Agenda Document Pack - Audit Committee - 02/12/2025
Midlothian Council · 2 December 2025
Back to Audit Committee — 2 December 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Notice of Meeting and Agenda Audit Committee Venue: Normandy Court/ Hybrid, Normandy Court, 20 Normandy Dr, Dalkeith, EH22 1JG Date: Tuesday, 02 December 2025 Time: 11:00 Executive Director : Place Contact: Clerk Name: Democratic Services Clerk Telephone: Clerk Email: democratic.services@midlothian.gov.uk Further Information: This is a meeting which is open to members of the public. Privacy notice: Please note that this meeting may be recorded. The recording may be publicly available following the meeting. If you would like to know how Midlothian Council collects, uses and shares your personal information, please visit our website: www.midlothian.gov.uk Page 1 of 134
Page 2
1 Welcome, Introductions and Apologies 2 Order of Business Including notice of new business submitted as urgent for consideration at the end of the meeting. 3 Declaration of Interest Members should declare any financial and non-financial interests they have in the items of business for consideration, identifying the relevant agenda item and the nature of their interest. 4 Minute of Previous Meeting 4.1 Minute of Audit Committee meeting of 30 September 2025 submitted for approval 3 - 14 4.2 Action Log 15 - 16 5 Public Reports 5.1 Treasury Management Mid-Year Review Report, report by Chief Financial Officer & Section 95 Officer 17 - 44 5.2 Internal Audit Work to November 2025, report by Chief Internal Auditor 45 - 68 5.3 Follow-Up Review of Completed Internal Audit Recommendations and Progress Update, report by Chief Internal Auditor 69 - 92 5.4 Strategic Risk Management – Strategic Risk Profile Quarter 2, 2025-26, report by Chief Officer Place 93 - 134 6 Private Reports No items for discussion 7 Date of Next Meeting The next meeting will be held on Monday 23 February 2026 at 11:00am. Page 2 of 134
Page 3
Audit Committee Tuesday 02 December 2025 Item No 4.1 Audit Committee Date Time Venue Tuesday 30 September 2025 11:00am Council Chambers/Hybrid Present: Councillor McEwan (Chair) Councillor Bowen (virtual) Councillor McCall Councillor Milligan Councillor Smaill In Attendance: Councillor McKenzie (virtual) Councillor Scott (virtual) Dr Grace Vickers, Chief Executive Kevin Anderson, Executive Director Place Morag Barrow, Joint Director Health and Social Care and Chief Officer to Midlothian Integration Joint Board David Gladwin, Chief Financial Officer & Section 95 Officer Saty Kaur, Chief Officer Corporate Solutions Derek Oliver, Chief Officer Place Duncan Stainbank, Chief Internal Auditor Alan Turpie, Legal and Governance Manager and Monitoring Officer Elaine Greaves, Principal Internal Auditor Lisa Young, Accountant Claire Gardiner, Audit Director, Audit Scotland Patricia Fraser, Senior Audit Manager, Audit Scotland Hannah Forbes, Democratic Services Officer Nicola Thorburn, Democratic Services Team Leader Page 3 of 134
Page 4
1. Welcome and Apologies for Absence The Chair welcomed everyone to the meeting of the Audit Committee. No apologies were received. 2. Order of Business The Order of Business is as per the agenda. 3. Declarations of interest No declarations of interest were intimated at this stage of the proceedings. 4. Minute of Previous Meeting 4.1 The Minutes of the previous meeting, held on 16 June 2025, were submitted for approval. Councillor Smaill moved to approve the minutes, seconded by Councillor Milligan. 4.2 Action Log – the Committee agreed that the item on the action log that has been recommended for closure can be closed. 5. Public Reports Report No. Report Title Submitted by: 5.1 Audit Committee - Nomination of Chair Chief Officer Corporate Solutions Outline of report and summary of discussion The Chief Officer Corporate Solutions presented the report for decision, seeking nomination of an Elected Member from the Audit Committee into the role of Chair until the Local Government Elections in May 2027. Audit Committee is recommended to: • Nominate an Elected Member from the Audit Committee to the role of Chair until the Local Government Elections in May 2027. Councillor Milligan nominated Councillor McEwan as the Chair of Audit Committee until the Local Government Elections in May 2027, seconded by Councillor Smaill. Councillor Smaill asked about the recruitment of an Independent Chair for Audit Committee. The Chief Officer Corporate Solutions clarified that the Chair of Audit Committee is now Councillor McEwan and that recruitment is ongoing for an Independent Member for Audit Committee, not specifically an Independent Chair. The Chair thanked the Chief Officer Corporate Solutions for their report and the Committee for their nomination. Decision Councillor Milligan nominated Councillor McEwan as the Chair of Audit Committee until the Local Government Elections in May 2027, seconded by Councillor Smaill. Page 4 of 134
Page 5
Report No. Report Title Submitted by: 5.2 Annual Audit Report to Members and the Controller of Audit – year ended 31 March 2025 Audit Scotland Outline of report and summary of discussion The Chair advised the Committee that they have asked Council Officers and Audit Scotland to include dates on their reports alongside the quarters, so it is clear which reporting period the information refers to. Councillor Milligan noted that they had only received the printed copies of agenda items 5.2 and 5.3 shortly before this meeting started and therefore, they would not participate in the discussion. The Chair noted that while the papers were available online in sufficient time prior to the meeting, if required, Elected Members should receive printed copies in advance of the meeting to allow time for reading. It was agreed that this matter would be taken away for review. The Audit Director, Audit Scotland presented their two reports, the first being the Letter of Representations ISA (UK) 580 which provides conclusions on the financial statement audit work. The Audit Director, Audit Scotland confirmed that they intend to issue an unmodified audit opinion which is the best result Audit Scotland give. Appendix B, a letter of representation, provides assurances from the Section 95 Officer on behalf of the Council on key judgements in the annual accounts. This includes fraud, and before approving this letter, the Audit Director, Audit Scotland asked Audit Committee Members to consider if they have any knowledge of actual fraud, non-compliance with law or regulations, or any issues that would prevent the Section 95 Officer signing this letter. The Audit Director, Audit Scotland moved onto the annual audit report, which confirms that the audit of Midlothian Council 2024/24 Annual Accounts resulted in an unqualified opinion confirming the financial statements are free from material misstatement. The Audit Director, Audit Scotland added that while this reflects well on the Council’s Finance Team and their preparation of the accounts the audit did identify several valuation and classification issues relating to non-current assets, these included misclassifications under International Financial Reporting Standards (IFRS)16 in relation to leases, errors in land and school valuations and the use of outdated conditions surveys. Audit Scotland have outlined the adjustments made to the accounts in appendix 2. While none of the adjustments were material individually, they do highlight areas for improvement particularly with the valuation methodology, and recommendations have been raised. The valuation of Council dwellings was also reviewed and, while the methodology was found to deviate from the Beacon method, Audit Scotland did confirm that the approach was reasonable and there is a recommendation going forward to align more closely with guidance in future valuations. In terms of the wider scope audit, the Audit Director, Audit Scotland highlighted that the Council’s financial management arrangements are well established and functioned effectively during the year. However, the Audit Director, Audit Scotland noted that there is a continued reliance on reserves which is unsustainable. The Council ended the year with a £3 million overspend, driven by pressures in school transport, staffing and waste disposal. While capital spending was well managed, the Audit Director, Audit Scotland noted that the Midlothian Integration Joint Board’s Page 5 of 134
Page 6
(MIJB) Adult Social Care budget remains a significant risk, alongside other financial challenges and Audit Scotland has concluded that Council must urgently identify recurring savings to balance future budgets. It was also concluded that governance arrangements are sound, there is clear strategic vision with effective scrutiny, and that the Council has appropriate frameworks for monitoring performance and resource use. The Audit Director, Audit Scotland noted that Midlothian Council continue to demonstrate a strong commitment to best value and governance arrangements are effective. Good progress has been made on previous recommendations. The Audit Director, Audit Scotland thanked Midlothian Council’s Finance Team for their hard work in supporting this year’s audit. The Chair thanked the Senior Audit Manager, Audit Scotland for their report, their work on the audit and then invited questions. Councillor Smaill advised that they found the report helpful and added that the Audit Committee has confidence in the Council’s finance function and therefore has no concerns over the adjustments that were required. Councillor Smaill referred to the valuation of Council houses and the adjustment factor and highlighted that this had been discussed at length previously. The Audit Director, Audit Scotland advised that the guidance specifically states that rent yields should be used to inform the adjustment factor and that the Valuer did do some work on this in-year but felt that the local information available on rent yields was not in-depth enough to inform a strong judgement. If they used fewer local factors, the adjustment factor would be out of line with rest of Scotland. The Audit Director, Audit Scotland confirmed that while this was raised, they are comfortable with what the Valuer has done to give a credible adjustment factor. The Chief Finance Officer and Section 95 Officer added that discount factor is approximately 66% and that the valuation of Council houses is a challenging piece of methodology and is observed closely. Councillor Smaill asked if other Scottish Local Authorities were following a different process, and whether using the Beacon methodology would be of benefit to the Council. The Audit Director, Audit Scotland clarified that in relation to the Beacon principle, a Beacon property had not been selected from each area and instead Midlothian Council had used a slightly different methodology, however Audit Scotland has reviewed that, and it would not result in any material misstatement. The Chair referred to the testing on Council Tax – Secondary Checks, as detailed on page 24 of the meeting papers and noted that Midlothian Council only identified 3 out of 10 however the Council procedures require at least 10 samples checks per year of the exemptions, discounts, reductions and refunds applied to Council Tax. The Chief Officer Corporate Solutions advised that there have been resource challenges in the Revenues Department over the last 12 months but gave assurance that work is ongoing, within the transformation programme and in general, to get the service performing well and that this target will be met next year. Page 6 of 134
Page 7
Decision Audit Committee noted the contents of the report. Report No. Report Title Submitted by: 5.3 Annual Accounts for the year ended 31 March 2025 Chief Financial Officer and Section 95 Officer Outline of report and summary of discussion The Chief Financial Officer and Section 95 Officer presented the report for decision, presenting the Council’s audited annual accounts for 2024/25 to Audit Committee and provided a brief overview of findings during the audit process. Audit Committee is recommended to approve the 2024/25 audited annual accounts for signature in light of the appointed auditor’s report for 2024/25. The Chief Financial Officer and Section 95 Officer added that due to the necessary technical aspects of local government accounts, this will always be a challenging area for Elected Members serving the Audit Committee. To support Audit Committee Members and their governance requirements reliance can be placed on the findings of the Council’s appointed auditor, Audit Scotland, and the Chief Financial Officer and Section 95 Officer. During the last three months Audit Scotland have carried out extensive work on the accounts, and the findings were discussed earlier in today’s meeting. Audit Scotland have issued an unmodified opinion. The Chief Financial Officer and Section 95 Officer noted that the Council have a very strong working relationship with Audit Scotland in what is a very challenging area to navigate. The Chief Financial Officer and Section 95 Officer thanked the Audit Director, Audit Scotland and their team for fostering this. Since these meeting papers were issued, the Chief Financial Officer and Section 95 Officer advised that there have been some minor adjustments which were all minimal and presentational in nature. The audited accounts that should be signed, if Audit Committee approve today, will reflect these adjustments. The Chief Financial Officer and Section 95 Officer applauded the tireless dedication of their team and gave their personal thanks. The Chair echoed these sentiments and thanked the Chief Financial Officer and Section 95 Officer and their team. The Chair thanked the Chief Financial Officer and Section 95 Officer for the report and invited questions. Councillor Smaill thanked the Chief Financial Officer and Section 95 Officer for the accounts and noted that they were very accessible. Councillor Smaill highlighted some minor presentational issues. The Chief Finance Officer and Section 95 Officer thanked Councillor Smaill for their feedback, acknowledged where the narrative could be expanded and agreed to take that on board for next year’s report. Councillor Smaill congratulated the Chief Financial Officer and Section 95 Officer Page 7 of 134
Page 8
on being the first Midlothian Council Chief Financial Officer and Section 95 Officer where the assets exceed £1 billion. The report was moved by Councillor McCall and seconded by Councillor Smaill. Decision Audit Committee approved the report and the recommendations. Report No. Report Title Submitted by: 5.4 Internal Audit Work to September 2025 Chief Internal Auditor Outline of report and summary of discussion The Chief Internal Auditor presented the report for decision, providing the Audit Committee with details of the recent work carried out by Internal Audit and the findings and recommended audit actions agreed by Management to improve internal controls and governance arrangements. The Internal Audit Annual Plan 2025/26 was approved by the Audit Committee on 24 February 2025. Internal Audit has carried out work associated with the delivery of the plan to meet its objective of providing an opinion on the efficacy of the Council’s risk management, internal control and governance. An Executive Summary of the final Internal Audit assurance report issued, including audit objective, findings, good practice and recommendations (where appropriate), and the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area, is shown in Appendix 1. The Internal Audit function conforms to the professional standards as set out in Global Internal Audit Standards (GIAS) including the production of this report to communicate the results of the reviews. The Audit Committee is recommended to: a) Consider the Executive Summary of the final Internal Audit assurance report issued associated with the delivery of the approved Internal Audit Annual Plan 2025/26; b) Note the Internal Audit Consultancy and Other Work carried out in accordance with the approved Internal audit Charter; and c) Acknowledge the assurance provided on internal controls and governance arrangements in place for the areas covered by this Internal Audit work. The Chair thanked the Chief Internal Auditor for the report and invited questions. Page 8 of 134
Page 9
Councillor Smaill asked about the IR35 position and the financial implications with His Majesty’s Revenues and Customs (HMRC) in relation to national insurance and income tax for agency workers that stay with the Council too long. The Chief Internal Auditor advised that long-term agency staff must be looked at on an individual basis. The Chief Officer Corporate Solutions assured Members that in terms of the IR35, HMRC conducted an audit of IR35 workers in the organisation in 2022/23 and they did not find any issues or irregularities. The process that requires to be updated inside the organisation is the review of how long agency workers are being used, which is a reviewed on a case-by-case basis within each service. The Chair asked if the Council enter into fixed term contracts with agencies on behalf of the agency worker. The Chief Officer Corporate Solutions advised that this was dependent upon the situation, for example business transformation projects with agreed funding have Project Managers who are brought in on a fixed- term contract. There are other areas, as detailed in the report, where there are challenges in recruitment, so agency workers are used to fill some of the gaps, but they should all be aligned to a specific project or piece of work. Councillor Milligan asked why the Recruitment and Selection Policy had not been updated since 2012 and advised that they expected this to have been reviewed during the COVID period. The Chief Office Corporate Solutions agreed that there should have been a robust process in place for reviewing this policy and there is now a policy register for the organisation and a red/amber/green (RAG) system in place for review. Work is ongoing to ensure this is aligned to onboarding, hybrid working, and the recruitment policy. The Chief Office Corporate Solutions expects that the policy will be in place by the end of December 2025. Councillor Milligan highlighted that the papers indicate that £3million of the spend on agency staff are to suppliers who are not approved in the Public Sector Framework, and that this will not be resolved until September 2026. Councillor Milligan asked if this could be resolved sooner, perhaps by the end of the financial year. Councillor Milligan also expressed concerns as the report states that clear written principles had not been established for managers to follow when a level 1 disclosure check is required, and that the guidance will not be ready until March 2026. The Chief Officer Corporate Solutions advised that ideally these tasks will be completed sooner but they have given the timeline of 1 year as this will involve reviews on a case-by-case basis, time to gain an understanding of the agency use within each service, and why some are not using the approved agencies on the Public Sector Framework. Support can then be provided through the procurement process if required. The Chief Officer Corporate Solutions has requested a breakdown of the figures which will show agency worker use across all the services. The Chair asked for clarification on whether the disclosures referred to agency staff only, and not permanent employees. The Chief Officer Corporate Solutions responded that this will be different across the services. The Chair asked whether the onus should be on the agencies to ensure the staff they provide have the necessary certification for employability. The Chief Officer Corporate Solutions advised that the contracts between Midlothian Council and the agency provider must be reviewed to confirm the position. Page 9 of 134
Page 10
Councillor Smaill asked if this work will be linked to the Council’s policy where our contractors, including agency workers, are paid the living wage and how this monitored. The Chief Officer Corporate Solutions advised that work is ongoing around “fair work” and a paper was taken to Council in 2024. There is a significant piece of work to be done in and around commissioned services and any organisations that the Council fund and if they pay the living wage. With the Council’s agency workers, we would not employ an agency worker that is paid less that the equivalent permanent role in the Council. Council staff are being paid the real living wage and above. The report was moved by Councillor Smaill and seconded by Councillor McCall. Decision Audit Committee approved the report and the recommendations. Report No. Report Title Submitted by: 5.5 Audit Committee Annual / End of Term Report 2024/25 Chair Outline of report and summary of discussion The Chief Internal Auditor presented the report for decision, providing Members with the Audit Committee Annual / End of Term Report 2024/25, which sets out how the Audit Committee has performed against its remit and the effectiveness of the Audit Committee in meeting its purpose based on the annual self-assessments of the Committee against best practice and provides assurances to the Council. It is important that the Council’s Audit Committee fully complies with best practice guidance on Audit Committees to ensure it can demonstrate its effectiveness as a scrutiny body as a foundation for sound corporate governance of the Council. The Chartered Institute of Public Finance and Accountancy (CIPFA) Audit Committees Practical Guidance for Local Authorities and Police 2022 Edition (hereinafter referred to as CIPFA Audit Committees Guidance) includes the production of an annual report on the performance of the Audit Committee for submission to the Council. The Audit Committee Annual / End of Term Report 2024/25 is appended to this report as Appendix 1 for consideration. The Audit Committee is recommended to approve the Audit Committee Annual /End of Term Report 2024/25 (Appendix 1) and its self-assessments using the CIPFA Audit Committees Guidance (Appendices 2 and 3) and agrees that the Audit Committee Annual / End of Term Report 2024/25 should be presented to the Council. The Chair thanked the Chief Internal Auditor for the report and invited questions. No questions were submitted. The report was moved by Councillor Smaill and seconded by Councillor McCall. Decision Audit Committee approved the report and the recommendations. Page 10 of 134
Page 11
Report No. Report Title Submitted by: 5.6 Risk Management Policy and Strategy Chief Officer Place Outline of report and summary of discussion The Chief Officer Place presented the report for decision, showing the revised Risk Management Policy and Strategy, which outlines the proposed approach to risk management and governance arrangements for risk monitoring and accountability. Audit Committee is recommended to approve the revised Risk Management Policy and Strategy. The Chair thanked the Chief Officer Place for their report and invited questions. Councillor Milligan highlighted the strategic risk evaluation for Care at Home on page 89 of the meeting papers, and asked whether a likelihood rating of 3, and the impact being 4, are suitable ratings given the criticality of this service and the significant rise in demand. The Chief Officer Place advised that those ratings relate to the Strategic Risk Profile and would be covered as part of agenda item 5.7 Strategic Risk Management – Strategic Risk Profile Quarter 1, 2025-26. The report was moved by Councillor Smaill and seconded by Councillor McCall. Decision Audit Committee approved the report and the recommendations. Report No. Report Title Submitted by: 5.7 Strategic Risk Management – Strategic Risk Profile Quarter 1, 2025-26 Chief Officer Place Outline of report and summary of discussion The Chief Officer Place presented the report for information, providing Audit Committee with: - • An update on the risk responses Midlothian Council has implemented during Q1 2025/26 to respond to the current risk climate. • Assurance that Midlothian Council took a proportionate and planned approach to prepare and respond to the current risk climate. • The risk evaluation of current strategic risks and opportunities for the Council. Audit Committee is recommended to note the current risk landscape and organisational response to the most significant risks in Quarter 1, 2025-26 (1st April to 30th June 2025). The Chair thanked the Chief Officer Place for their report and invited questions. The Joint Director Health and Social Care and Chief Officer to Midlothian Integration Joint Board addressed Councillor Milligan’s previous question regarding Page 11 of 134
Page 12
the Care at Home rating and advised that financially they have allocated additionality through the NHS Unscheduled Care Funding hence this service’s risk rating has not increased at this point in time. The Joint Director Health and Social Care and Chief Officer to Midlothian Integration Joint Board agreed to discuss this specific risk rating with their team and revert. Councillor McCall asked about cyber security after seeing notable differences in the number of spam emails that they receive in their other role working for a Member of the Scottish Parliament (MSP) in comparison to what they receive at the Council. The Chief Officer Place advised that through the Risk and Resiliency Group and the Business Continuity Planning Midlothian Council does have an enhanced level of cyber security. The Chief Officer Corporate Solutions added that in terms of cyber security everyone should be mindful that it is a case of when, not if, the Council may be subject to a cyber event. The meeting papers detail some of the appropriate organisational and technical measures taken. Midlothian Council systems are subject to rigorous checks and protocols are in place. The Chief Internal Audit added that their team plan to undertake some work on cyber security to ensure Midlothian Council have everything possible in place. Councillor Smaill asked Audit Scotland if there were any methodologies to support the management of capital plan finances as these are challenging to confirm. The Chair asked if the Capital Plan was putting Midlothian Council at too great a risk. The Chief Internal Auditor deferred the question to the Executive Director Place and added that they were open to discussing this further offline to determine where their team could assist. The Executive Director Place advised that there is an existing Capital Plan for the current financial year, which was established in February 2025, and delivery is in progress with regular reporting to the Elected Members. In terms of future years, work is ongoing using Artificial Intelligence (A.I) to have a significant piece of data processing carried out, and the aim is to take a draft paper to the October meeting of Midlothian Council on the Asset Management Plan. The Audit Director, Audit Scotland highlighted that the Year 4 Audit Scotland Best Value Thematic work will be focused on asset management so examples of good practice can be shared then. The Chief Finance Officer and Section 95 Officer reminded the Audit Committee that the affordability of capital plans is measured by the Prudential Framework, and those indicators are reported to Council regularly. When Capital Plan prioritisation was first discussed it was understood that due to the infrastructure pressures in Midlothian there was a significant risk of not being able to deliver those pressures and operate within budget. The Chief Finance Officer and Section 95 Officer explained that when budgets are set for future years, both the Housing Revenue Account Budget and the General Fund, the cost of borrowing and running the premises that are created or developed as part of the Capital Plan are reflected in the budget. The challenge now is to ensure future challenges, and the delivery of the existing Capital Plan is accurately reflected going forward. Page 12 of 134
Page 13
Councillor Milligan added that the Capital Plan was still lacking information, and that Elected Members must have a clearer picture to show the prioritisation of capital projects. In terms of cyber security, Councillor Milligan asked when information is gathered after an attack on organisations and whether that information is shared widely to support learning. The Chief Internal Auditor advised that there are public sector networks locally and nationally where information is shared for learning. The Chief Internal Auditor added that any organisation is only as strong as their weakest link, and often that is the human element of any process. The Chief Officer Corporate Solutions advised that they are part of groups that link in together during the recovery phase of a cyber-attack and will be attending an upcoming session to work through potential scenarios. Controls and processes are under constant review and there are regular staff communications with reminders around the risks. The Audit Director, Audit Scotland emphasised that a cyber-attack on a local authority would be catastrophic. Councillor Smaill noted that the information on page 115 of the meeting papers, Cost of Living Crisis, relates to 2022 and added that this should be updated given the significant changes since then in terms of support and benefits available now. Decision Audit Committee noted the contents of the report. Action Review the Strategic Risk Ratings assigned to Care at Home and provide an update - Joint Director Health and Social Care and Chief Officer to Midlothian Integration Joint Board. Review SRP.RR.22 Cost of Living Crisis and update with current data following changes in the support and benefits available since 2022 – Chief Officer Place. 6. Private Reports No items for discussion. 7. Any Other Business The Chair updated Audit Committee regarding concerns raised previously on Home to School Transport overspend. The Chair has discussed this with the Chief Internal Auditor, and this is still being reviewed. The Chief Internal Auditor confirmed that the report has been submitted to management for review, and they hope to get the full report shared with Elected Members and Audit Committee as soon as possible. The Chair asked that the Chief Internal Auditor provide paper copies of the report to Elected Members. Page 13 of 134
Page 14
8. Date of Next Meeting The meeting concluded at 12:13pm. The next meeting of the Audit Committee will be held on Tuesday 02 December 2025 at 11:00am. Page 14 of 134
Page 15
Audit Committee Tuesday 2 December 2025 Item 4.2 Audit Committee Action Log No Date of Meeting Item No and Title Action Action Owner Expected completion date Comments 1 30 September 2025 5.7 Strategic Risk Management – Strategic Risk Profile Quarter 1, 2025-26 Review the Strategic Risk Ratings assigned to Care at Home and provide an update. Joint Director Health and Social Care and Chief Officer to Midlothian Integration Joint Board TBC 2 30 September 2025 5.7 Strategic Risk Management – Strategic Risk Profile Quarter 1, 2025-26 Review SRP.RR.22 Cost of Living Crisis and update with current data following changes in the support and benefits available since 2022. Chief Officer Place TBC Page 15 of 134
Page 16
Page 16 of 134
Page 17
Audit Committee Tuesday 2 December 2025 Item No 5.1 Treasury Management Mid-Year Review Report 2025/26 Report by David Gladwin, Chief Financial Officer & Section 95 Officer Report for Consideration 1 Recommendations The Audit Committee is invited to comment on this report before it is presented to Council. In particular, Audit Committee should note the following recommendations which are proposed to be put to Council on 16 December 2025:- a) Note the report and the treasury activity undertaken in the period to 20 November 2025, as outlined in Section 4 and Section 5.2; b) Note the current economic position and forecast for interest rates, and the actual and forecast Treasury Management activity during the second-half of the year as outlined in Section 5.2 and 5.3; and note the continuation of a Treasury Management strategy of minimising cash (fixed term deposit) balances to allow the Council to continue to defer costs associated with locking into longer-term borrowing at rates that remain elevated, noting that this strategy is similar to the majority of other Scottish Councils; c) Note the technical revisions to the Prudential Indicators in Section 6 of this report; d) Note the loans fund rate performance relative to other Scottish Local authorities, as outlined in Section 7, and the cash saving (compared to the Scottish Average) that the Treasury Management function brings to support the Council’s in-year revenue budget. 2 Purpose of Report/Executive Summary The purpose of this report is to inform members of the Audit Committee, and subsequently Council, of the Treasury Management activity undertaken during the first half of 2025/26 and the forecast activity for the second half of 2025/26 in accordance with the Treasury Management and Annual Investment Strategy approved by Council on 25 February 2025. It also provides an update to the Treasury and Prudential Indicators for 2025/26. Date: 20 November 2025 Report Contact: Gary Thomson, Senior Finance Business Partner gary.thomson@midlothian.gov.uk Page 17 of 134
Page 18
3 Background Audit Committee Role The Prudential Code recommends that the main Treasury Management reports are presented for scrutiny by Audit Committee in advance of consideration by Council. This report is being presented to Audit Committee on 2 December 2025 for consideration prior to being presented to Council on 16 December 2025. Any revisions arising from Audit Committee consideration of the report on 2 December 2025 will be incorporated into the final version of the report to Council on 16 December 2025. Treasury management Treasury management is defined in the Prudential Code as: “The management of the local authority’s borrowing, investments and cash flows, its banking, money market and capital market transactions; the effective control of the risks associated with those activities; and the pursuit of optimum performance consistent with those risks.” The main function of the treasury management service is the funding of the Council’s capital investment plans. These capital plans provide a guide to the borrowing need of the Council, essentially the longer-term cash flow planning to ensure the Council can meet its capital spending operations. The management of this long-term borrowing requirement involves arranging long or short-term loans or using cash balances; and on occasion any debt previously drawn may be restructured to meet Council risk or cost objectives. As the Council operates a balanced budget, this broadly means cash raised during the year will meet its cash expenditure. As part of the treasury management operations, officers ensure this cash flow is adequately planned, with available cash balances being deposited in low-risk counterparties, providing adequate liquidity initially before considering optimising return on deposits. This mid-year report has been prepared in compliance with CIPFA’s Code of Practice on Treasury Management, and covers the following: • An economic update for the first half of the 2025/26 financial year; • A review of the Treasury Management Strategy Statement and Annual Investment Strategy 2025/26 (TM&AIS 2025/26) approved by Council on 25 February 2025; • The Council’s capital expenditure, as set out in the General Services and HRA Capital Plan reports, and prudential indicators; • A review of the Council’s borrowing strategy for 2025/26; • A review of the Council’s deposit portfolio for 2025/26; • A review of debt rescheduling undertaken during 2025/26; • A review of compliance with Treasury and Prudential Limits for 2025/26. Page 18 of 134
Page 19
4 Treasury Activity during first half of 2025/26 The main points arising from treasury activity in the 6 months to 30 September 2025 were:- • Long term borrowing of £40.000 million was secured in April 2025, this being:- o Two £10 million PWLB Maturity loans with tenors of 3 and 4 years respectively and at interest rates of 4.16% and 4.18% respectively. o Two £10 million PWLB Equal Instalment of Principle (EIP) loans with tenors of 6 and 8 years respectively and at interest rates of 4.18% and 4.20% respectively. • Long term borrowing of £0.870 million matured, this being £0.500m of PWLB EIP loans, £0.340 million of Market Loans and £0.031 million PWLB Annuities; • A fixed term deposit of £10.000 million was placed with Lloyds Banking Group in April 2025, with a tenor of 1 year and earning an interest rate of 4.18%; • The average interest rate earned on external funds on deposit in the first half of the year was 4.24%. Loan Portfolio The Council’s loan portfolio as at 30 September 2025 is shown in table 1 below (position at 31 March 2025 also shown for comparison):- Table 1: Council’s Loan Portfolio at 31 March 2025 and 30 September 2025. Loan Type 31 March 2025 30 September 2025 Principal Outstanding £000’s Weighted Average Rate Principal Outstanding £000’s Weighted Average Rate % PWLB Annuity 395 8.92% 365 8.92% PWLB Maturity 333,502 3.11% 353,502 3.17% PWLB EIP 10,000 4.49% 29,500 4.29% LOBO 15,000 4.63% 15,000 4.63% Market Loans 20,548 3.04% 20,208 3.04% Total Loans 379,445 3.21% 418,575 3.30% Underlying Borrowing Requirement* 469,866 427,696 Over/(Under) Borrowing -90,421 -67,884 * The Underlying Borrowing Requirement is the Capital Financing Requirement excluding the “Public Private Finance” (PPP) Contract Liabilities Page 19 of 134
Page 20
The balance of external and internal borrowing is generally driven by market conditions. At 30 September 2025 the Council was under borrowed by £67.884 million – this is the extent to which the Council has yet to finance its current borrowing requirement from long term loans. This position reflects the Council’s use of working capital and balance sheet useable reserves to fund part of the prior year and current in-year borrowing requirement. This strategy of using internal borrowing (working capital) to fund the in- year CFR is prudent given the current plateau in medium to longer-term PWLB borrowing rates of c. 5.50%+ together with the expected gradual drop in these medium to longer-term PWLB borrowing rates over the remainder of the current and forthcoming financial years as outlined in Appendix 4. Debt Rescheduling No Debt Rescheduling took place in the first half of the financial year. Funds on Deposit The Council’s funds on deposit portfolio as at 30 September 2025 is shown in table 2 below (position at 31 March 2025 also shown for comparison):- Table 2: Council’s Funds on Deposit Portfolio at 31 March 2025 and 30 September 2025 Type 31 March 2025 30 September 2025 Principal Outstanding £000’s Weighted Average Rate Principal Outstanding £000’s Weighted Average Rate % Money Market Funds 25,946 4.54% 29,667 4.09% Bank Call Accounts 538 4.34% 243 3.77% Bank Fixed Term Deposits 0 n/a 10,000 4.18% Total Deposits 26,484 4.54% 39,910 4.11% The Chief Financial Officer & Section 95 Officer confirms that the approved limits within the Annual Investment Strategy were not breached during the first 6 months of 2025/26. Page 20 of 134
Page 21
5 Actual/Expected Treasury Activity during second half of 2025/26 5.1 Economic Update The Council has appointed MUFG Corporate Markets (formerly Link Treasury Solutions Limited) as its treasury advisors and part of their service is to assist the Council to formulate a view on interest rates. These are outlined in Table 3 below. Table 3: MUFG Corporate Markets Central Forecast for Interest Rates In summary, interest rates for borrowing across the entire Gilt Yield curve have shifted higher and are expected to remain elevated for longer, particularly at the medium-longer end of the curve. This reflects ongoing concerns around the stickiness of inflation, elevated wages and the difficult funding choices facing the Chancellor in the upcoming Budget on 26 November 2025; although international factors emanating from the Trump administration’s fiscal, tariff and geo-political policies continue to play a significant role in market expectations. The Bank of England announced in September that it would be favouring the short and medium part of the curve for the foreseeable future when issuing gilts, but market reaction to the November Budget is likely to be the decisive factor in future gilt market attractiveness to investors and their willingness to buy UK sovereign debt. The Bank of England Base Rate remains at 4.00%, with (a) inflation not anticipated to drop below 2% until early 2027 and (b) wages still rising by just below 5%, resulting in a 7-2 vote to keep rates at 4.00% at the September Monetary Policy Committee (MPC) meeting, which narrowed to 5-4 in favour of holding rates at 4.00% at the November MPC meeting. Markets are now factoring in a rate cut to 3.75% at the next MPC meeting (18 December 2025), although fiscal policy arising from the UK Budget on 26 November 2025 may well yet change this path. At this juncture, MUFG Corporate Markets still forecast longer term borrowing rates to gradually fall back over the next two to three years as inflation dampens, and for bank rate to gradually drop from 4.00% to 3.25% with one base rate cut per financial year; although there remains upside risk to all forecasts at present. More detail is provided in Appendices 1, 2 and 3. NOW Dec-25 Mar-26 Jun-26 Sep-26 Dec-26 Mar-27 Jun-27 Sep-27 Dec-27 Mar-28 Jun-28 Sep-28 BANK RATE 4.00% 4.00% 3.75% 3.75% 3.50% 3.50% 3.50% 3.50% 3.25% 3.25% 3.25% 3.25% 3.25% 3 month average earnings 4.06% 4.00% 3.80% 3.80% 3.50% 3.50% 3.50% 3.50% 3.30% 3.30% 3.30% 3.30% 3.30% 6 month average earnings 3.97% 3.90% 3.70% 3.70% 3.50% 3.50% 3.50% 3.50% 3.30% 3.30% 3.40% 3.40% 3.40% 12 month average earnings 3.84% 3.90% 3.70% 3.70% 3.50% 3.50% 3.50% 3.50% 3.30% 3.40% 3.50% 3.60% 3.60% 5 Year PWLB 4.77% 4.70% 4.50% 4.40% 4.30% 4.30% 4.30% 4.20% 4.20% 4.20% 4.20% 4.10% 4.10% 10 Year PWLB 5.36% 5.20% 5.00% 4.90% 4.80% 4.80% 4.80% 4.70% 4.70% 4.70% 4.70% 4.60% 4.60% 25 Year PWLB 6.04% 5.90% 5.70% 5.70% 5.50% 5.50% 5.50% 5.40% 5.40% 5.30% 5.30% 5.30% 5.20% 50 Year PWLB 5.84% 5.60% 5.40% 5.40% 5.30% 5.30% 5.30% 5.20% 5.20% 5.10% 5.10% 5.00% 5.00% MUFG Corporate Markets Interest Rate View November 2025 Page 21 of 134
Page 22
5.2 Actual & Expected Treasury Activity in Second Half of 2025/26 Actual Activity in Second Half of 2025/26 Borrowing New long-term borrowing of £40.000 million was secured in early November 2025, this being one £40.000 million PWLB EIP loan with a tenor of 8 years and at an interest rate of 4.21%, with borrowing secured in order to de-risk the Council’s in-year capital financing requirement in advance of the UK budget on 26 November, and taking advantage of a dip in Gilt Yields which returned yields at the shorter end of the Gilt Yield curve back to levels last seen in early 2025/26. Debt Rescheduling With the whole of the gilt yield curve shifting upwards and remaining higher, the Council has continued to review opportunities to reschedule part of its external debt portfolio. This involves the Council repaying loans prematurely (both market and PWLB) whilst high discount rates on premature repayment prevail (i.e. where the spread between the refinancing rate and the redemption rate is highest). In November 2025, the Council elected to reschedule (prematurely repay) PWLB debt as follows:- • £12.700 million PWLB Maturity loan, original drawn date of 2 August 2027 and existing maturity date of 15 May 2053, at a fixed interest rate of 4.55% The premature repayment of this PWLB loan to the UK Debt Management Office has generated a one-off discount (credit) of £1.079 million to the Council and is expected to generate further cash savings (in interest costs on external debt) to the Council of £1.064m, and so a total expected cash saving of £2.187 million, over the next 27 years. This equates to a positive NPV of £1.787 million (at the Treasury Green Book discount rate of 3.50%). This debt rescheduling has therefore allowed the Council to generate an initial cash saving whilst also ensuring that the expected refinancing of the debt remains prudent and affordable across both the short and medium/long term. Page 22 of 134
Page 23
Total External Debt Portfolio at 18 November 2025 The Council’s total external debt portfolio as at 18 November 2025 is therefore as follows:- Table 4: Council’s Loan Portfolio at 18 November 2025 Loan Type 18 November 2025 Principal Outstanding £000’s Weighted Average Rate % PWLB Annuity 332 8.92% PWLB Maturity 340,802 3.12% PWLB EIP 68,875 4.24% LOBO 15,000 4.63% Market Loans 20,208 3.04% Total Loans 445,217 3.34% Expected Activity in the remainder of the Second Half of 2025/26 The expected activity in the second half of 2025/26, as outlined below, updates the treasury management position in light of the economic position as outlined in Section 5.1 above, and the General Services and HRA Capital Plans as will be presented to Council at Quarter 2 Monitoring (16 December 2025). Borrowing Long term borrowing of £2.828 million matures in the second half of 2025/26, this being £0.519 million of PWLB Maturities, £1.933 million of PWLB EIPs, £0.344 million of Market Loans and £0.032 million PWLB Annuities. Proactive Treasury Management by the Council in the last decade has placed the Council in a strong refinancing position for its existing external debt portfolio; however the prevailing interest rate environment, with the continued plateau in long-term (PWLB) borrowing rates, has driven an approved Treasury Management strategy to go relatively short dated with new borrowing undertaken in the most recent financial years, with the expectation that this new borrowing will be refinanced at maturity with longer dated borrowing, given all interest rate forecasts show a gradual easing in medium to long term borrowing rates throughout the forecast period as outlined in Table 3. This relatively short-dated new borrowing that has been undertaken increases the short-medium term borrowing requirement for the Council, with a larger slice of the Council’s existing debt portfolio maturing in the remainder of the current and forthcoming 4 financial years (total of £111.599 million or 25.07% of the total existing debt portfolio). This is in Page 23 of 134
Page 24
addition to already approved borrowing per the Council’s approved General Services and HRA Capital Plans. Table 5: Maturity Profile of Existing External Loan Portfolio Financial Year 2025/26 Remaining £000’s 2026/27 £000’s 2027/28- 2029/30 £000’s 2030/31- 2034/35 £000’s 2035/36- 2044/45 £000’s 2045/46+ £000’s Debt Maturing 2,828 19,675 89,096 85,512 22,220 225,886 % of total portfolio 0.64% 4.42% 20.01% 19.21% 4.99% 50.74% The approved Treasury Management Strategy for borrowing is to continue to fund the in-year Capital Financing Requirements from PWLB for a relatively shorter-term duration (3-5 year debt tenors), to navigate past the current interest rate hump, with gilt yields expected to gradually ease throughout the course of the next 12-36 months. However, as part of this strategy, cognisance will continue to be taken of the overall level of financing required in the period out to 2029/30, to ensure that the Council can retain a relatively smooth debt maturity profile over this period and beyond. The Council continues to operate in a position whereby borrowing takes advantage of any dips in longer-term borrowing rates from PWLB and other sources, in order to maintain a low weighted average coupon rate on external debt. As noted in Section 5.1 (Table 3), the current PWLB yield curve remains elevated and is bell shaped with a peak in rates around the 20-30 year tenor (6.04%), with 5-10 year rates at c. 4.70-5.35% and 50 year rates are c. 5.84%. The yield curve is expected to remain bell shaped over the short-medium term forecast period, with:- • a gradual shift downwards of the entire curve by c. 30-40bps over the next 12 months and • a further 10-20bps drop over the subsequent 12 months. This is a shallower drop than previously expected, meaning long-term borrowing rates are likely to remain higher and stickier for longer. In addition, the differential between shorter dated gilts (5 year, currently at 4.70%) and longer dated gilts (25 year, currently at 5.60%) is particularly marked, with a spread of around 90bps remaining throughout the period of the forecast. To put this into context, for every £10 million borrowed, sourcing this from longer-dated borrowing would equate to an additional £90,000 per annum in external debt interest costs. To refinance the existing debt Page 24 of 134
Page 25
maturities of £111.599 million in the forthcoming 4 financial years solely from longer dated borrowing, this would equate to an additional £1.004 million per annum in external debt interest costs. Therefore, whilst the funding of the Council’s in-year and forward CFR is typically for infrastructure with long asset lives (50-60 years) – and the tenor of PWLB and market loans are typically drawn with this in mind – consideration for any new borrowing in the remainder of the 2025/26 financial year, to fund the Council’s in-year CFR, will seek to balance:- a) the security/certainty of current relatively high and expensive longer-term borrowing rates of upwards of 5.60% in the 30-50 year duration (which are forecast to drop by 30-40bps within one year and 50-60bps within 24 months) and the potential additional budgetary pressure that this brings in both the short/medium and longer term; with b) the option to borrow initially for a shorter-term duration from PWLB or other markets, for 2 to 5 years, to allow the Council to fund the immediate in-year borrowing requirement. Based on current interest rate forecasts (see Table 3), this would then allow the Council the option to either (i) refinance this borrowing at initial maturity with less expensive, longer term borrowing, e.g. a 45 to 48 year tenor in, say, 36 months, or (ii) refinance this borrowing at initial maturity with further shorter-dated borrowing; to allow the Council to navigate past the current elevated and sticky interest rate environment on longer-dated gilts. It is expected that any further long-term borrowing that is undertaken in 2025/26 to finance the current & future year capital plans will be sourced by drawing new PWLB loans at the Certainty Rate (which has been available to the Council since 2012 and is priced at Gilts+80bps), and/or the HRA rate. The HRA rate is available to all Councils (the availability of which was extended out in the UK Government Budget to the 31 March 2026) to fund HRA capital expenditure, at a rate that is 40bps lower than the current certainty rate available from the PWLB (so priced at Gilts + 40bps). Both the General Services and HRA capital programmes are being kept under regular review due to the effects of inflationary pressures, shortages of materials and labour, and the ratios of financing costs to the net revenue streams and impact on the Council’s Medium Term Financial Strategy. The Council’s borrowing strategy will, therefore, also be regularly reviewed and then revised, if necessary, to achieve optimum value and risk exposure in the long-term. The impact particularly of the finalisation of the General Services Capital Plan Prioritisation and full Asset Management Plans will have a significant bearing on this. Council officers, in conjunction with MUFG, will continue to monitor daily long-term borrowing rates in order to take advantage of any dips in the market or to de-risk any change in the medium-longer term forecast for gilt yields. Page 25 of 134
Page 26
Debt Rescheduling Council officers will continue to explore debt rescheduling opportunities with MUFG Corporate Markets; with only prudent and affordable debt rescheduling that considers both the short and medium-longer term impact being considered. Funds on Deposit In accordance with the Prudential and Treasury Management Codes, it is the Council’s priority for funds on deposit to ensure:- • security of capital first • liquidity second, and • finally to obtain an appropriate level of return which is consistent with the Council’s risk appetite. In the current economic climate, it is considered appropriate to keep any deposits short term to cover cash flow needs, but also to seek out value available in periods up to 12 months with high credit quality financial institutions, using the MUFG suggested creditworthiness approach, which includes a minimum sovereign credit rating and Credit Default Swap (CDS) overlay information. Based on the interest rate forecasts as outlined in Section 5.1 above, there continues to be a clear differential between any borrowing costs taken for new PWLB loans (whether 5 year, 25 year or 50 year), and interest earned on Fixed Term Deposits (FTD’s) of up to 12 months. Specifically:- • the cost of borrowing is now currently 4.70%-5.90% (PWLB certainty rates as per Table 3); whereas maximum interest earnable on FTD’s is 3.90% (so a differential of 0.80% to 2.00%). • The forecast position in 12 months is similar – borrowing rates of 4.30%-5.50% (certainty rates) compared to interest earnable on FTD’s of max 3.50% (so again a differential of 0.80% to 2.00%) • In 24 months, borrowing rates of 4.20%-5.30% (certainty rates) compared to interest earnable on FTD’s of 3.40% (so a differential of 0.80%-1.90%) This would suggest that the optimum Treasury strategy would be, as per the strategy approved by Council in February 2025, to continue to run down cash balances to allow borrowing to (continue to) be deferred for as long as possible i.e. minimise the cash backing of reserves. Clearly this position results in an elevated refinancing risk, as the internal-borrowing / under-borrowed position for the Council remains high (c. £84m at 31/03/2026, slightly down from an under borrowed Page 26 of 134
Page 27
position of £90m at 31/03/2025); however the flipside of this is that there is (a) an offsetting reduction in counterparty risk on deposits (less FTD’s placed) – thereby replacing one additional risk with an offsetting mitigation in risk elsewhere; and (b) furthermore that all the market led and economic forecast intelligence still points to the medium term forecast of a path of long-term borrowing rates gradually easing off over the next 24-36 months and beyond. Day to day liquidity to meet cashflow requirements is sourced from the Council’s three Money Market Funds, which all operate on an instant access basis. Interest rates receivable from these are currently between 4.03%-4.06%, reflective of the current Bank of England Base Rate, and will meander towards 4.00% in the coming month. The Council will keep enough liquidity in its MMF’s on a month-to-month basis to ensure we can manage our daily cashflow needs (£15m-£20m). An updated list of Countries for Deposits as at 18 November 2025 is included as Appendix 4. 5.3 Expected Loan & Fund on Deposit Portfolio at 31 March 2026 Taking all of the above into account, the expected loan and funds on deposit portfolios at 31 March 2026 is shown in Tables 6 and 7 below:- Table 6: Council’s forecast Loan Portfolio at 31 March 2026 Loan Type 31 March 2026 Principal Outstanding £000’s Weighted Average Rate PWLB Annuity 332 8.91% PWLB Maturity 367,983 3.23% PWLB EIP 67,542 4.24% LOBO 15,000 4.63% Market Loans 19,864 3.04% Total Loans 470,722 3.42% Underlying Borrowing Requirement 555,028 Over/(Under) Borrowing -84,306 Table 7: Council’s forecast Funds on Deposit Portfolio at 31 March 2026 Type 31 March 2026 Principal Outstanding £000’s Weighted Average Rate Money Market Funds 10,000 3.75% Bank Call Accounts 369 3.25% Bank Fixed Term Deposits 10,000 4.18% Total Deposits 20,369 3.95% Page 27 of 134
Page 28
The forecast Under-Borrowed position of £84.306 million at 31 March 2026 as outlined in Table 5 above equates to 15% of the Council’s projected Total Underlying Borrowing Requirement of £555.028 million. The equivalent position at 31 March 2025 was 19% (£90.421 million under-borrowed of a £469.866 million Total Underlying Borrowing Requirement). Graph 1 below outlines the Under-Borrowed position of Scottish Councils as at the most recent balance sheet date (31 March 2025). A negative borrowing % indicates that the Council is Internally Borrowed, with this ratio calculated as the % of Under-Borrowing against the Council’s total Underlying Borrowing Requirement. Graph 1: Under-borrowed (Internal Borrowing) % of Scottish Councils at 31 March 2025 * Midlothian As can be noted, the majority of Scottish Councils are under-borrowed, with an average around the 17.5% mark. The proposed Borrowing & Deposit strategy approach outlined above keeps the Council well within this Scotland-wide position. Page 28 of 134
Page 29
6 Prudential & Treasury Management Indicators 2025/26 It is a statutory duty for the Council to determine and keep under review the affordable capital expenditure and borrowing limits as outlined in the prudential and treasury management indicators reported as part of the Council’s suite of treasury management reports. The following prudential indicators have therefore been refreshed from those reported to Council on 25 February 2025 in the original Treasury Management and Annual Investment Strategy Statement 2025/26. These are technical revisions to the Prudential Indicators as a consequence of the revisions to the Council’s General Services and HRA Capital Plans and are based on the actual capital plan outturns for 2024/25, and revisions to the capital expenditure and income budgets for 2025/26. The Authorised Limit has been retained at the value set in the Treasury Management & Investment Strategy for 2025/26 as approved by Audit Committee and Council in February 2025. Table 8: Prudential Indicators 2025/26 – Mid Year Update Indicator 2025/26 Original Estimate £000’s 2025/26 Current Position £000’s 2025/26 Revised Estimate £000’s 2025/26 Capital Expenditure 171,922 38,670 128,987 2025/26 Required Borrowing 125,170 20,884 95,956 2025/26 Underlying Borrowing Requirement* 604,957 484,938 555,028 2025/26 Gross External Borrowing 528,600 418,575 470,722 2025/26 Over/(Under) Borrowing -76,357 -66,363 -84,306 Operational Boundary – Borrowing 604,957 555,028 555,028 2025/26 Capital Financing Requirement** 685,618 567,516 635,689 2025/26 Authorised Limit*** 604,957 604,957 604,957 Net Income from Service Investments as % of Net Revenue Stream 0.01% 0.01% Ratio of Financing Costs to Net Revenue Stream – General Services 2.85% 1.86% Ratio of Financing Costs to Net Revenue Stream – HRA 44.42% 44.22% Ratio of HRA Debt to Net Revenue Stream 836% 842% Ratio of HRA Debt per Dwelling 44 43 * Excludes “On balance sheet” PPP schemes. ** Includes “On balance sheet” PPP schemes. *** Equates to the original estimate of the 2025/26 Underlying Borrowing Requirement The Capital Financing Requirement (CFR) denotes the Council’s underlying need to borrow for capital purposes. The CFR includes borrowing arising as a result of the Council’s Capital Plans, plus the Page 29 of 134
Page 30
long-term liability arising from the Council’s PPP and DBFM contracts. The Underlying Borrowing Requirement strips out the latter of these (long-term liability arising from the two PPP contracts) from the CFR. The Authorised Limit represents the statutory limit determined under section 3 (1) of the Local Government Act 2003, and is the limit beyond which borrowing is prohibited. This limit needs to be set and revised by Members. For 2025/26 this was calculated to equate to the forecast value of the 2025/26 Underlying Borrowing Requirement. During the year to date, the Council has operated within the treasury and prudential indicators set out in the Council’s Treasury Management Strategy Statement for 2025/26. All treasury management operations have also been conducted in full compliance with the Council's Treasury Management Practices. Page 30 of 134
Page 31
7 Performance Indicators 2024/25 – Comparison with Other Scottish Local Authorities The CIPFA Scottish Treasury Management Forum collates performance indicators for all Scottish Local Authorities. The indicators relating to financial year 2024/25 have been published and once again demonstrate the continuing effectiveness of the Council’s Treasury function in maximising efficiency in Treasury Management activity, with the Council having the lowest weighted average borrowing & investment (loans fund) rate across all Scottish mainland authorities in 2024/25 (2.73%). The Council has consistently maintained its loans fund rate as either the lowest, one of the lowest, across all Scottish mainland authorities for the last decade and more. Appendix 5 outlines the loans fund rate for each Scottish Local Authority in 2024/25. Were the internal loans fund rate for 2024/25 to have equated to the Scottish weighted average for 2024/25 of 4.12%, this would have generated loan charges for Midlothian Council in 2024/25 of £28.4 million. The Council’s actual 2024/25 loan charges for General Services and HRA were £22.3 million, representing a cash saving (compared to the Scottish average) of £6.1 million in 2024/25. The forecast loans fund rate of 2.64% for 2025/26 is expected to once again be one of the lowest for all Scottish Local Authorities. 8 Summary Treasury Management activity during the year to 18 November 2025 has been effective within the parameters set by the strategy for the year. Any further long-term borrowing for the remainder of 2025/26 will be in line with the approved strategy, and reflective of the borrowing requirement arising from the General Services and HRA capital plans that will be reported to Council on 16 December 2025, and existing debt maturity profile. Debt rescheduling opportunities will continue to be assessed. Officers will continue to review the opportunities available to the Council for deposit of funds as governed by the approved strategy. The Prudential and Treasury Management Indicators have been updated to reflect current capital expenditure and income projections. Page 31 of 134
Page 32
9 Report Implications 9.1 Resource Expenditure from Treasury Management activity i.e. loan charges, is reported in the quarterly financial positions to Council, with Quarter 2 monitoring reflected in the Financial Monitoring 2025/26 – General Fund Revenue report that will be presented to Council on 16 December 2025. 9.2 Digital None. 9.3 Risk As the Council follows the requirements of the CIPFA Code of Practice for Treasury Management, and the Prudential Code, there is a reduced level of risks involved in Treasury Management activities. Those risks that do exist are further controlled through written Treasury Management Practices which define the responsibilities of all staff involved, which were reviewed and approved by Audit Committee as part of the presentation of the 2023/24 Mid-Year Review Report on 6 December 2022. 9.4 Ensuring Equalities There are no equalities issues arising directly from this report. 9.5 Additional Report Implications See Appendix A. Page 32 of 134
Page 33
Appendix A: Report Implications A.1 Key Priorities within the Single Midlothian Plan Not applicable. A.2 Key Drivers for Change A.3 Key Delivery Streams Themes addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious None of the above A.4 Delivering Best Value The report does not directly impact on Delivering Best Value. A.5 Involving Communities and Other Stakeholders Although no external consultation has taken place, cognisance has been taken of professional advice obtained from Link Treasury Solutions Limited, the Council’s appointed Treasury Consultants. A.6 Impact on Performance and Outcome The strategies adopted are an integral part of the corporate aim to achieve Best Value as they seek to minimise the cost of borrowing by exercising prudent debt management and investment. This in turn helps to ensure that the Council’s capital expenditure is sustainable in revenue terms. A.7 Adopting a Preventative Approach Not applicable. A.8 Supporting Sustainable Development Not applicable. Page 33 of 134
Page 34
Background Papers: Appendix 1: Economic Update for first part of 2025/26 financial year Appendix 2: PWLB Borrowing Rates 1 April 2025 to 30 September 2025 Appendix 3: Bank Rate and SONIA Rates 1 April 2025 to 30 September 2025 Appendix 4: Approved Countries for Deposits as at 18 November 2025 Appendix 5: Loans Fund Rate Comparison Scottish Local Authorities 2024/25 Page 34 of 134
Page 35
Appendix 1: Economic Update for first part of 2025/26 financial year The first half of 2025/26 saw: • A 0.3% pick up in Gross Domestic Product (GDP) for the period April to June 2025. More recently, the economy flatlined in July, with higher taxes for businesses restraining growth. • The rate of average earnings growth excluding bonuses has fallen from 5.5% to 4.8% in July. • Consumer Price Inflation (CPI) has ebbed and flowed but finished September at 3.8%, whilst core inflation eased to 3.6%. • The Bank of England cut interest rates from 4.50% to 4.25% in May, and then to 4% in August. • The 10-year gilt yield fluctuated between 4.4% and 4.8%, ending the half year at 4.70%. From a GDP perspective, the financial year got off to a bumpy start with the 0.3% m/m fall in real GDP in April as front-running of US tariffs in Quarter 1 (when GDP grew 0.7% on the quarter) weighed on activity. Despite the underlying reasons for the drop, it was still the first fall since October 2024 and the largest fall since October 2023. However, the economy surprised to the upside in May and June so that quarterly growth ended up 0.3% quarter on quarter (q/q). Nonetheless, the 0.0% month on month (m/m) change in real GDP in July will have caused some concern, with the hikes in taxes for businesses that took place in April this year undoubtedly playing a part in restraining growth. The weak overseas environment is also likely to have contributed to the 1.3% m/m fall in manufacturing output in July. That was the second large fall in three months and left the 3 months to 3 months rate at a 20- month low of -1.1%. The 0.1% m/m rise in services output kept its 3 months to 3 months rate at 0.4%, supported by stronger output in the health and arts/entertainment sectors. Looking ahead, ongoing speculation about further tax rises in the Autumn Budget on 26 November will remain a drag on GDP growth for a while yet. GDP growth for 2025 is forecast by Capital Economics to be 1.3%. Sticking with future economic sentiment, the composite Purchasing Manager Index (PMI) for the UK fell from 53.5 in August to 51.0 in September. The decline was mostly driven by a fall in the services PMI, which declined from 54.2 to 51.9. The manufacturing PMI output balance also fell, from 49.3 to 45.4. That was due to both weak overseas demand (the new exports orders balance fell for the fourth month in a row) and the cyber-attack-induced shutdown at Jaguar Land Rover since 1 September reducing car production across the automotive supply chain. The PMIs suggest tepid growth is the best that can be expected when the Quarter 3 GDP numbers are released. Turning to retail sales, and the 0.5% m/m rise in volumes in August was the third such rise in a row and was driven by gains in all the major categories except fuel sales, which fell by 2.0% m/m. Sales may have been supported by the warmer-than- usual weather. If sales were just flat in September, then in Quarter 3 sales volumes would be up 0.7% q/q compared to the 0.2% q/q gain in Quarter 2. With the November Budget edging nearer, the public finances position looks weak. Public net sector borrowing of £18.0bn in August means that after five months of the financial year, borrowing is already £11.4bn higher than the Office for Budget Responsibility (OBR) forecast at the Spring Statement in March. The overshoot in the Chancellor’s chosen fiscal mandate of the current budget is even greater with a cumulative deficit of £15.3bn. All this was due to both current receipts in August Page 35 of 134
Page 36
being lower than the OBR forecast (by £1.8bn) and current expenditure being higher (by £1.0bn). Over the first five months of the financial year, current receipts have fallen short by a total of £6.1bn (partly due to lower-than-expected self-assessment income tax) and current expenditure has overshot by a total of £3.7bn (partly due to social benefits and departmental spending). Furthermore, what very much matters now is the OBR forecasts and their impact on the current budget in 2029/30, which is when the Chancellor’s fiscal mandate bites. As a general guide, Capital Economics forecasts a deficit of about £18bn, meaning the Chancellor will have to raise £28bn, mostly through higher taxes, if she wants to keep her buffer against her rule of £10bn. The weakening in the jobs market looked clear in the spring. May’s 109,000 m/m fall in the Pay-As-You-Earn (PAYE) measure of employment was the largest decline (barring the pandemic) since the data began and the seventh in as many months. The monthly change was revised lower in five of the previous seven months too, with April’s 33,000 fall revised down to a 55,000 drop. More recently, however, the monthly change was revised higher in seven of the previous nine months by a total of 22,000. So instead of falling by 165,000 in total since October, payroll employment is now thought to have declined by a smaller 153,000. Even so, payroll employment has still fallen in nine of the ten months since the Chancellor announced the rises in National Insurance Contributions (NICs) for employers and the minimum wage in the October Budget. The number of job vacancies in the three months to August stood at 728,000. Vacancies have now fallen by approximately 47% since its peak in April 2022. All this suggests the labour market continues to loosen, albeit at a declining pace. A looser labour market is driving softer wage pressures. The rate of average earnings growth excluding bonuses has fallen from 5.5% in April to 4.8% in July. The rate for the private sector slipped from 5.5% to 4.7%, putting it on track to be in line with the Bank of England’s Quarter 3 forecast (4.6% for September). CPI inflation fell slightly from 3.5% in April to 3.4% in May, and services inflation dropped from 5.4% to 4.7%, whilst core inflation also softened from 3.8% to 3.5%. More recently, though, inflation pressures have resurfaced, although the recent upward march in CPI inflation did pause for breath in August, with CPI inflation staying at 3.8%. Core inflation eased once more too, from 3.8% to 3.6%, and services inflation dipped from 5.0% to 4.7%. So, we finish the half year in a similar position to where we started, although with food inflation rising to an 18-month high of 5.1% and households’ expectations for inflation standing at a six year high, a further loosening in the labour market and weaker wage growth may be a requisite to UK inflation coming in below 2.0% by 2027. An ever-present issue throughout the past six months has been the pressure being exerted on medium and longer dated gilt yields. The yield on the 10-year gilt moved sideways in the second quarter of 2025, rising from 4.4% in early April to 4.8% in mid-April following wider global bond market volatility stemming from the “Liberation Day” tariff announcement, and then easing back as trade tensions began to de- escalate. By the end of April, the 10-year gilt yield had returned to 4.4%. In May, concerns about stickier inflation and shifting expectations about the path for interest rates led to another rise, with the 10-year gilt yield fluctuating between 4.6% and 4.75% for most of May. Thereafter, as trade tensions continued to ease and markets increasingly began to price in looser monetary policy, the 10-year yield edged lower, and ended Quarter 2 at 4.50%. Page 36 of 134
Page 37
More recently, the yield on the 10-year gilts (which drives PWLB borrowing rates) rose from 4.46% to 4.60% in early July as rolled-back spending cuts and uncertainty over Chancellor Reeves’ future raised fiscal concerns. Although the spike proved short lived, it highlighted the UK’s fragile fiscal position. In an era of high debt, high interest rates and low GDP growth, the markets are now more sensitive to fiscal risks than before the pandemic. During August, long-dated gilts underwent a particularly pronounced sell-off, climbing 22 basis points and reaching a 27-year high of 5.6% by the end of the month, pushing PWLB borrowing rates in the same direction. While yields (and PWLB borrowing rates) have since eased back, the market sell-off was driven by investor concerns over growing supply-demand imbalances, stemming from unease over the lack of fiscal consolidation and reduced demand from traditional long-dated bond purchasers like pension funds. For 10-year gilts, by late September, sticky inflation, resilient activity data and a hawkish Bank of England have kept yields elevated over 4.70% (with a corresponding elevation in PWLB borrowing rates). The Financial Times Stock Exchange (FTSE) 100 fell sharply following the “Liberation Day” tariff announcement, dropping by more than 10% in the first week of April - from 8,634 on 1 April to 7,702 on 7 April. However, the de-escalation of the trade war coupled with strong corporate earnings led to a rapid rebound starting in late April. As a result, the FTSE 100 closed Quarter 2 at 8,761, around 2% higher than its value at the end of Quarter 1 and more than 7% above its level at the start of 2025. Since then, the FTSE 100 has enjoyed a further 4% rise in July, its strongest monthly gain since January and outperforming the S&P 500. Strong corporate earnings and progress in trade talks (US-EU, UK-India) lifted share prices and the index hit a record 9,321 in mid-August, driven by hopes of peace in Ukraine and dovish signals from Fed Chair Powell. September proved more volatile and the FTSE 100 closed Quarter 3 at 9,350, 7% higher than at the end of Quarter 1 and 14% higher since the start of 2025. Future performance will likely be impacted by the extent to which investors’ global risk appetite remains intact, Fed rate cuts, resilience in the US economy, and Artificial Intelligence optimism. A weaker pound will also boost the index as it inflates overseas earnings. MPC meetings: 8 May, 19 June, 7 August, 18 September, 6 November 2025 There were five Monetary Policy Committee (MPC) meetings in the year to 18 November. In May, the Committee cut Bank Rate from 4.50% to 4.25%, while in June policy was left unchanged. In June’s vote, three MPC members (Dhingra, Ramsden and Taylor) voted for an immediate cut to 4.00%, citing loosening labour market conditions. The other six members were more cautious, as they highlighted the need to monitor for “signs of weak demand”, “supply-side constraints” and higher “inflation expectations”, mainly from rising food prices. By repeating the well-used phrase “gradual and careful”, the MPC continued to suggest that rates would be reduced further. In August, a further rate cut was implemented. However, a 5-4 split vote for a rate cut to 4.00% laid bare the different views within the Monetary Policy Committee, with the accompanying commentary noting the decision was “finely balanced” and reiterating that future rate cuts would be undertaken “gradually and carefully”. Ultimately, Governor Bailey was the casting vote for a rate cut but with the CPI measure of inflation expected to reach at least 4.00% later this year, the MPC will be wary of making any further rate cuts until inflation begins its slow downwards trajectory back towards 2.00%. Page 37 of 134
Page 38
The Bank of England does not anticipate CPI getting to 2.00% until early 2027, and with wages still rising by just below 5.00%, it was no surprise that the September meeting saw the MPC vote 7-2 for keeping rates at 4.00% (Dhingra and Taylor voted for a further 25bps reduction). This positioned narrowed at the November meeting to 5-4 in favour of holding rates at 4.00%, with markets now factoring in a rate cut to 3.75% at the next MPC meeting on 18 December, although fiscal policy arising from the UK Budget on 26 November 2025 may well yet change this path. The Bank also took the opportunity to announce that they would only shrink its balance sheet by £70bn over the next 12 months, rather than £100bn. The repetition of the phrase that “a gradual and careful” approach to rate cuts is appropriate suggests the Bank still thinks interest rates will fall further but possibly not until February, which aligns with both our own view and that of the prevailing market sentiment. Page 38 of 134
Page 39
Appendix 2: PWLB Borrowing Rates 1 April 2025 to 30 September 2025 The graphs and table below show the movement in PWLB certainty rates for the first six months of the year to date: PWLB certainty rates 1 April 2025 to 30 September 2025 1 Year 5 Year 10 Year 25 Year 50 Year 01/04/2025 4.82% 4.94% 5.38% 5.95% 5.63% 30/09/2025 4.58% 4.95% 5.53% 6.23% 5.98% Low 4.36% 4.62% 5.17% 5.78% 5.46% Low date 04/08/2025 02/05/2025 02/05/2025 04/04/2025 04/04/2025 High 4.84% 4.99% 5.62% 6.41% 6.14% High date 02/04/2025 21/05/2025 03/09/2025 03/09/2025 03/09/2025 Average 4.55% 4.82% 5.40% 6.11% 5.83% Spread 0.48% 0.37% 0.45% 0.63% 0.68% 4.00% 4.50% 5.00% 5.50% 6.00% 6.50% 7.00% PWLB Rates 01.04.25 - 30.09.25 1 Year 5 Year 10 Year 25 Year 50 Year 50 year target % Page 39 of 134
Page 40
The current PWLB rates are set as margins over gilt yields as follows:- • PWLB Standard Rate is gilt plus 100 basis points (G+100bps) • PWLB Certainty Rate (GF) is gilt plus 80 basis points (G+80bps) • PWLB Local Infrastructure Rate is gilt plus 60 basis points (G+60bps) • PWLB Certainty Rate (HRA) is gilt plus 40bps (G+40bps) PWLB maturity certainty rates (gilts plus 80bps) year to date to 30 September 2025 Gilt yields and PWLB certainty rates have remained relatively volatile throughout the six months under review, but the general trend has been for medium and longer dated parts of the curve to shift higher whilst the 5-year part of the curve finished September close to where it begun in April. Concerns around the stickiness of inflation, elevated wages, households’ inflation expectations reaching a six-year high, and the difficult funding choices facing the Chancellor in the upcoming Budget on 26 November dominated market thinking, although international factors emanating from the Trump administration’s fiscal, tariff and geo-political policies also played a role. At the beginning of April, the 1-year certainty rate was the cheapest part of the curve at 4.82% whilst the 25-year rate was relatively expensive at 5.92%. Early September saw the high point for medium and longer-dated rates, although there was a small reduction in rates, comparatively speaking, by the end of the month. The spread in the 5-year part of the curve (the difference between the lowest and highest rates for the duration) was the smallest at 37 basis points whilst, conversely, the 50-years’ part of the curve saw a spread of 68 basis points. At this juncture, MUFG Corporate Markets still forecast rates to fall back over the next two to three years as inflation dampens, although there is upside risk to all 3.00 3.40 3.80 4.20 4.60 5.00 5.40 5.80 6.20 6.60 7.00 PWLB Certainty Rate Variations 01.04.25 to 30.09.25 1-Apr-25 30-Sep-25 Average Page 40 of 134
Page 41
forecasts at present. The CPI measure of inflation is expected to fall below 2% in early 2027 but hit a peak of 4% or higher later in 2025. The Bank of England announced in September that it would be favouring the short and medium part of the curve for the foreseeable future when issuing gilts, but market reaction to the November Budget is likely to be the decisive factor in future gilt market attractiveness to investors and their willingness to buy UK sovereign debt. Page 41 of 134
Page 42
Appendix 3: Bank Rate and Sterling Overnight Index Average (SONIA) Rates 1 April 2025 to 30 September 2025 The graphs and table below show the movement in Bank and SONIA rates for the first six months of the year to date: Creditworthiness: The UK’s sovereign rating has proven robust through the first half of 2025/26. The Government is expected to outline in detail its future fiscal proposals in the Budget scheduled for 26 November 2025. Deposit Counterparty criteria: The current deposit counterparty criteria selection approved in the TMSS is meeting the requirement of the treasury management function. CDS prices: It is noted that sentiment in the current economic climate can easily shift, so it remains important to undertake continual monitoring of all aspects of risk and return in the current circumstances. 3.50 3.75 4.00 4.25 4.50 4.75 5.00 Bank Rate vs term SONIA rates % 01.04.25 - 30.09.25 Bank Rate SONIA 1 mth 3 mth 6 mth 12 mth Bank Rate SONIA 1 mth 3 mth 6 mth 12 mth High 4.50 4.46 4.47 4.36 4.28 4.17 High Date 01/04/2025 07/05/2025 03/04/2025 01/04/2025 02/04/2025 02/04/2025 Low 4.00 3.97 3.97 3.96 3.89 3.75 Low Date 07/08/2025 29/08/2025 16/09/2025 08/09/2025 07/08/2025 04/08/2025 Average 4.23 4.19 4.16 4.10 4.01 3.88 Spread 0.50 0.49 0.50 0.39 0.39 0.42 Page 42 of 134
Page 43
Appendix 4: Approved Countries for Deposit as at 18 November 2025 AAA • Australia • Denmark • Germany • Netherlands • Norway • Singapore • Sweden • Switzerland AA+ • Canada • U.S.A. AA • Abu Dhabi (UAE) • Finland • Qatar AA- • Belgium • France • U.K. A+ • Belgium • France Page 43 of 134
Page 44
Appendix 5: Loans Fund Rate Comparison Scottish Local Authorities 2024/25 Council Loans Fund Rate 2024/25 Midlothian 2.73% East Lothian 2.83% Renfrewshire 2.88% Perth & Kinross 3.28% Aberdeenshire 3.29% North Ayrshire 3.36% Angus 3.37% Shetland 3.45% East Ayrshire 3.46% Fife 3.68% Dumfries & Galloway 3.80% East Renfrewshire 3.87% Edinburgh City 4.14% West Lothian 4.17% Aberdeen City 4.20% South Ayrshire 4.23% Scottish Borders 4.25% Highland 4.32% East Dunbartonshire 4.41% Dundee City 4.50% Inverclyde 4.61% West Dunbartonshire 4.64% Argyll & Bute 4.71% Glasgow City 4.77% Falkirk 4.78% North Lanarkshire 4.87% Stirling 5.35% Orkney 5.72% Moray 6.21% Comhairle Nan Eilean Siar 6.40% Page 44 of 134
Page 45
Audit Committee Tuesday 2 December 2025 Item No 5.2 Internal Audit Work to November 2025 Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is asked to: a) Consider the Executive Summary of the final Internal Audit assurance report issued associated with the delivery of the approved Internal Audit Annual Plan 2025/26; b) Note the Internal Audit Consultancy and Other Work carried out in accordance with the approved Internal audit Charter; and c) Acknowledge the assurance provided on internal controls and governance arrangements in place for the areas covered by this Internal Audit work. 2 Purpose of Report/Executive Summary The purpose of this report is to provide members of the Audit Committee with details of the recent work carried out by Internal Audit and the findings and recommended audit actions agreed by Management to improve internal controls and governance arrangements. The Internal Audit Annual Plan 2025/26 was approved by the Audit Committee on 24 February 2025. Internal Audit has carried out work associated with the delivery of the plan to meet its objective of providing an opinion on the efficacy of the Council’s risk management, internal control and governance. An Executive Summary of the final Internal Audit assurance report issued, including audit objective, findings, good practice and recommendations (where appropriate), and the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area is shown in Appendix 1. The Internal Audit function conforms to the professional standards as set out in Global Internal Audit Standards (GIAS) including the production of this report to communicate the results of the reviews. Date 14 November 2025 Report Contact: Duncan Stainbank duncan.stainbank@midlothian.gov.uk Page 45 of 134
Page 46
3 Progress Report 3.1 The Internal Audit Annual Plan 2025/26 was approved by the Audit Committee on 24 February 2025. Internal Audit has completed the following work in the period from 18 September 2025 to 14 November 2025 associated with the delivery of the plan to meet its objective of providing an opinion on the efficacy of the Council’s risk management, internal control and governance. 3.2 The Internal Audit function conforms to the professional standards as set out in Global Internal Audit Standards (GIAS), including the production of this report to communicate the results. 3.3 Internal Audit issued a final assurance report on the following subjects: • School & Social Work Transport; and • Foster Care and Adoption. 3.4 An Executive Summary of the final Internal Audit assurance report issued including audit objective conclusions, key findings, recommendations, areas of good practice, the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area is shown in Appendix 1. 3.5 Both the School & Social Work Transport review and the Foster Care and Adoption Review have both been overall categorised as Limited Assurance. The definitions for Internal Audit assurance categories are as follows: Level Definition Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. 3.6 The School & Social Work Transport Audit was part of the 2025/26 Internal Audit plan however the scope of the review to be completed was reviewed to meet the requirements identified by members at the 24 June 2025 Council. Specifically, the Audit review was to focus on the control environment in place for the 2024/25 financial year. As a result, the report grading does not reflect the significant progress in embedding an appropriate control framework as a result of a project that was already underway. The Audit review completed for the control environment in 2024/25 provides an assessment of Limited Assurance reflecting the control environment in place in the 2024/25 financial year, particularly the following: • The lack of a Council Policy for School Transport, • A lack of clarity on authorisation procedures, • No investment in appropriate software solutions for School Transport, Page 46 of 134
Page 47
• Financial information specifically on School Transport not flowing appropriately within the Council, and • Due to limited staff resources, limited contract management processes. 3.7 However, the weaknesses in the client transport control environment had been identified prior to the audit work commencing and an improvement project had already been funded and was in operation. As a result, for 2025/26, the following improvements have already been delivered: • A School Transport Policy was implemented in May 2025; • Authorisation procedures for ASN transport have been agreed (although not yet operational) and the Policy provides a clear framework for authorisation of mainstream Education transport; • The project has investigated software solutions and is planning to get appropriate solutions in place; • Improvements in availability of some financial information in 2025 have been made; • Reviews of staff resources and procedures are planned to take place; and • A Tender process for all client transport has been undertaken that ensures that there is an appropriate contractual framework in place for the Council for all client transport needs ensuring that client transport is maintained within the Council Policy and this contractual framework will be required going forward. 3.8 The School & Social Work Transport report identifies that from the 25 recommendations made, management have identified that 6 are already completed and 8 are already part of the project plan for 2026. This provides some assurance that the Client Transport Project was already in the process of implementing an appropriate control framework. The additional recommendations within the review are also all now being taken forward by management. 3.9 The School & Social Work Transport report currently being provided reflects backwards on the control framework in place for the 2024/25 financial year. As a result of the substantial changes in the control framework that have not been reviewed as part of this work, it would be appropriate to include a further follow-up review of Client Transport within the 2026/27 Internal Audit Plan, subject to Audit Committee approval. This will allow a review to be undertaken of the effectiveness of the changes put in place in improving the control framework and assurance that officers are delivering to the approved Council Policy. 3.10 The Foster Care and Adoption Audit provides and overall Limited assurance grading. Policies and procedures are in place for foster care and adoption and segregation of duties for the payment of allowances and fees are in place. However, 13 overpayments amounting to £150K have occurred and invoices have not yet been raised for 7 of the overpayments, adoption cases have not been reviewed for any of the cases tested, rates input to Mosaic were incorrect for some elements and the setting of rates for adoption allowances was unclear. A small number of incorrect payments have been identified as part of the review. Management had prior to the review already started to resolve these issues and have committed to implementing the recommendations made by the agreed target dates. Internal Audit Consultancy and Other Work 3.11 Internal Audit staff have been involved in the following for the Council to meet its aims and objectives, and its roles and responsibilities in accordance with the approved Internal Audit Charter and Strategy: a) In its critical friend role provided an independent view and challenge at various forums including: Capital Plan and Asset Management Board, Chief Officers Risk & Resilience Group, and the Integrity Group. Page 47 of 134
Page 48
b) Learning and development during the research stage of new audit areas for all Internal Audit team members and through joining audit forums (Computer Audit Sub-group) and meetings; and c) Monitored publication of Audit Scotland reports. Recommendations 3.12 Recommendations in reports are suggested changes to existing procedures or processes to improve the controls or to introduce controls where none exist. The grading of each recommendation reflects the risk assessment of non-implementation, being the product of the likelihood of the risk materialising and its impact: High Recommendations relating to factors fundamental to the success of the control objectives of the system. The weaknesses may give rise to significant financial loss/misstatement or failure of business processes. Medium Recommendations which will improve the efficiency and effectiveness of the existing controls. Low Recommendations concerning minor issues that are not critical, but which may prevent attainment of best practice and/or operational efficiency. Outwith the report, Internal Audit informs operational managers about other matters as part of continuous improvement. 3.8 The table below summarises the number of Internal Audit recommendations made during 2025/26: Recs Rating 2025/26 Number of Recs High 1 Medium 25 Low 12 Not Graded 0 Sub-total reported this period 38 Previously reported 22 Total 60 Recommendations agreed with action plan 60 Not agreed; risk accepted 0 Total 60 4 Report Implications (Resource, Digital, Risk and Equalities) 4.1 Resource Resource implications of implementing Internal Audit recommendations are considered as part of the audit process to ensure these are reasonable and proportionate to the risks. 4.2 Digital There are no digital implications arising from this report. Page 48 of 134
Page 49
4.3 Risk The GIAS require Internal Audit to evaluate the effectiveness of the Council’s Risk Management arrangements and contribute to improvements in the process. At the start of each audit engagement, to capture potential areas of risk and uncertainty more fully, key stakeholders have been consulted and risk registers have been considered. During each audit engagement the management of risk has been tested. It is anticipated that improvements in the management and mitigation of risks will arise as a direct result of Management implementing the Internal Audit recommendations made. If audit recommendations are not implemented, there is a greater risk of financial loss and/or reduced operational efficiency and effectiveness, and Management may not be able to demonstrate improvement in internal control and governance arrangements, and effective management of risks. 4.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. The Internal Audit work is carried out in accordance with the appropriate legislation and professional standards. The latter includes compliance by those within the Internal Audit function with the ethical requirements set out in the GIAS which is appropriate for the profession of Internal Audit founded as it is on trust placed in its independent and objective assurance about risk management, internal control and governance. 4.5 Additional Report Implications (See Appendix A) Page 49 of 134
Page 50
APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable Midlothian Council to deliver its key priorities in support of achieving the Council’s objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s Internal Audit service provision to assist the Council in achieving its objectives. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value Implementation by Management of the actions associated with Internal Audit recommendations, that are designed to improve internal control and governance arrangements and management of risks, underpins the Council’s own continuous improvement arrangements to enhance its effectiveness, thus supporting the delivery of the Council’s best value duties. A.5 Involving Communities and Other Stakeholders The Chief Internal Auditor is accountable to the Audit Committee which, in fulfilling its governance role, acts as a bridge between the Council and other stakeholders. Page 50 of 134
Page 51
This report has been presented to Senior Management relevant to the areas audited and have agreed the final Internal Audit assurance reports as set out in the relevant Executive Summary within Appendix 1. A.6 Impact on Performance and Outcomes The Findings and Recommendations from Internal Audit work during the year are designed to assist the Council in improving its performance and outcomes. A.7 Adopting a Preventative Approach Internal Audit assurance work includes assessments on when a preventative approach can be adopted. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Good governance is important to enable Midlothian Council to achieve its objectives. Page 51 of 134
Page 52
Page 52 of 134
Page 53
Appendix 1. Executive Summary: School and Social Work Transport Conclusion: Limited Assurance The control environment for School and Social Work Transport had a number of significant weaknesses in 2024/25, however, the project to improve the arrangements for client transport from May 2024 has achieved a number of substantial milestones including: the approval of the Integrated Transport Policy; the awarding of a new client transport framework; the onboarding and allocation of routes to new providers, strengthened onboarding arrangements, the implementation of invoicing standards and monthly monitoring information that must be adhered to by all suppliers. A significant, unforeseen overspend occurred during 2024/25 which was not identified due to a lack of information sharing between Education, the Travel Team, and Financial Services. Management have advised that processes have been established to ensure that this will not be repeated. Although work is underway to improve systems, there is no up-to-date route management system in place and the service is managed using a mix of different spreadsheets, which is not best practice and could result in errors. E-Forms using the Granicus system to improve passenger transport information have been developed but are yet to be launched. Operational efficiencies may be achievable following review of transport usage data and implementation of the e-forms. Background The purpose of the audit was to review the processes and systems in place to ensure that the organisation of School and Social Work transport is completed effectively, efficiently and provides best value for the Council, including ensuring that transport provision is in line with Council policy and legislative requirements. The Travel Team, amongst other responsibilities, is responsible for the coordination of passenger transport on behalf of other services in the Council, primarily Education, Adult Social Care and some Children’s Services transport. A project is currently underway to review the Education and Social Care transport service and identify and implement improvements, savings and cost avoidance initiatives. The project was initiated in response to significant inflationary pressures on school transport costs, including the large increase in the number of pupils requiring ASN transport. The Travel Team manages their service using a mix of different spreadsheets. The service previously used the CTX system over three years ago, a legacy transport system hosted on-premises, to support school transport planning amongst other tasks, but it is now obsolete (12 versions behind the current release) and no longer used due to difficulties deleting, integrating, exporting and reporting data from the system. The CTX system has not yet been formally decommissioned. In early 2024, an external consultant was engaged to carry out a review of passenger transport at a cost of £35k. The report contained 29 recommendations detailing the actions required to improve and modernise the service and was presented to the Business Transformation Board in May 2024. £0.9M was allocated from transformation funding to engage an external delivery partner to support the required improvements however, the Client Transport Project Board decided to utilise an internal delivery model to optimise costs and build and retain a strong knowledge base within the Council. BTSG approved for a Project Manager and a Project Support Officer to be appointed for an 18-month delivery period at a budgeted cost of £262,800, substantially lower than the amount originally allocated from transformation funding, with the Project Manager commencing soon afterwards and the Project Support Officer starting in February 2025. The Client Transport Project Board is made up of members of the senior leadership team from across all three directorates and the project plan and priorities are approved by this Board. Page 53 of 134
Page 54
Summary of key findings and recommendations The following findings and recommendations are highlighted, which have all been agreed by Management: • Detailed information was not provided to Financial Services to enable effective budget monitoring and forecasting to be undertaken which contributed to the failure to accurately identify the large unforeseen overspend in Q4 of the 2024/25 financial year. Purchase orders have been piloted and rolled out for coach and mini-bus routes, providing some improvement in available financial forecasting data. Additionally, a spend analysis spreadsheet has been created for the new Transport Framework from August 2025 which will continue to be updated as new routes are added, existing routes are changed, and this spreadsheet can be scrutinised by Financial Services at any time going forward. • There has been a lack of monitoring of suppliers which has contributed to the consistent overcharging by a supplier over a 2-year period. Monitoring processes have been established and will continue to be undertaken going forward. • Prior to August 2025, invoice quality was poor as many suppliers did not quote a route number that matches the name of the route number used by the Travel Team. Management have developed appropriate monitoring processes for supplier invoices which have been in place since August 2025 and will ensure that all suppliers adhere to the new requirements set out in the Code of Conduct and the Guidance for Invoicing going forward. • There was no Council policy in place for client transport and only Adult Social Care had a policy in place. Management have established a Council wide policy for client transport. • Prior to August 2025, expired passenger transport framework contracts were utilised. The new client transport procurement framework has been awarded and the routes have been allocated to suppliers on the new framework. • The recently approved Integrated Transport Policy includes the eligibility criteria, assessment process and appeal process however, it does not clarify the authorisation arrangements for client transport and there is no other written procedure in place documenting this. Documented procedures will be prepared setting out the authorisation arrangements for client transport by 30 November 2025. • As there was no transport policy in place, there is no detailed audit trail of formal ASN assessments for transport needs other than requests for transport submitted to the Travel Team mailbox (financial year 2024/25). Management will establish a formal annual process to review the transport needs of all ASN pupils to support route planning by 30 June 2026. Development of this is underway as part of the project. • Although social work clients’ data is held in the Mosaic case management system, standard travel passports with information on the client’s needs are not in place to assist with route planning. A process will be developed for information to be provided to the Travel Team on social work clients to support route planning by 30 June 2026. • An annual confirmation with pupils’ parents/guardians to determine whether school transport is still required is not undertaken. Appropriate processes will be developed to confirm whether school pupils require transport to allow school routes to be optimised each year by 30 June 2026. Work on this is underway as part of the project. • There is no software solution in place to support the service or assist with route planning other than a number of different spreadsheets developed by the team. A system will be procured to assist in managing the service including route management by 30 June 2026. Work on this is underway as part of the project. • A number of potential improvements to walking routes which would result in fewer pupils requiring transport were identified, but there has not been a thorough analysis of these or presentation to the project board. The improvements to walking routes will be reviewed, the cost benefit / analysed, and the findings presented to the project board by 30 June 2026. • There is no documented business continuity plan in place for the Travel Team, and members of the Travel Team are routinely providing transport cover amongst their other duties leaving less time for supplier monitoring; the level of staffing in the Travel Team is lower than prior years potentially putting service continuity at risk. The level of resource allocated, and skills required to support the Travel Team achieving its objectives will be reviewed and a business continuity plan prepared by 30 June 2026. Page 54 of 134
Page 55
Recommendations Grade High Medium Low Total Current Report 1 20 4 25 Prior Report – February 2021 0 0 0 0 Materiality The main client transport budgets for 2025/26 are as follows: Secondary Schools £1,917,577 Special Schools & ASN £1,568,631 ASC Learning Disabilities £936,586 Primary Schools £515,273 ASC Physical Disabilities £80,000 Children’s Services (Disabilities) £69,145 Children’s Services (Without Disabilities) £76,338 Total £5,163,550 The total equivalent budget for 2024/25 was £4.2M. Page 55 of 134
Page 56
Headlines Objectives Conclusion Comments 1. School and Social Work Transport is only provided when there is a requirement in accordance with clear and defined Council Policies and legislation. 2024/25 - Limited Assurance Until May 2025, there was no Council policy for client transport and only Adult Social Care had a separate policy that formally set out the basis for transport provision. The lack of a formal policy means it is difficult to defend decisions made on client transport if a request for transport is rejected and subsequently appealed. The absence of an approved policy contributed to the overspend on client transport in 2024/25 and prior years. This issue has been addressed by the approval of the Integrated Transport Policy on 20 May 2025. 2. Clear and appropriate procedures are in place confirming who can authorise school or social work transport requirements, on what basis, and that these procedures are always adhered to. 2024/25 Limited Assurance The Integrated Transport Policy provides an appropriate basis for client transport across the Council. The new policy does not clarify the authorisation arrangements for client transport and there is no documented procedure to clarify this, however, Education management have advised that the new process is understood by all relevant teams. Adult Social Care and Children’s Services transport arrangements are authorised as part of a package of care by the respective resource panels. Education management have advised that going forward, the central ASN team and Education Resource Group will be the lead on reviewing new ASN transport requests and senior management will also be required to authorise transport requests. For mainstream Education, formal approval is rarely required as the pupil’s distance from their catchment school is the primary criteria as to whether they are eligible for transport. It was noted that although procedures have been prepared for suppliers to follow for onboarding, there are limited procedures in place for the Travel Team to follow for day-to-day tasks. 3. Appropriate and accurate route planning arrangements are in place to review transport needs and provide best value for the Council and contracts are put in place using an appropriate and compliant procurement process. 2024/25 Limited Assurance There is no software solution in place to assist with route planning other than a number of different spreadsheets developed by the team. An annual confirmation with pupils’ parents/guardians to determine whether school transport is still required is not undertaken. Mini-bus and coach requirements have been based on assuming transport provision continues for everyone provided, which historically has resulted in overprovision and anecdotal evidence that some school buses are operating with high numbers of empty seats. There is no detailed audit trail of formal ASN assessments of transport needs other than requests for transport submitted to the Travel Team. Similarly, there was no formal annual review of ASN transport against the policy (as there was no policy); once ASN transport had been approved it had been assumed to be required indefinitely. Although a system was used this year to analyse walking routes and safe walking routes to ensure the entitlement to school transport is accurate, the team only had short-term access to this system. The School Travel Plan Coordinator has highlighted a number of potential improvements that could be made to walking routes which would result in fewer pupils requiring transport, but these have not been formally reviewed and presented to the project board. Page 56 of 134
Page 57
Headlines Objectives Conclusion Comments Although processes are in place for Children’s Services and Adult Social Care to review travel needs, travel passports with information on the client’s needs are not in place to assist with route planning for social care. For Education, Travel Passports were issued to schools in June 2025, with schools asked to support parents/guardians in completing them for ASN pupils already receiving transport and this is progressing. The previous framework for Home to School Taxi Services ended at the end of the school term in 2024/25, the previous Home to School Coach and Mini-buses framework ended in July 2024, and the previous framework for Taxi Services for Social Care expired in July 2021. Therefore, prior to August 2025 expired framework contracts were being used. The Project Team and the Travel Team have successfully retendered all client transport services this year and reallocated the routes. The Travel Team have advised that pupil number data is not received from Education until July each year, which leaves limited time to optimise routes prior to schools recommencing. 4. Appropriate processes are in place to monitor and forecast expenditure for the year, both initially and when changes are made and that they are allocated to the appropriate Council budgets. 2024/25 No Assurance In 2024/25 the Passenger Transport project was at an early stage and no substantive changes had been made to the service, therefore no savings should have been anticipated. For 2025/26, the budget has been increased by £1M to £5.2M. An overspend of £1.677M was reported to June 2025 Council and it was stated that this was due to the volume and value of school pupil transport invoices being higher than budgeted (£714k higher than the projected overspend of £963k reported to February 2025 Council). Similarly, for 2023/24, an overspend of £1.2M was reported to June 2024 Council and a projected overspend of £1M was reported to February 2024 Council. Although the non-devolved ASN budget was exceeded by £886K in 2023/24 with an outturn of £1.59M, the ASN budget for 2024/25 was originally set at £705K (subsequently revised to £1M). Page 57 of 134
Page 58
Following the departure of key staff from the Travel Team in 2022, detailed transport information was not provided to Financial Services to enable effective monitoring to be undertaken. Education offered to temporarily administer the processing of Education transport invoices on behalf of the Travel Team from August 2022 while they transitioned to new staffing and processes. In order to do this efficiently, Education developed a spreadsheet detailing the names of the suppliers, the route names, the number of school days and the cost per day, cost centres, invoice details and amounts, and enabled identification of variance and forecasting of costs within the academic year. Financial Services were not aware that Education had developed these spreadsheets and if they had been, the overspend could have been predicted with more accuracy. Senior Finance Business Partners met regularly with senior management but had limited contact with the Travel Team. Forecasting information was based on reviewing actual spend and was not informed by increases in the number of ASN pupils receiving transport, changes to timetables and contracts. For mainstream Education transport, a change was made to the timetabling of buses for secondary schools in 2024 effective from Q2 due to the alignment of the school day for secondary schools. In 2023/24 and previous years, some bus providers were doubling up routes, but for the new academic year routes were reallocated via a mini-competition and this practice ceased resulting in a better service for schools and school pupils, addressing the issue of buses picking up and dropping off when school buildings were not open which is a pupil safety issue. However, this change resulted in more buses running and higher costs for the Council. The financial impact of this change was not reported as part of the budget monitoring in 2024/25. From January 2025, Mayfield Primary School was decanted, and emergency temporary transport was arranged for all pupils impacted by this. This additional transport also contributed to the higher-than- expected costs for 2024/25; the financial impact of this change was not reported as part of the budget monitoring in 2024/25. Between March 2024 and March 2025, the number of routes on the Education Invoice Breakdown Spreadsheet increased by 32 primarily driven by more ASN taxi transport. As the school year progressed from August 2024, new ASN routes were added contributing to invoice costs for Q4 being a further 18% to 22% higher than Q2 and Q3 respectively. The processing of invoices has been passed back to the Travel Team, with new improved processes in place for coaches and mini-buses, with support and instruction given on the process and spreadsheet developed by Education. From August 2025, purchase orders have been piloted and rolled out for coach and mini-bus routes, providing some improvement in available financial forecasting data. Management have advised that a spend analysis spreadsheet has been created for the new Transport Framework from August 2025 which will continue to be updated as new routes are added, existing routes are changed, and that this spreadsheet can be scrutinised by Financial Services at any time going forward. Page 58 of 134
Page 59
Headlines Objectives Conclusion Comments 5. Appropriate processes are in place to monitor that services are provided in line with the contracted service and that invoices are paid in a timely manner when they are accurate and in accordance with the contracted service that has actually been provided. 2024/25 Limited Assurance There has been a lack of monitoring of suppliers which has contributed to the consistent overcharging by a supplier over a 2-year period - the issue was only identified following complaints from pupils and parents, not from internal monitoring processes. Prior to August 2025, no usage monitoring information was received from coach and mini-bus companies and prior to the new tender, supplier onboarding procedures were weak. There is no business continuity plan in place for the Travel Team, and members of the Travel Team are routinely providing transport cover amongst their other duties leaving less time for supplier monitoring; the level of staffing in the Travel Team is lower than prior years. Management have advised that they intend to review the resource allocated, and skills required to support the Travel Team. Prior to August 2025, invoice quality was poor as many suppliers did not quote a route number that matches the name of the route number used by the Travel Team. Although a register is in place with the names of all individuals receiving taxi transport, reconciling this is complex. The Transport Invoice Breakdown Spreadsheet developed by Education provided some assurance that changes month to month were able to be queried, and any differences could be queried with the Travel Team to ensure that any changes were legitimate, however, reconciliation is still complicated as route numbers are often not provided on invoices by suppliers. A rota spreadsheet showing current clients, addresses, contact details, suppliers, and daily costs was in place for ASC and this was shared with the Travel Team, but as noted above there were no route references on this spreadsheet making reconciliation complicated depending on the information provided on the supplier invoice. As part of the revised framework tender, detailed onboarding procedures have been prepared for all providers. All transport providers now have to agree to a Code of Conduct, guidance has been prepared on invoicing standards, all suppliers are provided with a route reference to quote on their invoice, and guidance has been provided on safeguarding responsibilities. Additionally, purchase orders are in place covering the entire year for mini-bus and coach providers, providing improved certainty over the level of spend for these suppliers. The updated onboarding arrangements put requirements on all coach and mini-bus providers to provide reports detailing passenger volume along with each invoice. By monitoring the uptake of pupil transport, there may be scope to reduce the number or sizes of buses used in future if uptake is lower than expectations. Taxis are not required to provide any monitoring information but are now obligated to carry out a meet and greet with parents/guardians at the start of each school term. Page 59 of 134
Page 60
Areas where expected controls are met/good practice No. Areas of Positive Assurance 1 An external consultant undertook a review of the Council’s client transport services in 2024 and highlighted the majority of the key issues for the service. Senior Management are aware of the improvements required to the service and these are being actively delivered through the Client Transport Project. A Project Team is in place that is well informed of the improvements required and actions are being progressed to further improve the service. 2. A Client Transport Board is in place with appropriate governance arrangements, senior management representation and regular reporting. The Senior Project Manager provides regular update reports, and the prioritisation of activities and project plan are approved by the Client Transport Board. 3. A number of milestones have been achieved by the Project Team including the approval of the Integrated Transport Policy; the awarding of a new client transport framework; and the allocation of routes to new providers. A Policy Working Group has been established who will meet annually, or at earlier intervals if required, to ensure the Policy remains fit for purpose. 4. As part of the new client transport framework, detailed onboarding procedures have been prepared for suppliers to follow which includes a requirement to agree to a Code of Conduct, follow guidance on invoicing standards and guidance on safeguarding responsibilities. 5. Serious Organised Crime Procurement Checks have been completed for all suppliers. 6. Monitoring of passenger numbers has been introduced as a mandatory requirement for all coach and mini-bus suppliers. The new framework also presented an opportunity to reinforce standards - all suppliers have provided evidence of licences and insurance. 7. From August 2025, purchase orders have been piloted and rolled out for coach and mini-bus routes, which will help in providing improved assurance. 8. The central ASN team and Education Resource Group now lead on reviewing new ASN transport requests and senior management are also required to authorise transport requests, ensuring that there is appropriate senior management oversight of new ASN transport in line with the requirements detailed in the Integrated Transport Policy. 9. A spend analysis spreadsheet has been created for the new Transport Framework from August 2025 which will continue to be updated as new routes are added, existing routes are changed, and this spreadsheet can be scrutinised by Financial Services at any time going forward. 10. Travel Passports have been implemented for Education, and work on rollout and uptake is continuing. 11. A Microsoft365 form has been implemented for schools to request ad-hoc bookings, ensuring the Travel Team co-ordinate all transport and avoids schools booking suppliers not on the Council’s framework. Page 60 of 134
Page 61
Recommendation Grading/Overall Opinion Definitions Recommendation Definition High Recommendations relating to factors fundamental to the success of the control objectives of the system. The weaknesses may give rise to significant financial loss/misstatement or failure of business processes. Medium Recommendations which will improve the efficiency and effectiveness of the existing controls. Low Recommendations concerning minor issues that are not critical, but which may prevent attainment of best practice and/or operational efficiency. Levels of Assurance Definition Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Page 61 of 134
Page 62
Page 62 of 134
Page 63
Appendix 1. Executive Summary: Foster Care and Adoption Conclusion: Limited Assurance Policies and procedures are in place for foster care and adoption and segregation of duties for the payment of allowances and fees are in place. However, 13 overpayments amounting to £150K have occurred and invoices have not yet been raised for 7 of the overpayments, adoption cases have not been reviewed for any of the cases tested, rates input to Mosaic were incorrect for some elements and the setting of rates for adoption allowances was unclear. A small number of incorrect payments have been identified. Background Mosaic is the Council’s Social Care system used to record information and process payments - there is an automated interface enabling authorised payments from Mosaic to be uploaded into Integra (the Council’s finance system). In August 2023, the Scottish Government introduced the Scottish Recommended Allowance (SRA) for foster carers and there are 16 key components which the allowance should cover. A foster fee is also paid to carers for each young person in their care. The Council has a policy on the Post Adoption Support Planning and Adoption Allowance scheme and this states that the Council must consider whether an adoption allowance may be paid for any children whose adoption it is arranging or has been arranged, before an adoption order is made. Summary of findings & recommendations The following key findings and recommendations are highlighted, which have all been agreed by Management: • 13 overpayments amounting to £150K were identified by management. 5 overpayments in relation to adoption cases were highlighted before the audit commenced and it was reported that these occurred due to no end dates for adoption allowances being input in the system. There has been minimal recovery of the overpayments. Management have already changed the process to add end dates and will review all cases and take appropriate action by 31 December 2025. • Testing of a sample of 6 adoptions highlighted that reviews had not taken place since the adoption allowances were awarded. Management have agreed to ensure that processes are in place to ensure that timely reviews are completed by 31 December 2025. • Incorrect rates had been input into Mosaic for some elements of the foster allowances and fees and the rates for adoption allowances and exceptional fees within the Mosaic system could not be clarified as there is no evidence / audit trail detailing what the adoption allowance rates should be (these do not mirror the foster allowance as per the Adoption Policy). Management in Children’s Services and Operational Support will ensure going forward that all rates are agreed through the Council’s MTFP. Complete. • A small number of incorrect payments have been identified including a duplicate payment of £669. Management advised this will be rectified and the overpayments will be reclaimed by 31 December 2025. Recommendation Summary Recommendations Grade High Medium Low Total Current Report 0 5 8 13 Prior Report N/A N/A N/A N/A Materiality In 2024/25 expenditure for foster carer fees and allowances was £2,709,255 and expenditure for adoption allowances and exceptional fees was £148,207. 15 adoption allowances and 3 adoption exceptional fees were paid out and 67 children were in foster care (as at 30 June 2025). Page 63 of 134
Page 64
Headlines Objectives Conclusion Comments 1. Adoption and Fostering assessments and approvals are determined by clear policies, procedures, guidance and are in line with best practice, relevant regulations and legislation. Reasonable Adoption and Fostering assessments and approvals are documented in the panel minutes. Policies and procedures for fostering and adoptions are in place which are in line with best practice, relevant regulations and legislation. In 2022, the Council paused recruiting new adopters however the service continued to support existing adopters and utilised external adoption agencies. The Council has started recruiting new adopters but, in some cases, may still use external agencies. Post adoption allowances were updated on 1 April 2023 however these were not presented to Council for approval and there is no evidence or audit trail detailing what the adoption allowance rates should be - the Council’s Post Adoption Policy states that the rate paid is normally the same as the foster allowance however the amounts paid do not reflect this. 2. Agreements are in place with all adopters and foster carers, clearly outlining the roles and responsibilities of both carers and the Council. Reasonable Testing of a sample of 6 adoptions highlighted that adoption support plans were not in place for 2 adoptions. Management advised that adoption support plans may not have been a requirement at the time the adoption was made and the requirement to complete these is in place for all new adoptions. Testing of a sample of 10 foster carers confirmed that agreements were in place however it was not always clear who had completed the foster carer agreement, and it was not always signed by the Director/Chief Officer. 3. All adoption allowances and payments to foster carers are paid at the appropriate rates and are supported by authorised purchase orders. Limited A small number of incorrect payments have been identified including a duplicate payment of £669. Foster allowances were updated in Mosaic in accordance with the national rates however a lesser amount has been input for the birthday and Christmas allowances as instructed by Children’s services management which has led to smaller payments than indicated in the current Council guidance. Although the correct overall foster care allowance fee has been input, there is no audit trail detailing how the weekly components are calculated (for maintenance, pocket money and clothing) on Mosaic. Foster fees were updated in April 2025 and were approved by Council. However, testing identified that the rates for foster fees level 2 for respite had not been updated - this has now been rectified. It was also noted that sample checks on payments are not undertaken. The short break policy needs to be reviewed to clarify what payments should be paid to carers for foster respite and what deductions should be made from the original carer during the short break. Page 64 of 134
Page 65
4. Appropriate validation and authorisation arrangements are in place for all adoption and fostering care payment runs, payments are only made to approved carers; and are only made for periods when the young person is with the carer. Limited • Appropriate validation and authorisation arrangements are in place for payment runs. However, 13 overpayments amounting to £150K were identified by management. 5 overpayments in relation to adoption cases were highlighted before the audit commenced and it was reported that these occurred due to no end dates for adoption allowances being input in the system and reviews not being undertaken. As at September 2025, from the 13 overpayments identified: 7 invoices had not been raised; 2 invoices have been raised; a payment plan is in place for 1 service user; 2 cases are being reviewed with the Council’s legal team (1 case recently discussed setting up a payment plan); and 1 overpayment (£1.5K) has been written off by senior management due to administration errors within the service. • Testing highlighted that although end dates were recorded on the system for adoption allowances, there were no end dates for foster care packages on the Mosaic system which increases the risk of overpayments. 5. Regular reviews of carers agreements between Midlothian Council and carers are undertaken to ensure that payments being made to adoption and foster carers remain valid. Limited Foster carers are reviewed at least every two years which includes undertaking statutory checks such as medical and disclosure checks. In addition, annual checks are also undertaken by the team leaders. All 10 foster carers reviewed complied with this however some records require updating. The Post Adoption Policy states that reviews for adoption allowances should be undertaken at a minimum of two years following implementation. A sample of 6 adoptions was tested however no reviews had been undertaken after the adoption allowances were granted. 6. Adequate budgetary management arrangements are in place for expenditure on adoption and fostering care. Reasonable • Budget monitoring for Fostering and Adoption is undertaken monthly however, due to the issues identified during the audit, a more detailed analysis needs to be undertaken as part of this process. Page 65 of 134
Page 66
Areas where expected controls are met/good practice No. Areas of Positive Assurance 1. All foster carer agreements were in place and improvements were made to the template during the audit review. 2. A Foster Care Handbook is in place which provides key information on foster care, including the legal basis for caring for children, foster carer approval, paperwork, agreements and financial information. Fostering Household Safer Caring guidance is also in place. 3. Appropriate validation and authorisation arrangements are in place for all payment runs. Segregation of duties is in place within Children Services when a service request is raised by an officer and approved by the team leader. Segregation of duties is also in place within the Operational Support team when purchase orders are raised and approved. 4. As part of the foster carer reviews, regular statutory checks such as medical and disclosure checks are undertaken. Audit checks are undertaken by team leaders to ensure case files are updated. 5 A policy is in place for the Post Adoption Support Planning and Adoption Allowance scheme which highlights how the Council supports young people who have been adopted. The policy states that allowance rates for adopters are determined by a financial assessment however will generally follow the standard foster allowances less child benefit payable for the age of the child (the rates paid do not reflect this in practice). Page 66 of 134
Page 67
Recommendation Grading/Overall Opinion Definitions Recommendation Definition High Recommendations relating to factors fundamental to the success of the control objectives of the system. The weaknesses may give rise to significant financial loss/misstatement or failure of business processes. Medium Recommendations which will improve the efficiency and effectiveness of the existing controls. Low Recommendations concerning minor issues that are not critical, but which may prevent attainment of best practice and/or operational efficiency. Levels of Assurance Definition Substantial Assurance A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, noncompliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. Page 67 of 134
Page 68
Page 68 of 134
Page 69
Audit Committee Tuesday 2 December 2025 Item No 5.3 Follow-Up Review of Completed Internal Audit Recommendations and Progress Update Duncan Stainbank, Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is asked to: a) Note the results from the sample check of Internal Audit recommendations that have been marked as completed by Management since the last review to improve internal controls and governance, and mitigate risks; b) Acknowledge the progress made by Management in implementing Internal Audit recommendations to improve internal controls and governance, to mitigate risks, and consider whether it is satisfied with the progress made by Management; c) Considers whether it is satisfied with the outcomes or whether any further action is required; d) Endorse the proposal to extend the due dates for the overdue recommendations; and e) Note that Internal Audit will continue to monitor for completion the outstanding recommendations and will provide update reports to the Audit Committee. 2 Purpose of Report/Executive Summary The purpose of this report is to provide an update to members of the Audit Committee on the results of the Internal Audit Follow-up review which included a sample check on the adequacy of new internal controls for Internal Audit recommendations marked as completed by Management in the period August 2024 to September 2025. This report also provides an update to members of the Audit Committee on the status of the implementation by Management of audit recommendations made and agreed in Internal Audit reports. Internal Audit is an independent appraisal function established for the review of the internal control system as a service to Midlothian Council. It objectively examines, evaluates and reports on the adequacy of internal control as a contribution to the proper, economic, efficient and effective use of resources and the management of risk. The Internal Audit activity adds value to the organisation (and its stakeholders) when it considers strategies, objectives, and risks; strives to offer ways to enhance governance, risk management and control Page 69 of 134
Page 70
processes (by way of making audit recommendations); and objectively provides relevant assurance. The remit of the Audit Committee includes “To consider reports on the effectiveness of internal controls and monitor the implementation of agreed actions”, as part of its high-level oversight of the Council’s governance, risk management and control framework. Date 18 November 2025 Report Contact: Duncan Stainbank Chief Internal Auditor duncan.stainbank@midlothian.gov.uk Appendix 1: Overdue Actions Appendix 2: ‘In Progress’ Actions Page 70 of 134
Page 71
3 Background 3.1 Internal Audit is an independent appraisal function established for the review of the internal control system as a service to Midlothian Council. It objectively examines, evaluates and reports on the adequacy of internal control as a contribution to the proper, economic, efficient and effective use of resources and the management of risk. 3.2 The Internal Audit activity adds value to the organisation (and its stakeholders) when it considers strategies, objectives, and risks; strives to offer ways to enhance governance, risk management and control processes (by way of making audit recommendations); and objectively provides relevant assurance. 3.3 Management has the responsibility for ensuring that agreed audit actions are implemented to improve internal controls, risk management and governance. At Internal Audit final report stage, the audit recommendations are input to Ideagen Risk Management system, the Council’s corporate performance management system. This is designed to assist with Management tracking of implementation, link with relevant risks and evidence improvement. 3.4 Each year, Internal Audit undertakes two follow up reviews on the recommendations it has raised. The first checks a sample of Internal Audit recommendations which have been reported as complete and reviews the adequacy of the actions taken and improvements made. The second reports on the progress Management have made in implementing the recommendations by the expected date. 3.5 The remit of the Audit Committee includes “To consider reports on the effectiveness of internal controls and monitor the implementation of agreed actions”, as part of its high-level oversight of the Council’s governance, risk management and control framework. 4 Review of Completion of Internal Audit Recommendations 4.1 The objective of this follow-up audit was to review a sample of Internal Audit recommendations that have been signed off by Management as complete during the period 1 August 2024 to 30 September 2025 to assess the evidence that recommendations have been implemented satisfactorily and to ensure that the new controls had the desired effect on improving internal control and governance and reducing risk. 4.2 A sample of 51 audit recommendations which were at the ‘completed’ status on the Ideagen Risk Management system were selected and evidence was obtained to support the satisfactory completion of each recommendation. Recommendations from the following Internal Audit reports were selected: Page 71 of 134
Page 72
Financial Year Internal Audit Report No. High Rated Medium Rated Low Rated Consultancy – Not Rated 2019/20 Electric Payments Systems 1 0 0 1 0 2020/21 Trading Standards 2 0 1 1 0 2020/21 Social Housing Rents 1 0 0 1 0 2022/23 Accounts Receivable – Sundry Debt 1 0 0 1 0 2022/23 Care at Home 4 0 1 3 0 2022/23 Information Governance 1 0 1 0 0 2022/23 Street Lighting 3 0 2 1 0 2022/23 Utilities: Energy and Water Consumption 4 0 1 3 0 2023/24 Absence and Performance Management 4 0 2 2 0 2023/24 Bowles Report – School Capacity 4 0 0 0 4 2023/24 Council Tax Discounts and Exemptions 1 1 0 0 0 2023/24 Developer Contributions 2 0 1 1 0 2023/24 Education Software 5 0 2 3 0 2023/24 Licensing 6 0 1 5 0 2023/24 Payroll 2 0 0 2 0 2023/24 Risk Management 1 0 1 0 0 2024/25 Midlothian Energy 6 0 2 4 0 2024/25 Revenue Budget Monitoring 3 0 1 2 0 Total 51 1 16 30 4 4.3 From the 51 recommendations tested, 37 (72.5%) were found to have been completed satisfactorily, and 14 (27.5%) were identified as requiring further work to bring the audit action to full completion. 4.4 For the audit recommendations that had been completed satisfactorily, the evidence that was provided by Management indicated that the action taken had the desired effect on improving internal control and governance and reducing risk. 4.5 For the 14 audit recommendations identified as requiring further work: 8 were Low-rated, 5 were Medium-rated, and one was not given a priority rating at the reporting stage as it related to audit consultancy work. The further work required for the 14 recommendations is detailed in the table below. Audit Recommendation Rating Further Work Required 1 Street Lighting When calculating Performance Indicators the following should be implemented: retain an audit trail of source documentation for reported PIs; create procedure notes to enable indicators to be produced in the absence of key individuals; undertake QA checks Medium Although it was evidenced that processes have improved, particularly through completion of the other 2 Street Lighting actions confirmed as fully complete as part of this follow-up review, a procedure note has not yet been drafted for Performance Indicators. 2 Utilities: Energy and The rates applicable for electricity generated by the Council’s solar panels should be obtained annually from the Low The rates applicable are now obtained annually, however the issue of the low electricity Page 72 of 134
Page 73
Audit Recommendation Rating Further Work Required Water Consumption provider. Additionally, the low electricity generation noted from a sample of panels should be reviewed and rectified as required. generation of the solar panels at Lasswade High School has not yet been addressed. 3 Utilities: Energy and Water Consumption Following the pilot exercise being undertaken for Fairfield House and Midlothian House, a longer-term plan for improving building efficiency and reducing utilities usage across the Council estate should be developed. Medium Management have advised that they have obtained approval to appoint an Energy Management Officer charged with making savings through improved management and control of systems. This post, although approved, has not been advertised yet, and management have not provided Internal Audit with a plan for improving building efficiency and reducing utilities usage; management have advised that developing such a plan will be a responsibility of the new post. 4 Absence and Performance Management The Maximising Attendance at Work policy should be reviewed and updated to reflect the audit findings. Low Some of the audit findings, including clarifying the absence trigger levels (i.e. whether it is 8 separate or continuous working or calendar days), referencing to the Time off Policy 2024 where relevant, or detailing the retention period of attendance management records, were not included in the latest policy update. 5 Bowles Report - School Capacity The catchment area for each development should be added to the Housing Data Main Schedule spreadsheet using the ARC GIS system before this is sent to Education. Not Rated The audit action was closed following the establishment of fortnightly meetings with Education to take them through the consultation responses that they had received from Planning. These meetings ran for a few months in 2024 (providing Education with information on location, phasing, and build rates), but the meetings stopped after this, reportedly due to the meetings being repeatedly missed by Education due to other commitments. Education have advised that they would like further support from the Planning Service, particularly in relation to the catchment area for new developments. Internal Audit have suggested this could be achieved by providing Education with an information pack with detailed information on any potential school location and the catchment area of all new residential developments going forward. 6 Developer Contributions Consideration should be given to establishing a Developer Contribution Steering Group to allow for additional reporting in the year given the high financial value and importance of this area. Low Although a short-life working group on Developer Contributions carried out some work in early 2025, particularly on the use of contributions nearing their expiry date, the Capital Plan & Asset Management Board have not yet formally considered whether such a group should be made permanent. 7 Education Software Guidance for DPIAs should specify the authorisation and segregation requirements, final versions submitted to the DPO, the timescales for update, the requirement to report to the ICO if necessary, and a process developed to follow-up DPIA actions. Low The latest version of the DPIA template has not yet been updated to detail the authorisation or segregation of duties requirements for DPIAs. 8 Education Software DPIAs identified as not being fully complete or with actions outstanding, should be completed. Appropriate monitoring and governance arrangements should be established to ensure the need for a DPIA is promptly identified going forward. Low The six applications with potential issues with their DPIAs was discussed with the Council’s Information Compliance Officer. For 1 of the applications no further action is required, but further work is required to check the status of the other 5 DPIAs. 9 Licensing Management should ensure the Licensing Forum is reconvened to ensure it is fulfilling its statutory duties. Consideration should be given as to how to manage potential conflicts of interest in Low Although the first meeting of the reconvened Licensing Forum was arranged for September 2025, it did not go ahead due to there being insufficient trade representatives. Page 73 of 134
Page 74
4.6 Discussions have been held with the action owners to highlight what is required to ensure the remaining elements of the audit actions are fully completed or a sustained control is established. 14 audit actions have been re-opened on the Ideagen Risk Management system to enable the recommendation to be completed by the new agreed action date with evidence of the improvement action undertaken. 5 Progress Update 5.1 The objective of the second review is to assess Management’s reported performance in closing actions raised by Internal Audit by the agreed due date. It is Management’s responsibility to design and maintain adequate risk management, governance and internal control processes and checking that the arrangements and controls are operating effectively which are also known as the first and second lines. The Audit Recommendation Rating Further Work Required terms of Protective Services coordinating the Licensing Forum. 10 Licensing Procedures should be developed for all licences issued by the Council and risk registers should be updated. Low The Team Manager – Health Safety and Resilience advised that procedures have not yet been updated, but these will be updated as the project to move all the Council’s licence applications to the Granicus system, so they are available online, continues. 11 Licensing Application forms should be updated with the Council’s Privacy Policy and should be available online for all licences. Low The licence applications have been updated with the Council’s Privacy Policy. However, a number of licence applications are still not available online and applicants are instead required to email the Licensing Team to receive the relevant form, including for HMOs, private hire, taxis, alcohol premises, alcohol personal licence, and extended hours licence. 12 Licensing The role of the Civic LSO should be delivered and adequate resource allocated to licensing monitoring and administrative support. The scheme of delegation should be updated to include the LSO for the Civic Government (Scotland) Act 1982 and the LSA 2005. Medium Management have reported that an appropriate officer has been given the responsibility of Civic LSO. However, full completion of this action requires an update to the Council’s Scheme of Delegation. The action will be reassigned to the appropriate officer with responsibility for the update of the Scheme of Delegation. 13 Risk Management Appropriate risk management training and support should be provided to management including creating an e- learning module, mandatory for relevant managers, and ongoing periodic 1 to 1 support to facilitate update of their risk registers. Medium A risk management course has been created and is available on the Council’s Learnpro system, but the course has not been appropriately promoted and to date has only been completed by 7 officers; none of these officers are senior managers with responsibility for their own service risk registers. 14 Midlothian Energy The Business Plan reported to Council should include all of the requirements detailed in the Shareholders Agreement including presentation of MEL’s annual audited accounts. Medium Some aspects of this recommendation were addressed when the business plan was last presented, but due to the timing of the audit recommendations (the report was issued in final in October 2024) and the timescales for preparing the new business plan some aspects of the recommendation were not included (e.g. financial forecast information including a projected Profit and Loss and Balance Sheet and financial variance reporting). It was discussed with management that there may be a benefit to report some of this information in a separate report due to the timing of the year-end for Midlothian Energy (31 December each year). Page 74 of 134
Page 75
quarterly performance monitoring process provides an opportunity for Management to have a discussion on all of the open audit actions, including those that are overdue, the reasons why they were not completed by the original due date, risk mitigations in place in the interim and requests to Internal Audit for extensions to due dates. 5.2 An Internal Audit action report was generated from the Ideagen Risk Management system on 14 November 2025 which reflected the Quarter 2 updates 2025/26. 39 actions were overdue, and 113 actions (including sub-actions) were in progress which are summarised as follows: Financial Year Action Status High Medium Low Total 2018/19 In Progress 2 1 0 3 2019/20 In Progress 0 1 2 3 Overdue 0 0 1 1 2020/21 In Progress 2 2 1 5 2021/22 In Progress 1 7 3 11 Overdue 0 1 4 5 2022/23 In Progress 0 5 5 10 Overdue 0 4 1 5 2023/24 In Progress 0 15 13 28 Overdue 0 11 3 14 In Progress Priority not given as consultancy for 5 actions 1 Overdue 4 2024/25 In Progress 4 14 12 30 Overdue 0 1 7 8 2025/26 In Progress 0 7 15 22 Overdue 0 1 1 2 Total 9 70 68 152 5.3 The 39 overdue actions are summarised in Appendix 1. The due dates for these are now to be extended to 31 March 2026 in the Ideagen Risk Management system, which will allow management to take further action to complete the recommendations within a reasonable time. CMT are in support of this proposal and the Audit Committee are asked to endorse this proposal. 5.4 The 113 audit actions in progress are summarised in Appendix 2 which highlights the number of audit actions in progress within each Directorate. 5.5 This report was prepared for presentation to the Audit Committee on 2 December 2025. The progress on implementation of Internal Audit recommendations has been discussed with the Corporate Management Team on 19 November 2025. 5.6 A further update on progress with the implementation of Internal Audit recommendations will be included within the Internal Audit Annual Assurance Report 2025/26 for Midlothian Council which is scheduled for presentation to the Audit Committee in June 2026. Page 75 of 134
Page 76
6 Report Implications (Resource, Digital, Risk and Equalities) 6.1 Resource Resource implications of implementing Internal Audit recommendations are considered as part of the audit process to ensure these are reasonable and proportionate to the risks. 6.2 Digital There are no digital implications arising from this report. 6.3 Risk The recommendations made by Internal Audit are designed to reduce the level of risk to which the Council is exposed through the strengthening of the control environment and management of risks. It is anticipated that improvements in the management and mitigation of risks will arise as a direct result of Management implementing the Internal Audit recommendations made. If audit recommendations are not implemented, there is a greater risk of financial loss and/or reduced operational efficiency and effectiveness, and Management may not be able to demonstrate improvement in internal control and governance arrangements, and effective management of risks. 6.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. The Internal Audit work is carried out in accordance with the appropriate legislation and professional standards. The latter includes compliance with the requirements of Global Internal Audit Standards Domain 2 Ethics and Professionalism. 6.5 Additional Report Implications (See Appendix A) Page 76 of 134
Page 77
APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable Midlothian Council to deliver its key priorities in support of achieving the Council’s objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s Internal Audit service provision to assist the Council in achieving its objectives. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value The purpose of Internal Auditing within Global Internal Audit Standards (GIAS) is that “Internal auditing strengthens the organisation’s ability to create, protect, and sustain value by providing the board and management with independent, risk based, and objective, assurance, advice, insight, and foresight.” Implementation by Management of the actions associated with Internal Audit recommendations, that are designed to improve internal control and governance arrangements and management of risks, underpins the Page 77 of 134
Page 78
Council’s own continuous improvement arrangements to enhance its effectiveness, thus supporting the delivery of the Council’s best value duties. A.5 Involving Communities and Other Stakeholders The Chief Internal Auditor is accountable to the Audit Committee which, in fulfilling its governance role, acts as a bridge between the Council and other stakeholders. This report is presented to the Audit Committee to fulfil its remit “monitor the implementation of agreed actions”, as part of its high-level oversight of the Council’s governance, risk management and control framework. This report has been presented to the Corporate Management Team to outline the key messages of assurance and areas of improvement. The implementation of Audit recommendations will continue to be tracked by Management using the Ideagen Risk Management system and followed-up by Internal Audit. Any further matters of concern will be raised to CMT and the Audit Committee as appropriate. A.6 Impact on Performance and Outcomes The Findings and Recommendations from Internal Audit work during the year are designed to assist the Council in improving its performance and outcomes. A.7 Adopting a Preventative Approach Internal Audit assurance work includes assessments on when a preventative approach can be adopted. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Good governance is important to enable Midlothian Council to achieve its objectives. Page 78 of 134
Page 79
Appendix 1 Internal Audit Performance Report – Overdue Actions Status: Overdue 39 2019/20 - Asset Registers - Substantial Assurance in terms of accuracy of main registers and insurance arrangements. Limited Assurance in terms of utilisation reporting, low value plant, and some improvements noted as required for asset disposal. Action Code Action Due Date Icon Progress Notes Service Managed By IA.AREG.02 Improve and consolidate road and footpath asset management data in Confirm system, and improve the referencing to road adoption / acquisition documentation. 30-Apr- 2025 20% Q2 25/26: In progress A digital transformation steering group has been established with membership drawn from Digital Services and Business Applications. There have been a number of demos for asset management systems and applications for Neighbourhood Services. However, Digital Services are currently working to create and develop a road map which will allow Neighbourhood services to make strategic decisions around their technical infrastructure and how to make best make use of ICT investments across the service. After completion this will define a process that can be taken forward to procure software systems required across the service. Place Service Road Services; Road *Services 2021/22 - Adult Social Care Contract Monitoring - Substantial for oversight processes established by C&CG and some areas of monitoring, Limited for overall monitoring framework, other monitoring aspects, and some areas of commissioning. Action Code Action Due Date Icon Progress Notes Service Managed By IA,ASCCON TRACT.01 A Terms of Reference should be established for the HSCP Quality Assurance sub-groups and it should be established how frequently the groups should meet and what they should report to the 31-Mar- 2025 75% Q2 25/26: Contract Management role now in place and C&CG remains under review. Adult Health and Social Care Head of *Adult and Social Care Page 79 of 134
Page 80
Action Code Action Due Date Icon Progress Notes Service Managed By C&CG. IA,ASCCON TRACT.02 An appropriate risk assessment framework should be developed to determine the level of monitoring that should be in place for all providers in line with best practice issued by the Scottish Government. 31-Mar- 2025 10% Q2 25/26: Contract Management role now in place and C&CG remains under review. Adult Health and Social Care Head of *Adult and Social Care IA,ASCCON TRACT.04 Management should review how the Mosaic system could be used to aid in provider performance monitoring. 31-Mar- 2025 95% Q2 25/26: Contract Management role now in place and C&CG remains under review. Adult Health and Social Care Head of *Adult and Social Care 2021/22 - Learning Disabilities and Physical Disabilities - Substantial Assurance for overall governance, Limited Assurance for commissioning arrangements and contract monitoring arrangements Action Code Action Due Date Icon Progress Notes Service Managed By IA.LDPD.01 .1 AS Adult Services (AS) - Policies and Procedures relating to Learning Disabilities and Physical Disabilities should be reviewed and updated and should be available on the intranet 30-Sep- 2025 65% Q2 25/26: Awaiting update from Service Manager on completion. Will be confirmed for next reporting period. Adult Health and Social Care Graham *Kilpatrick IA.LDPD.01 .2 CS Children Services (CS) - Policies and Procedures relating to Learning Disabilities and Physical Disabilities should be reviewed and updated and should be available on the intranet 31-Mar- 2025 85% Q4 24/25: New Service manager (Disability) has commenced in post and is taking this action forward as part of 2024/25 strategic disability plan. Work around this action continues. Children’s Services, Partnership and Communities Children’s Services 2022/23 - Justice Services - Satisfactory Action Code Action Due Date Icon Progress Notes Service Managed By IA.JUSTICE .02 The framework agreements should be utilised to develop a joined up, cross team procurement exercise where terms and conditions with Randstad are refreshed and documented across HSCP teams to ensure value for money is being achieved by all teams. 31-Aug- 2025 25% Q2 25/26: In progress Randstad currently supply agency staff across HSCP on different basis including spot purchase. Work was undertaken with HSCP to identify where these provisions are available under Scottish Government or Scotland Excel frameworks and to migrate these across to the frameworks. In some areas however, there is no framework available and Randstad will only supply the Adult Health and Social Care; Corporate Solutions Place Performance Officer; Legal *and Governance Manager Page 80 of 134
Page 81
Action Code Action Due Date Icon Progress Notes Service Managed By provision on their own terms. It should be noted that Randstad (and other suppliers) are only commissioned when they represent most economically advantageous price. Recent investigation during quarter 1 has shown that Randstad are not on a framework. Contracts have been awarded separately and would require all to be terminated and re-tendered. It is therefore recommended that this action be closed because this cannot realistically be fully completed without termination and re- tendering. It has been proposed with Internal Audit that this action is closed based on the above information. Further discussions to be held with internal audit to reach a decision. IA.JUSTICE .05 Section 27 petty cash controls also require to be strengthened to ensure alignment with Council requirements. For example, management should ensure: ·The use of disbursement logs, ·The frequency of reconciliation is in line with the Council's risk 31-Mar- 2025 80% Q2 25/26: No further update available at time of reporting. Adult Health and Social Care AHSC Performance Officer; Head of *Adult and Social Care; Julie *Jessup; Deklan Clelland; Rhea Dornan 2022/23 - Mental Health Services - Substantial for budget monitoring and partnership working. Limited for contract monitoring; and compliance with procurement regulations and the Council’s FTPP policy Action Code Action Due Date Icon Progress Notes Service Managed By IA.MH.05 Monitoring of performance should be undertaken for all providers ensuring that all relevant performance templates are completed. The frequency of monitoring should be increased for higher value contracts. Contracts where providers are not meeting targets 31-Mar- 2025 93% Q2 25/26: Ongoing as part of the CC&G work. ED/CSPC Performance Officer Page 81 of 134
Page 82
Action Code Action Due Date Icon Progress Notes Service Managed By IA.MH.05 HSC IA.MH.05 Health and Social Care (HSC) - Monitoring of performance should be undertaken for all providers ensuring that all relevant performance templates are completed. The frequency of monitoring should be increased for higher value contracts. Contracts 31-Mar- 2025 80% Q1 25/26: Ongoing Adult Health and Social Care Head of *Adult and Social Care 2022/23 - Utilities: Energy and Water Consumption - Substantial Assurance for the procurement arrangements, invoicing and third-party usage. Limited Assurance for usage monitoring and the medium to long-term plans to reduce usage. Action Code Action Due Date Icon Progress Notes Service Managed By IA.UTILITIE S.06 The property sharing arrangement with the NHS for the Recovery Hub including any rental contribution should be reviewed to ensure it reflects current usage and this should be documented in a written agreement between the Council and NHS Lothian. 31-Mar- 2025 90% Q2 25/26: Confirmation requested that this is complete, update for next quarter. Adult Health and Social Care Head of *Adult and Social Care 2023/24 - Attainment Scotland Funding - Reasonable Assurance Action Code Action Due Date Icon Progress Notes Service Managed By IA.ASF.02 Appropriate officers within the Education Directorate should annually receive a copy of the School Fund Audit Report for each school with a school fund and these should be reviewed to check for compliance with the School Fund Guidelines. 31-Mar- 2025 30% Q4 24/25: Work ongoing Work in this area is ongoing within the Finance team - Request has been made to extend this audit action to Q2 25/26 Education Young People and Partnerships, Executive Director *Children IA.ASF.03 The School Fund Guidelines should be updated, include the procedures for monitoring hardship funds, the allowable reasons for transferring PEF budgets to school funds, and processes should be developed to ensure that funds are used as intended. 31-Mar- 2025 30% Q4 24/25: Work ongoing Work in this area is ongoing within the Finance team - Request has been made to extend this audit action to Q2 25/26 Education Young People and Partnerships, Executive Director *Children IA.ASF.04 An NCA and SLA should be in place for therapeutic suppliers used by schools and quotations tendering considered. PEF spend in 2024/25 should be reviewed to ensure compliance with procedures and a reminder issued of the 31-Mar- 2025 30% Q4 24/25: Work ongoing Work in this area is ongoing within the Procurement team - Request has been made to extend this audit action to Q2 25/26 Education Sinead Urquhart Page 82 of 134
Page 83
Action Code Action Due Date Icon Progress Notes Service Managed By approved framework suppliers. IA.ASF.05 Management should liaise with Procurement to ensure that a non-competitive action form is in place for all contracts that have not been competitively tendered, quotations / tendering is considered, and a service level agreement is prepared as required. 31-Mar- 2025 18% Q4 24/25: Work ongoing Work in this area is ongoing within the Business team - Request has been made to extend this audit action to Q2 25/26 Education Hazel *Moar; Claire *Sutherland 2023/24 - Bowles Report - School Capacity Action Code Action Due Date Icon Progress Notes Service Managed By IA.BOWLES .04 The concept of including a figure for expected numbers of children who are privately educated within the roll projections methodology should be explored as part of regular reviews of the pupil role projection. 30-Jun- 2025 30% Q4 24/25: Work ongoing We continue to explore this however we can only give number that go into secondary or leave primary part way through, so this is not achievable at this time. Education Magnus Inglis IA.BOWLES .07 The 2017-2047 Midlothian Learning Estate strategy approved in 2017 should be updated to include the correct pupil product ratios and the updated version should be published on the Council's website. 30-Jun- 2025 30% Q2 25/26: Work ongoing Joint audit with Education and Place. The updated pupil product ratios will be reflected in the next updated Learning Estate Strategy. Note that this ratio is reviewed to ensure suitability. Education; Place Service Executive Director *Place; Fiona *Robertson IA.BOWLES .08 Consideration should be given to including a clause in S75 developer agreements to protect the Council against the risk of any unusual or unexpected increases in construction costs. 31-Dec- 2024 0% Executive Director *Place Executive Director *Place IA.BOWLES .09 Following the external review of pupil forecasting, risks and ratings relating to school capacity / building should be reviewed and updated where applicable. 30-Jun- 2025 40% Q2 25/26: Work ongoing Recent audit added. Joint audit between Place and Education. Roll data is reviewed to ensure appropriate statutory capacity is provided. Education; Place Service Executive Director *Place; Fiona *Robertson 2023/24 - Care Homes Council & Private- Substantial and Limited Action Code Action Due Date Icon Progress Notes Service Managed By IA.CAREHO MES.01 Overarching guidance should be in place for managing Newbyres and Highbank Care Homes. 31-Mar- 2025 40% Q2 25/26: Updates requested from Service Managers on completion. Adult Health and Social Care Head of *Adult and Social Care Page 83 of 134
Page 84
Action Code Action Due Date Icon Progress Notes Service Managed By The guidance should explain the roles and responsibilities of services, legislative requirements and monitoring arrangements. IA.CAREHO MES.03 Care plan reviews for residential care should be undertaken on a timely basis and the community care home review policy should be reviewed and updated. 31-Mar- 2025 50% Q2 25/26: Updates requested from Service Managers on completion. Adult Health and Social Care Head of *Adult and Social Care IA.CAREHO MES.04 Care Home Service risks should be recorded within an Adult Social Care Risk Register in line with the Council’s Risk Management Policy. 31-Mar- 2025 30% Q2 25/26: Updates requested from Service Managers on completion. Adult Health and Social Care Head of *Adult and Social Care IA.CAREHO MES.05 Monitoring of care homes should be undertaken to ensure they are complying with the NCHC. Building & contents insurance should be checked annually and maintained. All external care home providers should have adequate business continuity plans. 31-Mar- 2025 15% Q2 25/26: No further update available at time of reporting. Adult Health and Social Care Head of *Adult and Social Care 2023/24 - Education Software - Mix of Substantial and Limited Assurance Action Code Action Due Date Icon Progress Notes Service Managed By IA.EDUSW ARE.01 Guidance distributed should include Windows and web-based applications used by schools if they are still being used including support and monitoring arrangements. Guidance should be provided for schools requiring new Windows software installed. 30-Jun- 2025 75% Q1 25/26: In progress There is no guidance provided to schools on Windows applications because the Windows 11 upgrade is now complete and school devices are unable to access Windows 11 applications not approved prior by Digital Learning, therefore the first part of guidance is no longer required (action complete). The remaining part of this action on web –based applications (used on school devices) requires action from Digital Learning team and not Digital Services. In relation to guidance being provided for schools requiring new Windows software, the guidance is that any requests for Windows applications needs to be approved by Digital Learning first as these cannot be accessed now due to the Windows11 upgrade. Education Susan *Ward Page 84 of 134
Page 85
Action Code Action Due Date Icon Progress Notes Service Managed By IA.EDUSW ARE.08 Review education software on Windows devices and web-based apps to establish if it is still used, meets the relevant educational needs, identify overlap/duplication between school purchases and DI&L, and to either remove or update the software as needed. 30-Jun- 2025 75% Q4 24/25: In progress Connected to the software in schools action. On track to complete by end of June 2025. Education Susan *Ward 2023/24 - Risk Management - Substantial for Risk Management Policy and application at a strategic level. Limited over the application of the Risk Management Policy at the service level, training, guidance, and service level reporting and monitoring. Action Code Action Due Date Icon Progress Notes Service Managed By IA.RISK.02 Annual reporting should be in place to provide the Audit Committee with assurance on compliance with the Risk Management Policy. Risk management procedures should be in place and available on the intranet and the officer risk group should be reinstated. 30-Sep- 2025 25% Q2 25/26: In progress Draft Risk Management Policy completed and presented to Chief Officer Place and Strategic Risk & Resilience Group in May 2025 for comments. To be approved by committee. Place Service Senior Manager Protective Services IA.RISK.04. CHILDREN' SSERVICE S Chief Officers and Head of Service should ensure that their service risk registers are appropriately updated by relevant managers. Service risks should be reported to DMTs and escalated as required to CMT and the Strategic Risk Register. 30-Sep- 2025 60% Q4 24/25: In progress Service risk registers are reviewed and updated as part of quarterly performance reporting. Further work is required to review historic risks. Childrens Services, Partnership and Communities Children’s Services Management Team IA.RISK.04. EDUCATIO N Chief Officers and Head of Service should ensure that their service risk registers are appropriately updated by relevant managers. Service risks should be reported to DMTs and escalated as required to CMT and the Strategic Risk Register. 30-Sep- 2025 60% Q4 24/25: In progress Service risk registers are reviewed and updated as part of quarterly performance reporting. Further work is required to review historic risks. Education Chief Operating Officer *Education IA.RISK.04. HEALTHAN DSOCIALC ARE Chief Officers and Head of Service should ensure that their service risk registers are appropriately updated by relevant managers. Service risks should be reported to DMTs and escalated as required to CMT and the Strategic Risk Register. 30-Sep- 2025 75% Q2 25/26: Midlothian HSCP services maintain local risk registers in line with partner policies. Adult Health and Social Care Director *Health and Social Care; Roxanne *King 2024/25 - Education Construction Governance - Reasonable Assurance Action Code Action Due Date Icon Progress Notes Service Managed By IA.EDUCO For financially significant, strategic projects, 30-Sep- 0% Q1 25/26 Education Marc *Bedwell Page 85 of 134
Page 86
Action Code Action Due Date Icon Progress Notes Service Managed By GOV.01 management should obtain assurance that appropriate project management resource is in place by ensuring a procurement exercise such as a mini-competition is completed for future projects. 2025 Following approval of Development Team and Learning Estate Rationale Report by CMT in June 2025, the personnel delivering the Learning Estate development were moved to report to Marc Bedwell and Fiona Robertson in the Children, Young People & Partnerships Directorate. Awaiting confirmation from Internal Audit to remove audits from Place. IA.EDUCO GOV.02 Specific Midlothian performance standards, expectations, and governance arrangements should be documented at the call-off stage so that an appropriate baseline is set for the External Project Manager’s performance for the duration of the project. 30-Sep- 2025 0% Q1 25/26 Following approval of Development Team and Learning Estate Rationale Report by CMT in June 2025, the personnel delivering the Learning Estate development were moved to report to Marc Bedwell and Fiona Robertson in the Children, Young People & Partnerships Directorate. Awaiting confirmation from internal audit to remove audits from Place. Education Marc *Bedwell IA.EDUCO GOV.03 Review the use of agency resource and establish if any roles should be reconsidered for Council contract appointment. The approved agency frameworks should be utilised for new appointments and incumbent resource transitioned in a planned process. 30-Sep- 2025 50% Q2 25/26: In progress Approval of Service Review for Development Team has allowed for recruitment to be initiated for roles currently filled with agency staff. Interviews complete and offers made for 4 of the 6 roles recruiting into. Education Marc *Bedwell IA.EDUCO GOV.04.1 The BCHS Project Board ToR should be updated to detail the roles and responsibilities of Project Board members and to establish a quorum for board decisions. 30-Sep- 2025 0% Q1 25/26 Following approval of Development Team and Learning Estate Rationale Report by CMT in June 2025, the personnel delivering the Learning Estate development were moved to report to Marc Bedwell and Fiona Robertson in the Children, Young People & Partnerships Directorate. Awaiting confirmation from internal audit to remove audits from Place. Education Marc *Bedwell Page 86 of 134
Page 87
Action Code Action Due Date Icon Progress Notes Service Managed By IA.EDUCO GOV.04.2 The MLCC Project Board ToR should be updated to establish a quorum for board decisions, the incomplete sections on Tolerances and Stakeholders updated, and a realistic board meeting frequency should be established and practiced by board members. 30-Sep- 2025 0% Q1 25/26 Following approval of Development Team and Learning Estate Rationale Report by CMT in June 2025, the personnel delivering the Learning Estate development were moved to report to Marc Bedwell and Fiona Robertson in the Children, Young People & Partnerships Directorate. Awaiting confirmation from internal audit to remove audits from Place. Education Marc *Bedwell IA.EDUCO GOV.05 Internal PMs should liaise with External PMs to ensure risk registers are regularly reviewed and updated. Project risks should be summarised to the board with reference to the full project risk register so there is assurance that they are up-to- date. 30-Sep- 2025 0% Q1 25/26 Following approval of Development Team and Learning Estate Rationale Report by CMT in June 2025, the personnel delivering the Learning Estate development were moved to report to Marc Bedwell and Fiona Robertson in the Children, Young People & Partnerships Directorate. Awaiting confirmation from internal audit to remove audits from Place. Education Marc *Bedwell IA.EDUCO GOV.07 The ToR for the CP&AMB and CYPE Programme Board should be updated to document when issues should be escalated to the Chief Executive and Leader of the Council. The CP&AMB ToR should adequately outline its reporting relationship with the CMT. 30-Sep- 2025 50% Q2 25/26: In progress Head of Development / CPAMB ToR updated and will be submitted to November CPAMB for approval. Education; Place Service Marc *Bedwell; Head of *Development 2024/25 - IT Asset Management - Limited Assurance Action Code Action Due Date Icon Progress Notes Service Managed By IA.ITASSET S.08 - Education The reason for disposal should be documented and authorisation evidenced before the assets are collected by the contractor. Documentation should be complete, systems updated, and any differences between assets for disposal and those collected explained. 30-Sep- 2025 0% Education Susan *Ward Page 87 of 134
Page 88
Recruitment & Use of Agencies - Limited Assurance Action Code Action Due Date Icon Progress Notes Service Managed By IA.RECRUI T&AGENCI ES.4.1 All DMTs should refer to the workflow authorisation ID in the staffing spreadsheets taken to DMT for approval so there is a clear audit trail between the workflow authorisation and what was approved at DMT. 31-Oct- 2025 0% Q2 25/26: New audit action added Oct 2025 – progress will be monitored in quarter 3 reporting period. Corporate Solutions Chief Officer Corporate Solutions IA.RECRUI T&AGENCI ES.07 The retention requirement for shortlisting information should be included in the information pack sent to recruiting managers. 31-Oct- 2025 0% Q2 25/26: New audit action added Oct 2025 – progress will be monitored in quarter 3 reporting period. Corporate Solutions Jacqui Dougall Page 88 of 134
Page 89
Appendix 2 Internal Audit Performance Report – Actions in Progress Status: In Progress 113 Financial Years Areas Total Place Corporate Solutions Children, Young People & Partnerships Health and Social Care 2018/19 1 2 0 0 3 2019/20 0 3 0 0 3 2020/21 5 0 0 0 5 2021/22 9 2 0 0 11 2022/23 7 3 0 0 10 2023/24 15 13 1 0 29 2024/25 5 14 11 0 30 2025/26 0 20 1 1 22 Total 42 57 13 1 113 Page 89 of 134
Page 90
Page 90 of 134
Page 91
Appendix 2 Internal Audit Performance Report – Actions in Progress Status: In Progress 113 Financial Years Areas Total Place Corporate Solutions Children, Young People & Partnerships Health and Social Care Actions Jointly Owned by Children, Young People & Partnerships and Health and Social Care Actions Jointly Owned by Corporate Solutions and Place Actions Jointly Owned by Corporate Solutions, Children, Young People & Partnerships, and Health and Social Care 2018/19 1 2 0 0 0 0 0 3 2019/20 0 3 0 0 0 0 0 3 2020/21 5 0 0 0 0 0 0 5 2021/22 9 2 0 0 0 0 0 11 2022/23 7 3 0 0 0 0 0 10 2023/24 14 13 1 0 0 1 0 29 2024/25 5 14 10 0 1 0 0 30 2025/26 0 17 1 1 0 1 2 22 Total 41 54 12 1 1 2 2 113 Page 91 of 134
Page 92
Page 92 of 134
Page 93
Audit Committee Tuesday 2 December 2025 Item 5.4 Strategic Risk Management – Strategic Risk Profile Quarter 2, 2025-26 Report by Derek Oliver, Chief Officer Place Report for Information 1 Recommendations Audit Committee is recommended to: • Note the current risk landscape and organisational response to the most significant risks in Quarter 2, 2025-26 (1st July to 30th September 2025). 2 Purpose of Report/Executive Summary The purpose of this report is to provide Audit Committee with: • An update on the risk responses Midlothian Council has implemented during Q2 2025/26 to respond to the current risk climate • Assurance that Midlothian Council took a proportionate and planned approach to prepare and respond to the current risk climate • The risk evaluation of current strategic risks and opportunities for the Council 20th November 2025 Report Contact: Derek Oliver, Chief Officer Place Derek.Oliver@midlothian.gov.uk Page 93 of 134
Page 94
3 Q2 Risk Management Overview 3.1 Midlothian Council has delivered a wide range of services to the people of Midlothian throughout Quarter 2, 2025-26. 3.2 The Council continues to manage and review risks recorded within the Strategic Risk Profile. The work required to maintain the necessary corporate oversight over the broader strategic landscape continues through the Risk and Resilience Chief Officer Group and Corporate Management Team (CMT). 3.3 Audit Committee should note that there were no new risks added from the previous Quarter however, as per the request from Audit Committee, the Strategic Opportunities section was revised to include Strategic Projects. The Projects included have a Red category across their respective Risk Evaluation. Updates on actions taken are included in the full strategic risk profile (Appendix B). 3.4 Strategic Risk Profile (SRP) The SRP is split into three sections: • Strategic Issues • Strategic Risks • Opportunities 3.5 STRATEGIC ISSUES - SUMMARY Strategic issues Likelihood Impact Score Evaluation Q2 2025/26 Q1 2025/26 The Change Programme 5 5 25 Critical Critical Financial Sustainability 5 5 25 Critical Critical 3.6 The Change Programme The Change Programme remains evaluated at Critical. The financial challenges of the forecasted budget gap pose a significant challenge for benefits realisation. Council agreed to a Transformation Blueprint in June 2023 which is a 5-year transformation plan. 3.7 Financial Sustainability The scale of the financial challenge continues to be reported to the Business Transformation Steering Group and Council. Page 94 of 134
Page 95
3.8 STRATEGIC RISKS – SUMMARY Strategic Risks Likelihoo d Impac t Score Evaluation Q2 25-26 Q1 25-26 Financial Sustainability in Future Years 5 5 25 Critical Critical The Long-Term Change Programme 5 5 25 Critical Critical Legal and Regulatory compliance 5 5 25 Critical Critical Climate Change 5 5 25 Critical Critical Emergency Planning and Business Continuity 4 5 20 High High Cyber Security 4 5 20 High Medium Growing Council 4 4 16 High High Scottish Child Abuse Inquiry 4 4 16 High High Health and Safety/Fire 4 4 16 High High Asset Management 3 5 15 Medium Medium Cost of Living Crisis 3 5 15 Medium Medium Counter Terrorism 3 4 12 Medium Medium Employee Performance 3 4 12 Medium Medium Care at Home 3 4 12 Medium Medium Governance and Standards 2 4 8 Low Low Internal Control Environment 2 3 6 Low Low Corporate Policies and Strategies 2 3 6 Low Low 3.9 STRATEGIC RISKS – RATED CRITICAL/HIGH 3.10 Financial Sustainability in future years The scale of the financial challenge continues to be reported to Business Transformation Steering Group and Council. 3.11 The Long-Term Change Programme The Change Programme has remained at Critical for the last 2 years. The financial challenges of the underlying budget gap pose a significant challenge. Council agreed to a Transformation Blueprint in June 2023 which is a 5-year transformation plan. Page 95 of 134
Page 96
3.12 Legal and Regulatory compliance Significant resourcing pressures have impacted on risk evaluation. Work is ongoing with the Scottish Information Commissioner and National Records of Scotland to develop and deliver improvement plans. 3.13 Climate Change Councillors were presented with a briefing on the Climate Action Plan in Q2 24-25 as committed to through the Transformation Blueprint. With a report presented to October Council, Councillors approved, given the challenges (particularly financial), the realignment of the target deadline of 2030 for net zero emissions from the Midlothian Council estate to 2045. In light of this, a refresh of the Council’s Climate Change Strategy, approved by Council in August 2020, is progressing. 3.14 Emergency Planning and Business Continuity Ongoing monitoring of a changing landscape and maintaining organisational readiness and preparedness. Increase in evaluation score aligned to internal audit of Risk Management, specifically in relation to a focus on resource, service risk registers and business continuity planning, as previously reported to Committee. This work is progressing. 3.15 Growing Council The risk evaluation remains High in Q2 2025-26. This is in response to the current financial challenge as described above and the increased pressure the Council faces with growth. Some current examples of this include: • Inflationary impact on the delivery of the capital programme • Cost of living crisis • Pressure on the care sector as people are living longer and require more care provision • General population growth places additional demand on infrastructure such as GPs, schools, waste services etc. 3.16 Scottish Child Abuse Inquiry (SCAI) The SCAI risk evaluation remains High as the Inquiry continues. 3.17 Health and Safety/Fire Safety Fire safety audits continue across the estate. New Head of Establishment Fire Information Handbook and Fire Logbooks rolled out with emphasis on need to complete/update Fire Evacuation Plans. Estate Safety & Maintenance Groups refreshed to identify and action any priority safety or repairs matters. Page 96 of 134
Page 97
3.18 Cyber Security The current climate and intelligence has raised the likelihood score and thus overall evaluation from Medium to High. Our teams remain vigilant and have in place necessary cyber resilience action plans and certification. 3.19 STRATEGIC OPPORTUNITIES 3.20 Capital Projects - Housing Projects impacted with 26% reduction in Affordable Housing Supply Programme grant to Midlothian and continued high build costs. Phase 5 housing programme has been reviewed to ensure affordability within the Housing Revenue Account, allowing for reduced levels of grant. Projects highlighted with specific Red Risk Evaluation(s) and detailed within the SRP are Newbyres, Gorebridge; Edmonstone Road, Shawfair and Newton Church Road, Danderhall. 3.21 Capital Projects – Transport, Net Zero & Infrastructure Cost of delivering enabling infrastructure projects has risen, resulting in significant funding gap emerging and impacting on progress of A701 Relief Road, Sustainable Transport Corridor and Straiton Junction Improvements, which are detailed within the SRP. 3.22 Capital Projects – Children, Young People & Partnerships Estates Programme: Primary Five specific projects identified within the SRP: 1. Mayfield/St Lukes PS New Build: Tender return from Stage 1 exceeds available budget. Programme delayed for project revision. 2. Kings Park PS Extension & Refurbishment: No available budget to undertake extension. Condition and suitability of school to be addressed. 3. Rosewell PS Extension: No available budget to undertake extension. Condition and suitability of school to be addressed. 4. Mauricewood PS Extension & Refurbishment: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Design team appointed to develop investment in school that aligns with budget available from Developer Contributions. 5. Bilston PS Extension: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Design team appointed to develop investment in school that aligns with budget available from Developer Contributions. Page 97 of 134
Page 98
3.23 Capital Projects – Children, Young People & Partnerships Estates Programme: Secondary Three specific projects identified within the SRP: 1. Beeslack HS Replacement: Contractor appointment delayed. Programme behind due to changes in scope / design. 2. Shawfair All Through: Site acquisition complete. School location fixed with design team. Remediation programme being revised. Seeking to make efficiencies in remediation programme. 3. Penicuik HS New Build: LEIP target for delivery is Dec 2026, however programme for occupation is July 2027. Cost reports tracking higher and risks identified in refurbishment works. SFT advising if additional LEIP funding available. 3.24 Capital Projects – Regeneration Three specific projects identified within the SRP: 1. Vogrie Changing Places: now progressing . 2. Destination Hillend: Alpine Coaster delivered with access and parking infrastructure. Project absorbed risk and contingency. Delays to delivery resulting from issues with access / water mains. Main Building tender return exceeded budget. Next Phase to be recast. Interim works on water supply and drainage required. 3. Hopefield Industrial Estate: Updated financial model required. 3.25 City Region Deal Edinburgh and South East Scotland City Region Deal - bid for funding to Scottish and UK Governments to accelerate economic growth through investment in infrastructure/ housing/ skills and innovation was agreed by Council in June 2018. Projects continue to be progressed with realisation of regional enhancements and connectivity. 4 Report Implications (Resource, Digital and Risk) 4.1 Resource There are no direct resource implications indicated in this report, although individual risks have associated resource implications. 4.2 Digital None 4.3 Risk The risks reported in this report are understood with the Council able to demonstrate the current risk controls and actions being taken in response to these. The report provides an overview of the significant risks faced by the Council during Quarter 2, 2025-26 and should act to provide assurance that Midlothian Council took a proportionate and planned approach to prepare and respond to each of these risks. Page 98 of 134
Page 99
4.4 Ensuring Equalities (if required a separate IIA must be completed) There are no direct equalities issues arising from this report. 4.5 Additional Report Implications (See Appendix A) See Appendix A Appendices Appendix A – Additional Report Implications Appendix B – Strategic Risk Profile (Quarter 2, 2025-26) Page 99 of 134
Page 100
APPENDIX A – Report Implications A.1 Key Priorities within the Single Midlothian Plan This report provides an overview of the Strategic Risk Profile of Midlothian Council at a defined point in time. The issues, risks and opportunities affecting or supporting delivery of the council priorities are set out within the Strategic Risk Profile. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious None of the above A.4 Delivering Best Value The Council’s commitment to best value and securing continuous improvement can best be delivered when decisions are made against a backdrop of understanding the risks and opportunities before an organisation. This report seeks to provide assurance that the current risk environment is understood and that Midlothian Council is taking appropriate action in response to those identified risks. A.5 Involving Communities and Other Stakeholders This Strategic Risk Profile report has been compiled with input from a range of internal key stakeholders. A.6 Impact on Performance and Outcomes This report seeks to provide an overview of the challenging risk environment within which the Council is operating at this time. Being in a risk aware position helps to inform current and future decision making, with the intention of enhancing decision making and the Page 100 of 134
Page 101
associated performance and outcomes which flow from well informed decision making. A.7 Adopting a Preventative Approach The Risk Management approach being taken by the Council is founded on a preventative approach to managing risks, where appropriate and more generally to decision making with far greater risk awareness. A.8 Supporting Sustainable Development Senior Managers must ensure the sustainability of the Council, which entails identifying, understanding and managing Strategic and Service level risks and opportunities. Page 101 of 134
Page 102
Page 102 of 134
Page 103
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 STRATEGIC RISK PROFILE, Q2 July-Sept 2025 STRATEGIC RISK PROFILE SRP This risk register captures the main strategic issues, risks and opportunities that are corporate in nature. It identifies the nature of the risks, measures required to control the risks and their evaluation. It also details what further actions are required to reduce the likelihood and impacts of those risks to more acceptable and manageable levels with timescales. Strategic Issues SRP.IR.02 The Change Programme Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.IR. 02 Risk cause The pace of transformation strands of activity, reporting to the Business Transformation Board, does not secure service transformation, delivery of outcomes or benefit realisation. Risk event Delayed progress or non-achievement of outcomes and benefits. Risk effect Slow or delayed financial benefits arising from service redesign, requiring the adoption of recovery plans or requiring short term service reductions which impact on the Council’s ability to deliver against its priorities. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. Transformation Blueprint agreed at Council June 2023 which is a 5- year transformation plan. Revised governance for transformation agreed and revised Terms of Reference in place for the Business Transformation Board to oversee progress on change programme. 2. Regular reporting to Council setting out scale of financial challenge ahead with recurring expenditure for current service delivery projected to exceed recurring income. 3. Cross Party Business Transformation Steering Group are given updates on the progress of the Transformation programme. 4. Financial monitoring reports and work of the Corporate Management Team evidence continued financial sustainability, in so far as services are delivered within the overall budget in year. 5 5 Page 103 of 134
Page 104
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SPR.R A-02.08 Transformation Blueprint 2023-28 delivery Q2 25/26: As per previous Quarters. Progress with sprints is reported to BTB at every meeting via the dashboard and also in detailed reports at some points. BTSG are provided with an updated dashboard every cycle and receive focused reports on individual sprints and also funding requests to release BT funds to support project work. Chief *Executive; Chief Officer *Place; Chief Officer Corporate Solutions; Chief Finance Officer; 30-Jun-2028 20% SRP.R A.02.03i Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q2 25/26: As Q1 25/26. Q1 25/26: Updated MTFS projections to 2028/29 were presented to Council in June 2025. A further update will be provided in quarter 3 of 25/26. Q4 24/25: MTFS projections to 2028/29 were presented to Council in February 2025 as part of setting the 2025/26 budget and accompanying Council Tax levels. A further update will be provided to Council during Q1 of 25/26. Q3 24/25: An update on the MTFS was presented to Council in December along with outcomes from the public consultation. Detailed analysis of emerging national budget positions for 2025/26 was presented and discussed at the Business Transformation Group. Q2 24/25: Further update on the MTFS was presented to Council in October and a public consultation was launched on 9th October running to 20th November. Q1 24/25: An update on the MTFS was presented to Council in June 2024. This identifies immediate actions required, in addition to those in the Transformation Blueprint, to bridge the gap between recurring expenditure and recurring income and to allow the setting of a balanced budget for 2025/26. Chief *Executive; Chief Finance Officer; 30-June-2024 100% Page 104 of 134
Page 105
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 SRP.IR.07 Financial Sustainability Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.IR. 07 Risk cause Scottish Government Grant settlements fall short of the resources needed to sustain core services. Core funding falling short of inflation pressures, pay awards and demographic pressures arising from an Increasing ageing population of over 75’s. Increasing population of 0-15 age group. Rising customer expectations. Risk event Transformation activity and the flexibility available to Councils as part of the grant settlement does not address future years projected budget gaps. Risk effect Inadequate government funding makes securing balanced budgets challenging. This in turn erodes the Council’s ability to deliver services to the community and potentially means that resources available fall short of those the Council assess as required to meet its statutory obligations. Whilst transformation activity can help reshape services and ensure best value in the delivery of services it is not a solution to continued erosion of core funding. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. There is an approved Capital Strategy and Reserves Strategy in place. The Capital Strategy is being updated in the context of ongoing and significant infrastructure pressures and to reflect completed Asset Management Plans.. 2. There is an approved budget for 2025/26. Services are delivered within the totality of that budget. 3. Enhanced monitoring arrangements have been agreed for service areas that are regularly showing overspends. 4. Directorates have budget boards in place to monitor and agree actions for those items which are identified as needing specific attention or present a risk to the financial position of services. 5. Strategic Boards in place and BTB focus and attention on driving transformation to support future year’s financial sustainability. 6. Working through COSLA to influence government spending decisions to influence Scottish Government’s budget allocation to Councils. 7. Capital Plan and Asset Management Board will scrutinise and challenge slippage on capital programmes recognising that slippage can have an adverse impact on financial sustainability and also the delivery on assets required to support capital growth. 8. Chief Executive continues to emphasise the need for effective financial control and underlined the benefit to the organisation of such an approach. 9. Scottish Governments May 2022 Resource Spending Review provided planning parameters for term of parliament, albeit these are challenging and present a real terms reduction in grant funding of circa 7% over the period. 10. Report to Council February 2025 sets out scale of financial challenge ahead with recurring expenditure for current service delivery projected to exceed recurring income. Updated MTFS projections presented in June 2025 with a further update to be presented in February 2026. 11. Cross Party Business Transformation Steering Group engaged in consideration of measures to secure balanced budgets alongside the development of a Strategic Plan to support decisions about what services, beyond those which are statutory can be provided. 12. Income Generation 5 5 Page 105 of 134
Page 106
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SPR.R A-02.09 Transformation Blueprint 2023 to 2028 Q2 25/26: Refer to SRP.RA-02.08 Chief *Executive; Chief Finance Officer; 30-Jun-2024 20% SRP.R A.02.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q2 25/26: Refer to SRA.RA-02.03i Chief *Executive; Chief Finance Officer; 30-June-2024 100% SRP.R A-02.10 Capital Plan Prioritisation Q2 25/26: Building Asset Management Plan approved by Council. Fleet Asset Management Plan and Digital Asset Management Plans are under development and are key parts of finalising the Capital Plan Prioritisation exercise. Q1 25/26: Work evaluating information flowing from building condition surveys continues with a view to presenting a draft building Asset Management Plan to Council in October. Q4 24/25: Council in February received an update on Capital Plan Prioritisation work and made a decision on an updated Learning Estate Strategy. The extent and affordability of work flowing from building condition surveys is being assessed and will be concluded and reported to Elected Members early in 2025/26. Q3 24/25: Work continues on Capital Plan Prioritisation Q2 24/25: Work continues on Capital Plan prioritisation Q1 24/25: Work continues on Capital Plan prioritisation Chief Finance Officer; Executive Director – Place; Executive Director - Education 31-Oct-2024 0% Page 106 of 134
Page 107
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Strategic Risks SRP.RR.01 Financial Sustainability in Future Years Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.01 Risk cause: Scottish Government Grant settlements fall short of the resources needed to sustain core services. Core funding falling short of inflation pressures, pay awards and demographic pressures arising from an Increasing ageing population of over 75’s. Increasing population of 0-15 age group. Rising customer expectations. Policy decisions by UK & Scottish Governments which are not fully funded. Changes to the responsibilities of Local Government and the funding implication that arise from that. Future year pay award settlements. Risk event: Real terms reduction in core grant settlements. Policies decisions at Government level not fully funded to Council's. Securing the extent of change required in order to deliver financial sustainability and a change program that recognises the size of the challenge. Cost pressures exceeding budget estimates. Pressures on increasing insurance premiums and associated risk improvement actions. Risk to not achieving financial sustainability is a failure to deliver cost reductions / service change embedded in the blueprint and also supplementing the blueprint. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. Development of Strategic Plan, Transformation Blueprint and MTFS projections which come together to provide a framework to effect change and to move the Council to a position of financial sustainability. 2. Maintaining a level of reserves to deal with unforeseen or one-off cost pressures. 3. Capital and Reserves Strategies in place. The Capital Strategy is being updated in the context of ongoing and significant infrastructure pressures. 4. Working through COSLA to influence government spending decisions to influence Scottish Government’s budget allocation to Councils. 5. Implement a lobbying strategy with government to recognise the unique position Midlothian Council is in. 6. Best Value Audit report actions. 7. Strategic Boards in place to drive transformation in line with the Transformation Blueprint. 8. Risk & Resilience Group and CMT oversight of Insurance Risk Improvement Actions. 5 5 Page 107 of 134
Page 108
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .02.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q2 25/26: Refer to SRP.RA-02.03i Chief *Executive; Chief Finance Officer; 30-June-2024 100% SRP.RA .02.04 Transformation Blueprint 2023 to 2028 Q2 25/26: Refer to SRP.RA-02.08 Chief *Executive; Chief Finance Officer; 30-Jun-2028 20% SRP.RA .02.06 Capital Plan prioritisation Q2 25/26: Building Asset Management Plan approved by Council. Fleet Asset Management Plan and Digital Asset Management Plans are under development and are key parts of finalising the Capital Plan Prioritisation exercise. Q1 25/26: Work evaluating information flowing from building condition surveys continues with a view to presenting a draft building Asset Management Plan to Council in October. Q4 24/25: Council in February received an update on Capital Plan Prioritisation work and made a decision on an updated Learning Estate Strategy. The extent and affordability of work flowing from building condition surveys is being assessed and will be concluded and reported to Elected Members early in 2025/26. Head of *Development; Executive Director *Place; Chief Finance Officer; 31-Oct-2024 0% SRP.RR.02 The Long-Term Change Programme Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.02 Risk cause: A MTFS that does not address the projected budget shortfall or contextual factors relating to the Midlothian area. Reduced resources Leadership fit for the future. Lack of clarity or clear compelling vision for the future Delay or shortfall in securing savings Lack of or not securing transformational change in service provision Risk event: Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief 1. Development of Strategic Plan, Transformation Blueprint and MTFS projections which come together to provide a framework to effect change and to move the Council to a position of financial sustainability. 2. Leadership from all Elected Members, Executive Team and Senior Leadership Group. 3. Appropriate governance in place across the BTB Strategic Boards 4. Resilience planning. 5. Capacity to deliver change. 6. High level priority is given to blueprint work. 5 5 Page 108 of 134
Page 109
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Delayed progress in applying various strands of the Change Programme including Delivering Excellence Framework. Slow benefits realisation and budget savings. Cuts in service provision rather than service transformation Risk effect: Objectives of change not actually met or progress too slow. Adverse impact on services Slow or delayed proposals/savings arising from service redesign. Potentially further eroding reserves or requiring short term service reductions which impact on Council's ability to deliver against its priorities. Staff morale negatively affected, Government step-in short term savings instead of transformation Finance Officer; Chief Officer Young People and Partnerships Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.R A.02.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q2 25/26: Refer to SPR.RA-02.03i Chief *Executive; Chief Finance Officer; 30-June-2024 100% SRP.R A.02.04 Transformation Blueprint 2023 to 2028 Q2 25/26: Refer to SRP.RA-02.08 Chief *Executive; Chief Finance Officer; 30-Jun-2028 20% Page 109 of 134
Page 110
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 SRP.RR.03 Legal and Regulatory Compliance Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.03 Risk cause Current or new legislation applying to Midlothian Council. Lack of capacity to resource statutory obligations around GDPR, data protection, records management, information requests and statutory regulatory functions such as fire safety/health & safety and civil contingency/business continuity requirements. Risk event Council and or Services not identifying all applicable legislation impacting Council activities and Service requirements. Risk effect Council failing to meet its statutory obligations resulting in a potential negative impact for service users or employees. Severe financial impacts due to litigation/prosecution. Reputational impact of not meeting statutory obligations. Head of *Adult and Social Care; Legal *and Governance Manager; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. Executive Directors, Chief Officer(s) and Head(s) of Service responsible for identifying applicable legislation and propose Council or Service responses to CMT and Cabinet/Council as required. 2. Annual Assurance Statement. 3. Internal Audit testing of internal controls as part of risk-based audit plan. 4. External Audit. 5. Range of external inspection. 6. BTSG oversight of new legislation 7. Central repository of applicable legislation. 5 5 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.R A.03.02 Rights of the Child Bill Q1 24/25: Bill now adopted. Policy to be presented to Council May/June 2024. Council wide group established and developing a plan that ensures we are all aware and adhering to UNCRC. Executive Director – People 31-Dec-2024 0% SRP.R A.03.05 Review of Standing Orders, Scheme of Administration and Scheme of Delegation Q4 24/25: Standing Orders and Scheme of Administration updated and approved at Feb 2025 Council Legal & Governance Manager; Executive Director *Place; Chief Officer Corporate Solutions; 28 Feb 2027 40% Page 110 of 134
Page 111
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 SRP.R A.03.07 Review of policy and creation of a policy register Q1 25/26: Engagement sessions taking place with each Directorate to review policy register Q4 24/25: Policy list presented to CMT May 2025 for CMT to review and feedback. Chief Officer Corporate Solutions 31-Dec-2025 40% NEW Compliance with statutory duties Q1 25/26: Progress Update Review for Records Management Plan submitted and approved by National Records of Scotland and published online. Compliance Team establishment ongoing. Strategic Information Governance Group established and Action Plan in development. Q4 24/25 : Resourcing proposal for a new Compliance Team being agreed by Corporate Management Team. Funding to be identified through existing Corporate Solutions budgets with implementation on a phased basis. Now proceeding to final stages of Managing Change process. Q1 24/25: Records Management Officer in post and reviewing the Records Management Plan, Corporate Retention Policy and Schedule and supporting the development of retention framework for M365 rollout. Chief Officer Corporate Solutions, Legal and Governance Manager 31-Dec-2025 10% SRP.RR.13 Climate Change Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.13 Risk cause Council Services not adequately engaged, resourced or directed to fulfil the requirements of the Climate Change Act. Risk event Council Services not responding to the Climate Change Act with sufficient pace. Risk effect Council failing to meet its obligation under the Climate Change (Scotland) Act 2009 and incurring the associated reputational damage. Chief *Executive; Executive Directors and Chief Officers.. 1. Statutory requirement to report on compliance with climate change duties. 2. Council Carbon Management Plan 3. Approval of a Corporate Climate Change Strategy and action plan 4. CPP Board for Climate Change to bring strategic focus and oversight of plans and progress. 5. Resilience Seminars 5 5 Page 111 of 134
Page 112
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .13.04 Delivery of the BTB Board Carbon Neutral by 2030 Q1 25/26: Work continues on revised Climate Action Plan/Strategy. Q3 24/25: Council approved realignment of Net Zero target from 2030-2045. Q2 24/25: Member Briefing delivered. Planning, Sustainable Growth and Investment *Manager; Chief Officer *Place; 31-Mar-2030 0% SRP.RA .13.05 Development of the Strategic Plan 2023- 27 Q3 24/25: Council approved realignment of Net Zero target from 2030 to 2045. Climate Action Strategy refresh to follow. Planning, Sustainable Growth and Investment *Manager; Chief Officer *Place; 31-Mar-2025 90% SRP.RR.09 Emergency Planning and Business Continuity Management Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.09 Risk cause The Council not preparing or timeously reviewing Emergency Plans and testing arrangements to respond to Civil Contingencies Incidents. Risk event There are a wide range of potential events the Council may be expected to respond to e.g., Severe weather incident, Pandemic, infectious diseases, utility disruption etc. Risk effect Loss or degradation of service. Loss or damage to buildings. Not adequately able to recover from the losses, (e.g. staff, major facility such as secondary school, main offices or computer systems etc). Not able to respond competently to a major emergency in the community. Head of *Adult and Social Care; Head of *Development; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; David Robertson; Chief Officer Young People and Partnerships 1. Community Risk Register used to highlight key risks. Council’s plans developed and maintained in response to identified risks. 2. Risk and Resilience Group support development, peer review and roll out of plans. 3. Establishment and service based contingency plans in place and maintained. 4. Emergency response plan setting out general approach to respond to a major emergency in-line with key partner organisations. 5. As part of the Council’s Emergency response the importance of recording decisions made and information available at the time is highlighted as this would be scrutinised in the event of an FAI. 6. Care for People Group – support for those affected by emergencies plus various international asylum cohorts. 4 5 Page 112 of 134
Page 113
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Loss of life, livelihoods and property due to inadequacy of response. Reputational consequences and damage. Prosecution through non-compliance with the Civil Contingencies Act. Fatal Accident Inquiries. Costs. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.R A.09.02 Development of Emergency Plans Q2 25/26: As Q1 25/26 for service review. Plans and Procedures updated: Emergency Contacts Directory (reflecting staff changes) Business Continuity (BC) Planning: The draft Corporate BC Plan update reported in Q1 awaiting approval/comments. In collaboration with Digital Services, the information on the previous Emergency Planning and Business Continuity Intranet Portal has been made available via the front page of Mid-Hub. There is a specific area for Business Continuity which will be further developed in the coming months There is regular, scheduled liaison with Cyber Security specialists in Digital Services. CONTEST/Prevent: Support is given to the CONTEST and Prevent SPOC on an ongoing basis, including representation at multi-agency meetings on behalf of the SPOC. Pertinent guidance and information is hosted on the Emergency Planning site on Mid-Hub. Drafted, on behalf of the CONTEST SPOC, the Midlothian Council response to a Scottish Government questionnaire relating to Protect and Prepare. Monitoring of progress with The Terrorism (Protection of Premises) Act, also known as “Martyn’s Law”. National guidance is awaited which will assist organisations in complying with the Act. There will be at least a 24 month implementation period (from April 2025). Ongoing routine representation at/participation in: Internal meetings requiring a Contingency Planning input, including Care for People, Estates Safety and Management Groups Support to services for Business Continuity activities Chief Officer *Place; Senior Manager Protective Services; David Robertson 31 March 2026 25% Page 113 of 134
Page 114
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Torness Emergency Planning Consultative Group meetings and other Torness multi-agency meetings requiring representation from Midlothian Council. Local Authority Resilience Group Scotland (LARGS) - networking meetings of resilience practitioners General resilience support to colleagues as required. Lothian and Borders Local Resilience Partnership meetings. Undertook/facilitated: Ongoing monitoring and circulation of information and liaison with services regarding the Public Switched Telephone Network switch-off (in conjunction with Digital Services). Training and Exercising: Attended information sessions, and provided briefings to senior colleagues, on a national pandemic exercise scheduled for Autumn 2025. The exercise takes place in three phases, the first one was held in Q2, the remaining phases will be in Q3. Drafted the Midlothian Council contribution to the Lothian and Borders Local Resilience Partnership’s response to the Phase 1 scenario. The exercise is ongoing. Nominations have been submitted for a counter-terrorism exercise is being held by the Lothian and Borders Multi-Agency CONTEST Group in November 2025. NOTES: Following attendance at meetings, seminars, presentations, training sessions, a summary of all pertinent information is forwarded to senior manager(s) and other colleagues as appropriate. Invitations are also forwarded where the subject might be of direct interest to other services/partners. Progress with review of emergency plans and business continuity arrangements has been hindered this quarter due to a combination of the reduced resource and annual leave. Q1 25/26: As Q4 24/25. The service review for the Health, Safety and Resilience Team Service, which includes Contingency Planning, requires to progress to implementation stage. SRP.R A.09.03 Business Continuity Software System Q2 25/26: Not renewing Clearview software. Sharepoint to be utilised. Resource requirements identified within service review for business continuity. Chief Officer *Place; Senior Manager Protective Services; David Robertson 31-Dec-2025 25% Page 114 of 134
Page 115
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 SRP.RR.16 Growing Council Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.16 Risk cause Population growth in Midlothian over the next 10 to 15 years will see Midlothian become the fastest growing Council in Scotland. Between 2014 and 2039, ages 0-15yrs, population is projected to increase by 20% and for ages 75+ population projected to increase by 100%. Risk event Failure to resource and plan for these rises will significantly impact the Councils ability to fulfil its statutory obligations in relation to these groups. Risk effect Inadequate capacity within the school estate to cope with the projected increase in pupil numbers. Insufficient provision to support an aging population placing costly inefficiencies on other parts of the care sector. General population increase placing additional demand on infrastructure including GP services. Increased pressure on infrastructure, services e.g., waste collection and growth of road network as new development roads are adopted. Head of *Adult and Social Care; Chief *Executive; Executive Director *Place; Fiona *Robertson; Chief Officer Young People and Partnerships 1. Local development plan and supplementary guidance on developer contributions. 2. Services planning future service provision on the basis of anticipated service demands 3. The change programme 4. Learning Estate Strategy 5. Capital Plan Prioritisation 6. Strategic Housing Investment Strategy 7. Rent Review Strategy 8. Joint needs assessment used to develop - IJB Strategic Plan 9. Capital Plan and Asset Management Board will scrutinise and challenge slippage on capital programmes recognising that slippage can have an adverse impact on financial sustainability and also the delivery on assets required to support capital growth. 10. City Deal provides the opportunity to support inclusive growth. 4 4 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .02.06 Capital Plan prioritisation Q2 25/26: Building Asset Management Plan approved by Council. Fleet Asset Management Plan and Digital Asset Management Plans are under development and are key parts of finalising the Capital Plan Prioritisation exercise. Q1 25/26: Work evaluating information flowing from building condition surveys continues with a view to presenting a draft building Asset Management Plan to Council in October. Head of *Development; Executive Director *Place; Chief Finance Officer; 31-Oct-2024 75% Page 115 of 134
Page 116
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Q4 24/25: Council in February received an update on Capital Plan Prioritisation work and made a decision on an updated Learning Estate Strategy. The extent and affordability of work flowing from building condition surveys is being assessed and will be concluded and reported to Elected Members early in 2025/26. SRP.RR.14.1 Scottish Child Abuse Inquiry Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.14.1 Risk Cause: Midlothian Council and its legacy organisations, predating the creation of Midlothian Council in 1996, have been involved in the provision of care of children going back to living memory. During this time there is the likelihood that the care children received fell below standards of care now in place. There is the further potential that some people in the care of Midlothian Council and its legacy organisations were subject to abuse by those who were employed to care for them. Risk Event: The Scottish Government began an Inquiry into cases of Child Abuse occurring prior to 17 December 2014, the intention of this enquiry is to identify historic case of abuse which have to date gone unreported. The most recent Section 21 notice around the Foster Care Case Study is a significant piece of work. The request for information from 1930 to date is very challenging given the volume of files that require to be read and analysed. Risk Effect: If the inquiry finds historic cases of abuse in Midlothian this could damage the reputation of the Council and could place doubt in the eyes of the public as to the safety of those currently in care. There is significant scope for a substantial financial impact arising from claims of Chief *Executive; Chief *Social Work Officer The Council initially set up an Inquiry Project Team, however this is no longer required as we have an experienced worker overseeing all requests for the Scottish Child Abuse Inquiry Team. Work is ongoing and we have the additional tasks of supporting and responding to enquiries from the redress team. The Inquiry Team have established a Project Plan covering: 1. Residential establishments, List D Schools and Foster Carers: identifying Children’s homes, Foster Carers and any List D Schools in Midlothian over the last 100 years and researching historic records. 2. Record Audit: reviewing the Council’s existing paper and electronic recordkeeping systems to identify relevant records and map them to residential establishments. This also includes, where possible, noting the Council’s historic recordkeeping policies, such as retention schedules. 3. Cataloguing/Indexing: checking and updating existing recordkeeping systems for accuracy and consistency, enabling effective information retrieval when requested by the Inquiry. The Project Team have established a Project Plan covering: 4. Ascertaining the succession and insurance position in relation to potential historic child abuse claims. 5. Ascertaining and agreeing Midlothian Council’s legal position/ approach in dealing with the potential historic child abuse claims. 6. Identifying the need for guidance, protocol, templates etc. should/if any claims be made against the council. 7. Project team is in place with project plan with a range of identified actions which are being progressed. Monthly meetings to progress project plan. 8. The SCAI Social Worker is very competent and experienced in this area of work and provides quarterly updates on their findings from the file read. This is a real strength within this area of work. The CSWO and 4 4 Page 116 of 134
Page 117
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 historic abuse. Some existing employees may be affected by the inquiry and subsequent claims of abuse. To date there has been no evidence from the extensive file read to suggest there has been systemic abuse within our foster care system. Principal Solicitor meet regularly with the social worker to discuss findings from the file read. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.R A.14.03 Foster Care and Residential Care File Review Q3 24/25: Phase 10 is now in progress with investigation of residential care homes run by local authorities. We will comply with all s21 requests. Childrens Services Management Team; Chief *Social Work Officer; Chief Officer Young People and Partnerships 31-Mar-2024 100% SRP.RR.19 Health & Safety/Fire Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.19 Risk cause Failing to identify and rectify non- compliance with Health and Safety regulations. Risk event Reactive rather than pro-active organisational health and safety culture. Employees/Managers not adequately trained. Employees required to undertake tasks in which they are not trained or competent. Statutorily driven health and safety protective arrangements for service users and employees not implemented sufficiently or correctly. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; David Robertson; 1. Health Safety and Wellbeing Strategy & Service Plan. 2. Suite of Health and Safety Management Arrangements developed setting out council response to statutory obligations. 3. Use of Health & Safety Management Information System (SPHERA) to enhance information transfer and organisational efficiency. 4. Training programme in place to support those with responsibility for managing health and safety. 5. Programme of fire risk assessments. 6. Estate Safety & Maintenance Groups for prioritising any matters requiring escalation. 4 4 Page 117 of 134
Page 118
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Non-compliance with policy and procedure. Serious fire leading to loss of life and property. Health and Safety team inadequately resourced to promote or implement pro- active measures or train managers/staff. Audits and inspections not being undertaken to confirm adherence to policy and legislative requirements. Loss of highly experienced staff due to partial or full retirement. Risk effect Death, serious injury or ill health impact on employees and/or service users. Loss or damage of Council property. Negative impact on outcomes for customers and service users. Severe impacts on delivery of services due to staff absences. Service users and employees exposed to hazards where statutory requirements exist. Statutory health and safety duty of care to services users and employees not met. Statutory notices and/or prosecution by HSE or SFRS resulting in significant fines. Criminal prosecution of the Corporate body and or individuals through Corporate Homicide (Corporate Manslaughter). Reputational damage. Significant costs incurred to Council due to insurance claims, loss of services, plant or buildings. Chief Officer Young People and Partnerships Related Action Code Related Action Related action latest note Managed By Due Date Status NEW Health, Safety & Resilience Service Review Q2 25/26: As Q4 24/25. Q1 25/26: As Q4 24/25. Q4 24/25: The service review for the Health, Safety and Resilience Team Service needs to progress to implementation stage. Chief Officer *Place; Senior Manager Protective Services; David Robertson 31/10/2025 0% Page 118 of 134
Page 119
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 SRP.R A.19.01 Delivery of Health, Safety and Wellbeing Service Plan Q2 25/26: Service Plan to follow service review. Chief Officer *Place; Senior Manager Protective Services; David Robertson 31-Mar-2025 0% SRP.R A.19.07 H&S fire safety audit across all Council estate Q2 25/26: Progress with fire risk assessments on a priority basis. Q1 25/26: Fire Risk Assessment work plan started – priorities being premises with sleeping risks, schools, depots, main offices, leisure centres and libraries. Chief Officer *Place; Senior Manager Protective Services; David Robertson 31-Mar-2026 20% SRP.RR.21 Cyber Security Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.21 Risk Cause Malicious attempts to damage, disrupt or gain unauthorised access to Council computer systems, networks or devices. Risk Event The cyber threat is severe and advancing quickly. The Council is at significant risk of cyber-attack from Ransomware Phishing Emails, Advanced Persistent Threats (APT) and Distributed Denial of Service Attacks (DDOS) attacks. Hacking and Social Engineering. Risk Effect Access to Council systems by cyber criminals and foreign intelligence agencies for financial, commercial or information gathering reasons. This could lead to significant financial losses, data compromise and subsequent regulatory sanction if our technical and organisational measures are deemed Head of *Adult and Social Care; Cyber Security Information Governance and *Compliance Manager; Head of *Development; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; David Robertson; Chief Officer Young People and Partnerships 1. Implementation of and compliance with the Scottish Government Cyber Resiliency Public Sector Action Plan 2. Cyber Essentials Plus Certification 3. Public Sector Network Certification 4. Regular Audits and Inspections 5. Appropriate technical and organisational measures deployed to reduce the likelihood and impact of an attack 6. Having adequate skills and knowledge in the organisation 7. Implementing Scottish Government Cyber Security Action Plan 8. Adoption of the NCSC (National Cyber Security Centre) Active Cyber Defence programme 9. Technology upgrades 10. Incident Response plans and exercises 4 5 Page 119 of 134
Page 120
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 insufficient. Severe business disruption including the almost total loss of critical IT systems and networks leading to significant service delivery challenges. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.21.1 Appropriate Technical and Organisational Measures Q2 25/26 Work continues this quarter to maintain and strengthen our cyber security. Key successes this quarter include: • Digital Services completed a detailed DWP security audit. • A penetration test of the schools network was conducted • Successfully defended the organisation against multiple cyber attacks. • Security oversight was provided for the onboarding of several new applications and technical services • A SOC (security operations centre) and CIR Cyber Incident Response tender) was prepared and issued Q1 25/26 Work continues this quarter to maintain and strengthen our cyber security. Key successes this quarter include: 1. Cyber Essentials Plus Certification and PSN Certification were successfully achieved, demonstrating compliance with national standards. 2. Successfully defended the organisation against multiple cyber attacks. 3. A confidential Cyber Defence Briefing Note was submitted to CMT following high-profile UK cyberattacks, including one targeting West Lothian’s education network. 4. Security oversight was provided for the onboarding of new applications and technical service Cyber Security Information Governance and *Compliance Manager 31-Mar-2027 75% Page 120 of 134
Page 121
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 SRP.RR.08 Asset Management – Buildings, Vehicles, Roads and Digital Assets/Networks Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.08 Risk cause Many of the assets the Council own by their nature are in a position of ongoing deterioration through their normal use, e.g., roads - normal wear and tear, streetlights and vehicles & buildings used to deliver services. Risk event Many assets will deteriorate under normal conditions although buildings, roads and streetlights as an example can be damaged during more extreme weather events or as a result of a lack of maintenance. Risk effect In the case of Roads Services there is a real risk of increased potholes and insurance claims, reduced skid resistance leading to higher accident potential and building up of higher costs in the future. In respect of vehicles, increased breakdowns, service failures, greater maintenance inevitable, higher short-term hire costs. In terms of property, health and safety issues arise, failure to meet current standards and higher running costs. There is also the risk of two-tier accommodation, some high quality, some low. Head of *Adult and Social Care; Head of *Development; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. There is provision in place within the capital plan for investment in the asset base. 2. Asset register 3. Condition Survey 4. Understanding of future asset needs 5. Asset Strategy: . Roads . Land . Fleet . Digital Service Network . Digital Service hardware 6. Capital programme - investment in estate. 7. Ongoing monitoring of properties by: Maintenance Surveyors, Facilities Management and Property Users. 8. Established Capital Plan and Asset Management Board and dedicated Asset Management Board 9. Establishment of 7 thematic Estate Safety and Management Groups chaired by Chief Officer Place 10. Building Accessibility Strategy 11. Completion and approval of Asset Management Plans 3 5 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.R A.08.02 Plan for appropriate investment in capital works and remedial maintenance over the lifespan of each property asset. Q2 25/26: Q2 25/26: Building Asset Management Plan approved by Council. Fleet Asset Management Plan and Digital Asset Management Plans are under development and are key parts of finalising the Capital Plan Prioritisation exercise. Chief Officer *Place; 30-Apr-2025 33% Page 121 of 134
Page 122
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Q1 25/26: Asset management plan for Property & Estate drafted. Due to be finalised and issued to Council in Q2. Updated governance for asset management included. Asset management plans for Fleet also approved at Council. Q3 24/25: Condition Surveys of Learning Estate (excl PPP) has concluded. Q4 presentation to Elected Members. Backlog repairs continue. Q1 24/25: Condition Surveys continue, with Learning Estate (excl PPP) expected to be concluded by end December 2024 to inform capital investment proposal. SRP.R A.08.05 Learning Estate Strategy Q1 25/26 Learning Estate Strategy Is currently being implemented with the focus on the delivery of the LEIP funded projects of Mayfield, Beeslack and Penicuik. Shawfair Campus project has been approved and design being developed. Learning Estate Programme Manager 30-March 2026 50% SRP.R A.08.06 Asset Management systems Q225/26: Q2 25/26: Building Asset Management Plan approved by Council. Fleet Asset Management Plan and Digital Asset Management Plans are under development and are key parts of finalising the Capital Plan Prioritisation exercise. Q1 25/26: Asset management plan for Property & Estate drafted. Due to be finalised and issued to Council in Q2. Updated governance for asset management included. Fleet Replacement Programme approved. Head of *Development; 31-Mar-2025 50% SRP.RR.22 Cost of Living Crisis Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.22 Risk cause The UK is currently facing an unprecedented storm of increasing prices, bills and tax. A 40-year high inflation rate of 9% is the main driver of the cost-of- living crisis which has outstripped wage and benefit increases. Chief *Executive; Director *Health and Social Care; Executive Director *Place 1. Council Cost of Living Task Force to oversee the Council’s response to the crisis 2. Allocation of LACER funding to support those most affected 3. Strategic Evaluation Partner appointed to create poverty profile 4. Community Planning Partnership has established a Midlothian Strategic Poverty Prevention Group co-chaired by Council Leader and Director of Public Health 5. New Child Poverty chair and lead appointed (Executive Director Children, Young People and Partnerships) 6. Child Poverty self-evaluation underway with Improvement Service 3 5 Page 122 of 134
Page 123
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Risk event Rapid ongoing rise of energy prices as well as food and drink prices. Risk effect The impact on households is already being noted with 87% of adults in the UK reporting an increase in their cost of living in April 2022 (Office for National Statistics; Francis-Devine et al, 2022). The price rises will impact low-income households the hardest as a larger proportion of their bills are on energy and food. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.R A.22.1 Cost of Living Task Force Q1 23/24: Meetings continuing. Chief *Executive; 31-Mar-2024 100% SRP.RR.23 Counter Terrorism – Compliance with Legislation Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.2 3 Risk cause Current or new legislation applying to Midlothian Council. Lack of capacity to resource the statutory obligations. Risk event Council and/or Services not identifying all applicable actions. The CONTEST and Prevent action plans fall short of what is required Risk effect Council failing to meet its statutory duties, potentially resulting in a negative impact on the safety of employees, service users and visitors to Council facilities. Reputational impact of not meeting statutory duties. Chief Officer Children’s Services, Partnerships and Communities 1. There is a CONTEST Lead and Depute (Single Point of Contact (SPOC)) in place. These individuals are also the nominated Prevent SPOC and Depute SPOC. 2. There are designated, trained officers available to Chair Prevent related case conferences (Prevent Multi-Agency Panel). 3. There is a Midlothian CONTEST Group chaired by the Chief Officer Children’s Services, Partnerships and Communities. Membership includes representatives from services in both Council Directorates and the Midlothian Health and Social Care Partnership plus key external partners. Terms of Reference are in place. 4. Executive Directors, Chief Officers and Heads of Service are responsible for ensuring that their services comply with allocated actions and identifying any concerns and additional actins required. 5. An annual report on CONTEST activities is submitted to the Corporate Management Team. 6. Prevent assurance Statements are required by the Home Office and Scottish Government every two years. 3 4 Page 123 of 134
Page 124
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 7. Scottish Government may also require additional CT reports at various times. 8. Relevant information and updates received from external partners and organisations are disseminated to CONTEST Group members and others as appropriate. 9. E-learning CONTEST related modules, including Prevent products are Mandatory. In-person and written briefings are available to other staff groups who do not have access to e- learning or for whom the full briefing is not appropriate. Risk Code Related Action Related action latest note Managed By Due Date Status SRP.RA.23. 01 Review and implement the recommendations from the Prevent Assurance 2025 process. Q2 25/26 Feedback with recommendations have been received from Home Office. Q4 24/25. The Home Office is due to provide feedback on the Midlothian Council Prevent Assurance 2025 submission. Communication during the process indicated that guidance would be given in respect of at least one of the assessment areas. Chief Officer Children’s Services, Partnerships and Communities June 2026 0% SRP.RA.23. 02 Terrorism (Protection of Premises) Act 2025: Implement the requirements of the Act as they become clear through Government guidance. Q4 24/25. New legislation. The Terrorism (Protection of Premises) Act 2025 (also known as Martyn’s law) received Royal Assent on Thursday 3 April. The Government intends for there to be an implementation period of at least 24 months before the Act comes into force. This period will enable those responsible for premises and events to have sufficient time to understand their new obligations, and to plan and prepare accordingly. Whilst those that fall within scope of the Act may wish to consider the requirements, there is no requirement to comply with them until the legislation comes into force. The Home Office will publish statutory guidance during the 24-month implementation period. Chief Officer Children’s Services, Partnerships and Communities 2027 0% SRP.RR.04 Employee performance Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.04 Risk cause Employees not suitably trained/developed for the roles required of them. Limited availability of qualified practitioners in certain sectors. Change program not informed by all key stakeholders. Ageing work force. Employees unclear on expected behaviours. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Over-riding risk control measure = Focus on having the right people, here, healthy, performing, behaving and well led via effective utilisation of the workforce strategy and accompanying action plan. Approval of the Council’s Workforce Strategy 2024-2034 which focuses on the thematic areas below: Attendance / Wellbeing 1. Continuing implementation of the Wellness@Midlothian agenda. 2. Creation of an Employee Health and Wellbeing Strategy and supporting policy. 3 4 Page 124 of 134
Page 125
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Employees constrained to innovate as a result of management practice. Employee productivity rate below the required level because of ineffective use of the People Policies particularly Maximising Attendance. Salaries in some functional areas lower compared to other LA’s resulting in recruitment issues particularly with trying to recruit experienced staff. Risk event Employees not engaged/consulted as part of organisational transformation. Experienced employees leaving the organisation. Inability to recruit suitably qualified / trained staff to fill vacancies negatively impacting on remaining workforce. Unacceptable behaviours demonstrated by employees. Stated organisational culture not consistently reinforced by managers. Poor employee performance will stifle transformational change. Risk effect Difficulties recruiting the right staff. Challenges retaining quality staff. Low skill levels. Low morale, especially during change. High absence rates, loss of experience in service areas. ‘A Great Place to Grow’ our values including respect, collaboration, pride and ownership not realised, potentially resulting in missing the opportunity to capitalise on the abilities, experience and ideas of team members. Poor employee performance will Exacerbate the financial challenge. Chief Officer Corporate Solutions; Chief Finance Officer; HR Strategic Lead; Chief Officer Young People and Partnerships 3. Maintaining the Healthy Working Lives Gold Award. 4. Proactive use of Occupational Health, Midlothian Physiotherapy, Employee Assistance Programme and the Workplace Chaplaincy Service. 5. Change of EAP supplier to ensure provision of best possible service. 6. Development of progressive People Policies. 7. Roll-out of mental health training for staff and managers. Performance 1. Service-level workforce plans. 2. Structured, robust, well established ‘Making Performance Matter’ Framework where expected standards of behaviour and Council values are re-enforced. 3. Continued re-enforcement of all People Policies involving various communication methods. 4. Development of a suite of management information to ensure Service Managers are informed e.g., turnover, absence levels/reasons etc. Organisational Change 1. Policy for Organisational Change includes strong emphasis on early engagement of employees. 2. Redeployment Procedure to ensure maximum chance of successful redeployment. Conduct 1. Resolution Policy encourages early intervention of workplace issues. 2. Professional standards and values build into the induction process and management development programme. Communication 1. A range of initiatives to keep staff informed of change (Chief Executive’s weekly email, Connect, All staff emails, tailored team briefings etc. Page 125 of 134
Page 126
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .02.04 Development and Delivery of the Council’s Workforce Strategy 2024-34 including analysis of future workforce requirements, gap analysis and gap closing strategies, and performance measures and target setting. Q2 25/26: Q1 25/26: Workforce Planning workshops completed with HR/OD team. Next session with CMT scheduled in September then onwards to Council Senior and Service Managers for full rollout. Q4 24/25: Council approved the Workforce Strategy 2024-2034 in December 2024. Work progressing on the delivery of the first three years through an agreed action plan. Acting HR Strategic Lead appointed. Two interim posts from BTB funding are being progressed for Talent and Reward. Q1 24/25: Workforce Strategy in development and expected to be presented to December Council with Action Plan for approval. Audit Scotland external audit on workforce and digital to be presented to Audit Committee September 2024. Chief Officer Corporate Solutions 31 Dec 2027 25% NEW Recruitment challenges in Procurement Service leading to contract management pressures and backlog in procurement exercises Q1 25/26: Procurement Manager in place. Additional Procurement Assistant resource (fixed term) onboarded August 2025. Category management realignment agreed and handover in progress. Business partnering model to commence in September 2025. Contract management framework drafted and in review. Contract register updated quarterly and published online. Pipeline in development for each category. Q4 24/25: Procurement Manager appointed to start on 1 June 2025. Chief Officer Corporate Solutions to implement an improvement plan and revised work plan for the service and develop business case for appropriate resourcing. Chief Officer Corporate Solutions 31 Dec 2025 10% SRP.RR.07 Care at Home Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.07 Risk cause Internal and External providers of Care at Home services unable to meet service and quality requirements as a result of a lack of capacity. Risk event Capacity of Community Support outstripped by demand. Head of *Adult and Social Care; Director *Health and Social Care 1. Care at Home winter assurance plan and business continuity plan complete 2. Development of Care at Home Service Improvement action plan 3. External commissioning complete and ongoing contract monitoring in place 4. External provider audits complete 5. Re-established Multi-Agency Quality in Care at Home quarterly review meetings jointly with East Lothian 6. Weekly provider meetings in place 3 4 Page 126 of 134
Page 127
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Risk effect There is a risk that patients will have their discharge delayed because there is insufficient community supports to enable timely discharge leading to deterioration in their health, beds being blocked and elective operations being cancelled. 7. Additional locum team members and contracts with agency staff in place 8. Daily discharge meeting with Multidisciplinary and Multi-agency team planning to plan and coordinate discharge to ensure care at hone support in place Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.R A.07.01 Independent review of adult and social care Q3 24/25: Scottish Government announced in January 2025 that they will not be proceeding with the National Care Service. Q2 24/25: The Scottish Government has initiated a pause on the development of the NCS. Head of *Adult and Social Care; Chief *Executive; 31-Jan-2024 100% SRP.RR.10 Governance and Standards in Public Life Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.10 Risk cause Code of conduct for Members and employees’ actions falling short of International Standards. Risk event Failure in openness, accountability, clarity. Risk effect Service, partnerships and project outcomes not achieved. Non- compliance with conduct standards and reduction in standards in public life. Legal *and Governance Manager; Chief *Executive; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions 01 Annual Assurance Statement. 02 Standing Orders 03 Scheme of Administration 04 Scheme of Delegation 05 Elected Member Code of Conduct 06 Induction programme for new members and ongoing learning and development programme 07 Employee Code of Conduct 2 4 Page 127 of 134
Page 128
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .03.05 Review of Standing Orders, Scheme of Administration and Scheme of Delegation Q4 24/25: Standing Orders and Scheme of Administration updated and approved at Feb 2025 Council. Q1 24/25: Workplan presented and agreed by SOWG in April 2024. Some changes to SOs and Scheme of Administration presented and approved by Council in May 2024. Legal *and Governance Manager; Chief Officer Corporate Solutions; 28 Feb 2027 20% SRP.RA .10.03 Review of the employee onboarding and induction programme Q1 25/26: Content for online induction now finalised – in design phase prior to launch in Autumn. Next step is face to face induction programme. Q4 24/25: Work ongoing to finalise the refreshed induction programme and onboarding process Chief Officer Corporate Solutions 31-Dec-2025 5% SRP.RR.12 Internal Control Environment Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.12 Risk cause Work procedures/process inadvertently create the capacity for fraud and waste to occur. Internal Controls requiring more time, effort or cost than the risk being managed. Mangers failing to follow procedures and keep systems updated with accurate information. Risk event Persons exploiting opportunities to commit fraud. Waste and errors Changing risk landscape associated with remote working solutions. Risk effect Waste and loss Risks over managed with risk controls costing more than the potential loss being managed. Increased opportunity for fraud Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer Young People and Partnerships 1. Services have been prompted to consider fraud and waste within Service Risk Registers. 2. Risk Management Guide provides direction on the need to balance time, effort and cost against benefit of risk controls. 3. Internal Audit examine internal control arrangements based largely on the risk registers. 4. Corporate Fraud team in place who assist managers to undertake fraud risk assessments in their areas (focused on priority areas) and provide advice and guidance on fraud related matters. Active participation in the National Fraud Initiative to investigate matches. 5. Whistleblowing Policy and Counter Fraud Policy in place (subject to review) with whistleblowing channels available to report concerns (anonymously if required). 6. Internal and external assurance. Annual Governance Statement which involves obtaining assurance from Management over controls in their Service. 7. E-learning for staff to complete mandatory training for fraud awareness. 8. Regular updates to Audit committee on progress with recommendations made by Internal Audit. 9. Remind staff to declare secondary employment/outside interests and gifts & hospitality 2 3 Page 128 of 134
Page 129
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 or financial loss has direct impact on management information. Has adverse effect on service performance. 10. Induction for all new employees (with service exceptions), including legal, HR, procurement, health and safety. Control at entry to organisation. 11. The Integrity Group continues to meet to improve the Council’s resilience to fraud, corruption, theft and crime (including cybercrime), maintaining proper risk management, governance and internal control processes and systems to ensure probity in systems and operations, and mitigation of risks, including the prevention, detection and resolution of fraud and irregularities. Management is also responsible for checking that the arrangements and controls are operating effectively and obtaining assurances from internal compliance, risk, inspection, quality, and control functions. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.R A.12.04 Review of Serious Organised Crime (SOC) group Q2 25/26: A recent change in Police management covering this area has meant that progress has been delayed. Anticipating re-engagement in Q3. Q3 24/25: Draft Strategy devised. Regulatory safeguards/actions progressing through Licensing. Q1 24/25: Initial meeting with Police is planned to discuss strategy. Chief Officer *Place; Health, Safety & Resilience Manager 31-Mar-2025 50% SRP.RR.11 Corporate Policies and Strategies Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.R R.11 Risk cause Policies may not match the aspirations of the Council's Strategic priorities or cultural perspective. Risk event Policies not monitored may become out of date. Policies not reviewed to ensure alignment with strategic priorities. Risk effect Policies not monitored could result in non-compliance with legislation Policies not aligned to strategic priorities Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief 1. Single Midlothian Plan providing overarching direction 2. Service plans aligned to Single Midlothian Plan. 3. Leadership team to ensure correct approaches are adopted to get the right results. 4. Strategic housing investment plan, submitted to Scottish Government. 5. Capital Strategy 6. Integrated Joint Board (IJB) Plan 7. IJB Strategic needs assessment 8. Midlothian Local Development Plan 2017 – the Council’s corporate spatial strategy. 2 3 Page 129 of 134
Page 130
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 will inhibit rather than support implementation of strategic priorities. Finance Officer; Chief Officer Young People and Partnerships Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA .02.04 Transformation Blueprint 2023 to 2028 Q2 25/26: Refer to SRP.RA-02.08 Chief *Executive; Chief Finance Officer; 30-Jun-2028 20% SRP.RA .03.07 Review of policy and creation of a policy register Q1 25/26: See comments earlier in SRP. Q4 24/25: Policy list presented to CMT May 2025 for CMT to review and feedback Chief Officer Corporate Solutions 31-Dec-2025 10% SRP.RA .11.05 Antisocial Behaviour Policy Q1 24/25: Member Briefing on Housing and Antisocial Behaviour to be prepared and presented during Q2, with report to Council to follow. Chief Officer *Place; 31-Dec-2024 0% Page 130 of 134
Page 131
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Strategic Opportunities SRP.OP.08 Capital Projects - Housing Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.08 Cost of delivering Affordable Housing Supply Programme has risen at faster rate than available grant to Midlothian and continued high build costs will affect ability to deliver housing programme. Policy requirement to deliver 25% affordable on new housing sites under significant pressure due to grant level not growing with housebuilding rate. More sites will be unable to delivery subsidised homes for rent due to shortfall in grant. Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Head of Development 1. Edmonstone Road, Shawfair – Timeline, Budget and Risk impacted with Stewart Milne entering administration. However, site now amber due to appointment of Dundas Building to finish site. Now on site. 2. Newtongrange Former Pool & Church Hall sites. Requirement to deliver 3D modular units on site. V limited Scottish suppliers for 3D due to Connect going into administration. VfM to be examined in tender report in Q2. Phase 5 housing programme has been reviewed to ensure affordability within the Housing Revenue Account. Grant level now restored which is to be used for acquisitions to address temporary accommodation pressures. However, high level of housing delivery and restored grant insufficient to support all housing sites to deliver subsidised 25% affordable homes. Timeline Budget Risk Resource A A A G A A A G SRP.OP.09 Capital Projects – Transport, Net Zero & Infrastructure Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.09 Cost of delivering enabling infrastructure projects has risen, resulting in significant funding gap emerging. Expansion of scope by Transport Scotland and restrictions on timing of ecology surveys driving further cost and timing risks. Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Head of Development 1. A701 Relief Road 2. A701 Sustainable Trasport Corridor 3. A701 Straiton Junction Improvements For all highlighted projects, estimated cost significantly exceeds budget available to deliver project. For all highlighted projects, addressing requirement for investment in A701 corridor in phases with prioritisation applied. Bush Loan Junction progressing ahead of remaining programme fully funded by Edinburgh and South East Scotland City Regional Deal (ESESCRD) funding. Timeline Budget Risk Resource R R R G R R R G R R R G Page 131 of 134
Page 132
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 SRP.OP.10 Capital Projects – Children, Young People & Partnerships Estates Programme: Primary Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.10 Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Executive Director CYPP; Head of Development 1. Mayfield/St Lukes PS New Build: Cost reduction exercise complete, Contract signed, Site start on 30th June 2025, with school expected to open February 2027. 2. Mauricewood PS Extension & Refurbishment: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Funding insufficient as some contributions were withdrawn for pay for costs of previous extension. Paper to CPAMB to seek approval to provide 6 classrooms and a gym hall, developer contribution funded. 3. Bilston PS Extension: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Design team appointed to develop investment in school that aligns with budget available from Developer Contributions. Design is currently being market tested to ensure project stays within the budget envelope, developer contribution funded, Construction anticipated to start Jan 2026 4. Relocation of Mount Esk Nursery / Hawthornean Extension: Rising roll and catchment review requires investment in school to address capacity and suitability. Limited budget available. Design team appointed to develop investment in school that aligns with budget available from Developer Contributions. Stage 2 design and costs complete. Work ongoing Budget Risk Resource A A A A A R R A A A A A R R A A SRP.OP.09 Capital Projects – Children, Young People & Partnerships Estates Programme: Secondary Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.09 Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Executive Director CYPP; Head of Development 1. Beeslack HS Replacement: Site acquisition being progressed. Planning consent now in place. Preferred contractor appointed under two stage process. Cost reduction work due to start next 2. Shawfair All Through: Site acquisition complete. School location fixed with design team. Remediation programme underway by Shawfair LLP. Shawfair All Through Campus budget approved at Council. Project team appointments to forthcoming project board 3. Penicuik HS New Build: LEIP target for delivery is Dec 2026, however programme for occupation is July 2027. Cost reports tracking higher and risks identified in refurbishment works. SFT Timeline Budget Risk Resource R A A G R A A A A A A G Page 132 of 134
Page 133
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 advising if additional LEIP funding available to address abnormal costs. Contractor, Morrison Construction appointed Jan’25. Decant works complete, advance works being planned SRP.OP.09 Capital Projects – Regeneration Risk Code Risk Identification Managed by Risk Commentary Risk Evaluation SRP.O P.10 Projects progressing, with Timeline, Budget, Risk and Resource categorised as parameters on a RAG status, with any Red classifications identified and reported. Executive Director *Place; Head of Development 1. Vogrie Changing Places: Warrant submission now complete and awaiting determination before install can go ahead. Part of wider Vogrie Renewal Strategy. 2. Destination Hillend: Alpine Coaster delivered with access and parking infrastructure and Coaster now open. Project absorbed risk and contingency. Updated brief issued to SSM for high level site planning and to brief Members in Q2. 3. Hopefield Industrial Estate: Updated financial model required. Cost plan for upgrade to infrastructure being developed 4. Dalkeith Asset Rationalisation Programme: Decant of staff to Fairfield House complete. Contractor appointed however project now overbudget and being rescoped. Timeline Budget Risk Resource R A R A R R R A R A A G A R A G SRP.OP.04 City Deal Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.O P.04 South East Scotland Region City Deal - a bid for funding to Scottish and UK Governments to accelerate economic growth through investment in infrastructure/ housing/ skills and innovation. 200 Council Houses linked to the City Deal. Head of *Adult and Social Care; Chief Operating Officer *Education; Chief *Executive; Director *Health and Social Care; Chief Officer *Place; Executive Director *Place; Chief Officer Corporate Solutions; Chief Finance Officer; Chief Officer 1. Maintain strong Midlothian involvement through the City Deal governance structure. 2. Midlothian City Deal Key Officer (Internal) Group. 3. Securing best arrangements for Midlothian through close liaison with partners and conclusion of business cases. 4 5 Page 133 of 134
Page 134
STRATEGIC RISK PROFILE, Q2 Jul-Sept 2025 Young People and Partnerships Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.O P.04.02 Realisation of outcomes of respective workstreams Q2 25/26: Work continues on the relevant programmes. Executive Director *Place 31-Mar-2026 10% Page 134 of 134