Agenda Document Pack - Audit Committee - 07/03/2023
Midlothian Council · 7 March 2023
Back to Audit Committee — 7 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Notice of Meeting and Agenda Audit Committee Venue: Council Chambers, Midlothian House, Dalkeith, EH22 1DN Date: Tuesday, 07 March 2023 Time: 11:00 Executive Director : Place Contact: Clerk Name: Democratic Services Clerk Telephone: Clerk Email: democratic.services@midlothian.gov.uk Further Information: This is a meeting which is open to members of the public. Privacy notice: Please note that this meeting may be recorded. The recording may be publicly available following the meeting. If you would like to know how Midlothian Council collects, uses and shares your personal information, please visit our website: www.midlothian.gov.uk Page 1 of 54
Page 2
1 Welcome, Introductions and Apologies 2 Order of Business Including notice of new business submitted as urgent for consideration at the end of the meeting. 3 Declaration of Interest Members should declare any financial and non-financial interests they have in the items of business for consideration, identifying the relevant agenda item and the nature of their interest. 4 Minute of Previous Meeting 4.1 Minute of Audit Committee 07 February 2023 Submitted for approval 3 - 8 4.2 Action log 9 - 10 5 Public Reports 5.1 Internal Audit Work to February 2023 Report by Chief Internal Auditor 11 - 20 5.2 Counter Fraud Annual Plan 2023/24 Report by Chief Internal Auditor 21 - 26 5.3 Internal Audit Charter Report by Chief Internal Auditor 27 - 36 5.4 Internal Audit Strategy and Annual Plan 2022/23 Report by Chief Internal Auditor 37 - 54 6 Private Reports No items for discussion 7 Date of Next Meeting The next meeting will be held on the Tuesday 25 April 2023 at 11am. Page 2 of 54
Page 3
Minute of Meeting Audit Committee Date Time Venue Tuesday 7 February 2023 1.00pm Council Chamber Present: Councillor Smaill (Chair) Councillor McEwan Councillor McKenzie Councillor Milligan Councillor Scott In Attendance: Grace Vickers Chief Executive Kevin Anderson Executive Director Place Morag Barrow Director Health and Social Care Derek Oliver Chief Officer Place David Gladwin Acting Chief Financial Officer Duncan Stainbank Chief Internal Auditor Sinead Urquhart Executive Business Manager Elaine Greaves Principal Internal Auditor Gary Thomson Senior Finance Business Partner Alan Turpie Legal and Governance Manager / Monitoring Officer Robert Dick Audit Scotland Patricia Fraser Audit Scotland Andrew Henderson Democratic Services Officer Audit Committee Tuesday 07 March 2023 Item 4.1 Page 3 of 54
Page 4
1. Welcome and Apologies for Absence Apologies were submitted on behalf of Fiona Robertson and Gillian Woolman (Audit Scotland). 2. Order of Business The Chair outlined that item 5.6 would be taken in advance of item 5.1 with the remaining items being heard in the order as outlined in the agenda. 3. Declarations of interest No declarations of interest were intimated at this stage of the proceedings. 4. Minutes of Previous Meetings 4.1 The minute of the meeting of 06 December 2022 was submitted and approved as correct record, moved by Councillor McKenzie and seconded by Councillor McEwan. 4.2 The Action log was submitted and noted. With regard to action point 1, the chair acknowledged that this would be an ongoing action along with a future paper being submitted on CSG and ethical depositing coming later in the year. 5. Public Reports Report No. Report Title Submitted by: 5.6 Internal Audit Service – Update on Shared Internal Audit Service between Midlothian and East Lothian Councils Executive Director Place Outline of report and summary of discussion Kevin Anderson provided a brief overview of the report making reference to the new Internal Audit arrangements with East Lothian Council which are now in place. The Chair took the opportunity to welcome the Chief Internal Auditor to Midlothian Council’s Audit Committee. Decision Audit Committee noted that the Shared Internal Audit Service between Midlothian and East Lothian Councils is now formally agreed and has commenced. Page 4 of 54
Page 5
Report No. Report Title Submitted by: 5.1 Treasury Management and Investment Strategy 2023/24 & Prudential Indicators, Acting Chief Financial Officer Outline of report and summary of discussion David Gladwin provided a brief overview of the report and appendices making reference to the Treasury Management Code of Practice, which outlines that the annual Treasury Management & Investment Strategy (TMIS) & Prudential Indicators report which is required to be scrutinised before being recommended to the Council. David Gladwin outlined that the Midlothian Council’s Treasury Management and Investment Strategy was in line with those of other local authorities and took the opportunity to confirm the exclusion of Qatar from preferred partners. A brief discussion ensued in relation to ethical treasury management and the capability for Council to react quickly on occasions where members saw a potential issue. David Gladwin confirmed that member’s views were taken into account when formulating the strategy and that members could flag potential issues for discussion at any time. In response to comments regarding existing counter parties, Gary Thomson confirmed that Midlothian Council’s deposit with Lloyds Bank Corporate Partners was non-ring fenced and designed for corporate clients and medium sized enterprises such as local authorities. A further discussion ensued in relation to a Midlothian Energy Ltd shareholder injection for 24/25, The Acting Chief Financial Officer confirmed that as this would feed through as capital expenditure it would sit within the Treasury Management and Investment Strategy and agreed to reflect this going forward. Decision a) Audit Committee approved the restriction of the Authorised Limit to the value of the Capital Financing Requirement at 31 March 2024 (£472.662 million), pending finalisation of the General Services Capital Plan Prioritisation; and b) Noted the ongoing review in respect of incorporating ESG criteria into the decision making process for making deposits, and that officers will continue to monitor and evaluate emerging approaches as the marketplace develops; and c) Noted that there are no other material changes proposed to the Treasury Management and Investment Strategy (TMIS) for 2023/24 from the strategy currently in place, other than to update the Prudential Indicators (Section 5 and Appendix 2), to reflect the revised capital plans; and d) Noted the retention of the current approach for the repayment of loans fund advances as outlined in Section 7; and e) Approved the Treasury Management and Investment Strategy for 2023/24. Page 5 of 54
Page 6
Report No. Report Title Submitted by: 5.2 Internal Audit Work to December 2022 Chief Internal Auditor Outline of report and summary of discussion Duncan Stainbank provided a brief overview of the report making reference to the Internal Audit Annual Plan 2022/23, the final internal audit annual assurance reports as attached to the report and acknowledged that all recommendations had been acknowledged by management. Duncan Stainbank then took the opportunity to respond to points of clarity. In response to comments regarding future utility prices, David Gladwin confirmed that the decision had been taken to provide supplementary budget on 2022/23 to meet higher than expected energy costs and that inflation projections for this sector were included in Medium Term Financial Strategy projections. With regard to the impact of inflation David Gladwin confirmed that procurement bodies are undertaking forward purchasing. Derek Oliver also took the opportunity to highlight that energy consumption is monitored across assets and that inflation was added to create a forecast of future expenditure. Decision a) Audit Committee noted the Executive Summaries of the final Internal Audit assurance reports issued; and b) Noted the Internal Audit Assurance Work in Progress and Internal Audit and Other Work carried out; and c) Acknowledged the assurance provided on internal controls and governance arrangements in place for the areas covered by this Internal Audit work. Report No. Report Title Submitted by: 5.3 Internal Audit Mid-Term Performance Report 2022/23 Chief Internal Auditor Outline of report and summary of discussion In speaking to the report Duncan Stainbank outlined that it was intended to inform Audit Committee about the progress made in the 9 months leading up to December 2022. Duncan Stainbank continued to summarise the key comments and status of audits as outlined in Appendix 1 and made reference to the Internal Audit Annual Plan as approved by Audit Committee on the 14 March 2022. A discussion ensued in relation to Building Maintenance Services, Elaine Greaves confirmed that an audit had previously been conducted and that some of the actions were being carried out as part of the service review. Derek Oliver agreed that he would bring a report following up actions to a future meeting of Audit Committee. In response to comments regarding contracts, Derek Oliver confirmed that the full procurement of contracts was contained within the service review and that additional resource has been sought to complete this and that this would be in line with the local procurement strategy. Derek Oliver further advised that payments of Page 6 of 54
Page 7
contractors was done as quickly as possible but that due diligence was also required. Decision a) Derek Oliver agreed to bring a report following up audit actions in relation to building maintenance services in future. b) Audit Committee noted the progress Internal Audit has made with activity in the Internal Audit Annual Plan 2022/23 to the end December 2022; and c) Confirmed it’s satisfaction with the performance of the Internal Audit service provision. Report No. Report Title Submitted by: 5.4 Risk Management Update – Strategic Risk Profile Quarter 3 2022/23 Chief Officer Place Outline of report and summary of discussion Derek Oliver provided a brief overview of the Risk Management Update making reference to the risk responses implemented during quarter three, assured members of the planned approach to response to the current risk climate and provided an overview of the current risk evaluation and requested that Audit Committee take note of the change in risks. Responding to comments regarding the usage of the Borders Railway and the 101 bus service, Derek Oliver confirmed engagement with bus partners had indicated that following the switch to hybrid working there had been a shift in usage to different days and times. Decision Audit Committee noted the current risk landscape and organisational response to the most significant risks in Quarter 3 (Q3) 2022/23 (1 October to 31 December 2022). Report No. Report Title Submitted by: 5.5 Scotland’s Public Finances: Challenges and Risks Acting Chief Financial Officer Outline of report and summary of discussion David Gladwin provided a brief overview of the Audit Scotland report summarising the key points of the report and outlined the three main messages. A brief discussion ensued in relation to lag times associated with Scottish Government Grant funding, David Gladwin confirmed that lag times were linked to population growth and that this was very nuanced depending of the area of distribution. In response to comments relating to the usage of data to outline population growth, Grace Vickers highlighted that Scottish Government growth unit examine various datasets and agreed to circulate the NRS data and forward. Decision a) Grace Vickers agreed to circulate NRS data and forward profiles to Audit Committee Members; and b) Considered and noted the Audit Scotland report; and Page 7 of 54
Page 8
c) Noted that the key messages have been considered by Council Officers and are embedded in the Medium Term Financial Strategy Report considered by Council on Tuesday 31st January and also the quarter 3 suite of financial governance reports to be presented to Council on Tuesday 21st February. 6. Private Reports None 7. Date of Next Meeting Date of Next Meeting: Tuesday 7 March 2023 at 11am. The meeting terminated at 1:53 pm Page 8 of 54
Page 9
Audit Committee Action Log No Subject Date Action Action Owner Expected completion date Comments 1 Responsible treasury management 06/12/2022 Session with members to be organised with regard to Responsible treasury management/ethical issues. Acting Chief Financial Officer Ongoing Carry forward, paper coming forward regarding CSG and ethical depositing coming later in the year. 2 Internal Audit Mid- Term Performance Report 2022/23 07/02/2023 Derek Oliver to submit a report to Audit Committee following up on audit actions for Building Maintenance Services. Chief Officer Place Ongoing Report will be presented to Audit Committee in April, following update report to BTSG in March. 3 Scotland’s Public Finances: Challenges and Risks 07/02/2023 Grace Vickers to circulate NRS data and future profiles to members. Chief Executive 07/03/2023 Complete – Circulated to members 07/03/2023 Audit Committee Tuesday 07 March 2023 Item No: 4.2 Page 9 of 54
Page 10
Page 10 of 54
Page 11
Audit Committee Tuesday 7 March 2023 Item 5.1 Internal Audit Work to February 2023 Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is asked to: a) Consider the Executive Summaries of the final Internal Audit assurance reports issued; b) Note the Internal Audit Assurance Work in Progress and Internal Audit and Other Work carried out; and c) Acknowledge the assurance provided on internal controls and governance arrangements in place for the areas covered by this Internal Audit work. 2 Purpose of Report/Executive Summary The purpose of this report is to provide members of the Audit Committee with details of the recent work carried out by Internal Audit and the findings and recommended audit actions agreed by Management to improve internal controls and governance arrangements. The Internal Audit Annual Plan 2022/23 was approved by the Audit Committee on 14 March 2022. Internal Audit has carried out work associated with the delivery of the Plan to meet its objective of providing an opinion on the efficacy of the Council’s risk management, internal control and governance. An Executive Summary of the final Internal Audit assurance reports issued, including audit objective, findings, good practice and recommendations (where appropriate), and the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area, is shown in Appendix 1. The MLC Internal Audit function conforms with the professional standards as set out in Public Sector Internal Audit Standards (PSIAS) (2017) including the production of this report to communicate the results of the reviews. Date 22 February 2023 Report Contact: Duncan Stainbank duncan.stainbank@midlothian.gov.uk Page 11 of 54
Page 12
2 3 Progress Report 3.1 The Internal Audit Annual Plan 2022/23 was approved by the Audit Committee on 14 March 2022. Internal Audit has carried out the following work in the period from 1 January to 28 February 2023 associated with the delivery of the Plan to meet its objective of providing an opinion on the efficacy of the Council’s risk management, internal control and governance. 3.2 The MLC Internal Audit function conforms with the professional standards as set out in Public Sector Internal Audit Standards (PSIAS) (2017) including the production of this report to communicate the results of the reviews. 3.3 Internal Audit issued final assurance reports on the following subjects: • Employability Funded Programmes; and • Performance Management and Performance Indicators. 3.4 An Executive Summary of the final Internal Audit assurance report issued, including audit objective, findings, good practice and recommendations (where appropriate), and the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area, is shown in Appendix 1. The definitions for Internal Audit assurance categories are as follows: Level Definition Comprehensive assurance Sound risk, control, and governance systems are in place. These should be effective in mitigating risks to the achievement of objectives. Some improvements in a few, relatively minor, areas may be required. Substantial assurance Largely satisfactory risk, control, and governance systems are in place. There is, however, some scope for improvement as current arrangements could undermine the achievement of objectives or leave them vulnerable to error or misuse. Limited assurance Risk, control, and governance systems have some satisfactory aspects. There are, however, some significant weaknesses likely to undermine the achievement of objectives and leave them vulnerable to an unacceptable risk of error or misuse. No assurance The systems for risk, control, and governance are ineffectively designed and operated. Objectives are not being achieved and the risk of serious error or misuse is unacceptable. Significant improvements are required. Current Internal Audit Assurance Work in Progress 3.5 Internal Audit assurance work in progress to deliver the Internal Audit Annual Plan 2022/23 consists of the following: Audit Area Audit Stage Care at Home Draft Report Issued Mental Health Services Testing underway Construction projects / social housing programme Testing underway Page 12 of 54
Page 13
3 Internal Audit Consultancy and Other Work 3.6 Internal Audit staff have been involved in the following for the Council to meet its aims and objectives, and its roles and responsibilities in accordance with the approved Internal Audit Charter and Strategy: a) In its critical friend role provided an independent view and challenge at various forums including Capital Plan and Asset Management Board, Capital Plan Management Group, Capital Plan Prioritisation Review Group, Chief Officers Risk & Resilience Group, Integrity Group, UKSPF Oversight Board and Information Management Group; b) Learning and development during the research stage of new audit areas for all Internal Audit team members and through joining virtual audit forums (Computer Audit Sub-group) and meetings; and c) Monitored publication of Audit Scotland reports and co-ordinated submission by management of Audit Scotland Reports to the Audit Committee or other Committee as relevant. Recommendations 3.7 Recommendations in reports are suggested changes to existing procedures or processes to improve the controls or to introduce controls where none exist. The grading of each recommendation reflects the risk assessment of non-implementation, being the product of the likelihood of the risk materialising and its impact: High: Significant weaknesses in existing controls, leaving the Council or Service open to error, fraud, financial loss or reputational damage, where the risk is sufficiently high to require immediate action within one month of formally raising the issue. Added to the relevant Risk Register and included in the relevant Assurance Statement. Medium: Substantial weaknesses in existing controls, leaving the Council or Service open to medium risk of error, fraud, financial loss or reputational damage requiring reasonably urgent action within three months of formally raising the issue. Low: Moderate weaknesses in existing controls, leaving the Council or Service open to low risk of error, fraud, financial loss or reputational damage requiring action within six months of formally raising the issue to improve efficiency, effectiveness and economy of operations or which otherwise require to be brought to attention of senior management. Outwith the report, Internal Audit informs operational managers about other matters as part of continuous improvement. 3.8 The table below summarises the number of Internal Audit recommendations made during 2022/23: Recs Rating 2022/23 Number of Recs High 0 Medium 1 Low 5 Sub-total reported this period 6 Previously reported 34 Total 40 Recommendations agreed with action plan 40 Not agreed; risk accepted 0 Total 34 Page 13 of 54
Page 14
4 4 Report Implications (Resource, Digital, Risk and Equalities) 4.1 Resource Resource implications of implementing Internal Audit recommendations are considered as part of the audit process to ensure these are reasonable and proportionate to the risks. 4.2 Digital There are no digital implications arising from this report. 4.3 Risk The PSIAS require Internal Audit to evaluate the effectiveness of the Council’s risk management arrangements and contribute to improvements in the process. At the start of each audit engagement, to capture potential areas of risk and uncertainty more fully, key stakeholders have been consulted and risk registers have been considered. During each audit engagement the management of risk has been tested. It is anticipated that improvements in the management and mitigation of risks will arise as a direct result of management implementing the Internal Audit recommendations made. If audit recommendations are not implemented, there is a greater risk of financial loss and/or reduced operational efficiency and effectiveness, and management may not be able to demonstrate improvement in internal control and governance arrangements, and effective management of risks. 4.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. The Internal Audit work is carried out in accordance with the appropriate legislation and professional standards. The latter includes compliance by those within the Internal Audit function with the Code of Ethics set out in the PSIAS which is appropriate for the profession of Internal Audit founded as it is on trust placed in its independent and objective assurance about risk management, internal control and governance. 4.5 Additional Report Implications (See Appendix A) Appendices APPENDIX A – Additional Report Implications APPENDIX 1 Page 14 of 54
Page 15
5 APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable the Council to deliver its key priorities in support of achieving the its objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above The Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Internal Audit service provision to assist the Council in achieving its objectives. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” Page 15 of 54
Page 16
6 Implementation by management of the actions associated with Internal Audit recommendations, that are designed to improve internal control and governance arrangements and management of risks, underpins the Council’s own continuous improvement arrangements to enhance its effectiveness, thus supporting the delivery of the Council’s best value duties. A.5 Involving Communities and Other Stakeholders The Chief Internal Auditor is accountable to the Audit Committee which, in fulfilling its governance role, acts as a bridge between the Council and other stakeholders. This report has been presented to the Corporate Management Team to outline the key messages of assurance and areas of improvement. Senior management relevant to the areas audited have agreed the final Internal Audit assurance reports as set out in the relevant Executive Summary within Appendix 1. A.6 Impact on Performance and Outcomes The Findings and Recommendations from Internal Audit work during the year are designed to assist the Council in improving its performance and outcomes. A.7 Adopting a Preventative Approach Internal Audit assurance work includes assessments on when a preventative approach can be adopted. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Good governance is important to enable Midlothian Council to achieve its objectives. Page 16 of 54
Page 17
APPENDIX 1 Report Summary of key findings and recommendations Recommendations Status H M L Subject: Employability Funded Programmes Category: Assurance – Risk Date issued: 13 January 2023 Draft 02 February 2023 Final Level of Assurance: Substantial for providing support to the community; working in partnership with other sectors; and meeting priorities and outcomes of the Single Midlothian Plan. Limited for the recording of information, maintenance of audit trails, compliance with the NOLB grant criteria, the Data Protection Act 2018 and the Council’s FTPP. The purpose of this audit was to review employability funded programmes under the terms of the associated agreements to assess compliance with the requirements and delivery of outcomes. Midlothian Council funds Arms Length and External Organisations (ALEOs) for a range of purposes related to council services and its broader corporate objectives set out in partnership with the community planning partners under the “Single Midlothian Plan”, the local outcomes improvement plan for Midlothian required by the Community Empowerment Act 2015. The Council has a Following the Public Pound (FTPP) policy and guidance which was last reviewed and updated in March 2022. The Communities Lifelong Learning Employability (CLLE) team works with young people, adults, families and community organisations to improve skills for learning, life and work. The No One Left Behind (NOLB) Employability Funding stream has been set up by the Scottish Government to deliver a flexible and user-based model of employability support for people from school leaving age up to 67 years (pensionable age). It is a partnership programme between the Scottish Government and Local Authorities. During 2022/23, the Scottish Government allocated funding of £845,679 to Midlothian Council to support local residents who meet the relevant eligibility criteria included in the No One Left Behind Employability funding streams. The United Kingdom Shared Prosperity Fund (UKSPF) was launched in April 2022 and is one strand of a suite of funding which superseded the EU structural funds and is nationally funded by the UK Government. Midlothian Council will receive £3,558,662 of funding over a 3 year period. This money will be distributed locally and invested in the following priorities set by the UK Government: Communities and Place, Support for Local Businesses, People and Skills; and Multiply (improving adult numeracy for those aged 19 plus). Internal Audit considers that the level of assurance is: substantial for providing support to the community; working in partnership with other sectors; and meeting priorities and outcomes of the Single Midlothian Plan. Quarterly financial and narrative delivery reports were submitted to the Scottish Government on time. Assurance is limited for the recording of information, maintenance of audit trails, compliance with the NOLB grant criteria, the Data Protection Act 2018 and the Council’s FTPP. Internal Audit made the following recommendations: 0 1 5 Management have accepted the factual accuracy of the report and its findings, and agreed to implement the recommendations. Page 17 of 54
Page 18
2 • To comply with the NOLB grant criteria and as good practice: further evidence should be obtained; an adequate audit trail maintained; more detailed information should be submitted in the narrative reports; action plans, SLA templates and the privacy statement should be updated; and the Council’s website should be updated to include more information on the NOLB programme and the EQIA. Management should also ensure that the CLLE team are using Egress where applicable. (Medium) • Management should ensure that all Service Level agreements (SLAs) are signed by the Council; and risk assessments should be completed for large grants. Management should document the governance arrangements for reporting different types of grants and demonstrate which Committees they will be reported to. (Low) • Roles and responsibilities for the grant panel should be documented; conflicts of interest forms completed and evidence maintained showing that factors stipulated in the FTPP for large grants were considered by the panel. Future grant application forms should state what happens to applications submitted after the deadline. Training on what should be treated as a procurement or a grant should be provided to the CLLE team. (Low) • An audit trail should be maintained of annual checks undertaken on providers’ insurance documents; monitoring information received from the provider should be recorded on the system; and officers should undertake sample checks. (Low) • Updated service level agreements should be issued on a timely basis and an audit trail of the decision making process should be maintained. The FTPP policy should be updated to document the governance required for the authorisation of variations. (Low) Page 18 of 54
Page 19
3 Report Summary of key findings and recommendations Recommendations Status H M L Subject: Performance Management and Performance Indicators Category: Assurance – Risk Date issued: 30 January 2023 Draft 13 February 2023 Final Level of Assurance: Substantial for the reporting of PIs. Limited for the implementation of the recommendations from the audit of Performance Management (LGBF) undertaken in 2021. The purpose of this audit was to test a sample of performance indicators to ensure that they are complete, accurate, based on current data and conform to the stipulated criteria. It included a follow up of the implementation of the recommendations from the audit of Performance Management (LGBF) – Improvement Service Return undertaken in 2021. Performance data is required for a number of purposes including internal monitoring, statutory requirements and for benchmarking. Key performance information is recorded in the Pentana performance management system and there are currently 2,541 PIs recorded. A range of statutory and non-statutory PIs are reported and these are principally driven by the Single Midlothian Plan and Service Plans. Service Plans as well as defining service specific priorities provide a link to the outcomes contained within the Single Midlothian Plan. Performance reports are submitted to Cabinet and the Performance Review and Scrutiny Committee (PRSC) and are published on the Council’s website. Service Plans 2021-22 were reported to Council in June 2021 and have been carried forward for one year. A draft 5 year Strategic Plan is currently under development which will look at making targeted improvements to performance reporting. The draft 5 year strategic plan was reported to Council in October 2022. The Council agreed to a continuation of the Draft Midlothian Council Strategic Plan 2023 - 2026 until the Medium Term Financial Strategy is agreed. Internal Audit considers that the level of assurance is: substantial in relation to the reporting of PIs but is limited for the implementation of the recommendations from the audit of Performance Management (LGBF) undertaken in 2021. 2 recommendations were made during this review and they have only been partially completed. Testing highlighted that, from the 12 performance indicators tested, 8 PIs were correct, 3 PIs had to be recalculated as no audit trail had been retained for the reported figures, and 1 error was noted for housing repairs. As detailed in the previous audit, Internal Audit made the following recommendation: • Services should be reminded of the performance measure controls they should have in place when calculating statutory and non-statutory performance indicators such as: retain an audit trail of source documentation; create procedure notes to enable indicators to be produced in the absence of key individuals; and undertake quality assurance checks for the calculation of PIs. (Low) 0 0 1 Management have accepted the factual accuracy of the report and its findings, and agreed to implement the recommendation. Page 19 of 54
Page 20
Page 20 of 54
Page 21
Audit Committee Tuesday 7 March 2023 Item 5.2 Counter Fraud Annual Plan 2023/24 Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is invited to: a) Approve the Counter Fraud Annual Plan 2023/24 (Appendix 1). 2 Purpose of Report/Executive Summary The purpose of this report is to gain approval from the Audit Committee for the proposed Counter Fraud Annual Plan 2023/24 to support the delivery of the Council’s Counter Fraud Strategy and to demonstrate compliance with the Council’s Counter Fraud Policy Statement. Having robust fraud prevention and investigation arrangements in place contributes to safeguarding the Council’s financial resources, for delivery of services, as part of protecting the public purse. A focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud, theft, corruption and crime (including cybercrime and money laundering), and ensure these are embedded preventative practices as specific changes associated with the Counter Fraud Strategy approved by Council in August 2020. The Counter Fraud Annual Plan 2023/24 (Appendix 1) sets out the planned counter fraud activity to support the approach and culture of the Council in tackling fraud and corruption to deliver the Counter Fraud Strategy. This will enable the Council to demonstrate compliance with its Counter Fraud Policy Statement as its commitment to tackling fraud and reflects the Integrity Group’s assessment of counter fraud controls. Date 22 February 2023 Report Contact: Duncan Stainbank duncan.stainbank@midlothian.gov.uk Page 21 of 54
Page 22
3 Background 3.1 A review was carried out in 2019/20 of counter fraud management arrangements in place and to make improvements in light of the significant fraud investigations that have occurred within Midlothian Council in recent years, noting that some are ongoing. 3.2 The conclusion of the review included a refresh to the corporate policy and strategy for tackling fraud. A revised Counter Fraud Policy Statement and Counter Fraud Strategy and proposal to have 2 FTE Corporate Fraud Officers to deliver the revised Counter Fraud Policy and Strategy were approved by Midlothian Council in August 2020. 4 Counter Fraud Annual Plan 2022/23 4.1 Having robust fraud prevention and investigation arrangements in place contributes to safeguarding the Council’s financial resources, for delivery of services, as part of protecting the public purse. A focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud, theft, corruption and crime (including cybercrime and money laundering), and ensure these are embedded preventative practices as specific changes associated with the Counter Fraud Strategy approved by Council in August 2020. 4.2 The Counter Fraud Annual Plan 2023/24 (Appendix 1) sets out the planned Counter Fraud activity to support the change in approach and culture for the Council for tackling fraud and corruption to deliver the approved Counter Fraud Strategy. This will enable the Council to demonstrate compliance with its Counter Fraud Policy Statement as its commitment to tackling fraud and reflects the Integrity Group’s assessment of counter fraud controls (update submitted to the Audit Committee in January 2022). 5 Report Implications (Resource, Digital, Risk and Equalities) 5.1 Resource The primary responsibility for the prevention, detection and investigation of fraud rests with Management, supported by the Integrity Group and the Corporate Fraud Team. The purpose of the Integrity Group is to improve the Council’s resilience to fraud, corruption, theft and crime (including cybercrime and money laundering). The formal establishment of the Integrity Group with a Terms of Reference (approved by the Audit Committee on 22 June 2020) enables the shift to more holistic working in multi- disciplinary forums to tackle fraud in a consistent and collaborative way across the Council. The revised Counter Fraud Policy Statement and Counter Fraud Strategy and proposal to have 2 FTE Corporate Fraud Officers to deliver the revised Counter Fraud Policy and Strategy were approved by Midlothian Council in August 2020. The 2 Corporate Fraud Officers are line managed by the Principal Internal Auditor who reports to the Chief Internal Auditor. Page 22 of 54
Page 23
Savings will continue to be identified arising from Corporate Fraud Team activity, which will be stated within the Counter Fraud Annual Reports presented to the Audit Committee. 5.2 Digital None. 5.3 Risk The Council is committed to minimising the risk of loss due to fraud, theft, corruption or crime and to taking appropriate action against those who attempt to defraud the Council, whether from within the authority or from outside. The Counter Fraud Policy Statement sets out the roles and responsibilities for the prevention, detection and investigation of fraud. The Counter Fraud Strategy provides a shift in approach to focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud. The work undertaken by the Corporate Fraud Team in collaboration with other Services is designed to reduce the fraud risks within the Council. 5.4 Ensuring Equalities An Integrated Impact Assessment (IIA) Form was completed as part of the development of the revised Counter Fraud Policy and Strategy. The conclusion was that undertaking a Combined Impact Assessment was not necessary as the policy / proposal has little relevance to equality, negligible impact on the economy, and no impact on the environment. The revised Counter Fraud Policy and Strategy set out enhancements to internal Management arrangements though it is anticipated that there will be minimal impact on internal staff only; there is no change to the Whistleblowing external-facing arrangements. 5.5 Additional Report Implications (See Appendix A) Appendices: Appendix A – Additional Report Implications Appendix 1 – Midlothian Council Counter Fraud Annual Plan 2022/23 Page 23 of 54
Page 24
APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change) by preventing and detecting fraud, additional resources might be available to support the Council’s objectives. Any loss of funds due to fraud, theft, corruption or crime might impact on the ability of Midlothian Council to achieve its key priorities. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s arrangements for tackling fraud as set out in the Counter Fraud Policy Statement and Counter Fraud Strategy that were approved by Council in August 2020. The shift to the key drivers for change is an intrinsic part of the change in approach and culture for the Council for tackling fraud and corruption. For example: (a) The formal establishment of an Integrity Group with a Terms of Reference (approved by the Audit Committee in June 2020) shifting to more holistic working in multi-disciplinary forums to tackle fraud in a consistent and collaborative way across the Council; (b) A focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud, theft, corruption, and crime and ensure these are embedded preventative practices; (c) Applying the minimum standard within the CIPFA Code of Practice on ‘Managing the Risk of Fraud and Corruption (2014)’ for counter fraud policy, strategy and other practices, and adopting the CIPFA Counter Fraud Maturity Model as a means of self-assessment moving forward will enable continuous improvement to be evaluated, managed and evidenced; and (d) Use of a blend of toolkits such as fraud risk assessments and e- learning packages that can be tailored to specific Services. Page 24 of 54
Page 25
A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value Having robust fraud prevention and investigation arrangements in place contributes to safeguarding the Council’s financial resources, for delivery of services, as part of protecting the public purse. The approved Counter Fraud Strategy states the Council will measure progress against the CIPFA Counter Fraud Maturity Model as a self- assessment approach to continuous improvement in order to continuous improvement to be evaluated, managed and evidenced demonstrate best value in the use of resources. A.5 Involving Communities and Other Stakeholders Ensuring awareness of the Whistleblowing facility to report areas of concern is important in the approach to tackling fraud. The facility has been promoted in recent years and is being utilised, as stated in the Counter Fraud Annual Report 2021/22 that reported outcomes of corporate fraud activity, some of which arose from whistleblowing received from staff, those within communities or other stakeholders. A.6 Impact on Performance and Outcomes The primary responsibility for the prevention, detection and investigation of fraud rests with Management, supported by the Integrity Group and the Corporate Fraud team. Internal Audit provides advice and independent assurance on the effectiveness of processes put in place by Management. The Findings and Recommendations from Internal Audit and Corporate Fraud work which are presented to the Audit Committee during the year assists the Council in maintaining and / or enhancing fraud prevention and detection controls. A.7 Adopting a Preventative Approach Having robust fraud prevention and investigation arrangements in place contributes to safeguarding the Council’s financial resources, for delivery of services, as part of protecting the public purse. A focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud, theft, corruption and crime, and ensure these are embedded preventative practices are specific changes associated with the approved Counter Fraud Strategy. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Good governance is important to enable Midlothian Council to achieve its objectives including sustainable outcomes. Page 25 of 54
Page 26
Midlothian Council Counter Fraud Annual Plan 2022/23 Appendix 1 Ref Category Activity Number of Days Commentary 1. Compliance Contract Management 40 Data analytics to test governance and internal controls in place over Contract Management arrangements with third parties to assess compliance with procurement rules. 2. Compliance Corporate Fraud Enquiries 155 Respond to whistleblowing notifications. 3. Data Match National Fraud Initiative 100 Co-ordinate the NFI exercise across Council services, review and investigate data matches, and periodically produce reports on the outcomes. 4. Data Match Social Housing 30 Data analytics on Social Housing, enquiries and investigations. 5. Data Match Council Tax 15 Data analytics on Council Tax, enquiries and investigations. 6. Other Corporate Fraud Policy Framework 15 Support the Integrity Group with monitoring of policies and procedures review, update and communication. Assist with the self- assessment of compliance against the CIPFA code on Managing the Risk of Fraud and Corruption. 7. Other Fraud Risk Assessments 30 Support operational Service Managers to assess fraud risks and put in place appropriate controls within processes and practices. 8. Other Fraud Awareness Training 15 Develop and deliver fraud awareness training modules (face-to-face, virtual or via e-learning) to Management and Staff. 9. Other Integrity and SOC Groups 6 Attend and provide support to the Council’s Integrity Group and the Serious and Organised Crime Group. Corporate Fraud Total 406 Page 26 of 54
Page 27
Audit Committee Tuesday 7 March 2023 Item 5.3 Internal Audit Charter Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is invited to: a) Note the changes to the Internal Audit Charter outlined in section 4 of this report in conformance with PSIAS; b) Approve the revised Internal Audit Charter shown at Appendix 1; and c) Note that the Internal Audit Charter will be reviewed annually. 2 Purpose of Report/Executive Summary This report provides the Audit Committee with the updated Internal Audit Charter for approval that defines the terms of reference for the Internal Audit function to carry out its role to enable the Chief Audit Executive to prepare annual Internal Audit opinions on the adequacy of the overall control environment for Midlothian Council, and for Midlothian Health and Social Care Integration Joint Board. The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” In accordance with the Public Sector Internal Audit Standards (PSIAS) (2017), the purpose, authority and responsibility of the Internal Audit activity must be formally defined in an Internal Audit Charter, consistent with the Definition of Internal Auditing, the Code of Ethics and the Standards. The Chief Audit Executive must periodically review the Internal Audit Charter and present it to senior management (Corporate Management team) and the board (Audit Committee) for approval. The Internal Audit Charter has been updated in conformance with the PSIAS for approval by the Audit Committee to ensure that Internal Audit is tasked to carry out its role in accordance with best Corporate Governance practice, and is shown in Appendix 1. Date 22 February 2023 Report Contacts Duncan Stainbank, Chief Internal Auditor duncan.stainbank@midlothian.gov.uk Page 27 of 54
Page 28
3 Background 3.1 The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” 3.2 The Midlothian Council Internal Audit function follows the professional standards as set out in the Public Sector Internal Audit Standards (PSIAS) which came into effect on 1 April 2013 (amended 2017), along with the CIPFA Local Government Application Note for the United Kingdom. The PSIAS have been developed by the standard setters (CIPFA for local government) through the Internal Audit Standards Advisory Board (IASAB) and have been based on the Institute of Internal Auditors International Standards of Professional Practice. 3.3 In accordance with the PSIAS, the purpose, authority and responsibility of the Internal Audit activity must be formally defined in an Internal Audit Charter, consistent with the Definition of Internal Auditing, the Code of Ethics and the Standards. The Chief Audit Executive must periodically review the Internal Audit Charter and present it to ‘senior management’ (Corporate Management Team) and the ‘board’ (Audit Committee) for approval. 3.4 Within the PSIAS a Public Sector requirement states the Internal Audit Charter must also: o define the terms ‘board’ and ‘senior management’ for the purposes of Internal Audit activity; o cover the arrangements for appropriate resourcing; o define the role of Internal Audit in any fraud-related work; and o include arrangements for avoiding conflicts of interest if Internal Audit undertakes non-audit activities. 3.5 Internal Audit assurance resources and services are also provided by Midlothian Council’s Internal Audit team to the Midlothian Health and Social Care Integration Joint Board (MIJB), including the appointed MIJB Chief Internal Auditor. The Internal Audit Charter and Strategy are applicable to each organisation. 4 Internal Audit Charter 4.1 The authority for Internal Audit to operate in Midlothian Council is contained in the Council’s Local Code of Corporate Governance, Standing Orders, and Financial Regulations. This Internal Audit Charter expands upon that framework. 4.2 The Internal Audit Charter as shown in Appendix 1 to this report: establishes the Internal Audit activity’s position within the organisation, including the nature of the Chief Audit Executive’s functional reporting relationship with the board; authorises access to records, personnel and physical properties relevant to the performance of engagements; and defines the scope of Internal Audit activities. Page 28 of 54
Page 29
4.3 The Internal Audit Charter, which was previously approved by the Audit Committee on 14 March 2022, has been updated by the Chief Audit Executive (shared Chief Internal Auditor). The summary of the changes reflect the following: • The agreement for shared Internal Audit services with East Lothian Council, , and the associated change in approach for the provision of Internal Audit resources; and 4.4 The Internal Audit Charter should be considered alongside the Internal Audit Strategy and Plan 2023/24. The Internal Audit Strategy sets out the Council’s assurance framework within which Internal Audit operates, and the Chief Audit Executive’s strategy for discharging its role and providing the necessary annual assurance opinions to Midlothian Council and Midlothian Health and Social Care Integration Joint Board (MIJB). The Internal Audit Charter and Strategy are applicable to these organisations. There are separate Internal Audit Annual Plans for each organisation, which set out the range and breadth of audit activity. 5 Report Implications (Resource, Digital, Risk and Equalities) 5.1 Resource The Local Authority Accounts (Scotland) Regulations 2014 that came into force on 10 October 2014 require a local authority to operate a professional and objective internal auditing service. Internal Audit must have sufficient staff and other resources to enable it to carry out the objectives of the Charter and to deliver a programme of independent and objective audit assurance work alongside other available sources of assurance to enable the Chief Audit Executive to prepare annual opinions on the adequacy of the overall control environment for Midlothian Council and the MIJB. Internal Audit resources are set out in the Internal Audit Strategy and Plan 2022/23. 5.2 Digital There are no digital implications arising from this report. 5.3 Risk The authority for Internal Audit to operate in Midlothian Council is contained in the Council’s Local Code of Corporate Governance, Standing Orders, and Financial Regulations. This Internal Audit Charter expands upon that framework. Approval of the Internal Audit Charter (Appendix 1), as recommended in this report, will ensure that Internal Audit is tasked to carry out its role in accordance with PSIAS and best Corporate Governance practice. Page 29 of 54
Page 30
The PSIAS require Internal Audit to evaluate the effectiveness of the Council’s Risk Management arrangements and contribute to improvements in the process. The work of Internal Audit (including its opinion on the control environment) shall contribute to the Council’s review of its corporate governance arrangements the outcome of which is published in the Annual Governance Statement. At all times, Management’s responsibilities (led by the Corporate Management Team) include: o Designing and maintaining proper risk management, governance and internal control processes and systems for which they have responsibility to ensure probity in systems and operations, including the prevention, detection and resolution of fraud and irregularities. These are not fixed but evolve as the Council changes. o Checking that these governance arrangements and internal controls are operating effectively and obtaining assurances from internal compliance, risk, inspection, quality, and control functions. (The above are known as the first and second lines.) o Engaging with Internal Audit (the third line) in a positive way to achieve shared goals for robust internal control and governance, best value and improvement, and ensuring that Internal Audit can properly fulfil its role. o Considering and acting upon Internal Audit findings and recommendations, including implementation of audit recommendations within agreed timescales and updating Pentana performance system, or accepting responsibility for any resultant risk from not doing so. o Seeking advice and consultancy support from Internal Audit on existing controls and on changes to and transformation of governance, processes and procedures. 5.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. The Internal Audit work is carried out in accordance with the appropriate legislation and professional standards. The latter includes compliance by those within the Internal Audit function with the Code of Ethics set out in the PSIAS. This is of particular importance and relevance for the profession of Internal Audit founded as it is on trust placed in its independent and objective assurance about risk management, internal control and governance. 5.5 Additional Report Implications (See Appendix A) Appendices: APPENDIX A – Additional Report Implications APPENDIX 1 – Internal Audit Charter Page 30 of 54
Page 31
APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable Midlothian Council to deliver its key priorities in support of achieving the Council’s objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s Internal Audit service provision to assist the Council in achieving its objectives. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” Internal Audit is a key element of good governance which is important to enable Midlothian Council to achieve its objectives. Page 31 of 54
Page 32
Recommendations made by Internal Audit underpin the Council’s own continuous improvement arrangements to enhance its effectiveness, thus supporting the delivery of the Council’s best value duties. A.5 Involving Communities and Other Stakeholders The Chief Audit Executive is accountable to the Audit Committee which, in fulfilling its governance role, acts as a bridge between the Council and other stakeholders. A.6 Impact on Performance and Outcomes Applying the framework of the PSIAS will give the Audit Committee assurance that the Internal Audit function is compliant with legislative requirements and current best practice. A.7 Adopting a Preventative Approach The PSIAS are applicable from 1 April 2013 (amended 2017) which means the Internal Audit Service has taken steps to be fully compliant. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Internal Audit is a key element of good governance which is important to enable Midlothian Council to achieve its objectives including sustainable outcomes. Page 32 of 54
Page 33
1 INTERNAL AUDIT CHARTER Appendix 1 INTRODUCTION The Public Sector Internal Audit Standards (PSIAS) requires that the purpose, authority and responsibility of the Internal Audit activity must be formally defined in an Internal Audit Charter, consistent with the Definition of Internal Auditing, the Code of Ethics and the International Standards for the Professional Practice of Internal Auditing (Standards) detailed in the PSIAS. Midlothian Council has adopted from the PSIAS1: the definition of Internal Auditing “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes”, the Mission Statement of Internal Audit “To enhance and protect organisational value by providing risk-based and objective assurance, advice and insight” and the Core Principles. OBJECTIVES OF INTERNAL AUDIT Internal Audit’s responsibility is to report to Midlothian Council on its assessment of the adequacy of the entire control environment, through the Corporate Management Team (‘senior management’) and the Audit Committee (the ‘board’ for the purposes of Internal Audit activity). Internal Audit adds value to the organisation (and its stakeholders) by enhancing governance, risk management and control processes and objectively providing relevant assurance. As part of Midlothian Council’s system of corporate governance, Internal Audit’s purpose is to support the Council in its activities designed to achieve its declared objectives and to do so: ➢ In support of the Council’s vision, values and priorities. ➢ As a contribution to the Council’s corporate management of risk, including assisting Management to improve the risk identification and management process in particular where there is exposure to significant financial, strategic, reputational and operational risk to the achievement of the Council’s objectives. ➢ As an aid to ensuring that the Council and its elected members, employees and contracted third parties are operating within the law and relevant regulations, and that public money is safeguarded and properly accounted for, and used economically, efficiently and effectively. ➢ As a contribution towards establishing and maintaining a culture of honesty, integrity, openness, accountability and transparency throughout the Council in all its activities and transactions. ➢ As a contribution towards ensuring that financial statements and other published performance information are accurate and reliable. Midlothian Council’s Internal Audit function provides assurance services to the Midlothian Health and Social Care Integration Joint Board (MIJB) and will apply the same standards as defined in this Charter to any work undertaken for MIJB, with separate Internal Audit plans and reports presented to its ‘senior management’ (MIJB Chief Officer and MIJB Chief Finance Officer) and to the ‘board’ (MIJB Audit and Risk Committee). 1 Public Sector Internal Audit Standards (PSIAS) (2017) Midlothian Page 33 of 54
Page 34
2 POSITION OF INTERNAL AUDIT WITHIN MIDLOTHIAN COUNCIL In terms of the PSIAS, the status of Internal Audit should enable it to function effectively, with recognition of the independence of Internal Audit fundamental to its effectiveness. The Chief Audit Executive (CAE) should have “sufficient status to facilitate the effective discussion of audit strategies, plans, results and improvement plans with senior management of the organisation.2” The CAE within Midlothian Council (the shared Chief Internal Auditor) has full access to those charged with governance, specifically the Elected Members and the Corporate Management Team. The latter includes the Council’s statutory officers: head of paid service (Chief Executive), s95 finance officer (Chief Officer Corporate Solutions), monitoring officer (Legal & Governance Manager) and chief social work officer (Chief Officer Children’s Services, Partnerships and Communities). The CAE has free and unfettered access to the Chair of each organisation’s ‘board’ to discuss any matters the members or auditors believe should be raised privately. In terms of accountability and independence to ensure conformance with PSIAS, the CAE reports functionally to the Midlothian Council Audit Committee. In this context functional reporting3 means the Audit Committee will: ➢ Approve the Internal Audit Charter. ➢ Approve the risk-based Internal Audit Annual Plan. ➢ Ratify the Internal Audit budget and resource plan to ensure that Internal Audit is adequately resourced to meet assurance and other key responsibilities. ➢ Receive communications from the CAE on the Internal Audit activity’s performance relative to its plan and other matters. ➢ Ratify all decisions regarding the appointment or removal of the CAE. ➢ Provide feedback to contribute to the performance appraisal of the CAE. ➢ Make appropriate enquiries of Management and the CAE to determine whether there are inappropriate scope or resource limitations. The CAE is line managed by the Chief Executive but retains responsibility for all operational audit activity and reports in their own name and retains final right of edit over all Internal Audit reports. The reporting line is managed in a manner which: ensures the CAE is accorded open and direct communication with Management; and ensures the CAE and the Internal Audit function have an adequate and timely flow of information concerning the activities, plans and initiatives of the Council and IJB. RIGHTS OF ACCESS The CAE and any member of the Internal Audit function authorised by them, relevant to the delivery of audit engagements for each of the organisations, has authority to: ➢ Have access at any reasonable times to all computer systems and records (paper/digital). ➢ Require and receive explanations concerning any matter under examination from personnel relevant to their roles including Elected Members / Board Members. ➢ Enter at all reasonable times and without notice any properties, provided that where such properties are leased to a third party the terms of the lease are observed. ➢ Require personnel to produce cash, stores, or other assets under their control. Internal Audit safeguards all information obtained in the carrying out of its duties, only uses it for defined purposes and makes no disclosure of any information held, unless this is authorised or there is a legal or professional requirement to do so. 2 Internal Audit Standards Advisory Board (IASAB) Public Sector Internal Audit Standards (PSIAS) (2017) 3 Chartered Institute of Internal Auditors (CIIA) – International Standards for Professional Practice of Internal Auditing Page 34 of 54
Page 35
3 SCOPE OF INTERNAL AUDIT ACTIVITY For each organisation Internal Audit shall systematically review, appraise, make appropriate recommendations for improvement, and report upon: • the governance arrangements and processes; • the design, implementation and effectiveness of ethics-related objectives, programmes and activities; • the information technology governance in support of strategies and objectives; • the systems and processes in place to ensure effective performance management and accountability; • the effectiveness and appropriateness of controls and other arrangements put in place to manage risk; • the potential for the occurrence of fraud and how fraud risk is managed; • the completeness, reliability, integrity and timeliness of information, both financial and operational; • the systems and processes established to ensure compliance with policies, plans, procedures, laws, and regulations, whether established internally or externally, and that employees’ actions are in compliance; • the action(s) taken to address significant legislative or regulatory issues; • the effectiveness of arrangements for safeguarding assets and interests; • the economy, efficiency and effectiveness with which resources are deployed; • the effectiveness and efficiency of operations and programmes; and • the extent to which operations are being carried out as planned and strategic objectives and goals are met. Internal Audit’s work covers: • all activities, systems, processes, controls, policies, and protocols that are currently existing or under development; • all records, personnel and properties; and • all services and other activities for which each organisation is responsible or accountable, whether delivered directly or by third parties through contracts, partnerships or other arrangements. AUDIT RESOURCES AND WORK PRIORITISATION The CAE ensures that Internal Audit resources are appropriate, sufficient and effectively deployed to achieve the approved plan. Appropriate refers to the mix of qualifications, knowledge, skills and other competencies needed to perform the plan such as compliance with the Code of Ethics set out in the PSIAS and with the Nolan principles established in the Seven Principles of Public Life. This is of particular importance and relevance for the profession of Internal Audit, founded as it is on the trust placed in its objective assurance about risk management, internal control and governance. The CAE holds a professional qualification (Bsc Hons, CIPFA) and is suitably experienced. Sufficient refers to the quantity of resources needed to accomplish the plan. Resources are effectively deployed when they are used in a way that optimises the achievement of the approved plan. The Internal Audit Strategy, as approved by the Midlothian Council Audit Committee, outlines the strategic direction for how Internal Audit will achieve its objectives in conformance with PSIAS. It guides the Internal Audit function in delivering high quality Internal Audit services to Midlothian Council and the MIJB. The Midlothian Council Internal Audit Annual Plan, as approved by the Audit Committee, is the main determinant of the relative priority to be placed on each part of the work of Internal Audit, with an Internal Audit Annual Plan specific to the MIJB being approved and monitored by its ‘senior management’ and ‘board’ (MIJB Audit and Risk Committee). The Internal Audit planning Page 35 of 54
Page 36
4 process, to determine the priorities of the Internal Audit activity consistent with the organisation’s goals, includes consideration of the organisation’s priorities, plans, strategies, objectives, risks and mitigating controls, and the internal and external assurances provided. The CAE determines the actual deployment of available resources covering the range and breadth of audit areas which are integral to the assurance process across the activities of Midlothian Council and MIJB in order to provide the statutory annual Internal Audit opinion to each organisation’s ‘senior management’ and ‘board’. This plan also requires to be sufficiently flexible to reflect the changing risks and priorities of each organisation. The Plan has within it the provision of resources as Contingency to respond to specific control issues highlighted during the year and covering other unforeseen variations in the level of resources available to Internal Audit, such as staff vacancies. The Plan has within it the provision of resources for Internal Audit ‘critical friend’ Consultancy that are valued by Management to support them in delivering innovation, change and transformation. Requests are considered and approved by the CAE subject to any consultancy activity being deliverable within the boundaries of the role of Internal Audit and the resources available. In the event that there is a need for a greater audit work to provide the statutory audit opinions than there are resources available, the CAE will identify the shortfall in the Plan and initially advise the Chief Executive followed by the Audit Committee. It will be for the Audit Committee to decide whether to accept the risks associated with the non-delivery of such audit work or to recommend to the Council that it requires Management to identify additional resources. NON-AUDIT ACTIVITIES The Internal Audit service preserves its independence and objectivity by: ensuring that staff are free from any conflicts of interest when undertaking assurance audits by following the requirements of relevant professional bodies and HR policies; and providing clarity on duties undertaken during audit consultancy engagements to ensure these do not impact on assurance audits and do not impair its independence and objectivity. APPROVAL The Internal Audit Charter was reported to and approved by the Midlothian Council Audit Committee at its meeting on 7 March 2023 and shall be subject to regular review by the CAE and the Audit Committee. Page 36 of 54
Page 37
Audit Committee Tuesday 7 March 2023 Item 5.4 Internal Audit Strategy and Annual Plan 2022/23 Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is invited to: a) Note the changes to the Internal Audit Strategy outlined in section 4 of this report; b) Note the outline of the Internal Audit planning process outlined in section 5 of this report; c) Approve the Internal Audit Strategy (Appendix 1); and d) Approve the Internal Audit Annual Plan 2023/24 (Appendix 2). 2 Purpose of Report/Executive Summary The purpose of this report is to gain approval from the Audit Committee to the proposed Internal Audit Strategy and Annual Plan 2023/24 to enable the Chief Internal Auditor to prepare annual opinions on the adequacy of the overall control environment for Midlothian Council, and Midlothian Health and Social Care Integration Joint Board (MIJB). The Internal Audit Strategy at Appendix 1 outlines the strategic direction for how Internal Audit will achieve its objectives, which are set out in the Internal Audit Charter, in conformance with PSIAS. It guides the Internal Audit function in delivering high quality internal audit services to Midlothian Council and the MIJB. The Internal Audit Annual Plan 2023/24 at Appendix 2 has been developed by the shared Chief Internal Auditor and the Principal Internal Auditor. It sets out the proposed range and breadth of audit activity and sufficient work within the audit programme of work to enable the Chief Internal Auditor to prepare the independent and objective audit opinions for Midlothian Council and MIJB. A separate Internal Audit Annual Plan 2023/24 for the MIJB will be presented to its Audit and Risk Committee. Key components of the audit planning process include a clear understanding of each organisation’s functions, associated risks, and assurance framework. Date 24 February 2023 Report Contacts Duncan Stainbank, Chief Internal Auditor duncan.stainbank@midlothian.gov.uk Page 37 of 54
Page 38
3 Background 3.1 The Local Authority Accounts (Scotland) Regulations 2014 that came into force on 10 October 2014 require a local authority to operate a professional and objective internal auditing service. This service must be provided in accordance with recognised standards and practices in relation to internal auditing. Recognised standards and practices are those set out in the Public Sector Internal Audit Standards: Applying the IIA International Standards to the UK Public Sector (PSIAS). The standards require internal audit to have suitable operational independence from the organisation. 3.2 The Midlothian Council Internal Audit function follows the professional standards as set out in Public Sector Internal Audit Standards (PSIAS) effective 1 April 2013 (updated 2017) which requires the Chief Audit Executive (CAE) to establish risk-based plans to determine the priorities of the Internal Audit activity, consistent with the organisation’s goals. The plans also require to be sufficiently flexible to reflect the changing risks and priorities pertaining to each organisation. 3.3 A fundamental role of the Council’s Internal Audit function is to provide senior management and members with independent and objective assurance, which is designed to add value and improve the organisation’s operations. In addition, the CAE is also required to prepare an Internal Audit annual opinion on the adequacy of each organisation’s overall control environment. 3.4 Internal Audit assurance resources and services are also provided by Midlothian Council’s Internal Audit team to the Midlothian Health and Social Care Integration Joint Board (MIJB), including the appointed MIJB Chief Internal Auditor. The Internal Audit Charter and Strategy are applicable to each organisation. 4 Internal Audit Strategy 4.1 The key standards within the PSIAS which relate to Managing the Internal Audit Activity are summarised below: “The chief audit executive must effectively manage the internal audit activity to ensure it adds value to the organisation. The internal audit activity is effectively managed when: • The results of the internal audit activity’s work achieve the purpose and responsibility included in the internal audit charter; • The internal audit activity conforms with the Definition of Internal Auditing and the Standards; and • The individuals who are part of the internal audit activity demonstrate conformance with the Code of Ethics and the Standards. The internal audit activity adds value to the organisation (and its stakeholders) when it provides objective and relevant assurance, and contributes to the effectiveness and efficiency of governance, risk management and control processes.” Page 38 of 54
Page 39
4.2 The Chief Internal Auditor (CAE) and the Principal Internal Auditor have developed the Internal Audit Strategy at Appendix 1. It outlines the strategic direction for how Internal Audit will achieve its objectives, which are set out in the Internal Audit Charter, in conformance with PSIAS. It guides the Internal Audit function in delivering high quality internal audit services to Midlothian Council and Midlothian Health and Social Care Integration Joint Board (MIJB). 4.3 The Internal Audit Strategy, since its previous approval by the Audit Committee on 14 March 2022, reflects the following: • The implementation of the shared Internal Audit service with East Lothian Council, and the associated change in approach for the provision of Internal Audit resources; • The prioritisation of audit activity on a risk basis from the cyclical work to allow for appropriate utilisation of diminished Internal Audit resources on the highest risk areas; and • Greater clarity on the PSIAS requirement for an annual Internal Self-Assessment and an External Quality Assessment (EQA), the latter which is scheduled during 2023. 4.4 The Internal Audit Strategy: • Outlines the assurance framework, providing clarity of the respective responsibilities of Management for designing and monitoring governance and control systems and of the role of Internal Audit in providing independent assurance thereon; • States how the key themes which are integral to the assurance gathering process across the organisation’s activities will be covered to inform the annual Internal Audit opinion statement; • Describes the approach to the development of the risk based Internal Audit annual plan; • Sets out the relative allocation of Internal Audit resources; • Outlines how the Internal Audit programme of work will be delivered to add value; and • Describes the monitoring and reporting of the Internal Audit findings from its work and progress with its plans to the relevant organisation’s audit committee/board. 5 Internal Audit Annual Plan 2023/24 5.1 The key standards within the PSIAS which relate to the preparation of the internal audit plan are summarised below: • Standard 2010 – Planning which states that “the chief audit executive must establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organisation’s goals” • Standard 2020 – Communication and Approval which states that “the chief audit executive must communicate the internal audit activity’s plans and resource requirements, including significant interim changes, to senior management and the board for review and approval. The chief audit executive must also communicate the impact of resource limitations.” 5.2 The CIPFA Publication ‘Audit Committees: Practical Guidance for Local Authorities and Police – 2018 Edition’ states that “The audit committee Page 39 of 54
Page 40
should seek to make best use of the internal audit resource within the assurance framework. In particular, the audit committee should seek confirmation from internal audit that the audit plan takes into account the requirement to provide an annual internal audit opinion that can be used to inform the Annual Governance Statement. Specific activities will include: • Approving (but not directing) the risk-based plan, considering the use made of other sources of assurance.” 5.3 The CIPFA Publication also states that “The committee will wish to seek assurance from the HIA that appropriate risk assessment has been carried out as part of the preparation of the internal audit plans when they are presented.” 5.4 The Chief Internal Auditor (CAE) and the Principal Internal Auditor have developed the Internal Audit Annual Plan 2023/24 at Appendix 2, based on the Internal Audit staff resources set out in 6.1. It sets out the proposed range and breadth of audit activity to be undertaken to provide the independent and objective audit opinions to Midlothian Council and MIJB. 5.5 As part of the Internal Audit planning process it was necessary to consider each organisation’s priorities, plans, strategies, objectives, risks and mitigating controls, and the internal and external assurances provided to determine the priorities of the Internal Audit activity consistent with the organisation’s goals, as follows: • Analysis was undertaken of Internal Audit work during the past 5 years against the Audit Universe which has been significantly revised and realigned by the Principal Internal Auditor to reflect the current strategic and operational management arrangements and approach to service delivery to ensure appropriate coverage; • The Strategic Risk Profile was checked to confirm coverage on key strategic risks, as reliance is placed on the risk assessments carried out by the Risk Owners taking account of the risk ratings and mitigations; and • Account was taken of known external audit and inspection activities to avoid duplication of assurance work. 5.6 It is envisaged that 2023/24 will continue to be a year of change for the Council and other partner organisations. Therefore the Internal Audit Annual Plan 2023/24 should be considered to be flexible and will be periodically reviewed, and amended as required, to reflect any new arrangement or changing risks and priorities or available resources. Any amendments relating to the Council will be brought to the Corporate Management Team and the Audit Committee for approval. 5.7 The Non MLC days reflect the Council’s partnership working commitment to provide Internal Audit resource and services to the Midlothian Health and Social Care Integration Joint Board (MIJB). A separate Internal Audit Annual Plan 2023/24 will be presented to MIJB Audit and Risk Committee for approval. Page 40 of 54
Page 41
6 Report Implications (Resource, Digital, Risk and Equalities) 6.1 Resource The Local Authority Accounts (Scotland) Regulations 2014 that came into force on 10 October 2014 require a local authority to operate a professional and objective internal auditing service. Internal Audit must have sufficient staff and other resources to enable it to carry out the objectives of the Charter and to deliver a programme of independent and objective audit assurance work alongside other available sources of assurance to enable the Chief Audit Executive to prepare annual opinions on the adequacy of the overall control environment for Midlothian Council, and MIJB. The Internal Audit staff resource totalling 3.22 FTE comprises Chief Internal Auditor (0.5 FTE), Principal Internal Auditor (0.72 FTE), Internal Auditor (2.0 FTE). Each member of the current Internal Audit team has a professional internal audit or accountancy qualification, and has suitable experience, knowledge, skills and competencies (such as the Code of Ethics set out in PSIAS and the Seven Principles of Public Life) needed to deliver the Plan. After deduction for estimated annual leave, public holidays, absence including staff turnover, learning and development, and management and supervision, this equates to a total of 522 days available for Internal Audit activity (2022/23 plan 751 days). The reduction in available days reflects the budget provision for the staff and other resources set out above within the Revenue Financial Plans which were approved by the Council on 21 February 2023. The plans reflect the decrease in the budget available for Internal Audit and whilst completion of the annual plan will be possible within the current resources there is a risk of a lack of resilience in the Internal Audit team, with any unplanned or additional work will result in elements of the current plan becoming unachievable. 6.2 Digital There are no digital implications arising from this report. 6.3 Risk The Objectives of Internal Audit are set out in its Charter, including “As part of Midlothian Council’s system of corporate governance, Internal Audit’s purpose is to support the Council in its activities designed to achieve its declared objectives and to do so: As a contribution to the Council’s corporate management of risk.” Page 41 of 54
Page 42
Key components of the audit planning process include a clear understanding of the Council’s functions, associated risks, and potential range and breadth of audit activity for inclusion within the plan. As in previous years, to capture potential areas of risk and uncertainty more fully, reference has been made to the Strategic Risk Profile and key stakeholders have been consulted. The PSIAS require Internal Audit to evaluate the effectiveness of the Council’s Risk Management arrangements and contribute to improvements in the process. The work of Internal Audit (including its opinion on the control environment) shall contribute to the Council’s review of its corporate governance arrangements the outcome of which is published in the Annual Governance Statement. At all times, Management’s responsibilities (led by the Corporate Management Team) include: o Designing and maintaining proper risk management, governance and internal control processes and systems for which they have responsibility to ensure probity in systems and operations, including the prevention, detection and resolution of fraud and irregularities. These are not fixed but evolve as the Council changes. o Checking that these governance arrangements and internal controls are operating effectively and obtaining assurances from internal compliance, risk, inspection, quality, and control functions. (The above are known as the first and second lines.) o Engaging with Internal Audit (the third line) in a positive way to achieve shared goals for robust internal control and governance, best value and improvement, and ensuring that Internal Audit can properly fulfil its role. o Considering and acting upon Internal Audit findings and recommendations, including implementation of audit recommendations within agreed timescales and updating Pentana performance system, or accepting responsibility for any resultant risk from not doing so. o Seeking advice and consultancy support from Internal Audit on existing controls and on changes to and transformation of governance, processes and procedures. 6.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. The Internal Audit work is carried out in accordance with the appropriate legislation and professional standards. The latter includes compliance by those within the Internal Audit function with the Code of Ethics set out in the PSIAS. This is of particular importance and relevance for the profession of Internal Audit founded as it is on trust placed in its independent and objective assurance about risk management, internal control and governance. 6.5 Additional Report Implications (See Appendix A) Page 42 of 54
Page 43
Appendices Appendix A – Additional Report Implications Appendix 1 – Internal Audit Strategy Appendix 2 – Internal Audit Plan Page 43 of 54
Page 44
APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable Midlothian Council to deliver its key priorities in support of achieving the Council’s objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s Internal Audit service provision to assist the Council in achieving its objectives. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” Internal Audit is a key element of good governance which is important to enable Midlothian Council to achieve its objectives. Page 44 of 54
Page 45
Recommendations made by Internal Audit underpin the Council’s own continuous improvement arrangements to enhance its effectiveness, thus supporting the delivery of the Council’s best value duties. A.5 Involving Communities and Other Stakeholders The Chief Audit Executive is accountable to the Audit Committee which, in fulfilling its governance role, acts as a bridge between the Council and other stakeholders. The Audit Committee remit includes “To approve the risk-based internal audit plan, including internal audit’s resources requirements, the approach to using other sources of assurance and any work required to place reliance upon those other sources”. The Executive Management Team has been consulted on the Internal Audit resources, risk-based audit approach and the resultant planned Internal Audit coverage to ensure it will provide assurance on controls and governance relating to the key risks facing the Council and to assist them in discharging their roles and responsibilities. A.6 Impact on Performance and Outcomes Applying the framework of the PSIAS will give the Audit Committee assurance that the Internal Audit function is compliant with legislative requirements and current best practice. The delivery of the Internal Audit strategy and annual plan assists the Council in improving its performance and outcomes. A.7 Adopting a Preventative Approach The PSIAS are applicable from 1 April 2013 (amended 2017) which means the Internal Audit Service has taken steps to be fully compliant. Specific audits within the 2023/24 plan will include assessments on when a preventative approach can be adopted by the Council. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Internal Audit is a key element of good governance which is important to enable Midlothian Council to achieve its objectives including sustainable outcomes. Page 45 of 54
Page 46
Page 46 of 54
Page 47
INTERNAL AUDIT STRATEGY APPENDIX 1 1. AIM OF STRATEGY 1.1. The aim of this strategy is to guide MLC Internal Audit function in delivering a high quality internal audit service to Midlothian Council (MLC) and Midlothian Health & Social Care Integration Joint Board (MIJB), which is capable of: • providing the statutory annual assurance and audit opinion on the adequacy of each organisation’s risk management, internal control and governance arrangements to the relevant organisation’s senior management and board/audit committee; • carrying out all other objectives contained in Internal Audit’s Charter; and • adding value to each organisation by influencing and offering ways to enhance the governance and internal control environment in alignment to their strategic priorities. 2. STRATEGY OBJECTIVES 2.1. The objectives of this strategy are to: • Outline the assurance framework which comprises assurances from within the organisation and from external providers of assurance to improve the organisational understanding of the expectations of Internal Audit; • State how the key themes which are integral to the assurance gathering process across the organisation’s activities will be covered to inform the annual audit opinion statement; • Describe the approach to the development of the risk based Internal Audit annual plan; • Set out the relative allocation of Internal Audit resources; • Outline how the Internal Audit programme of work will be delivered to add value and will be prioritised to ensure those areas of greatest risk are covered during the audit year; and • Describe the monitoring and reporting of the Internal Audit findings from its work and progress with its plans to the relevant organisation’s audit committee/board. 3. ASSURANCE FRAMEWORK 3.1. It is Management’s responsibility to design and maintain proper risk management, governance and internal control processes and systems to ensure probity in systems and operations, and mitigation of risks, including the prevention, detection and resolution of fraud and irregularities. Management is also responsible for checking that the arrangements and controls are operating effectively and obtaining assurances from internal compliance, risk, inspection, quality, and control functions. These are known as the first and second lines. Internal Audit, as the third line, is the review function which will provide independent assurance on the effectiveness of the first and second lines of defence, challenge current practices, recommend best practice and improvements to lead to a strengthening of the control environment and management of risks, thus assisting the organisation in achieving its objectives. 3.2. The organisation’s assurance framework is the means by which the relevant organisation’s Senior Management and Audit Committee/Board ensures that they are properly informed on the risks of not meeting objectives or delivering appropriate outcomes and that it has adequate assurances on the design and operation of systems in place to mitigate those risks. 3.3. The assurance framework comprises assurances from within the organisation (from Management and compliance functions, and independent and objective assurance from Internal Audit) and from external providers of assurance. Examples of the latter include the Accounts Commission, External Audit (Audit Scotland for MLC and MIJB), Education Scotland, Care Inspectorate, Scottish Housing Regulator, and other regulators. 3.4. The assurances are considered during the annual review of the effectiveness of each organisation’s overall governance framework carried out by officers of each organisation and supported by Internal Audit. The output is the Annual Governance Statement which is included within the relevant organisation’s Annual Report and Accounts. Page 47 of 54
Page 48
3.5. Where audit assurance is required on services that are delivered jointly by public sector joint working arrangements which include the organisation as a partner, these assurances will be sought as appropriate from partners’ Internal Audit service providers and Management. 4. KEY THEMES INTEGRAL TO INTERNAL AUDIT ASSURANCE 4.1. Each organisation is responsible for ensuring that its business is conducted in accordance with the law and proper standards, and that public money is safeguarded and properly accounted for, and used economically, efficiently and effectively. Fundamentally corporate governance is about the systems and processes, and cultures and values that are used by the organisation to discharge those responsibilities in a timely, inclusive, open, honest and accountable manner. This includes: setting the strategic direction, vision, culture and values of the organisation; effective operation of corporate systems; processes and internal controls; engaging with and, where appropriate, lead communities; monitoring whether strategic objectives have been achieved and services delivered cost effectively; and ensuring that appropriate arrangements are in place for the managing risks. 4.2. The organisation’s statutory financial officer, Section 95 Officer or equivalent, i.e. Acting Chief Financial Officer (MLC) and Chief Finance Officer (MIJB), is responsible for the proper administration of the organisation’s financial affairs. Under his/her direction, the organisation’s system of internal financial control is based on a framework of Financial Regulations (rules and regulations for financial management or administration arrangements linked to other key financial documents that set out the policy framework, associated strategy, and the more detailed procedures and guidelines), regular Management Information, administrative procedures (including segregation of duties), Management Supervision, and a system of Delegation and Accountability. 4.3. The continued use of and investment in technology to support service delivery, and digital change and transformation to improve operations is a key part of the vision for each organisation. Arrangements in place are underpinned by the overarching framework of the ICT security policy designed to ensure that computer systems are secure, reliable and conform to nationally agreed standards, and by the ICT Strategy linked to Corporate Priorities designed to support effective and modern service delivery and to meet service objectives. 5. APPROACH TO PERIODIC PLANNING 5.1. The Internal Audit Strategy and the Internal Audit Annual Plan 2023/24 have been prepared in conformance with the Public Sector Internal Audit Standards (PSIAS) to fulfil the requirement to produce the statutory annual assurance and audit opinion for each organisation. 5.2. As part of the Internal Audit planning process it was necessary to consider each organisation’s priorities, plans, strategies, objectives, risks and mitigating controls, and the internal and external assurances provided to determine the priorities of the Internal Audit activity consistent with the organisation’s goals, as follows: • Analysis was undertaken of Internal Audit work during the past 5 years against the Audit Universe, which has been significantly revised and realigned to reflect the current strategic and operational management arrangements and approach to service delivery, to ensure appropriate coverage; • The Strategic Risk Profile was checked to confirm coverage on key strategic risks, as reliance is placed on the risk assessments carried out by the Risk Owners taking account of the risk ratings and mitigations; and • Account was taken of known external audit and inspection activities to avoid duplication of assurance work. 5.3. The audit planning process involves consultation with key stakeholders including discussions with Senior Management of each organisation to capture potential areas of risk and uncertainty more fully. This is of particular importance during a period of change and transformation as each organisation responds to new legislation or service delivery arrangements that might affect plans, priorities and resources. Page 48 of 54
Page 49
6. ALLOCATION OF INTERNAL AUDIT RESOURCES 6.1. The Internal Audit staff resource totalling 3.22 FTE comprises Chief Internal Auditor (0.5 FTE), Principal Internal Auditor (0.72 FTE), Internal Auditor (2.0 FTE). Each member of the Internal Audit team has a professional internal audit or accountancy qualification, and has suitable experience, knowledge, skills and competencies (such as the Code of Ethics set out in PSIAS and the Seven Principles of Public Life) needed to deliver the plan. The Available Days has been amended to reflect the Internal Audit resources after consideration of estimated annual leave, public holidays, absence including staff turnover, learning and development, and management and supervision. 6.2. It is estimated that around 80% of Available Days will be spent on assurance, and legislative and other compliance activities combined. The Assurance work includes sufficient work across a range and breadth of audit areas which assure those processes that are currently in place and which Management rely on to deliver services, and to enable preparation of the required annual audit opinion on the adequacy of the organisation’s control environment. 6.3. An estimate of 10% of Available Days will be spent on Other activities in support of the Internal Audit function meeting its wider objectives as set out in the Internal Audit Charter. 6.4. An estimate of around 4% of Available Days will be utilised on Consultancy activities which support Management in delivering innovation, change and transformation. Management seek this value added activity during this unprecedented period of change for Local Government though this allocation reflects a reasonable estimate of what is actually deliverable within the boundaries of the role of Internal Audit and the resources available. 6.5. It is estimated that around 6% of Available Days will be spent on the provision of Internal Audit services to Midlothian Health and Social Care Integration Joint Board (MIJB). This reflects MLC’s contribution of support resources as governance arrangements have changed in response to statutory partnership working for the provision of health and social care integration. 7. APPROACH TO DELIVERY OF PROGRAMME OF WORK 7.1. To facilitate operational delivery an Internal Audit Programme of Work will be developed which provides an indication of when work will be scheduled during the year, taking account of discussions with Senior Management and the availability of Internal Audit resources. 7.2. For each Assurance audit, in line with recognised good practice, an Audit Assignment detailing the scope, objectives and timing will be prepared and agreed with the relevant Chief Officer/Head of Service and Manager prior to commencement of Internal Audit fieldwork. Within assurance work: • The organisation’s Local Code of Corporate Governance (MLC/MIJB) will be used by Internal Audit as an integrated toolkit to test the extent of compliance. • End to end reviews of financial management and administration processes will be undertaken by Internal Audit to test the extent of compliance (as integral part of protecting public finances, safeguarding assets, and delivering services effectively and sustainably), and substantive testing of transactions including data analytics will be carried out to ensure completeness and accuracy. • The Plans (Financial and Asset Management) to deliver the organisation’s strategies, plans and priorities will be reviewed against best practice standards. • Internal Audit will consider fraud risk and prevention and detection controls, and other appropriate cross- cutting risks and controls (such as risk management, performance management, community engagement, equalities, business continuity, and health and safety), highlight examples of effective internal controls, and share good practice across service areas. • The ICT arrangements in place to protect each organisation from attack in relation to data security, integrity and availability will be tested and ICT Plans will be reviewed to confirm they support delivery of the organisation’s strategies and priorities. Page 49 of 54
Page 50
• National reports that give rise to introducing best practice arrangements or lessons learned from other local authorities or other public sector bodies will be considered and applied by Internal Audit to influence and offer ways to enhance governance and internal controls. 7.3. The Legislative and Other Compliance work will include testing in accordance with the terms of the funders’ service level agreements or legislative requirements, as part of the wider assurance framework. 7.4. Within Consultancy activities Internal Audit will add value to the Council as it transforms its service delivery models, re-designs its business processes, and utilises technology to automate processes by influencing and offering ways to ensure adequate governance, risk management and internal controls. Internal Audit in its ‘critical friend’ role will provide an independent view and challenge of a sample of programmes and projects, and an objective assessment of self-evaluation arrangements and improvement that underpin the provision of Best Value. 7.5. Other work will include: • Carrying out Follow-Up to monitor Management’s progress with implementation of Audit recommendations to: ensure that improvement actions have been timeously and effectively implemented; check that these have had the desired effect to manage identified risks; and demonstrate continuous improvement in internal control and governance. To facilitate the Internal Audit follow-up activity, Audit recommendations will continue to be input to Pentana, the corporate performance management system, to assist relevant Management in tracking and recording their implementation in a consistent way; • Performing potentially high risk Contingency audits, investigations and review of issues highlighted during the year that may be the result of a weakness in internal controls or that may be requested by Management or the Audit Committee; and • Delivering the Help Desk Facility where Internal Audit guidance and advice is given to Management on internal controls. 8. MONITORING THE WORK OF INTERNAL AUDIT 8.1. The Public Sector Internal Audit Standards (PSIAS) requires periodic reporting on the Internal Audit activity to the relevant organisation’s Senior Management and Audit Committee/Board. 8.2. Internal Audit assurance work completed and work in progress, and consultancy and other work for the Council associated with the delivery of the Plan will be outlined within regular reports to its Audit Committee. Specifically relating to Internal Audit assurance work, this report will include an Executive Summary of the audit objective, good practice, findings, recommendations, and audit opinion of assurance for each Final Internal Audit Report issued to relevant Senior Management in the period. 8.3. Regular progress updates on implementation by Management of relevant Audit recommendations will be reported periodically during the year to the relevant organisation’s Senior Management and Audit Committee/Board. 8.4. Internal Audit’s compliance with its Strategy, delivery of its risk-based Annual Plan, and outcomes of assessment(s) against Public Sector Internal Audit Standards (PSIAS) will be considered by the Chief Internal Auditor on a regular basis and formally reported every six months to the Council’s Corporate Management Team and the Audit Committee, through a Mid-Term Performance Report and within the Annual Assurance Report. 8.5. The Internal Audit Annual Assurance Report for each organisation (Midlothian Council and MIJB) to their respective Senior Management and Audit Committee/Board will provide the statutory annual audit opinion on the levels of assurance based on Internal Audit findings over the year to inform each organisation’s Annual Governance Statement. 8.6. The PSIAS requires an annual Internal Self-Assessment and an External Quality Assessment (EQA) each five years by appropriately qualified and independent reviewers to assess conformance with the Definition of Internal Auditing and Standards and the application of the Code of Ethics. The Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) have implemented a “peer review” framework, in which MLC participates, as a cost effective means of complying with the EQA requirement. Reporting on outcomes includes a statement on conformance with PSIAS and the quality assurance and improvement plan (QAIP) to enable an evaluation of the Internal Audit quality management framework and to identify opportunities for improvement. Page 50 of 54
Page 51
Internal Audit Annual Plan 2023/24 Appendix 2 Category Activity Days Commentary Assurance - Cyclical MLC Annual Assessment of Internal Control and Governance 20 Prepare an annual assurance report for Management and the Audit Committee summarising the work undertaken by Internal Audit during the year and forming an opinion on adequacy of the Council’s arrangements for risk management, governance and internal control. Continuous audit approach on progress with areas of improvement. Annual evaluation of compliance with the Local Code of Corporate Governance covering the corporate whole and individual Directorates/Services. Assurance - Risk Growing Council, Budgeting for Growth 30 Review the approach to including Population and infrastructure growth into future budget requirements across Council Services. Assurance - Risk Workforce Planning 30 Review of the strategy for recruitment, retention and training of employees across the Council, including a review of changes made in relation to new ways of working. Assurance - Cyclical Care Homes, Council and Private. 20 Review of the arrangements in place to manage the process of utilising appropriate bed spaces within care homes and the monitoring and control mechanisms in place to ensure quality care and best value. Assurance - Cyclical Council Tax Discounts and Exemptions 20 Review the processes in place to ensure that the Council is providing the appropriate Council Tax discounts and exemptions to those households with an entitlement to these discounts and exemptions whilst preventing any error or fraud. Assurance - Risk IT Audit 30 Review Core IT controls following a more detailed review of the current control environment with the It teams to establish best use assurance resources between Internal and External Audit. Assurance - Risk Developer Contributions 30 Review the processes in place to ensure that appropriate contributions are received for Infrastructure as a result of Housing Development and the governance, Control and risk management processes in place to ensure that the calculations for the value of contributions to be received are based on accurate and complete information. Category Activity Days Commentary Page 51 of 54
Page 52
Assurance - Risk Children's Services Continued Care 30 Review the processes around continuation of care for looked after children. Assurance - Cyclical Payroll 20 Review the processes in place to ensure complete, accurate and timely payment of Council staff (including Teachers payroll) in accordance with the Contractual terms and Conditions of the employees. Assurance - Risk Absence & Performance Management 30 Review the operation of the systems in place for monitoring of absence to ensure maintenance of staff wellbeing in new working environments and capacity for service delivery. Review the operation of performance management processes across the Council following COVID recovery. Assurance - Cyclical Licensing 20 Review the policies, processes and procedures in place to ensure the effective licensing services are in place and subject to effective governance. Assurance - Risk School Budgets Devolved School Management (DSM) 30 Review of internal financial controls and business administrative procedures in place and data analytics of expenditure (DSM, PEF and other Funds including Schools Funds) to ensure the efficient and effective use of resources in the school establishments, to complement the assurance received from Education Scotland arising from their inspection programme of schools. Assurance - Risk Property assets and property strategy 20 Review the processes of developing a property asset management strategy and the governance of the implementation. Assurance - Risk Risk Management 20 Review the Risk Management governance and control arrangements across the Council to ensure that they are providing, good quality, timely, complete and accurate reporting to all senior management, council members and other stakeholders Council risk information. Consultancy Consultancy 20 In its ‘critical friend’ role provide: an independent view and challenge of a sample of programmes and projects (including Learning Estate Strategy, Business Transformation Board, Information Management Group); and an objective assessment of self-evaluation arrangements. Category Activity Days Commentary Page 52 of 54
Page 53
Other MLC Audit Committee Self- Assessment 5 Provide assistance to Chair in undertaking a self-assessment of the Audit Committee against the CIPFA best practice guidance. Assurance - Cyclical MLC Recommendation Follow Up Reviews 30 Undertake 2 reviews: the first includes a sample check on the adequacy of new internal controls for Audit Actions flagged as closed, and the second assesses performance against closing Audit Actions by the agreed due date. Other Contingency 20 Support / undertake any investigations and other reactive work to ensure high risk issues and concerns identified by Management or Audit Committee during the year are appropriately addressed. Other Help Desk Enquiry system 20 Provide guidance and advice to Management and Staff on internal controls. Manage any enquiries received through the whistle- blowing facilities offered by the Council. Other MLC Administration of Audit Scotland Reports 2 Monitor publication of Audit Scotland reports and co-ordinate submission by Management of Audit Scotland Reports to the relevant Committee. Other Risk Management Group 5 Attend and provide support to the Risk Management Group, the Serious and Organised Crime Group, and the Integrity Group. Other MLC Attendance at Boards / Committees 10 Prepare for and attend Audit Committee meetings and other Boards/Committees as relevant. Other MLC Audit Planning for 2023/24 10 Update the Audit Universe, check risk registers and other sources of assurance, and develop and consult on proposed coverage within the Internal Audit Annual Plan 2023/24. MIJB Assurance Midlothian Health and Social Care Integration Joint Board 40 Audit reviews and support to be determined and agreed by the Midlothian Health and Social Care Integration Joint Board Audit and Risk Committee for review of the adequacy of the MIJB’s arrangements for risk management, governance and internal control for delegated resources. Total Days 2023/24 522 Page 53 of 54
Page 54
Page 54 of 54