2021_22_Interal Audit_CivilContingencies_FinalReport
Argyll and Bute Council · 23 June 2022
Back to Audit and Scrutiny Committee — 23 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Report March 2022 FINAL High Medium Low VFM Number of Findings 0 2 0 0 Civil Contingencies Audit Opinion: Substantial
Page 2
2 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ........................................................................................................................................ 3 Background ......................................................................................................................................... 3 Scope ................................................................................................................................................... 4 Risks .................................................................................................................................................... 4 Audit Opinion ..................................................................................................................................... 5 Recommendations ............................................................................................................................. 5 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Action Plan ..................................................................................................................... 11 Appendix 2 – Audit Opinion ................................................................................................................. 13 Contact Details Internal Auditor: Mhairi Weldon Telephone: 01546 604294 e-mail: mhairi.weldon@argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 www.argyll-bute.gov.uk 1. Executive Summary Introduction 1. As part of the 2021/22 internal audit plan, approved by the Audit & Scrutiny Committee in March 2021, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Civil Contingencies. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. The Council as well as the emergency services, NHS Health Boards the Scottish Environment Protection agency (SEPA), the Maritime and Coastguard Agency and Integration Joint Boards have a key role to play in planning for and responding to an emergency and supporting the long- term recovery following an emergency. They are “Category 1” responders under the Civil Contingencies Act 2004 (the Act). 5. Part one of the Act focuses on local arrangements for civil protection, establishing a statutory framework of roles and responsibilities for local responders. The Council is subject to seven civil protection duties under the Act and are required to: 1. Assess the risk of emergencies occurring and use this to inform contingency planning 2. Put in place emergency plans 3. Put in place business continuity management arrangements 4. Put in place arrangements to make information available to the public about civil protection matters and maintain arrangements to warn, inform and advise the public in the event of an emergency 5. Share information with other local responders to enhance co-ordination 6. Co-operate with other local responders to enhance co-ordination and efficiency 7. Provide advice and assistance to business and voluntary organisation about business continuity management 6. Category 2 responders are defined as gas and electricity companies, rail and air transport operators, harbour authorities, telecommunications providers, Scottish Water, the Health and Safety Executive and NHS National Services Scotland. Category 2 responders have a statutory duty to co-operate and share information with Category 1 responders in the planning and response to major emergencies.
Page 4
4 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 7. The Act also states that other organisations, such as the voluntary and private sectors, can have an important role to play in consolidating our overall resilience and contributing to effective preparation for, response to and recovery from an emergency incident. 8. A civil emergency can be declared by the police or fire service when the situation surrounding different types of incident escalates to involve large numbers of people or is a major threat to many properties. An emergency situation can arise from: Severe weather Road traffic crashes Utility failures (water, power, gas) Chemical/Oil spill Fires Explosions Flooding Terrorist action or threat 9. The Council works closely with neighbouring local authorities, partner and third sector organisations to prepare, test and review contingency plans that will reduce the likelihood and impact of an emergency occurring in the area. 10. Other legislation exists which shares the characteristics and practices of civil contingencies legislation, in particular: The Radiation (Emergency Preparedness and Public Information) Regulations 2019 (REPPIR) Control of Major Accident Hazards Regulations 2015 (COMAH) Major Accident Control regulations (MACR). Much of the activity required by the Act is relevant to this other legislation and there is no requirement to duplicate planning and preparation required by both sets of legislation. 11. There is an increasing recognition that Councils need to draw on resources and abilities of its communities to help prepare for, respond to and recover from emergencies as effectively as possible. This is known as “community resilience”. Scope 12. The scope of the audit was to assess compliance with duties 1, 2, 5 & 6 of the Act and ensure that work plans take cognisance of other legislation including The Radiation (Emergency Preparedness and Public Information) Regulations 2019 (REPPIR), Control of Major Accident Hazards Regulations 2015 (COMAH) and Major Accident Control regulations (MACR) as outlined in the Terms of Reference agreed with the Head of Legal and Regulatory Support on 17 December 2021. Risks 13. The risks considered throughout the audit were: SRR08: Civil Contingency & Business Continuity arrangements are not effective ORR04: Failure to improve quality of life of and reduce risks to residents and visitors
Page 5
5 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 ORR10: Failure to ensure that communities and employees are prepared to deal with major incidents Audit Risk 1: Failure to comply with the requirements of the Civil Contingencies Act 2004 Audit Opinion 14. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 15. Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Recommendations 16. We have highlighted two medium priority recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: The Civil Contingencies Unit should be routinely consulted in the process of maintaining and updating the Council’s Strategic and Operational Risk Registers There should be consideration of the Civil Contingencies Unit being delegated with responsibility for all duties of the Act to manage overall compliance requirements 17. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 18. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 The Council assesses potential risks of emergencies occurring and puts in place emergency plans All Risks Substantial The West of Scotland Regional Resilience Partnership (WoS RRP) & Local Resilience Partnership (LRP) are appropriately constituted to provide effective and efficient emergency response arrangements. Risks of emergencies are assessed and documented at WoS RRP level and by other competent authorities at LRP and Council level, however, the Council’s Strategic and Operational Risk Registers are not shared with the Civil Contingencies Unit prior to approval.
Page 6
6 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 Control Objective Link to Risk Assessment Summary Conclusion Emergency plans have been collaboratively prepared to cover a number of emergency scenarios, they are clear and concise and address requirements for additional regulations where relevant. 2 Council staff are appropriately trained and periodic exercises take place to test emergency plans All Risks High Exercises to test emergency plans take place annually with appropriate agencies involved and these were well attended. Civil Contingencies officers are suitably qualified and training is provided to senior and recovery managers prior to exercises taking place. 3 The Council co- operates with local responders and shares information to enhance co- ordination and efficiency All Risks High Council officers hold office bearer positions within both the Wos RRP and LRP providing considerable resource and time commitment. There is evidence of good co-operation, collaboration and information sharing between the partner agencies through attendance and provision of various updates at meetings and participation in exercises and de-briefs. Officers attending hold suitable positions to implement actions within their respective organisations and provide feedback at meetings. 19. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings The Council assesses potential risks of emergencies occurring and puts in place emergency plans 20. WoS RRP comprises of organisations that are legally required to prepare for, respond to and recover from any major disruptions and emergencies in the West of Scotland region. The WoS RRP works to enhance the safety and resilience of the region and its communities by supporting and co-ordinating six LRPs across the West. The Argyll and Bute LRP comprises representatives from Argyll and Bute Council area and Policing Division L and other national agencies. The LRP plan and prepare collaboratively to ensure efficient and effective emergency response arrangements are in place across Argyll and Bute. 21. WoS RRP risks are identified via collaborative working between its members, they include different scenarios with specific assumptions and impacts on individuals, general public, businesses, towns and the general environment. The impacts and likelihoods of identified risks occurring are assessed and scored providing an overall assessment of low, medium, high or very high.
Page 7
7 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 22. The results of risk assessments are used to create plans and procedures to help prepare for an emergency. Those risks with the highest likelihood and potential to have significant impact are compiled within a community risk register that is made available to the general public to allow them to become better prepared and more resilient should an emergency occur. Incident types identified include those relating to weather, health and resource issues among others. 23. The LRP and the Council do not conduct further risk assessments in respect of their emergency plans as the risks are assessed by the Health and Safety Executive or the Office for Nuclear Regulation who will provide a hazard assessment and consequence report for the LRP or Council to prepare the relevant emergency plans. 24. The Council prepares a Strategic Risk Register that is reviewed by the Senior Management Team 6 monthly and Departmental Operational Risk Registers that are reviewed quarterly at Departmental Management Teams, however, neither of these documents are shared with the Civil Contingencies Team for input or for review and consideration of inclusion in emergency planning. Action Plan 1 25. Operational risks must be included within the Council’s Critical Activity Recovery Plans (CARPs) to evidence compliance with the third duty of the Act to maintain business continuity plans. CARPs were reviewed in a recent audit of business continuity and are therefore not included within the scope of this review, however, it is noted that whilst the Civil Contingencies officers are trained to comply with all duties of the Act, the Council’s business continuity duties are managed out with the Unit. Action Plan 2 26. Emergency plans are prepared by the WoS RRP, LRP and the Council, legislation requires that these are reviewed every three years to ensure they remain current. The Councils’ practice has been to conduct a review of these plans annually due to many organisational and personnel changes, however it has not been possible to review all plans in the last two years due to other commitments including responses to COVID-19. 27. Resilience Direct is a unique digital online private network which enables collaboration between organisations. Access to the service is strictly controlled and provides a secure electronic file storage area for use by category one and two responders to share information during the preparation, response and recover phases of an event or emergency. There are 18 documents retained in the plans area of the Resilience Direct file store for members to access, four of these are guides prepared by other agencies with the Council providing input via the LRP. The remaining 14 documents are plans, nine of which are multi-agency plans and five are the responsibility of the Council. All plans have been reviewed within the last three years as required by the Act. 28. Four emergency plans and one guide were reviewed and found to comply with Scottish Government guidance. Contributors and information sources are clearly identified and links to further information are provided where relevant. The plans are generic with content clearly linked to a range of identified risks and include the duties of each organisation along with ownership of key tasks. In addition consideration is given to resources and capacity to manage an emergency at strategic, tactical and operational levels and special consideration is afforded to vulnerable people and to those affected by emergencies and their close contacts.
Page 8
8 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 Communications strategies and arrangements for crisis management are also included as well a requirement to review performance. 29. In addition to the Civil Contingencies Act, the Council is also required to fulfil duties under other regulations including: The Radiation (Emergency Preparedness and Public Information) Regulations 2019 (REPPIR), Control of Major Accident Hazards Regulations 2015 (COMAH) and Major Accident Control regulations (MACR) There is no requirement to duplicate arrangements where the duties are identified in both the Act and regulations, however there are some additional duties identified including: Determine a Detailed Emergency Planning Zone (DEPZ) and an outline planning zone (OPZ) at relevant sites where major hazards have been identified Prepare an off-site emergency plan that dovetails with the operators plan at the identified hazard location Provide prior information to residents within a DEPZ and make available to those in the OPZ Provide information to the public in event of an emergency Determine reference levels in the event of a radiation emergency and prioritise keeping doses below 100 mSv These duties have been fulfilled by the Council in accordance with the Act and regulations. 30. The Council is entitled to recover costs incurred in the performance of their duties from operators of establishments where major hazards have been identified, however, in order to maintain good partnership working arrangements that provide mutual benefits, it is felt that charging for such services may not be appropriate. It is also considered that the potential income would not be substantial and therefore the cost to administer charges would negate the benefit. 31. External agencies have contributed to the plans and there is inclusion of the requirement for co- operation and co-ordination of management at operational, tactical and strategic levels. The contribution of voluntary organisations is also considered with the Council acting as their co- ordinator. 32. Business recovery is included within the emergency plans with each agency involved being responsible for their own business continuity. The Council has a separate Business Continuity Management Policy. Council staff are appropriately trained and periodic exercises take place to test emergency plans 33. The Act and other regulations require that an exercise to test emergency plans must take place every three years as a minimum. A programme of testing components may be prepared with a view to cover all major areas of a plan in the three year period. With the exception of 2020 due to the COVID-19 response, the Council and other category one and two responders have participated in exercises annually. 34. Civil Contingencies within the Council prepares an annual work plan which details when training is to take place. The Council’s Strategic Management Team and recovery managers, have been
Page 9
9 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 provided with training, copies of presentations and a teleconference protocol are available on the Council’s Emergency Planning SharePoint site. The Resilience Direct file store also contains copies of presentations, checklist, scenario and templates for those who have been provided with access. Copies of attendance records are maintained. 35. Civil contingencies officers either hold or are working towards SCQF level 9 Professional Development Award (PDA) in Resilience Management, this covers the core competencies framework for Resilience Practitioners/Professionals and is embedded within the officer’s job descriptions. To support management, each time an exercise takes place, a programme of training is customised and delivered prior to the event. Training needs are also captured on debrief forms following completion of an exercise and used to inform future training content. The Council co-operates with local responders and shares information to enhance co-ordination and efficiency 36. The WoS RRP Resilience Arrangements document sets out the requirement for co-operation and sharing information in regard to best practice, conduct of exercises and lessons learned. The Community Risk Register provides contact details and links to the websites of category one and two responders, it also describes how information is shared to increase overall resilience of the region and provide “integrated emergency management”. All WoS RRP members share resources and expertise with other responders, and additionally, consortiums are established to share, operate and maintain equipment. The WoS RRP meets three times per year and is attended by multiple agencies. 37. The Terms of Reference for the Argyll and Bute Local Resilience Partnership clearly states the requirement for sharing information in the objectives. The LRP strategic level group met ten times during 2021 in response to COVID and the tactical level group met three times, both groups were well attended by multiple agencies. Additional sub-groups are created for specific topics as and when required. 38. Information is shared at meetings of both the WoS RRP and the LRP with updates being provided from each of the partner agencies and by sub-groups formed to progress specific projects. Records are maintained of meetings and actions are documented. These documents are available for review on the Resilience Direct file store for category one and two responders or the Council’s SharePoint site for appointed managers, officers and Civil Contingencies. 39. Sensitive personal information is occasionally required to provide situational awareness, this is also stored on the Resilience Direct file store and classified as sensitive. Access to this private network is strictly controlled and users have further restrictions within the file store to ensure they can only access information that they require to perform their duties. 40. The Council receives Freedom of Information (FoI) requests in respect of civil contingencies and these requests are actioned in accordance with the corporate process. Responses are clear and concise, do not include sensitive personal information and are provided within the statutory timeframe allowed. 41. The Council is represented at all meetings of the WoS RRP and the LRP to ensure awareness of current risk threat levels and any potential for these to escalate to an emergency situation. The Civil Contingencies Manager currently chairs the LRP at tactical level and the Chief Executive chairs the LRP at strategic level with additional Council officers in attendance as required. The
Page 10
10 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 Terms of Reference for the LRP is periodically updated and each time this happens the office bearers stand down and the positions are offered to other attendees. 42. Emergency plans clearly set out who the lead responder organisation is, this is usually the Police with the Council taking over as lead in the recovery phase. Roles and responsibilities are detailed throughout plans as well as the need for co-operation and good communications between the responders. 43. Debriefing records created as a result of exercises that have taken place are shared with partner agencies, this enables learning from identified good practice, training needs and areas for improvement.
Page 11
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Medium 1 Risk Registers The Council prepares a Strategic Risk Register and Operational Risk Registers that are reviewed by senior management, however, these are not reviewed by the Civil Contingencies Unit for consideration within the emergency planning context. Emergency plans and risk registers may not include all identified risks. Following the 6 month review of the SRR by the SMT and the quarterly review of the services ORR’s by DMT they will be shared with the CCU for their information and action where appropriate. Governance, Risk and Safety Manager Date – 30 September 2022 Medium 2 Civil Contingencies Duties Civil Contingencies officers are trained to comply with all duties of the Act, however, the Council’s business continuity duties are managed out with the Unit. The Council may not fully comply with the third duty of the act to maintain business continuity plans. A review of Business Continuity arrangements across the Council is to be progressed during 22/23 and part of that will be to integrate Business Continuity duties within the Civil Contingencies Unit as part of their wider resilience responsibilities. Governance, Risk and Safety Manager Date - 31 March 2023 In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows:
Page 12
12 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 13
13 Argyll and Bute Council – Internal Audit Report – Civil Contingencies, March 2022 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.