Final Audit Plan ABC 23-24
Argyll and Bute Council · 16 March 2023
Back to Audit and Scrutiny Committee — 16 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL COMHAIRLE EARRA-GHÀIDHEAL AGUS BHÒID INTERNAL AUDIT PLAN 2023-24
Page 2
2 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Contents Purpose of Internal Audit ............................................................................................................................................................................................... 1 Public Sector Internal Audit Standards (PSIAS) Requirements.......................................................................................................................................... 1 Risk Assessment............................................................................................................................................................................................................. 2 Strategic Risks................................................................................................................................................................................................................ 4 Resourcing the Plan ....................................................................................................................................................................................................... 4 Confirmation of Independence ....................................................................................................................................................................................... 5 2023/24 Internal Audit Plan ........................................................................................................................................................................................... 5 Monitoring the Plan ....................................................................................................................................................................................................... 5 Quality Assurance and Improvement Programme ........................................................................................................................................................... 6 Conclusions.................................................................................................................................................................................................................... 6 Appendix 1 – 2023/24 Internal Audit Plan....................................................................................................................................................................... 7 Appendix 2 – 2023/24 Internal Audit Plan by Council Directorate / Head of Service ........................................................................................................10 Appendix 3 – Strategic Risk Register (Abridged) .............................................................................................................................................................11 Contact Details Chief Internal Auditor: Paul Macaskill Telephone: 01546 604108 e-mail: paul.macaskill@argyll-bute.co.uk www.argyll-bute.gov.uk
Page 3
1 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Definition of Internal Audit 1. Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. Source: Section 4: Definition of Internal Auditing: Public Sector Internal Audit Standards Purpose of Internal Audit 2. The main objective of internal audit is to provide a high quality, independent audit service to Argyll and Bute Council (the Council) which provides annual assurances in relation to internal controls and overall governance arrangements. In addition to this primary assurance role, internal audit will also: support the S95 Officer and the Audit & Scrutiny Committee (the Committee) in the discharge of their duties support the Council’s Monitoring Officer support the Council’s anti-fraud and corruption arrangements provide guidance on control implications for new or changed systems where appropriate support the Council and the Strategic Management Team during key transformational/ change projects. Public Sector Internal Audit Standards (PSIAS) Requirements 3. PSIAS sets out the requirement for the: Chief Internal Auditor (CIA) to prepare a risk-based audit plan which takes into account the Council’s strategic objectives, associated risks and the views of senior management and the Committee CIA to review and adjust the plan as necessary in response to changes in the Council’s business, risks, operations and priorities audit plan to incorporate or be linked to a strategic or high-level statement of how internal audit will be delivered and developed in accordance with the Internal Audit Charter and how it links to the organisational objectives and priorities.
Page 4
2 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Risk Assessment 4. Internal audit’s approach to annual audit planning is risk-based with all areas which may be subject to audit review contained within an audit universe which is subject to formal review, at least annually. This provides a layered approach to obtaining a sufficient profile of the organisation covering Core Assurance, Audit Needs Assessment and Audit Universe. The audit universe includes all significant activities and systems that contribute to the achievement of the Council’s priorities and objectives. This is displayed in the diagrams on page 5 of this report. 5. The audit universe is risk assessed each year to help determine the annual audit plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Note however that that the audit universe, whilst a key factor, is not the only consideration when determining the audit plan. Senior management have been consulted on priority areas for review, and cognisance is taken of the plans of external audit and other statutory agencies, in order to avoid duplication, and increase potential for cross reliance. 6. The audit universe risk assessment is based upon a matrix taking account of scores for each potential audit area in respect of: materiality (based on expenditure) sensitivity (Control Environment, Management Concerns, Political Sensitivity, Regulatory Compliance, System Complexity and Extent of Changes – these help to provide a wide understanding of the risks and implications to the organisation in all of its functions) time elapsed since it was last subject to review overall audit assessment when it was last subject to review. 7. We employ a risk-based priority audit planning tool to identify those areas where audit resources can be most usefully targeted. This involves scoring a range of systems, services and functions across the whole Authority, known as the “Audit Universe” using a number of factors/criteria. The final score, or risk factor for each area, together with a priority ranking, then determines an initial schedule of priorities for audit attention. Furthermore, our reliance and successful operation is founded upon the need for strong Information Technology arrangements which support key systems across the Council, therefore, it is appropriate that an annual review is scheduled in this area based on risk and discussions with management.
Page 5
3 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan 8. The matrix gives an overall “score” for each area that is used to prioritise audit reviews. The audit plan for the year has been created by:
Page 6
4 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Strategic Risks 9. The Strategic Risk Register records the Council’s own assessment of the most potentially damaging risks and their likelihood of occurrence. This document is used to inform the annual audit plan with identified reviews cross referenced to the strategic risk register. An abridged version of the strategic risk register is included in appendix 3 for reference. In addition, Operational Risk Registers are reviewed to identify high risk areas and which we take cognisance of in assessing and scoring the Audit Universe in terms of wider corporate risk which helps to provide a more comprehensive overview of the organisation. Resourcing the Plan 10. Internal audit has a core establishment of five members of staff, due to a retirement of one member of staff we are currently operating with four full time equivalent officers and one contracted member of staff, two of which professionally qualified members of staff. Available audit days have been calculated as 768 days (including management and administration time), following the deduction of annual leave, training, a small provision for sickness, 50 days to deliver scrutiny work and 50 days to deliver the HSCP internal audit function. This 768 days total includes the CIA’s input to audit reviews and the running of the internal audit team and a contingency in the event of unplanned work. 11. Given the range and complexity of areas to be reviewed it is important that suitably qualified, experienced and trained individuals are appointed to internal audit positions. The CIA, in compliance with PSIAS hold appropriate professional qualifications (CIPFA and Institute of Internal Audit). Also within the internal audit section we have one contracted CIPFA qualified team member, one AAT and CIA qualified member and one training for CIPFA. 12. Internal audit officers identify training needs as part of their annual appraisal process and are encouraged to undertake appropriate training, including in-house courses and external seminars as relevant to support their development. 13. Through an assessment of the mix of knowledge, skills and experience of the audit team, it is considered that the available resources are the minimum to achieve the work outlined in the plan.
Page 7
5 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Confirmation of Independence 14. PSIAS requires internal audit to communicate, on a timely basis, all facts and matters that may have a bearing on our independence. We can confirm that the staff members identified to complete the reviews in the 2023/24 annual audit plan are independent and objectivity is not compromised. 2023/24 Internal Audit Plan 15. Appendix 1 presents the internal audit plan for 2023/24. As our internal audit approach is informed by risks, where appropriate, the plan is cross- referenced to the strategic risk register contained at appendix 3. Appendix 3 also demonstrates the strategic risks that were subject to audit focus in 2022/23 and those we are projecting to cover in the periods 2023/24 and 2024/25. This provides assurance to the Committee that key strategic risks are subject to audit coverage over a three year cycle. Note that the projected timescales in appendix 3 are provisional as these may change to reflect changes in the Council’s risk environment. 16. Appendix 2 presents the 2023/24 internal audit plan in a different format to provide assurance to the Committee that it provides appropriate coverage across all the Council’s directorates and head of service’s areas of service delivery. Monitoring the Plan 17. Internal audit reports on performance to the Committee on a quarterly basis including full copies of audit reports issued, progress implementing audit recommendations, performance against agreed performance indicators and a summary of all internal audit activity in the previous quarter. Paul Macaskill Chief Internal Auditor Moira Weatherstone Auditor Mhairi Weldon Trainee Auditor Annemarie McLean Trainee Auditor Leanne Rennie Audit Assistant
Page 8
6 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Quality Assurance and Improvement Programme 18. The PSIAS require each internal audit service to maintain an ongoing quality assurance and improvement programme (QAIP) based on an annual self- assessment against the Standards, supplemented at least every five years by a full independent external assessment. 19. The Scottish Local Government Chief Internal Auditors’ Group (SLACIAG) has developed a framework for external assessments to be undertaken by member authorities of SLACIAG on a broadly reciprocal arrangement utilising a peer review option. The Council’s internal audit team has participated in this framework and an external validation of its own self-assessment took place during 2017/18 which concluded that we demonstrated overall compliance with PSIAS with many areas of strong practice. The next scheduled external assessment is currently in progress with findings reported in 2023. 20. In 2022/23 internal audit carried out an internal self-assessment against PSIAS and prepared a submission for external evaluation, the result of this evaluation will be reported on when the results have been communicated to the Council. It confirmed the service fully conformed to PSIAS all 14 assessment areas. The area previously self-assessed as ‘Generally Conforming’ with improvements built into the service’s QAIP has been completed with the appointment of an Interim Chief Internal Auditor. 21. The internal audit team review their QAIP on a quarterly basis and report it to the Committee as part of the standard agenda item ‘Internal Audit Summary of Activities.’ The programme details all improvement activity being progressed by the team. Conclusions 22. The pressures, demands and expectations on Local Authorities in Scotland have increased year on year on the backdrop of challenging financial settlements in which to deliver key services to those across Scotland including Argyll and Bute. This Internal Audit Plan seeks to assist the Council’s Executive Leadership Team (ELT) and senior managers, together with those charged with governance, specifically, the Council’s Audit and Scrutiny Committee that assurance in our systems, approach and outcomes meet the needs of the communities we serve whilst achieving ‘Best Value’ in the use of our finite resources. 23. The resourcing of this plan is based on the existing staff levels and contractual input in order that a balance of qualified and experienced staff can be allocated to audit work which matches their skills base and experience. In addition, such resourcing is considered as the minimum essential in which to deliver this plan across the Council during 2023/24. We would also like to express our gratitude to the Council’s senior managers who have assisted us in the production of this plan.
Page 9
7 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Appendix 1 – 2023/24 Internal Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Cross Cutting Continuous Monitoring Programme Budgeting 15 Cyclical review of key controls over an 18 month programme of audit testing. Council Tax and NDR 20 Creditors 20 Debtors 15 General Ledger 15 Payroll 25 Treasury management 15 VAT 15 Follow–up 45 Compliance Pippa Milne Financial Services Financial Ledger 25 Post implementation review to determine how the system is operating paying particular attention to feeder systems, reporting functionality, procedures and training. Financial Services Risk Management 15 Assess the adequacy of, and compliance with, the Council’s risk management arrangements. Douglas Hendry Education – Wendy Brownlie Pupil Registration 15 Review the arrangements for the new online registration system for pupils going to school. Education – Wendy Brownlie Engagement & Consultation 20 Review the process of engagement and consultation that led to the establishment of ‘Stretch Aims’ as required by Scottish Government to close the poverty related attainment gap. SRR09 Legal and Regulatory Support Freedom of Information (FOI) 20 Review of the process and procedure for the collection and response to FOI requests and assess the response times across the Council. Commercial Services Compliance Review 15 Review and assess the arrangements for the provision of period products throughout relevant Council establishments. Commercial Services Building Cleaning 20 Review and assess the arrangements for cleaning across the Council establishments. Kirsty Flanagan Roads and Infrastructure Services - Jim Smith Fleet Management 20 Review the arrangements for the authorisation and use of hire vehicles, establishing whether 'best value' is achieved.
Page 10
8 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Roads and Infrastructure Services Pupil and Public Transport 25 Review the methodology for ASN transport spend; looking at scope for the potential of merging normal bus services with school/ASN transport; and the distance from home to school transport. Roads and Infrastructure Services Piers and Harbours 20 Review of charging and income arising from piers and harbour dues. Development and Economic Growth Oban Airport 15 Annual review to provide assurance re compliance with operational manual and assess compliance with the aerodrome operating manual. Development and Economic Growth Planning 25 Review the systems and process in place in respect of Planning focusing on efficiency of processes and improvements in communication with customers. SRR01 Customer Support Services Human Resources 30 Review the use of causal staff and extensions of these arrangements and determine whether there are any contractual implications and that the correct contractual status is reflected on the Payroll system. SRR06 Customer Support Services Cloud Based Computer Services 20 Review systems in process in place to support security and data integrity of Cloud Based services. SRR11 Fiona Davies H&SCP Registration and Training SSSC Registration 25 Assess the arrangements for evidencing SSSC registration, monitoring and renewals within the Council. H&SCP Client Funds Client Funds 25 Assess the introduction and implementation of client fund accounts held on behalf of clients who lack capacity. SRR07 H&SCP - Learning and Physical Disabilities Learning and Physical Disability Care Packages 30 Review of the management and governance of physical and learning disabilities and mental health high cost packages. SRR07 Kevin Anderson LiveArgyll Establishment visits 35 Cyclical audit approach to assess LiveArgyll establishment’s compliance with physical controls and compliance with SOP’s. Verification Activity LGBF Accuracy 10 Accuracy of submission. SPT Annual Claim Accuracy 2 Accuracy of submission.
Page 11
9 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Education Maintenance Allowance Accuracy 5 Accuracy of submission. Stores Stock count 5 Assess stock count procedures. Summary of Days Directorate Contact Number of Days 2023/2024 Cross Cutting – Continuous Monitoring 185 Pippa Milne 40 Douglas Hendry 90 Kirsty Flanagan 155 Fiona Davies 80 LiveArgyll 35 Verification Activity 22 Contingency 61 Total 668
Page 12
10 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Appendix 2 – 2023/24 Internal Audit Plan by Council Directorate / Head of Service Pippa Milne Douglas Hendry Kirsty Flanagan Fiona Davies Financial Services Education Legal & Regulatory Support Commercial Services Customer Support Roads & Infrastructure Development & Economic Growth Health & Social Care Partnership Financial Ledger Risk Management Pupil Registration Engagement and Consultation Education Maintenance Allowance Freedom of Information (FOI) Compliance Review Building Cleaning Human Resources Cloud Based Computing Piers and Harbours Income Pupil and Public Transport Fleet Management Use of Hire Vehicles Planning Oban Airport SSSC Registration Learning and Physical Disability Care Packages Client Funds Live Argyll Establishment visits 2023-24 Other Activity NFI – Counter Fraud Team Follow Up Local Government Benchmarking Framework
Page 13
11 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan Appendix 3 – Strategic Risk Register (Abridged) No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 1 Population and Economic Decline Failure to identify relevant factors contributing to the decline and failure to develop strategies and actions targeting these factors. 20 1. Local outcome improvement plan targets population and economic recovery 2. Maximise external funding opportunities 3. Economic Strategy 4. Strategic infrastructure plan 5. Area economic development action plans 6.Promote and Market Argyll and Bute 7. Maximise social-eco benefits via effective partnership working 8. Single Investment Plan 9. Refugee sponsorships are fully supported 10. Temp accommodation is in place for all refugees 16 Treat 1. Lobbying activity in pursuit of regional immigration policies and related strategies 2. Rural Growth Deal Outline Business Cases and Final Business Cases to be developed in 2022/23 and Deal to be signed late 2022 or early 2023. 3. Preparation of bid to Levelling Up Fund – preparing for April 2022 in time for submission date which is still to be confirmed. 4. Settlement Officer post agreed to be funded 50:50 from HIE/Council focusing on barriers to people living in communities, housing and others. 5. Preparation of a pipeline of projects across Argyll and Bute in order to be able to react to any other bid funding as and when it is announced. 6. UK Shared Prosperity Fund Investment Plan for next 3 years prepared and submitted to Policy and Resources Committee on 11th August 2022 - next iteration will provide further update. 2019/20 (Scrutiny) 2023/24
Page 14
12 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 7. Multi-agency approach to refugee settlement underway linking with national processes and agendas.
Page 15
13 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 2 Condition and suitability of Infrastructure & Asset Base Infrastructure and asset base does not meet current and future requirements and is not being used or managed efficiently and effectively. 16 1.Asset management board 2.Robust capital planning and monitoring 3. Asset management work plan 4. Business case modelling including sustainability, development and strategic change 5. Intelligence and best practice sharing via Heads of Property Group. 6. Community Empowerment and Community Asset Transfer – Arrangements in place to evaluate and determine requests. 7. Roads Asset Management Plan 8. Status and Options Report 9. R&A Services control hub and joint operations team 10. One Council Property Approach 12 Treat 1. Development of capital strategy in 2022. 2. 'Modern Workspace Programme will review, engage and rationalise property portfolio for future needs of the Council. Changes will take place on phased and town by town basis. Programme will be running for 3 years - April 2024 2020/21 2021/22 2022/23
Page 16
14 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 3 Financial Sustainability Insufficient resource to meet current and future service requirement. Budget not aligned / does not support business outcomes 16 1. Longer term financial planning and financial strategy 2. Income generation activity 3. Robust budget preparation and budget monitoring protocols 4. Maintaining adequate contingency with reserves. 5. Digital transformation 6. Effective workforce planning model 7. Business Outcomes 8. Financial Services resilience building project including knowledge sharing and development of guidance notes 12 Treat 1. Discussions are continuing in respect of a change programme that will include ensuring that the Council can operate within its budget (2022 for year 2023/24). 2. Rural Growth Deal Outline Business Cases and Final Business Cases to be developed in 2022/23 and Deal to be signed late 2022 or early 2023. 3. Implementation of new general ledger system with enhanced budget planning and forecasting capabilities (July 2022) 4. Investment in professional training through Grow Our Own Activity. 5. Officers considering implications of service concessions guidance and capital accounting review Terms of Reference and how that impacts future financial sustainability. 2019/20 (Scrutiny) 2020/21 2022/23 2023/24 Ongoing via Continuous Monitoring 4 Governance and Leadership Governance and leadership arrangements are 16 1. Administration in place with working majority 2. Members Seminar programmes 3. Mentoring and Coaching Support for policy leads and Senior Management 4. Priorities agreed by Council 8 Treat 1. Monitor delivery of BV action plan (ongoing date) 2020/21 (Scrutiny)
Page 17
15 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage not conducive to effective working and lead to a lack of strategic direction. 5.Corporate Plan sets out objectives 6. Performance Improvement Framework and Service Planning. 7. Leadership development programme. 8. Council constitution regularly reviewed and updated. 9. Established partnership governance arrangements 10. Scrutiny arrangements in respect of Police, Fire and Health. 11. Governance arrangements for scrutiny established 5 Engagement and Understanding the needs of the Community The Council fails to understand service user needs and emerging demographic trends and does not align service delivery to meet these 12 1. Community Planning partnership 2. Community Engagement Strategy 3.Customer Service Board 4. Operation and development of panels and forums. Young people’s plan, citizens panel 5. Budget Consultation 6.Comprehensive Complaints Protocols 7.Demographic and end user analysis 9 Treat 1.Deliver agreed actions in BV3 action plan relating to Work with Communities and Community Groups to improve engagement - September 2022 2022/23
Page 18
16 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 6 Service Delivery Insufficient resources to ensure effective service delivery 9 1. Performance Improvement Framework 2.Service Improvement plans 3.Argyll and Bute Manager programme 4. Customer needs analysis Protocols 5.Demographic and end user analysis 6.Workforce Planning 7.Internal and External Scrutiny Arrangements 8.Complaints process 6 Treat 1. Monitor progress of performance mgt project and implement recommendations (Ongoing from Oct 2020 to Sept 2022) 2. Budget approach being developed to look at longer term rather than 1 year focus - will be discussed at first Budget Working Group meeting in September. The approach looks at duties/powers and discretionary services. 2021/22 2023/24 7 Health and Social Care Partnership Failure to deliver strategic objectives and integrate Health and Social Care services in an efficient and effective manner exposes the Council, as a key partner, to unacceptable financial and reputational risk. 20 1. HSCP integration scheme approved by Scottish government 2. Strategic Plan in place 3. Performance and Financial reporting arrangements in place 4. Independent audit arrangements in place. 5. Integrated Joint board with elected member representation including Council Leader 6.Chief Officer member of ABC Senior Management Team with co-location of officers 7. Tripartite leadership agreement 8. Monitoring of HSCP financial position. 9. Medium term Financial Plan in place. 10. Establishment of Strategic and Tactical Groups with links to HSCP, NHS and national/regional resilience groups 12 Treat 1. Develop options to deliver sustainability of future years budgets (ongoing) 2. Completion of Strategic Plan which was delayed due to COVID. 3. Assessment on impact of COVID on services in short, medium and long term. 4. Financial assessment of the financial implications on the Council of services transferring to the NCS. 5. Development and regular review of Economic Recovery work stream with input from representatives across the 2019/20 2020/21 2022/23 Assurance also taken from IJB internal audit function
Page 19
17 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage organisation and the Health and Social Care Partnership. 8 Civil Contingency & Business continuity Arrangements are not effective. 8 1. Emergency Planning Test events 2. Critical Activity Recovery Plans 3. Roll out of Community resilience partnership programme 4. Peer review of major exercises undertaken to provide external validation of planning process 5. West of Scotland local resilience partnership 6.Cross sector expertise and partnership working 7. Emergency Management Support Team (EMST) meetings 8. Training 9. EU Withdrawal Tactical Working Group with arrangements for reporting to the West of Scotland Resilience Partnership 6 Treat Develop long term test schedule for DRPs to be presented to the SMT (December 2021) 2021/22
Page 20
18 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 9 Welfare Reform Implementation of welfare reform is not managed well resulting in increased poverty and deprivation or short term crisis 12 1. Financial Inclusion and Advice Group established 2. Joint working with DWP, CPP and other agencies 3. Child Poverty Planning Group set up and active 4. Flexible Food Fund created. Supporting householders in our area with funds and advice to address food and fuel insecurities 6 Tolerate 1. Extend Flexible Food Fund Contract for a further year to March 2023. 2. Council, HSCP and third sector deliver range of 20 Covid related support projects under the Flexible Fund banner by March 2023. 3. Deliver sustainable school clothing bank across the Argyll and Bute area by December 2022. 4. One-off top-up payments of £75 per child issued to School Clothing Grant recipients by end of February 2022. 5. Argyll and Bute centric anti- poverty training delivered to 600 Council, NHS and third sector staff by March 2022. 6. ""Worrying about money"" leaflet to be issued with Council Tax bills containing advice and support for people with money worries in March 2022. Update website with information and support. 2019/20 2023/24
Page 21
19 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 10 Waste Management Unable to dispose of waste in landfill sites due to the implications of the biodegradable municipal waste (BMW) landfill ban in 2025 20 1. Helensburgh and Lomond waste solution available via third party offtakers 2. Waste strategy 16 Treat 1. Options Appraisal undertaken by external consultants and will be reported to EDI Committee in December 2022, which will determine a compliant solution on the BWN ban by the deadline of December 2025. 2. Decision will be required by Council as to whether they request a derogation in respect of waste to end the Waste PPP Contract. 3. Officers are keeping a watching brief on implications of the Barr Environmental position. 4. DRS is being reviewed and officers are keeping a watching brief on this which is due to be implemented in August 2023 and what implications this could have for the Council. 2021/22 (Scrutiny) 2023/24 11 Service Delivery - Cyber Security Unable to deliver services to customers because of failure of ICT systems following major cyber security breach 20 1. ICT Security & compliance officer in post, producing weekly threat analyses, member of CiSP 2. PSN and Cyber Essentials Plus accreditations for corporate network 3. Regular patching regimes in place 4. ICT Disaster recovery plans tested regularly 5. All critical activities have recovery plans developed (CARP’s) 15 Treat 1. Review all contingency plans with updated knowledge from SEPA and UHI Cyber Attacks. 2. Work with Scottish Government Cyber Resilience Team to test ICT response 3. Issue regular communications to raise awareness of importance of cyber security and awareness 2019/20 2022/23 2023/24
Page 22
20 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 6. Review the issuing of regular communications to raise awareness of importance of cyber security and awareness again 4. Enforce password changes when found to be weak 5. Cyber Security Resilience Exercise planned for late February 2022. 6. Continued close review of disaster recovery plan and associated tests, finalise and test incident response procedure, and review of mirroring between the 2 data centres (monthly at ITMT) and backup 7. Review and progress requirements for Education Network to achieve CE+ accreditation. 12 Cost of Living Crisis The Council are unable to respond to the implications arising from the 'Cost of Living' crisis 25 1. Financial stability and support to HSCP 2. Social Welfare and Poverty Funding assistance. 3. Focused support and multi-agency approach where risk is highlighted 4. Monitoring of trends in service use to high light any significant change as a result of financial hardship 5. Targeted measures - for example to those receiving Council Tax reductions - via Gift Cards and Flexible Food and Fuel Fund 12 Treat 1. Review and monitor changes in demand for key services which correlate to personal effects arising from financial distress. 2. Assessment of the 'Cost of Living' crisis on wellbeing and service capacity/sustainability - December 2022
Page 23
21 Argyll and Bute Council – Internal Audit 2023/24 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 13 Impact of Climate Change The Council or communities are overwhelmed by severe or more frequent flooding, landslides, rainfall, storms, sea level changes or hot weather events due to changes in global temperature caused by climate change 25 1. Continued delivery of Council De- Carbonisation Plan 2. Civil Contingencies Manager liaising/ collaborating with Regional Resilience Partnerships and other resilience partners in terms of storm event, hot weather events, cut off communities, landslides etc. 3. Development and delivery of an integrated approach to decarbonisation and adaptation of Argyll and Bute as a Region via Community Planning Partnership 4. Roads & Amenity Services continue to develop asset management plan and address strategic risks in terms of rising sea levels, bridge repairs, critical infrastructure vulnerability 12 Treat 1. Review of De-Carbonisation Plan December 2024 2. Consideration of all Council Papers with climate change as consideration / implications - ongoing 3. Review scoring of business cases and pipeline of strategic projects with enhanced climate change considerations 2021/22