023 Table 2 - Actions due after 31 March 2023 Service Complete On Course Delayed & Rescheduled Total INTERNAL AUDIT CE – Financial Services 0 2 0 2 DH – Commercial Services 0 2 1 3 DH – Legal & Regulatory 1 1 0 2 KF – Customer Support Services 0 4 0 4 KF – Development & Economic Growth 0 2 0 2 KF – Roads & Infrastructure Services 0 4 0 4 H&SCP (IJB) – Adult Services (Older Adults & Community Hospitals) 0 0 1 1 H&SCP (IJB) – Finance & Transformation 0 1 0 1 H&SCP (SW) – Adult Services (Mental Health Learning Disability, Addictions & Lifelong Conditions) 0 4 0 4 H&SCP (SW) – Finance & Transformation 0 2 0 2 EXTERNAL AUDIT Nil 0 0 0 0 TOTAL 1 22 2 25 Service Complete Delay & Reschedule Evidence Required No Response Total INTERNAL AUDIT CE – Financial Services 3 2 0 0 5 DH – Commercial Services 1 0 0 0 1 DH – Legal & Regulatory 0 3 0 0 3 KF – Customer Support Services 1 0 0 0 1 KF – Development & Economic Growth 1 1 0 0 2 KF – Roads & Infrastructure Services 2 0 1 0 3 H&SCP (IJB) – Adult Services (Older Adults & Community Hospitals) 0 3 0 0 3 H&SCP (IJB) – Strategic Planning & Performance 2 1 0 0 3 H&SCP (SW) – Adult Services (Mental Health Learning Disability, Addictions & Lifelong Conditions) 3 4 0 0 7 LiveArgyll 1 0 0 0 1 EXTERNAL AUDIT Nil 0 0 0 0 0 TOTAL 14 14 1 0 29
Page 3
4.0 CONCLUSION 4.1 Satisfactory progress continues to be made implementing audit actions. 5.0 IMPLICATIONS 5.1 Policy - None 5.2 Financial - None 5.3 Legal - None 5.4 HR - None 5.5 Fairer Scotland Duty - None 5.5.1 Equalities – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands Duty - None 5.6 Risk –None 5.7 Customer Service – None Paul MacAskill Chief Internal Auditor 20 June 2023 For further information contact: Paul MacAskill, 01546 604108 Paul.macaskill@argyll-bute.gov.uk APPENDICES Appendix 1 – Action Plan Points Delayed & Rescheduled or with No Response
Page 4
Appendix 1 Action Plan Points Due 31 March 2023 - Delayed & Rescheduled/Evidence Required Service, Report, Plan no. & Finding Agreed Action Original and Revised Dates Comment Responsible Officer MEDIUM FINANCIAL SERVICES FIXED ASSET REGISTER (AIRS) 3. Asset Record Maintenance There are inconsistencies in descriptions when recording Council assets across the various systems and asset references are not always available to aid cross referencing. This results in difficulties reconciling assets held in service records to the fixed asset system AIRS. Work with Property Services and Fleet to ensure systems record the same assets and refer to references on other systems. 31 Dec 2022 31 Mar 2023 30 Jun 2023 The data matching exercise between both systems has been completed and the Concerto reference numbers harvested and assigned to the corresponding AIRS records. A data upload has been prepared to physically add the Concerto references to the records in AIRS and discussions are ongoing with the AIRS system supplier to confirm how to upload the reference data to AIRS. Completion of this work has been delayed by recent sickness absence but will be finished at the earliest opportunity. Delayed and Rescheduled Accountant - Capital MEDIUM LEGAL & REGULATORY SUPPORT CIVIL CONTINGENCIES 2. Civil Contingencies Duties Civil Contingencies officers are trained to comply with all duties of the Act, however, the Council’s business continuity duties are managed out with the Unit. A review of Business Continuity arrangements across the Council is to be progressed during 22/23 and part of that will be to integrate Business Continuity duties within the Civil Contingencies Unit as part of their wider resilience responsibilities. 31 Mar 2023 31 Mar 2024 An invitation to quote for the first part of the process, ie, a review of our current BCM programme and systems to ensure the council’s BCM programme is effective and robustly maintained has been issued to a number of consultants. Delayed and Rescheduled Governance, Risk and Safety Manager
Page 5
Service, Report, Plan no. & Finding Agreed Action Original and Revised Dates Comment Responsible Officer MEDIUM LEGAL & REGULATORY SUPPORT Heritage Assets 1. Valuations, Insurance & Fixed Assets Register Finding: Civic chains, archive documents and museum exhibits are not included within the Council’s programme of valuations. Finding: There is no inclusion of valuable archive documentation within the Council’s All Risks insurance policy. Finding: Civic chains, Museum exhibits and valuable archive documents are not included within the Council’s Fixed Asset Register, AIRS. Recommendation: Officers representing the various services involved should meet to discuss the requirements for valuation, insurance and inclusion within the Council’s Annual Accounts and nominate responsible officer(s) to take forward any actions identified as a result. Officers representing the various services involved will meet to discuss the requirements for valuation, insurance and inclusion within the Council’s Annual Accounts and nominate responsible officer(s) to take forward any actions identified as a result. 31 Mar 2023 30 Jun 2023 Civic Chains are included on the Council’s insurance but arrangements are being made for further valuation to update on individual basis; inclusion of Museum exhibits and archive documents on AIRs is being explored and actions planned to be complete by 30 June 2023. Delayed and Rescheduled Head of Legal and Regulatory Support HIGH LEGAL & REGULATORY SUPPORT ICT Remote Working 2. GDPR Training and annual refresher 21.4% of employees with a user accounts have completed the mandatory or refresher GDPR modules in 2021, falling below the target of 90%. An email will be issued to all networked employees reminding them of the requirement to complete the mandatory or refresher GDPR modules on LEON by 31 March 2023. 31 Mar 2023 30 Sep 2023 The mandatory module is undertaken as part of a new employee’s induction. The refresher training module has been revised/updated and sent to Organisational Development to build. Reminder email will be sent once confirmation is received that it is available in LEON. Delayed and Rescheduled Governance and Risk Manager
Page 6
Service, Report, Plan no. & Finding Agreed Action Original and Revised Dates Comment Responsible Officer LOW DEVELOPMENT & ECONOMIC GROWTH Private Sector Housing Grants & Adaptions 3. Procedure Notes and Shared Documents While the vast majority of requirements are included there would be benefit to updating these to reflect current working practices, which have evolved due to hybrid working arrangements and the digitalisation of records. Consideration should be given to creating a checklist to ensure consistent application of processes. Procedures and documents will be reviewed and updated. Checklists to be drawn up and introduced when updating the procedures 31 Mar 2023 30 Sep 2023 Meeting will be arranged with HSCP, Care and Repair and Housing Officers to update procedures and documents. This is scheduled to take place in early June 2023 due to staff shortages etc. Delayed and Rescheduled Team Lead - Housing operations LOW ROADS & INFRASTRUCTURE SERVICES STREET CLEANING 4. Updating of ELM Local Environment Teams (LETs) are not currently using tablet devices to indicate that work allocated has been completed. Supervisors are updating the system in some areas but this is not consistent across the Council. Reintroduce use of handheld devices subject to ongoing Covid restrictions etc. to allow efficient updates to ELM. 31 July 2022 31 Dec 2022 31 Mar 2023 Handheld devices reintroduced across the teams, supervisors have received refresher training and are now delivering training/toolbox talks to frontline staff to enable updates to be completed to the ELM system. Evidence Required Operations Manager, Roads & Infrastructure Services HIGH ADULT SERVICES (OLDER ADULTS & COMMUNITY HOSPITALS) HSCP - CARE PROGRAMME APPROACH (CPA) 1. CPA Procedures There are no agreed CPA written procedures, including client assessment processes, to ensure a consistent approach to CPA service provision across the HSCP. Processes and procedures will be developed across Argyll & Bute to improve consistency and ensure service provision is appropriate across the region. This is subject to the recruitment of key posts within the service which are currently vacant. 30 June 2022 31 Dec 2022 28 Feb 2023 30 Sep 2023 April 2023 - CPA administrator and co-ordinator in post, benchmark of clients on CPA completed and CPA process and criteria written, currently going through clinical quality group for ratification and roll out. Delayed and Rescheduled Consultant Nurse
Page 7
Service, Report, Plan no. & Finding Agreed Action Original and Revised Dates Comment Responsible Officer HIGH ADULT SERVICES (OLDER ADULTS & COMMUNITY HOSPITALS) HSCP - CARE PROGRAMME APPROACH (CPA) 2. CPA Training There is no programme of CPA training available to relevant HSCP staff to ensure a consistent approach to CPA service provision across the HSCP. A training programme will be developed once key service staff are recruited. 30 Sept 2022 28 Feb 2023 31 Dec 2023 April 2023, process for CPA awareness initiated, soft roll out to begin the process of understanding need and levels of understanding, both post holders able to and currently supporting teams to implement and progress supported CPA and are able to support training where needed across A&B. Delayed and Rescheduled Service Manager MEDIUM ADULT SERVICES (OLDER ADULTS & COMMUNITY HOSPITALS) HSCP - CARE PROGRAMME APPROACH (CPA) 4. Carefirst Carefirst does not have a specific identifier category for clients on the CPA programme. Carefirst will be replaced by the system Eclipse system in June 2022. Service is moving to Eclipse on June 2022, an identifier category will be included. 30 June 2022 30 Sept 2022 31 Mar 2023 30 Sep 2023 The go live date for Eclipse has been further delayed to June 2023. This will result in another delay in implementing this recommendation. Delayed and Rescheduled Service Manager/ Eclipse Project Manager MEDIUM STRATEGIC PLANNING AND PERFORMANCE HSCP - RISK MANAGEMENT - Risk Management Training 6. There is no formal, proactive programme of risk management training. Whilst we understand some training has been provided where requested by the Clinical Governance Manager and her team (and tailored to whom it is being delivered), there is no requirement for Risk Leads to have training and training records are not maintained. There is also no dedicated training programme in place for new members of the IJB or Audit Committee, such as within induction training. A formal programme of risk management training should be developed and delivered to all key personnel involved in the management of risk. 30 June 2021 30 June 2022 30 Dec 2022 31 Mar 2023 30 Sep 2023 The following actions are being taken - • Reviewing partner risk management online training resources. There has been a significant change of personnel within the team and we are keen to support a longer term approach to embedding risk management and this will be updated through the contingency risk and resilience group which is the appropriate internal governance. Clinical Governance Manager
Page 8
Service, Report, Plan no. & Finding Agreed Action Original and Revised Dates Comment Responsible Officer Risk management may be impaired due to insufficient risk training and support amongst key personnel. • Implementing a programme of system training (immediate) • Co-opting support from HR and the Business Improvement manager to support completion of the task at an integrated organisational level. Due to the review action an update will be provided by the next quarterly reporting period which indicates an actual completion date but the activity is started. Delayed and Rescheduled HIGH ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) Client Funds 3. Procedures This is a restricted report, content removed. The facility to set up individual bank accounts for each client will be made available to all Social Work Offices 31 Mar 2023 30 Jun 2023 Restricted Report, content removed. Delayed and Rescheduled Finance Manager Departmental Support HIGH ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) Client Funds 4. Procedures This is a restricted report, content removed. A new safe will be installed 31 Mar 2023 30 Jun 2023 Restricted Report, content removed. Delayed and Rescheduled SW Admin Manager
Page 9
Service, Report, Plan no. & Finding Agreed Action Original and Revised Dates Comment Responsible Officer HIGH ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) Client Funds 8. Procedures This is a restricted report, content removed. Local banking facilities will be set up for each Social Work Office 31 Mar 2023 30 Jun 2023 Restricted Report, content removed. Delayed and Rescheduled Finance Manager Departmental Support VFM ADULT SERVICES (MENTAL HEALTH LEARNING DISABILITY, ADDICTIONS & LIFELONG CONDITIONS/CSWO) SW - CHARGING FOR NON-RESIDENTIAL CARE SERVICES 4. Service Uptake Data Records held on Carefirst do not allow for an analysis of the level of service uptake compared to those assessed as having a need. If this analysis could be performed it would help inform discussions and decisions in relation to service uptake, charges and barriers to uptake. It would be advisable to progress this issue in conjunction with the CareFirst replacement programme which is scheduled to be complete by April 2022. Recommendation accepted. Further discussion will be held with supplier to include service uptake functionality and reporting capabilities on new system from April 2022. 31 Mar 2022 30 Sept 2022 31 Mar 2023 30 Jun 2023 Eclipse go live has now been further delayed to June 2023. Some further delay to the implementation of this recommendation is now expected Delayed and Rescheduled Deputy Head of eHealth HSCP
Page 10
Action Plan Points Due After 31 March 2023 - Delayed & Rescheduled/Evidence Required Service, Report, Plan no. & Finding Agreed Action Original and Revised Dates Comment Responsible Officer LOW COMMERCIAL SERVICES Externally Funded Projects - Rothesay Pavilion 3. Resources Consideration should be given to reviewing the extensive use of outside contractors and consultants as opposed to investing in in-house resources in regard to major capital projects especially in light of the projected overspend on the project. As part of the End Project Report, Lessons Learned, a review of the decision pertaining to project resourcing will be undertaken, and recommendations made to Head of Service with respect to the on-going efficient resourcing of projects. In developing future projects the Council will continue to give consideration to the most efficient resourcing model. 30 Jun 2023 30 Jun 2024 In approving the Staged Approach to Project Completion on 23 February 2023, the Council has accepted the resourcing structure for the delivery of the Stage 2a works, which are to be delivered between 1 May 2023 and 14 June 2024. How the subsequent stages of works are to be resourced will be determined by a number of factors, including: securing the additional funding necessary to take those works forward; the procurement route for securing the services of a suitably qualified and experienced principal contractor; the availability of the existing Design Team and Cost Consultants to support the delivery of the later stages of implementation; and the availability, experience and capacity of internal technical resources to provide support to the project through the next stages of implementation. These will all be considered in the interim period to arrive at a preferred implementation strategy for Stage 2b and Stage 2c, which will be submitted to the Policy and resources Project Manager
Page 11
Service, Report, Plan no. & Finding Agreed Action Original and Revised Dates Comment Responsible Officer Committee and full Council for consideration and approval at the appropriate juncture, but realistically this may not be fully determined prior to completion of the Stage 2a works on 14 June 2024. Delayed and Rescheduled HIGH ADULT SERVICES (OLDER ADULTS & COMMUNITY HOSPITALS) HSCP - CARE PROGRAMME APPROACH 3. Client Records There is no consistent agreed process for maintaining client records, including the recording and sharing of information. HSCP expect to transition to new Eclipse system. Implementation of the new system and associated processes and procedures will address this recommendation and the Data Officer will be involved in the development of processes and procedures. 30 June 2022 30 Sept 2022 31 Mar 2023 30 June 2023 30 Sep 2023 The Eclipse go live date has been further delayed to June 2023 by the project board. Further delay in implementing this recommendation is one of the implications of this. Delayed and Rescheduled Service Manager/ Eclipse Project Manager