FINAL AGREED IA 202223 Audit Plan- Amended to Include EMA
Argyll and Bute Council · 23 June 2022
Back to Audit and Scrutiny Committee — 23 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Plan 2022/23 Moira Weatherstone Interim Chief Internal Auditor David Sullivan Accountant Mhairi Weldon Senior Audit Assistant Annemarie McLean Auditor Leanne Rennie Audit Assistant
Page 2
2 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan Contents Purpose of Internal Audit ....................................................................................................................... 3 Public Sector Internal Audit Standards (PSIAS) Requirements ............................................................. 3 Risk Assessment ..................................................................................................................................... 3 Strategic Risks ......................................................................................................................................... 4 Resourcing the Plan ................................................................................................................................ 4 Confirmation of Independence .............................................................................................................. 4 2022/23 Internal Audit Plan ................................................................................................................... 5 Monitoring the Plan ............................................................................................................................... 5 Quality Assurance and Improvement Programme ............................................................................... 5 Appendix 1 – 2022/23 Internal Audit Plan ............................................................................................ 6 Appendix 2 – 2022/23 Internal Audit Plan by Council Directorate / Head of Service ......................... 9 Appendix 3 – Strategic Risk Register (Abridged) ................................................................................. 10 Contact Details Interim Chief Internal Auditor: Moira Weatherstone Telephone: 01546 604146 e-mail: moira.weatherstone@argyll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan Definition of Internal Audit 1. Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. Source: Section 4: Definition of Internal Auditing: Public Sector Internal Audit Standards Purpose of Internal Audit 2. The main objective of internal audit is to provide a high quality, independent audit service to Argyll and Bute Council (the Council) which provides annual assurances in relation to internal controls and overall governance arrangements. In addition to this primary assurance role, internal audit will also: • support the S95 Officer and the Audit & Scrutiny Committee (the Committee) in the discharge of their duties • support the Council’s Monitoring Officer • support the Council’s anti-fraud and corruption arrangements • provide guidance on control implications for new or changed systems where appropriate • support the Council and the Strategic Management Team during key transformational/ change projects. Public Sector Internal Audit Standards (PSIAS) Requirements 3. PSIAS sets out the requirement for the: • Chief Internal Auditor (CIA) to prepare a risk-based audit plan which takes into account the Council’s strategic objectives, associated risks and the views of senior management and the Committee • CIA to review and adjust the plan as necessary in response to changes in the Council’s business, risks, operations and priorities • audit plan to incorporate or be linked to a strategic or high-level statement of how internal audit will be delivered and developed in accordance with the Internal Audit Charter and how it links to the organisational objectives and priorities. Risk Assessment 4. Internal audit’s approach to annual audit planning is risk-based with all areas which may be subject to audit review contained within an audit universe which is subject to formal review, at least annually. The audit universe includes all significant activities and systems that contribute to the achievement of the Council’s priorities and objectives. 5. The audit universe is risk assessed each year to help determine the annual audit plan and ensure that suitable audit time and resources are devoted to reviewing the more significant areas of risk. Note however that that the audit universe, whilst a key factor, is not the only consideration
Page 4
4 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan when determining the audit plan. Senior management have been consulted on priority areas for review, and cognisance is taken of the plans of external audit and other statutory agencies, in order to avoid duplication, and increase potential for cross reliance. 6. The audit universe risk assessment is based upon a matrix taking account of scores for each potential audit area in respect of: • materiality (based on expenditure) • sensitivity (based on whether a service is a statutory duty, statutory power or non- statutory, is customer facing and whether it features as a specific challenge in the Council’s service plans) • time elapsed since it was last subject to review • overall audit assessment when it was last subject to review. 7. The matrix gives an overall “score” for each area that is used to prioritise audit reviews. Strategic Risks 8. The Strategic Risk Register records the Council’s own assessment of the most potentially damaging risks and their likelihood of occurrence. This document is used to inform the annual audit plan with identified reviews cross referenced to the strategic risk register. An abridged version of the strategic risk register (version dated February 2022) is included in appendix 3 for reference. Resourcing the Plan 9. Internal audit has a core establishment of five full time equivalent officers including two professionally qualified members of staff. Available audit days have been calculated as 778 days (including 85 days of management and administration time), following the deduction of annual leave, training, a small provision for sickness, 90 days to deliver scrutiny work and 50 days to deliver the HSCP internal audit function. This 778 days total includes the CIA’s input to audit reviews and the running of the internal audit team and a contingency of 44 days. 10. Given the range and complexity of areas to be reviewed it is important that suitably qualified, experienced and trained individuals are appointed to internal audit positions. The CIA, in compliance with PSIAS holds an appropriate professional qualification (CIPFA). Also within the internal audit section we have one CIMA qualified team member, one AAT and CIA qualified member and one training for CIPFA. 11. Internal audit officers identify training needs as part of their annual appraisal process and are encouraged to undertake appropriate training, including in-house courses and external seminars as relevant to support their development. 12. Through an assessment of the mix of knowledge, skills and experience of the audit team, it is considered that the available resources are sufficient to achieve the work outlined in the plan. Confirmation of Independence 13. PSIAS requires internal audit to communicate, on a timely basis, all facts and matters that may have a bearing on our independence. We can confirm that the staff members identified to
Page 5
5 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan complete the reviews in the 2022/23 annual audit plan are independent and objectivity is not compromised. 2022/23 Internal Audit Plan 14. Appendix 1 presents the internal audit plan for 2022/23. As our internal audit approach is informed by risks, where appropriate, the plan is cross-referenced to the strategic risk register contained at appendix 3. Appendix 3 also demonstrates the strategic risks that were subject to audit focus in 2021/22 and those we are projecting to cover in the period 2022/23-2023/24. This provides assurance to the Committee that all strategic key risks are subject to audit coverage over a three year cycle. Note that the projected timescales in appendix 3 are provisional as these may change to reflect changes in the Council’s risk environment. 15. Appendix 2 presents the 2022/23 internal audit plan in a different format to provide assurance to the Committee that it provides appropriate coverage across all the Council’s directorates and head of service’s areas of service delivery. Monitoring the Plan 16. Internal audit reports on performance to the Committee on a quarterly basis including full copies of audit reports issued, progress implementing audit recommendations, performance against agreed performance indicators and a summary of all internal audit activity in the previous quarter. Quality Assurance and Improvement Programme 17. The PSIAS require each internal audit service to maintain an ongoing quality assurance and improvement programme (QAIP) based on an annual self-assessment against the Standards, supplemented at least every five years by a full independent external assessment. 18. The Scottish Local Government Chief Internal Auditors’ Group (SLACIAG) has developed a framework for external assessments to be undertaken by member authorities of SLACIAG on a broadly reciprocal arrangement utilising a peer review option. The Council’s internal audit team has participated in this framework and an external validation of its own self-assessment took place during 2018/19 which concluded that we demonstrated overall compliance with PSIAS with many areas of strong practice. The next scheduled external assessment will be conducted in 2022. 19. In 2021/22 internal audit carried out an internal self-assessment against PSIAS which was reported to Committee in September 2021. It confirmed the service fully conformed to PSIAS in 13 of the 14 assessment areas. The area self-assessed as ‘Generally Conforming’ with improvements built into the service’s QAIP has been completed with the appointment of an Interim Chief Internal Auditor. 20. The internal audit team review their QAIP on a quarterly basis and report it to the Committee as part of the standard agenda item ‘Internal Audit Summary of Activities.’ The programme details all improvement activity being progressed by the team.
Page 6
Appendix 1 – 2022/23 Internal Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Cross Cutting Continuous Monitoring Programme Budgeting 15 Cyclical review of key controls over an 18 month programme of audit testing. Council Tax and NDR 20 Creditors 20 Debtors 15 General Ledger 15 Payroll 25 Treasury management 15 VAT 15 Follow–up 40 Compliance Pippa Milne Financial Services Payroll Processes 25 Review of the processes and procedures in place between HR and payroll to ensure that employee information is updated in a timely manner Financial Services Management of Debt/Debt Recovery 25 Assess the controls in place for the management of debt and assess compliance with procedures Douglas Hendry Education – Jennifer Crockett Early Years 25 Assess compliance and use of Early Years Covid recovery funds Education – Jennifer Crocket Counselling in Schools 30 Assess the use of the three year Scottish Government funding to support the delivery of counselling through schools against the set of ten nationally agreed core principles Legal and Regulatory Support Purchasing Cards 20 Compliance with procedures and authorisation processes to establish value for money Legal and Regulatory Support Procurement 25 Review process in place in terms of the procurement strategy and annual procurement report to ensure compliance with statutory requirements Commercial Services Externally Funded Projects 30 Assess compliance with policies and procedures, including conditions of external funded projects SRR02 Commercial Services Heritage Assets 25 Review the management and record keeping of Heritage assets
Page 7
7 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Kirsty Flanagan Roads and Infrastructure Services - Jim Smith Burial records 20 Review the control environment and administration of burial records Roads and Infrastructure Services Car Parking Facilities 25 Review the policies, procedures and compliance for the management of car parking fees Development and Economic Growth Oban Airport 15 Annual review to provide assurance re compliance with operational manual Assess compliance with the aerodrome operating manual. Development and Economic Growth LEADER 5 Annual review to assess compliance with the requirements of the Argyll and the Islands LEADER 2014 – 2020 Service Level Agreement (agreement was extended) Development and Economic Growth Building Standards 20 Review the systems and process in place to support compliance with the verification scheme Development and Economic Growth Private Sector Grants and Housing Adaptations 20 Assess compliance with policies and procedures Customer Support Services Equality and Socio- Economic Impact Assessment 20 Assess compliance with legislation and guidance Customer Support Services Customer Service Centre 20 Review the process and systems used for the handling of initial customer contacts and ensure that customer enquiries are followed up in a timely manner SRR05 SRR06 Customer Support Services Cyber Security 20 Review systems in process in place to support security of key systems SRR11 Fiona Davies H&SCP Older People Services Client Funds 25 Review the processes and procedures in place to ensure the management of client funds and financial affairs, including compliance with Code of Conduct SRR07 H&SCP – Learning and Physical Disabilities Learning and Physical Disability care packages 25 Assess effectiveness and compliance with Learning and Physical Disability care packages SRR07
Page 8
8 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan Directorate Contact Service Audit Title Days High Level Scope Strategic Risk Kevin Anderson LiveArgyll Events Management 20 Assess procedures to manage events hosted in Live Argyll venues including controls over revenue, expenditure, risk management and insurance LiveArgyll Establishment visits 15 Cyclical audit approach to assess LiveArgyll establishment’s compliance with physical controls and compliance with SOP’s Verification Activity LGBF Accuracy 9 Accuracy of submission EMA Education Management Allowance 5 Accuracy of submission Summary of Days Directorate Contact Number of Days Last Year (Revised) Number of Days 2022/2023 Cross Cutting – Continuous Monitoring 185 180 Pippa Milne 45 50 Douglas Hendry 140 155 Kirsty Flanagan 135 165 Fiona Davies 30 50 LiveArgyll 20 35 Verification Activity 14 14 Contingency 55 44 Total 624 693
Page 9
9 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan Appendix 2 – 2022/23 Internal Audit Plan by Council Directorate / Head of Service Pippa Milne Douglas Hendry Kirsty Flanagan Fiona Davies Financial Services Education Legal & Regulatory Support Commercial Services Customer Support Roads & Infrastructure Development & Economic Growth Health & Social Care Partnership Payroll Processes Management of Debt/Debt Recovery Early Years Counselling in Schools Purchasing Cards Procurement Externally Funded Projects Heritage assets Equality and Socio-Economic Impact Assessment Customer Service Centre Cyber Security Burial Records Car Parking Facilities Building Standards Private Sector Grants and Housing Adaptations Oban Airport LEADER Client Funds Learning and Physical Disability Care Packages Live Argyll Events Management Establishment visits Other Activity NFI – Counter Fraud Team Follow Up Local Government Benchmarking Framework
Page 10
10 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan Appendix 3 – Strategic Risk Register (Abridged) No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 1 Population and Economic Decline Failure to identify relevant factors contributing to the decline and failure to develop strategies and actions targeting these factors. 20 1. Local outcome improvement plan targets population and economic recovery 2. Maximise external funding opportunities 3. Economic Strategy 4. Strategic infrastructure plan 5. Area economic development action plans 6.Promote and Market Argyll and Bute 7. Maximise social-eco benefits via effective partnership working 8. Single Investment Plan 16 Treat 1. Lobbying activity in pursuit of regional immigration policies and related strategies 2. Rural Growth Deal Outline Business Cases and Final Business Cases to be developed in 2022/23 and Deal to be signed late 2022 or early 2023. 3. Preparation of bid to Levelling Up Fund – preparing for April 2022 in time for submission date which is still to be confirmed. 4. Settlement Officer post agreed to be funded 50:50 from HIE/Council focusing on barriers to people living in communities, housing and others. 5. Preparation of a pipeline of projects across Argyll and Bute in order to be able to react to any other bid funding as and when it is announced. 2019/20 (Scrutiny)
Page 11
11 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 2 Condition and suitability of Infrastructure & Asset Base Infrastructure and asset base does not meet current and future requirements and is not being used or managed efficiently and effectively. 16 1.Asset management board 2.Robust capital planning and monitoring 3. Asset management work plan 4. Business case modelling including sustainability, development and strategic change 5. Intelligence and best practice sharing via Heads of Property Group. 6. Community Empowerment and Community Asset Transfer – Arrangements in place to evaluate and determine requests. 7. Roads Asset Management Plan 8. Status and Options Report 9. R&A Services control hub and joint operations team 10. One Council Property Approach 12 Treat 1. Development of capital strategy in 2022. 2. 'Modern Workspace Programme will review, engage and rationalise property portfolio for future needs of the Council. Changes will take place on phased and town by town basis. Programme will be running for 3 years - April 2024 2020/21 2021/22 2022/23
Page 12
12 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 3 Financial Sustainability Insufficient resource to meet current and future service requirement. Budget not aligned / does not support business outcomes 16 1. Longer term financial planning and financial strategy 2. Income generation activity 3. Robust budget preparation and budget monitoring protocols 4. Maintaining adequate contingency with reserves. 5. Digital transformation 6. Effective workforce planning model 7. Business Outcomes 8. Financial Services resilience building project including knowledge sharing and development of guidance notes 12 Treat 1. Discussions are continuing in respect of a change programme that will include ensuring that the Council can operate within its budget (2022 for year 2023/24). 2. Rural Growth Deal Outline Business Cases and Final Business Cases to be developed in 2022/23 and Deal to be signed late 2022 or early 2023. 3. Implementation of new general ledger system with enhanced budget planning and forecasting capabilities (July 2022) 4. Investment in professional training through Grow Our Own Activity. 2019/20 (Scrutiny) 2020/21 2022/23 Ongoing via Continuous Monitoring 4 Governance and Leadership Governance and leadership arrangements are not conducive to effective working and lead to a lack of strategic direction. 16 1. Administration in place with working majority 2. Members Seminar programmes 3. Mentoring and Coaching Support for policy leads and Senior Management 4. Priorities agreed by Council 5.Corporate Plan sets out objectives 6. Performance Improvement Framework and Service Planning. 7. Leadership development programme. 8. Council constitution regularly reviewed and updated. 8 Treat 1. Monitor delivery of BV action plan (ongoing date) 2. Induction training for new Members following May elections (May/June 2022) 2020/21 (Scrutiny)
Page 13
13 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 9. Established partnership governance arrangements 10. Scrutiny arrangements in respect of Police, Fire and Health. 11. Governance arrangements for scrutiny established 5 Engagement and Understanding the needs of the Community The Council fails to understand service user needs and emerging demographic trends and does not align service delivery to meet these 12 1. Community Planning partnership 2. Community Engagement Strategy 3.Customer Service Board 4. Operation and development of panels and forums. Young people’s plan, citizens panel 5. Budget Consultation 6.Comprehensive Complaints Protocols 7.Demographic and end user analysis 9 Treat Deliver agreed actions in BV3 action plan relating to Work with Communities and Community Groups to improve engagement - March 2022 2022/23 6 Service Delivery Insufficient resources to ensure effective service delivery 9 1. Performance Improvement Framework 2.Service Improvement plans 3.Argyll and Bute Manager programme 4. Customer needs analysis Protocols 5.Demographic and end user analysis 6.Workforce Planning 7.Internal and External Scrutiny Arrangements 8.Complaints process 6 Treat Monitor progress of performance mgt project and implement recommendations (Ongoing from Oct 2020 to June 2022) 2021/22
Page 14
14 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 7 Health and Social Care Partnership Failure to deliver strategic objectives and integrate Health and Social Care services in an efficient and effective manner exposes the Council, as a key partner, to unacceptable financial and reputational risk. 20 1. HSCP integration scheme approved by Scottish government 2. Strategic Plan in place 3. Performance and Financial reporting arrangements in place 4. Independent audit arrangements in place. 5. Integrated Joint board with elected member representation including Council Leader 6.Chief Officer member of ABC Senior Management Team with co-location of officers 7. Tripartite leadership agreement 8. Monitoring of HSCP financial position. 12 Treat 1. Develop options to deliver sustainability of future years budgets (ongoing) 2. Completion of Strategic Plan which was delayed due to COVID. 3. Assessment on impact of COVID on services in short, medium and long term. 2019/20 2020/21 2022/23 Assurance also taken from IJB internal audit function
Page 15
15 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 8 Civil Contingency & Business continuity Arrangements are not effective. 8 1. Emergency Planning Test events 2. Critical Activity Recovery Plans 3. Roll out of Community resilience partnership programme 4. Peer review of major exercises undertaken to provide external validation of planning process 5. West of Scotland local resilience partnership 6.Cross sector expertise and partnership working 7. Emergency Management Support Team (EMST) meetings 8. Training 9. EU Withdrawal Tactical Working Group with arrangements for reporting to the West of Scotland Resilience Partnership 6 Treat Develop long term test schedule for DRPs to be presented to the SMT (December 2021) 2021/22 9 Welfare Reform Implementation of welfare reform is not managed well resulting in increased poverty and deprivation or short term crisis 12 1. Financial Inclusion and Advice Group established 2. Joint working with DWP, CPP and other agencies 3. Child Poverty Planning Group set up and active 4. Flexible Food Fund created. Supporting householders in our area with funds and advice to address food and fuel insecurities 6 Tolerate 1. Extend Flexible Food Fund Contract for a further year to March 2023. 2. Council, HSCP and third sector deliver range of 20 Covid related support projects under the Flexible Fund banner by March 2023. 3. Deliver sustainable school clothing bank across the Argyll and Bute area by December 2022. 4. One-off top-up payments of £75 per child issued to School 2019/20 2023/24
Page 16
16 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage Clothing Grant recipients by end of February 2022. 5. Argyll and Bute centric anti- poverty training delivered to 600 Council, NHS and third sector staff by March 2022. 6. ""Worrying about money"" leaflet to be issued with Council Tax bills containing advice and support for people with money worries in March 2022. Update website with information and support. 10 Waste Management Unable to dispose of waste in landfill sites due to the implications of the biodegradable municipal waste (BMW) landfill ban in 2025 20 1. Helensburgh and Lomond waste solution available via third party offtakers 2. Waste strategy 16 Treat Progress on developing delivery models to be reported to EDI Committee (ongoing). 2021/22 (Scrutiny) 2023/2024 11 Service Delivery - Cyber Security Unable to deliver services to customers because of failure of ICT 20 1. ICT Security & compliance officer in post, producing weekly threat analyses, member of CiSP 2. PSN and Cyber Essentials Plus accreditations for corporate network 3. Regular patching regimes in place 15 Treat 1. Review all contingency plans with updated knowledge from SEPA and UHI Cyber Attacks. 2. Work with Scottish Government Cyber Resilience Team to test ICT response 2019/20 2022/23
Page 17
17 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage systems following major cyber security breach 4. ICT Disaster recovery plans tested regularly 5. All critical activities have recovery plans developed (CARP’s) 3. Issue regular communications to raise awareness of importance of cyber security and awareness 4. Enforce password changes when found to be weak 5. Cyber Security Resilience Exercise planned for late February 2022. 6. Continued close review of disaster recovery plan and associated tests, finalise and test incident response procedure, and review of mirroring between the 2 data centres (monthly at ITMT) and backup 7. Review and progress requirements for Education Network to achieve CE+ accreditation. 12 Impact of COVID - 19 The Council are unable to deliver core services as a result of the Covid 19 virus with adverse impact to community and the economy 25 1. Establishment of Strategic and Tactical Groups with links to HSCP, NHS and national/regional resilience groups 2. Tactical team via the Civil Contingencies Manager liaising/ collaborating with Regional Resilience Partnerships and other resilience partners. 3. Development and delivery of an integrated approach to deliver decisions and mitigations 12 Treat 1. Development and regular review of Economic Recovery workstream with input from representatives across the organisation and the Health and Social Care Partnership. 2. Assessment of COVID on wellbeing and service capacity/sustainability. 3. P&R Committee in December 2021 agreed funding of £110k 2021/22 2023/24
Page 18
18 Argyll and Bute Council – Internal Audit 2022/23 Annual Audit Plan No Risk Gross Risk Current Mitigation Residual Risk Approach Key Actions Audit Coverage 4. SITREP reporting through contingency planning structures in place from the Recovery and Renewal Fund to aid delivery of critical areas of the Recovery Strategy and Action Plan which will create 2 temporary posts for a 12 month period.