Internal and External Audit Report Follow Up 2021-22
Argyll and Bute Council · 23 June 2022
Back to Audit and Scrutiny Committee — 23 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
ARGYLL AND BUTE COUNCIL AUDIT AND SCRUTINY COMMITTEE FINANCIAL SERVICES 23 JUNE 2022 INTERNAL AND EXTERNAL AUDIT REPORT FOLLOW UP 2021-22 1.0 INTRODUCTION 1.1 Internal and external audit reports include an action plan with a management response establishing the agreed action, timescale and responsible officer. Internal Audit record these in a database and, on a monthly basis, follow them up to ensure they are being progressed. 1.2 This report updates the committee on all open actions as at 31 March 2022 including information on actions where the agreed implementation date has been rescheduled. 2.0 RECOMMENDATIONS 2.1 To endorse the contents of the report. 3.0 DETAIL 3.1 The two tables below provide a numerical summary of open audit actions with a split between actions due by and due after 31 March 2022. Table 1 – Actions due by 31 March 2022 DMT/Service Complete Delayed/ Rescheduled No Response Evidence Required Total Internal Audit CE – Financial Services 2 0 0 0 2 KF – Customer Support Services 2 3 0 0 5 KF – Roads & Infrastructure Services 0 1 0 3 4 H&SCP (SW) – Adult Services (Mental Health Learning Disability, Addictions & Lifelong Conditions) 1 0 0 0 1
Page 2
External Audit KF – Customer Support Services 0 0 0 1 1 External Audit TOTAL 5 4 0 4 13 Table 2 – Actions due after 31 March 2022 DMT/Service Complete Delayed/ Rescheduled No Response On Course Evidence Required Total Total Internal Audit CE – Financial Services 3 1 0 11 0 15 DH – Commercial Services 0 1 0 2 0 3 DH – Legal & Regulatory 0 0 0 3 0 3 DH – Lifelong Learning & Support 0 0 3 1 0 4 KF – Customer Support Services 0 1 0 2 0 3 KF – Development & Economic Growth 0 0 0 3 0 3 KF – Roads & Infrastructure Services 0 2 0 10 0 12 H&SCP (SW) – Adult Services (Mental Health Learning Disability, Addictions & Lifelong Conditions) 0 0 0 2 0 2 H&SCP (SW) – Children & Families and Criminal Justice 0 0 0 0 1 1 LiveArgyll 0 0 0 1 0 1
Page 3
External Audit TOTAL 3 5 3 35 1 47 3.2 Appendix 1 provides further detail on actions that have either been delayed and rescheduled or for which Internal Audit have received no response from the service to inform this follow up. 4.0 CONCLUSION 4.1 COVID19 continues to impact on the progress services are making to complete audit action points. 5.0 IMPLICATIONS 5.1 Policy - None 5.2 Financial - None 5.3 Legal - None 5.4 HR - None 5.5 Fairer Scotland Duty - None 5.5.1 Equalities – None 5.5.2 Socio-Economic Duty – None 5.5.3 Islands Duty - None 5.6 Climate Change – None 5.7 Risk –None 5.8 Customer Service – None Moira Weatherstone Interim Chief Internal Auditor 23 June 2022 For further information contact: Moira Weatherstone, 01546 604146 moira.weatherstone@argyll-bute.gov.uk APPENDICES Appendix 1 – Action Plan Points with No Response and Delayed & Rescheduled
Page 4
Appendix 1 - Action Plan Points with No Response & Delayed and Rescheduled No Response Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer LIFELONG LEARNING & SUPPORT - PUPIL WORK PLACEMENTS Training There is no training programme to support officers involved in the work placement programme including ensuring appropriate steps are taken to determine whether a PVG check is required. Medium Conduct a training needs analysis with school staff leading on work placements. Produce a programme of centrally run CPD opportunities for next academic year (or include in Education Service Training Programme). 30 September 21 31 December 21 30 June 22 No Response Head of Education - Support & Lifelong Learning LIFELONG LEARNING & SUPPORT - PUPIL WORK PLACEMENTS Self-evaluation Education Scotland provides a benchmarking exercise which schools can undertake as part of a self- evaluation exercise. This provides a check Low CPD session to be held on benchmarking tool for school staff. Introduce an annual benchmarking exercise for all secondary schools. 31 December 21 30 June 22 No Response Head of Education - Support & Lifelong Learning
Page 5
No Response Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer list on how things are being undertaken against the requirements of the Standard. Schools have not completed this exercise. LIFELONG LEARNING & SUPPORT - PUPIL WORK PLACEMENTS Reporting There are no periodic management reports on pupil work placements. These would form an important understanding of the success and challenges of work placements and facilitate discussions about how to overcome some of the barriers which are resulting in a decreasing pool of employers signing up to the VFM Identify and agree meaningful KPIs for new service plan, monitoring and reporting. Implement new KPI data collection in schools. Establish robust reporting framework including EMT and CSC. 30 June 22 No Response Head of Education - Support & Lifelong Learning
Page 6
No Response Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer scheme. Action Plan Points Due by 31 March 2022 – Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer CUSTOMER SUPPORT SERVICES - ORGANISATIONAL CULTURE & 2019 EMPLOYEE SURVEY ACTION PLAN Involvement in change It is difficult to connect service plan performance reports to corporate outcomes and the Corporate Plan, as service reporting only references related business outcomes. There is a risk that the link between service performance and the Corporate Plan is not sufficiently transparent. The Council should consider N/A Use new approach of online exit questionnaires to help identify root causes for departures and assess the potential additional benefit of exit interviews. 31 March 20 31 December 20 31 March 21 30 September 21 31 March 22 Delayed - ongoing work to address data storage and DPIA requirements before launch. Delayed and Rescheduled Head of Customer Support Services
Page 7
Action Plan Points Due by 31 March 2022 – Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer developing clearer links between service are performance reporting and the corporate outcomes contained in the Corporate Plan. CUSTOMER SUPPORT SERVICES - SICKNESS ABSENCE Dedicated HR Assistants Development & Infrastructure and Education have a dedicated HR Assistant for Attendance who circulate reports on a monthly basis to the Heads of Service. The HR assistants provide analysis and trends over time on sickness absence. As there is no mechanism in place to assess the impact of a dedicated HR assistant on levels VFM HR will review attendance trends and survey Development & Infrastructure and Education services to assess and report to SMT on how effective the dedicated HR assistants have been to their service. 30 June 21 31 December 21 31 March 22 This review was delayed following SMT’s request for a specific report on Wellbeing. Delayed and Rescheduled HR Team Leader
Page 8
Action Plan Points Due by 31 March 2022 – Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer of sickness absence it is not possible to assess whether they are delivering value for money. CUSTOMER SUPPORT SERVICES - SICKNESS ABSENCE Maximising Attendance e- Learning Only 184 Council officers have completed the e- learning module ‘Maximising’ Attendance. HR will be updating the module to reflect the revised sickness absence policies and procedures. Completion of the revised module should be promoted as part of the roll out of the revised governance documents. Low HR will update the module to reflect the revised sickness absence policies and procedures. 31 December 21 31 March 22 New e-learning module available and work has been completed to review the module. Module now needs built. Delayed and Rescheduled HR Team Leader ROADS & INFRASTRUCTURE Recharging for sweeping of VFM Ensure that timely and accurate 31 March 22 Discussions have taken place with Network and Operations Manager,
Page 9
Action Plan Points Due by 31 March 2022 – Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer SERVICES - STREET CLEANING Council car parks. The Council’s income generating car parks are recharged for street sweeping according to information retained in work schedules rather than actual work taking place, additionally the Council’s non- income generating car parks are not recharged for sweeping. recharges are carried out and a system in place to ensure that this is regularly taking place. Standards colleagues. Operations are now rescheduling the frequency of cleanliness activities to present to Network and Standards colleagues. This should be completed by the end of May 2022. Delayed and Rescheduled Roads & Infrastructure Services CUSTOMER SUPPORT SERVICES - EXTERNAL AUDIT - PERFORMANCE REPORTING It is difficult to connect service plan performance reports to corporate outcomes and the Corporate Plan, as service reporting only references related business outcomes. There is a risk that N/A Consideration will be given to including clearer links as part of ongoing improvements. 30 June 2020 30 April 2021 31 March 2022 This item is complete. The Performance Management Project has developed Corporate Outcome Indicators that align service activity directly with corporate outcomes. Business Outcomes and Service outcomes have been removed as per the Council paper in September 2021. SMT agreed the alignment of Head of Customer Support Services
Page 10
Action Plan Points Due by 31 March 2022 – Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer the link between service performance and the Corporate Plan is not sufficiently transparent. The Council should consider developing clearer links between service are performance reporting and the corporate outcomes contained in the Corporate Plan. COIs with Strategic Committees in March 2022. Evidence Required. ROADS & INFRASTRUCTURE SERVICES - LOGICAL ACCESS User Management Controls A number of issues were identified where user management controls fell short of good practice. In some circumstances the systems do not have the required functionality. We Low Tranman – on 25 august a call was logged with Civica regarding audit trail. 30 September 20 31 January 21 31 March 21 30 June 21 31 December 21 Evidence Required Tranman Systems Administrators
Page 11
Action Plan Points Due by 31 March 2022 – Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer have only highlighted issues where the system does have the functionality however it has not been turned on. Tranman Leaver and change notifications are not always received in a timely manner No review of user access rights and permission levels No audit trail is available ROADS & INFRASTRUCTURE SERVICES - LOGICAL ACCESS Password Controls A number of issues were identified where password controls fell short of good practice. In some circumstances the systems do not have the required Low Tranman – Civica have advised that there may be an option to make use of Active Directory to access the system and this is being considered. 31 March 21 30 June 21 31 December 21 Evidence Required Tranman Systems Administrators
Page 12
Action Plan Points Due by 31 March 2022 – Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer functionality. We have only highlighted issues where the system does have the functionality however it has not been turned on. Tranman Password changes are not enforced Password complexity not enforced Password file visible to the systems administrator ROADS & INFRASTRUCTURE SERVICES - LOGICAL ACCESS Logon Controls A number of issues were identified where logon controls fell short of good practice. In some circumstances the systems do not Low Tranman – Civica have advised that there may be an option to make use of Active Directory to access the system and this is being considered. 31 March 21 30 June 21 31 December 21 Evidence Required Tranman Systems Administrators
Page 13
Action Plan Points Due by 31 March 2022 – Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer have the required functionality. We have only highlighted issues where the system does have the functionality however it has not been turned on. Tranman User not locked following failed login attempts No control over inactive users Action Plan Points Due After 31 March 2022 - Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer / Status ROADS & INFRASTRUCTURE SERVICES - FLEET MANAGEMENT Management of Pool Cars A high level analysis of the use of pool cars suggests the Council could VFM The pool car module will be released through Tranman. The pool car module offers a centralised approach to bookings and visibility. The 30 September 20 31 December 20 30 June 21 31 December 21 30 April 2022 30 July 22 We have just employed a person to cover our existing Systems persons maternity leave. Training is ongoing but hopefully system could be implemented by end of July. Procurement/ Technical Officer
Page 14
Action Plan Points Due After 31 March 2022 - Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer / Status generate considerable savings through more efficient use of pool cars. Fleet Services should explore this further via a more detailed review which should consider the potential benefits of: · a more centralised approach to the administration and booking of pool cars · better promotion of the use of pool cars · providing greater visibility of bookings and destinations to encourage pool car sharing · implementing or Council’s internal communications department will be contacted to highlight the use of the pool cars. Work will be undertaken to increase usage. Delayed and Rescheduled
Page 15
Action Plan Points Due After 31 March 2022 - Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer / Status developing a pool car booking system · identifying ways of transferring the balance of pool car usage from shorter journeys to longer ones ROADS & INFRASTRUCTURE SERVICES - FLEET MANAGEMENT Driving Hours Compliance Fleet drivers not subject to EU legislation maintain manual driving records which are handed to supervisors on a weekly basis to check and sign. This is a resource intensive process which is subject to human error. There would be clear process efficiency gains and less risk of error if the Council adopted the system already Low The key officer will ensure that all drivers hold and use tachograph cards to move away from the paper book records. 31 December 20 31 March 21 30 June 21 31 March 22 30 June 22 31 August 22 Some resistance from service users but Senior Management are trying to resolve this and move forward. Delayed and Rescheduled Procurement/ Technical Officer
Page 16
Action Plan Points Due After 31 March 2022 - Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer / Status in place for fleet drivers subject to EU legislation and rolled out electronic driver cards to all fleet drivers. CHILDREN AND FAMILIES AND CRIMINAL JUSTICE - SW - SOCIAL CARE CONTRACT MANAGEMENT Call Up Letters Sample testing highlighted situations where services are being provided without a call up letter being in place. This is contrary to Council policy. Low Updated call up letters will be issued when providers confirm estimated capacity for year. 31 December 20 31 March 21 30 June 21 31 December 21 30 April 22 All contract issues with providers now resolved and call up letters for 22/23 have been issued. Evidence Required H&SCP - Locality Manager COMMERCIAL SERVICES - CONTRACT MANAGEMENT - PROPERTY SERVICES Concerto In order to present cost KPI data the Contract Manager needs to extract data from Concerto and manipulate it in Excel using pivot tables. There would be merit in investigating whether the required KPIs can VFM Investigate and develop functionality of Concerto as necessary to minimise data manipulation and therefore officer time. 30 September 21 31 March 22 30 September 22 Restructure ongoing within Property Services. Process to recruit permanent Property Maintenance Manager started, this action to be delivered within this role - target date adjusted to allow completion of the recruitment process. Delayed and Rescheduled Property Maintenance Manager
Page 17
Action Plan Points Due After 31 March 2022 - Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer / Status be generated via a standard reporting package rather than through data manipulation although we acknowledge there may be a cost involved in this which would need to be considered. CUSTOMER SUPPORT SERVICES - SICKNESS ABSENCE Attendance Review Meetings Procedures stipulate that attendance review meetings should be carried out by the employee’s line manager to facilitate the employees return to work. No evidence of review meetings being carried out was available for any of a sample of eight long term absences. Medium HR will review the mechanism for documenting content of attendance review meetings and recommend a preferred option for automatically populating the documentation into the Myview system. 31 December 21 30 April 22 30 June 22 Solution has been selected. Implementation date required to be amended. Delayed and Rescheduled HR Development Team Lead
Page 18
Action Plan Points Due After 31 March 2022 - Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer / Status Procedures should be updated to ensure that all attendance review meetings are properly recorded in the MyView system in the same way that return to work interviews are recorded in Myview. FINANCIAL SERVICES- CAPITAL MONITORING Capital Programme Training There is no training programme to support officers involved in the management of the Council’s capital programme. It would be beneficial to engage with project managers to identify training needs and address these through the development of a training programme to help ensure a Medium Training documentation to be created that project managers can refer to. Refresher training to be provided for existing Project Managers and a plan put in place for training for any new staff that have capital budget monitoring responsibilities. 30 June 22 30 September 22 An initial training document was prepared during 2021 explaining how to complete the capital monitoring returns, however due to absence this never progressed to training roll out. Specific engagement has taken place with two new Project Managers responsible for significant projects and refresher training for existing Project Managers will be provided following the commencement of the 2022-23 capital monitoring process. Finance Manager
Page 19
Action Plan Points Due After 31 March 2022 - Delayed & Rescheduled/Evidence Required Service / Report Finding Priority Agreed Action Dates Comment Responsible Officer / Status consistent and robust approach to capital project management. In particular this should include training on capital project profiling. Delayed and Rescheduled