Agenda Document Pack - Audit Committee - 18/03/2024
Midlothian Council · 18 March 2024
Back to Audit Committee — 18 March 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Notice of Meeting and Agenda Audit Committee Venue: Council Chambers/Hybrid, Midlothian House, Dalkeith, EH22 1DN Date: Monday, 18 March 2024 Time: 11:00 Executive Director : Place Contact: Clerk Name: Democratic Services Clerk Telephone: Clerk Email: democratic.services@midlothian.gov.uk Further Information: This is a meeting which is open to members of the public. Privacy notice: Please note that this meeting may be recorded. The recording may be publicly available following the meeting. If you would like to know how Midlothian Council collects, uses and shares your personal information, please visit our website: www.midlothian.gov.uk Page 1 of 114
Page 2
1 Welcome, Introductions and Apologies 2 Order of Business Including notice of new business submitted as urgent for consideration at the end of the meeting. 3 Declaration of Interest Members should declare any financial and non-financial interests they have in the items of business for consideration, identifying the relevant agenda item and the nature of their interest. 4 Minute of Previous Meeting 4.1 Minute of meeting of 29 January 2024 submitted for approval 3 - 10 4.2 Action log 11 - 12 5 Public Reports 5.1 Annual Audit Plan 2023/24, report by Audit Scotland, External Auditors 13 - 32 5.2 Internal Audit Work to February 2024, report by Chief Internal Auditor 33 - 42 5.3 Counter Fraud Annual Plan 2024/25, report by Chief Internal Auditor 43 - 48 5.4 Internal Audit Charter, report by Chief Internal Auditor 49 - 58 5.5 Internal Audit Strategy and Annual Plan 2024/25, report by Chief Internal Auditor 59 - 74 5.6 Strategic Risk Profile Q3 2023/24, report by Chief Officer Place 75 - 114 6 Private Reports No items for discussion 7 Date of Next Meeting The next meeting will be held on Tuesday 14 May 2024 at 2.00pm. Page 2 of 114
Page 3
Minute of Meeting Audit Committee Date Time Venue Monday 20 January 2024 11.00 am Council Chamber/Hybrid Present: Councillor Milligan (Chair) Councillor Bowen Councillor McCall Councillor McEwan Councillor Smaill In Attendance: Grace Vickers Chief Executive Alan Turpie Legal and Governance Manager/Monitoring Officer Kevin Anderson Executive Director Place Fiona Robertson Executive Director Children, Young People & Partnerships Morag Barrow Director Health and Social Care Derek Oliver Chief Officer Place David Gladwin Chief Financial Officer Duncan Stainbank Chief Internal Auditor Elaine Greaves Principal Internal Auditor Gary Thomson Senior Finance Officer Patricia Fraser Audit Scotland Janet Ritchie Democratic Services Officer Hannah Forbes Democratic Services Assistant Audit Committee Monday 18 March 2024 Item No 4.1 Item 4.2 Page 3 of 114
Page 4
1. Welcome and Apologies for Absence The Chair welcomed everyone to the meeting and drew the committee’s attention to the issue with the online papers which were reinstated on Friday and if everyone agreed to accept all papers the meeting would proceed. 2. Order of Business The order of business was as detailed in the agenda previously circulated. 3. Declarations of interest No declarations of interest were intimated at this stage of the proceedings. 4. Minutes of Previous Meetings 4.1 The minute of the meeting of 30 October was submitted for approval. Mr Gladwin highlighted a typo on page 6 which should read Section 95 Officer, not Section 75 Officer. The minute was approved with this amendment. Councillor Smaill highlighted that during the discussion on the Newbattle site it was noted that a paper would be presented to March Council then on to the Audit Committee and Mr Anderson in confirming also confirmed that the policy on new houses cost benefit would include passive housing in the analysis and there is no additionality to the rent for passive house status but there is for the new build supplement policy. 4.2 The minute of the meeting of the Special meeting of 5 December 2023 was submitted and approved as a correct record. 4.3 The Action log was submitted and noted. Councillor Smaill highlighted that Hillend was not on the action log and due to the issues should this be added. Mr Anderson advised that the reporting mechanism was in place and that the Internal Audit review report be reported back to the Audit Committee. Mr Stainbank confirmed that the work on Hillend will proceed shortly, and a report will be brought back to the June Audit Committee. Councillor Smaill further raised the problems of the road and that it was important to receive assurance that this project would get back on track. Mr Anderson provided an update on the two active contracts, one in relation to the road issue and the other the Alpine Coaster and there is one other in respect of tendering for the main building. Mr Anderson further advised that there has been a resolution in terms of the water pipes and the work will be undertaken by the civil contractor on site and the revised programme will be reported to the Hillend project board this week and this will in turn be reported to the Business Transformation Steering Group. Page 4 of 114
Page 5
5 Public Reports Report No. Report Title Submitted by: 5.1 Annual Audit Report to Members and the Controller of Audit - year ended 31 March 2023 Chief Financial Officer and Section 95 Officer Outline of report and summary of discussion In accordance with the Treasury Management Code of Practice, the annual Treasury Management & Investment Strategy (TMIS) & Prudential Indicators report was required to be adequately scrutinised before being recommended to the Council. For Midlothian, this role was undertaken by the Audit Committee, with this report being presented to Audit Committee on 29 January 2024 prior to consideration by Council on 27 February 2024. The purpose of the report to Council will be to provide an update on the implementation of the Council’s TMIS 2023/24, and to make recommendations to facilitate consideration of the 2024/25 Strategy, specifically the TMIS for 2024/25, the Prudential and Treasury indicators contained therein, and the approach to the statutory repayment of loans fund advances. Any revisions arising from Audit Committee consideration of the report on 29 January 2024 will be incorporated into the final version of the report to Council on 27 February 2024. Mr Gladwin in presenting this report advised that there were no material changes from the existing strategy presented to Council in February 2023 and advised that the only change asked of Members was to increase the authorised limit for external debt to £545.673 million to reflect anticipated borrowing to the end of the financial year 2024/25. Mr Gladwin highlighted the main sections contained within the report and outlined the recommendations as set out in the report. Councillor Smaill raised the reconciliation of the steep increase on the borrowing capacity and the impact on the general reserves and the impact on the ability to have a balanced budget each year. Mr Gladwin in responding confirmed the importance of the capital plan in the context of the Medium-Term Financial Strategy (MTFS). Mr Gladwin then explained that discussions will take place with elected members in the coming weeks as the 24/25 budget is prepared and he will be restating MTFS projections through to 28/29 or possibly 29/30 including up to date projected debt charges. Further discussion took place with regards to the increase in the debt limit, the overall long-term affordability, and the cost of borrowing. Councillor McEwan asked for clarity on the increase of the borrowing limit for future years and Mr Gladwin confirmed that this is the maximum amount Officers have authority to borrow as based on the capital plans in place. In previous years TMIS the authorised borrowing limit has been set looking out for a number of years. Whilst the Council strives to get to a long-term sustainable medium term financial strategy it is considered prudent to limit the authorised limit to the following financial year only. Page 5 of 114
Page 6
Decision The Audit Committee endorsed the recommendations which are proposed to be put to Council on 27 February 2024: a) Approve the restriction of the Authorised Limit to the value of the Capital Financing Requirement at 31 March 2025 (£545.673 million), pending finalisation of the General Services Capital Plan Prioritisation. b) Note that there are no other material changes proposed to the Treasury Management and Investment Strategy (TMIS) for 2024/25 from the strategy currently in place, other than to update the Prudential Indicators (Section 5 and Appendix 2), to reflect the revised capital plans. c) Note the retention of the current approach for the repayment of loans fund advances as outlined in Section 6 and that any changes arising from the Scottish Government’s consultation on the Amendment to the Local Authority (Capital Finance and Accounting) (Scotland) Regulations 2016 will be reflected in a revised TMIS if required; and d) Accordingly approve the Treasury Management and Investment Strategy for 2024/25. Action Chief Financial Officer and Section 95 Officer Report No. Report Title Submitted by: 5.2 Follow-Up Review of Completed Internal Audit Recommendations Chief Internal Auditor Outline of report and summary of discussion The purpose of this report was to provide an update to members of the Audit Committee on the results of the Internal Audit Follow-up review which included a sample check on the adequacy of new internal controls for Internal Audit recommendations marked as completed by Management in the period April 2022 to March 2023. This report also provides an update to members of the Audit Committee on the status of the implementation by Management of audit recommendations made and agreed in Internal Audit reports. Mr Stainbank in presenting this report outlined that of the 41 recommendations selected, 27 were fully completed, 8 were partly completed and required further work and 6 were not implemented as detailed within the report. Decision The Audit Committee: (a) Noted the results from the sample check of Internal Audit recommendations that have been marked as completed by Management in the period April 2022 to March 2023 to improve internal controls and governance and mitigate risks. Page 6 of 114
Page 7
(b) Acknowledged the progress made by Management in implementing Internal Audit recommendations to improve internal controls and governance, to mitigate risks, and consider whether it is satisfied with the progress made by Management. (c) Considered whether it is satisfied with the outcomes or whether any further action is required. (d) Endorsed the proposal to extend the due dates for the overdue recommendations. (e) Noted that Internal Audit will continue to monitor for completion the outstanding recommendations and will provide update reports to the Audit Committee. Report No. Report Title Submitted by: 5.3 Internal Audit Mid-Term Performance Report 2023/24 Chief Internal Auditor Outline of report and summary of discussion The purpose of this report was to inform the Audit Committee of the progress Internal Audit has made in the first 9 months of the year to 31 December 2023, towards completing the Internal Audit Annual Plan 2023/24. It also summarises the statutory obligations for Internal Audit and requirements of the Public Sector Internal Audit Standards. Mr Stainbank in highlighting the main sections contained within the report advised that the Internal Audit plan had, in addition to regularly required review processes, 13 audits scheduled for completion in 2023/24 and that 2 assignments were substituted for other risk work which had been identified during the year and is detailed on the appendix to the report. Mr Stainbank advised that these audits had been replaced by Property leases as detailed in item 5.5 on today’s agenda and work which will be completed in relation to the Hillend project. Mr Stainbank in responding to a comment raised by Councillor Smaill regarding the fact the internal audit team was smaller, advised that the team had been reduced by 1fte but the plan was appropriately sized for this but they were at risk should a member of the team go off unwell it would then have to be reviewed but as no-one was off they were still hoping to complete the work by June 2024. Decision The Audit Committee: (a) Noted the progress Internal Audit has made with activity in the Internal Audit Annual Plan 2023/24 to the end of December 2023. (f) Confirmed that it is satisfied with the performance of the Internal Audit service provision. Page 7 of 114
Page 8
Report No. Report Title Submitted by: 5.4 Internal Audit Work to December 2023 Chief Internal Auditor Outline of report and summary of discussion The purpose of this report is to provide members of the Audit Committee with details of the recent work carried out by Internal Audit and the findings and recommended audit actions agreed by Management to improve internal controls and governance arrangements. Mr Stainbank in presenting this report advised on the 2 audits which were completed and highlighted the recommendations as detailed within the appendices. Councillor Smaill with regards to care home raised the issue of the financial stress and asked if the council was liable to be faced with a large demand from the IJB. Ms Barrow in responding advised possibly yes, and that discussions have been taking place and this has been reported to the IJB and that a financial recovery plan is in place and has achieved a lot of savings but there still may be a gap for this financial year and going into next financial year it will be significantly worse. Following on from this Mr Smaill asked if this would be brought to some certainty before the budget setting on the 27 February. Ms Barrow further updated that the IJB will meet on 8 February and that there are still some variances around the assumptions made as part of the overspend position relating to how some of the internal systems work but still believe there will be a pressure at the end of the year. Decision The Audit Committee: (a) Considered the Executive Summaries of the final Internal Audit assurance reports issued associated with the delivery of the approved Internal Audit Annual Plan 2023/24. (b) Noted the Internal Audit Consultancy and Other Work carried out in accordance with the approved Internal audit Charter. (c) Acknowledged the assurance provided on internal controls and governance arrangements in place for the areas covered by this Internal Audit work. Report No. Report Title Submitted by: 5.5 Lease of Premises: Burnbrae Road, Bonnyrigg Chief Internal Auditor Outline of report and summary of discussion The purpose of this report was to provide members of the Audit Committee with details of the recent work carried out by Internal Audit following an instruction from the Council meeting on 29 August 2023. Page 8 of 114
Page 9
The instruction in the minute was that the Council had agreed: • That Internal Auditors investigate the position of the retail unit at Burnbrae Road, and that the Council are at no undue risk. • That an update is provided ‘in private’ on the retail unit currently being constructed adjacent to this building, in Buccleuch Street. Mr Stainbank in presenting this report advised that Internal Audit has reviewed the situation of the retail unit at Burnbrae road which was subject to the inherent commercial risks of developing retail unit space as part of any place making development. Mt Stainbank highlighted the main points contained within the report confirming that whilst commercial risk had been identified in relation to the development of this retail unit, this risk was being appropriately managed. He further advised that Internal Audit have no concerns over the processes being undertaken in relation to the units at Buccleuch street that they would bring to the attention of the Audit Committee although the process remains ongoing. The Chair highlighted that he disagreed with the statement that the position of the retail unit at Burnbrae Road that the Council were at no undue risk and further highlighted the that it was very concerning that there was no legal guarantee that the company who signed up to it would take it although the council were committed to spending the money. He further advised on how it would work with the private sector and although the units are now complete there was no legal signed agreement and while these were empty, there was the risk of vandalism and there should be a recommendation before a commitment is made to this amount of money that there is some guarantee that there is a customer at the back of it. Mr Stainbank in responding advised that there is a commercial risk in developing properties on this basis but advised that getting a legally enforceable agreement in place prior to building work commencing is unlikely in these circumstances and further advised that there was a written agreement in relation to Burnbrae road indicating that the company intended to lease the premises when available , however that was not legally enforceable as it was not a full lease at the point that the development was commencing. He further advised that it is extremely difficult to get a company to sign up to a full lease prior to building commercial properties therefore there is a level of risk in making those decisions to develop properties. The Chair further highlighted that before the council commits to spending this type of money in the future there should be some reasonable degree of certainty there is a client at the end of it. Councillor Smaill highlighted that at 3.6 of the report it states that there is a major supermarket retailer and that a final lease is now available for signature during January 2024 and wondered what stage this was now at and highlighted if there was a long void period what would be the impact on insurance costs. . Mr Anderson in responding advised that the conclusion was anticipated to be settled on 9 February 2024 and in terms of Buccleuch Street there was one Page 9 of 114
Page 10
settlement and the other in negotiation with a favourable expectation of the wider scope of Dalkeith Town Centre. In responding to a further question raised by Councillor Smaill with regards to the Buccleuch Street units being converted into a residential properties if these were not taken up as commercial units, advised that while commercial units can be converted into residential status these were not built with that expectation and it was unlikely to be a requirement due to the active retail interest in Buccleuch Street and confirmed also there has been no financial detriment relative to rental charge for Burnbrae. Decision The Audit Committee noted the work undertaken by Internal Audit in response to the instruction, from the Council on 29 August 2023 to review the lease of the retail premises at Burnbrae Road Bonnyrigg. 6 Private Reports None 7 Date of Next Meeting Date of Next Meeting: Monday 18 March 2024 at 11am. The meeting terminated at 11.39 pm. Page 10 of 114
Page 11
Audit Committee Action Log No Subject Date Action Action Owner Expected completion date Comments 1 5.1 Treasury management 06/12/2022 Session with members to be organised with regards to Responsible treasury management/ethical issues. Chief Financial Officer Ongoing Carry forward, paper coming forward regarding CSG and ethical depositing coming later in the year. 2 5.2 Annual Accounts for the year ended 31 March 2023 30/10/2023 Agreed that Members would discuss the governance arrangements in place for reporting any capital projects overspends within their individual groups and provide further feedback to officers Committee Recommend for closure: Capital Plan Prioritisation reported to council includes recommended governance arrangement changes. 3 5.6 Council House Building Programme – Progress Update 2023 30/10/2023 Mr Anderson to report back in due course on the actual cost per unit of the 10 houses within the Buccleuch Street development Kevin Anderson June 2024 Recommend for closure: Passivhouse cost comparison report on Council Agenda 27 March and will forward further onto Audit Committee 4 4.3 Action Log Hillend Project 29/01/2024 Hillend Project was raised, and Internal Audit confirmed that the work will be commencing shortly and will submit report to the Audit Committee. Duncan Stainbank June 2024 Audit Committee Monday 18 March 2024 Item No 4.2 Page 11 of 114
Page 12
Page 12 of 114
Page 13
Prepared for The Midlothian Council March 2024 Midlothian Council Annual Audit Plan Audit Committee Monday 18 March 2024 Item No 5.1 Page 13 of 114
Page 14
Midlothian Council | 2 Contents Introduction 3 Annual accounts 5 Wider Scope and Best Value 11 Reporting arrangements, timetable, and audit fee 14 Other matters 17 Appendix 1: Your audit team 19 Page 14 of 114
Page 15
Introduction | 3 Introduction Summary of planned audit work 1. Claire Gardiner has been appointed by the Accounts Commission as external auditor of Midlothian Council for the period from 2022/23 until 2026/27. The 2023/24 financial year is therefore the second year of the five-year audit appointment. A brief biography of the audit team is provided at Appendix 1. 2. This document summarises the work plan for our 2023/24 audit. The main elements of the audit include: • an audit of the financial statements and an opinion on whether they give a true and fair view and are free from material misstatement • an audit opinion on other statutory information published with the financial statements in the annual accounts, including the Management Commentary, the Annual Governance Statement, and the Remuneration Report • consideration of arrangements in relation to wider scope areas: financial management; financial sustainability; vision, leadership and governance; and use of resources to improve outcomes • consideration of Best Value arrangements • providing assurance on the Housing Benefit Subsidy Claim, Non- Domestic Rates Return, the Whole of Government Accounts (WGA) return • a review of Midlothian Council’s arrangements for preparing and publishing statutory performance information • provision of an Independent Auditor’s Report expressing my opinions on the different elements of the annual accounts and an Annual Audit Report setting out conclusions on the wide scope areas. Respective responsibilities of the auditor and Midlothian Council 3. The Code of Audit Practice sets out in detail the respective responsibilities of the auditor and the Midlothian Council. Key responsibilities are summarised below. Auditor responsibilities 4. The auditor’s responsibilities are established by the Local Government (Scotland) Act 1973 and the Code of Audit Practice (including supplementary guidance) and guided by the Financial Reporting Council’s Ethical Standard. Page 15 of 114
Page 16
Introduction | 4 5. Auditors in the public sector give an independent opinion on the financial statements and other information within the annual accounts. We also review and report on the wider scope arrangements in place at the Midlothian Council. In doing this, we aim to support improvement and accountability. Midlothian Council’s responsibilities 6. Midlothian Council is responsible for maintaining adequate accounting records and internal controls, and preparing financial statements for audit that give a true and fair view. They are also required to produce other reports in the annual accounts in accordance with statutory requirements. 7. Midlothian Council has the primary responsibility for ensuring the proper financial stewardship of public funds, compliance with relevant legislation, and establishing effective arrangements for governance, propriety, and regularity that enable them to deliver their objectives. Adding Value 8. We aim to add value by: • tailoring audit work to the circumstances of Midlothian Council and the audit risks identified • being constructive and forward looking • providing independent conclusions • attending meetings of the Audit Committee, and • recommending and encouraging good practice. 9. In so doing, we will help the Midlothian Council promote improved standards of governance, better management and decision making, and more effective use of resources. Page 16 of 114
Page 17
Annual accounts | 5 Annual accounts Introduction 10. The annual accounts are an essential part of demonstrating Midlothian Council’s stewardship of resources and its performance in the use of those resources. 11. We are required to perform an audit of the financial statements, consider other information within the annual accounts, and express a number of audit opinions in an Independent Auditor's Report in accordance with International Standards on Auditing (ISAs) in the UK, Practice Note 10 from the Public Audit Forum which interprets the ISAs for the public sector, and guidance from Audit Scotland. 12. We focus our work on the areas of highest risk. As part of our planning process, we perform a risk assessment highlighting the audit risks relating to each of the main financial systems relevant to the production of the financial statements. Materiality 13. The concept of materiality is applied by auditors in planning and performing the audit, and in evaluating the effect of any uncorrected misstatements on the financial statements. We to plan our audit to obtain reasonable assurance about whether the financial statements are free from material misstatement. The assessment of what is material is a matter of professional judgement over both the amount and the nature of the misstatement. Materiality levels for the 2023/24 audit 14. We assess materiality at different levels as described in Exhibit 1. The materiality values for Midlothian Council and its group are set out in below. Exhibit 1 2023/24 Materiality levels for Midlothian Council and its group Materiality Amount Planning materiality – This is the figure we calculate to assess the overall impact of audit adjustments on the financial statements. Materiality has been set based on our assessment of the needs of the users of the financial statements and the nature of the Midlothian Council’s operations. For the year ended 31 March 2024, we have set our materiality at 2% of gross expenditure based on the audited financial statements for 2022/23. £10.2 million Performance materiality – This acts as a trigger point. If the aggregate of errors identified during the financial statements audit exceeds performance materiality, £6.1 million Page 17 of 114
Page 18
Annual accounts | 6 this could indicate that further audit procedures are required. Using our professional judgement, we have assessed performance materiality at 60% of planning materiality. Reporting threshold (i.e. clearly trivial) – We are required to report to those charged with governance on all unadjusted misstatements more than the ‘reporting threshold' amount. £400,000 Source: Audit Scotland Significant risks of material misstatement to the financial statements 15. Our risk assessment draws on our cumulative knowledge of Midlothian Council, its major transaction streams, key systems of internal control, and risk management processes. It is informed by our discussions with management, meetings with internal audit, attendance at committees, and a review of supporting information. 16. Audit risk assessment is an iterative and dynamic process. Our assessment of risks set out in this plan may change as more information and evidence becomes available during the progress of the audit. Where such changes occur, we will advise management, and where relevant, report them to those charged with governance. 17. Based on our risk assessment process, we identified the following significant risks of material misstatement to the financial statements. These are risks which have the greatest impact on our planned audit procedures. Exhibit 2 summarises the nature of the risks, management’s sources of assurance over these risks, and the further audit procedures we plan to perform to gain assurance over the risks. Exhibit 2 2023/24 Significant risks of material misstatement to the financial statements Significant risk of material misstatement Management’s sources of assurance Planned audit response 1. Risk of material misstatement due to fraud caused by management override of controls As stated in ISA (UK) 240, management is in a unique position to perpetrate fraud Owing to the nature of this risk, assurances from management are not applicable in this instance. • Assess the design and implementation of controls over journal entry processing. • Make inquiries of individuals involved in the financial reporting process about inappropriate or unusual activity relating to the processing of journal entries and other adjustments. • Test journals at the year-end and post-closing entries and focus on significant risk areas. • Consider the need to test journal entries and other adjustments throughout the year. Page 18 of 114
Page 19
Annual accounts | 7 Significant risk of material misstatement Management’s sources of assurance Planned audit response because of management’s ability to override controls that otherwise appear to be operating effectively. • Evaluate significant transactions outside the normal course of business. • Assess any changes to the methods and underlying assumptions used to prepare accounting estimates compared to the prior year. • Carry out substantive testing of income and expenditure transactions around the year-end to confirm they are accounted for in the correct financial year. • Conduct focussed testing of accounting accruals and prepayments. • Assess the adequacy of controls in place for identifying and disclosing related party relationship and transactions in the financial statements. 2. Estimation in the valuation of land and buildings. There is a significant degree of subjectivity in the valuation of land and buildings. Valuations are based on specialist and management assumptions, and changes in these can result in material changes to valuations. All non-current assets are revalued on a five-year rolling basis. Values may also change year on year, and it is important that the Midlothian Council ensures the financial statements accurately reflect the value of the land and buildings. • Council procedures and controls around valuation and accounting. • Review the information provided to the valuer to assess for completeness. • Evaluate the competence, capabilities, and objectivity of the professional valuer. • Complete a walkthrough of the valuation process to obtain an understanding of the process, including the methodologies and assumptions applied. • Obtain an understanding of the management’s involvement in the valuation process to assess if appropriate oversight has occurred. • Examine management’s assessment of any assets not revalued in 2023/24 against evidence of changes in other revalued assets. • Test the reconciliation between the financial ledger and the property asset register. • Perform sample testing of individual asset valuations and lives. Page 19 of 114
Page 20
Annual accounts | 8 Significant risk of material misstatement Management’s sources of assurance Planned audit response Due to the inherent complexity and subjectivity risks regarding land, buildings and dwellings’ valuations, a significant risk of material misstatement in the 2023/24 valuations has been identified. Source: Audit Scotland 18. As set out in ISA (UK) 240: The auditor’s responsibilities relating to fraud in an audit of financial statement, there is a presumed risk of fraud over the recognition of revenue. There is a risk that revenue may be misstated resulting in a material misstatement in the financial statements. We have considered the risk that revenue may be misstated resulting in a material misstatement in the financial statements. 19. We have rebutted this risk as funding received from Scottish Government is clearly communicated and can be readily agreed to third party confirmations. In addition, Midlothian Council’s other income streams comprise of a high volume of low value transactions, and we have concluded there is limited opportunity or incentive to manipulate the recognition of income in the financial statements. 20. We also considered the risk of fraud over expenditure, as most public bodies are net spending bodies, and the risk of fraud related to expenditure recognition may be greater that the risk relating to revenue recognition (in accordance with Practice Note 10: Audit of Financial Statements and Regularity of Public Sector Bodies in the UK). We have rebutted the presumption that a material risk exists within expenditure. This is on the basis that: • Most expenditure is in areas considered low-risk due to the nature of the expenditure streams or where individual transactions are relatively small in scale and therefore are unlikely to result in material misstatements • Evidence of external fraud from counter fraud services and the National Fraud Initiative does not indicate material risk • Experience in the sector, including a review of past misstatements, does not indicate material risk. Page 20 of 114
Page 21
Annual accounts | 9 21. We have not, therefore, incorporated specific work into our audit plan in these areas over and above our standard audit procedures. Other areas of audit focus 22. As part of our assessment of audit risks, we have identified one other area where we consider there is also a risk of material misstatement to the financial statements. Based on our assessment of the likelihood and magnitude of the risk, we do not consider this to represent a significant risk. We will keep this area under review as our audit progresses. 23. The area of specific audit focus is: • Valuation of pension liability: The liability requires the use of an actuarial methodology based on a range of assumptions including financial and demographic assumptions. Small movements in these can result in material changes to valuations. We will assess the scope, independence and competence of the professionals engaged in providing estimates for pensions and review appropriateness of actuarial assumptions and results including comparison with other councils. We will establish officer’s arrangements for ensuring the reasonableness of professional estimations and the accuracy of information provided to the actuary by Midlothian Council. 24. As part of our risk assessment, we have also identified the following areas where further work will be performed. These are not audit risks but areas we will keep under review: • IFRS 16 takes effect for local government bodies from 2024/25.This will change the way in which Midlothian Council accounts for operating leases, including recognising assets and liabilities for the rights and obligations arising from leases previously classified as operating leases. We will assess Midlothian Council’s preparedness for this and review any disclosure made in relation to the new standard in line with guidance. • The statutory override relating to valuation of infrastructure assets is due to end for the 2024/25 financial statements. We will review the progress made by Midlothian Council in preparing for this. Group Consideration 25. As group auditors, we are required under ISA (UK) 600: Audits of group financial statements (including the work of component auditors) to obtain sufficient appropriate audit evidence on which to base our audit opinion on the group financial statements. 26. Midlothian Council has a group which comprises component entities, including subsidiaries, associates, and joint ventures. Our planned audit approach for the components is informed by our assessment of risk at Midlothian Council and our consideration of the size and nature of assets, liabilities, and transaction streams. In addition to Midlothian Council the group comprises four components which we Page 21 of 114
Page 22
Annual accounts | 10 have assessed as not financially significant, our procedures with therefore be limited to agreement to agreement to component accounts and analytical procedures. 27. We will obtain sufficient appropriate audit evidence in relation to the consolidation process to support our group audit opinion. Page 22 of 114
Page 23
Wider Scope and Best Value | 11 Wider Scope and Best Value Introduction 28. Reflecting the fact that public money is involved, public audit is planned and undertaken from a wider perspective than in the private sector. The Code of Audit Practice sets out the four areas that frame the wider scope of public sector audit, and requires auditors to consider and conclude on the effectiveness and appropriateness of the arrangements in place for each wider scope area in audited bodies. 29. In summary, the four wider scope areas are: • Financial management – this means having sound budgetary processes. We will consider the arrangements to secure sound financial management, including the strength of the financial management culture, accountability, and arrangements to prevent and detect fraud, error, and other irregularities. • Financial sustainability – we will look ahead to consider whether Midlothian Council is planning effectively to continue to deliver services. We will also comment on financial sustainability in the medium (two to five years) to longer term (longer than five years). • Vision, leadership, and governance – we will conclude on the clarity of plans in place to deliver the vision, strategy, and priorities adopted by Midlothian Council. We also consider the effectiveness of the governance arrangements to support delivery. • Use of resources to improve outcomes – Midlothian Council must make best use of their resources to meet stated outcomes and improvement objectives. We will consider how Midlothian Council demonstrates economy, efficiency, and effectiveness through the use of financial and other resources. Wider scope risks 30. We have identified significant risks in the wider scope areas set out in Exhibit 3. This exhibit sets out the risks, management’s sources of assurance for the risks, and the further audit procedures we plan to perform to gain assurances over the risks. Exhibit 3 2023/24 Wider scope risks Page 23 of 114
Page 24
Wider Scope and Best Value | 12 Description of risk Management’s sources of assurance Planned audit response 1. Financial Sustainability The council’s five-year financial strategy, which is considered regularly, identifies a cumulative funding gap of £21 million for the period 2024/25 to 2028/29. There is a risk to financial sustainability and that there is inadequate resource to maintain delivery and quality of services in the short to medium term. • Regular update of medium and longer term financial plans that take account of the significant financial challenges facing the council. • Well established procedures for the monitoring and reporting of the council’s financial performance. • The application of Financial Management and Control Code of Practice. • Review of the council’s annual budget setting arrangements. • Assess the adequacy of the council’s medium and longer term financial plans. • Review and assessment of budget monitoring arrangements. • Assess the council’s savings programme, including the reasonableness of future savings plans and the adequacy of progress reports to committee. 2. IT Control Environment The expansion in the use of digital technology across the public sector increases the risk profile for public sector bodies and requires increased attention to the control environment. We recognise that the strategic aims with regards to IT at Midlothian Council are developing and we will consider how developments in this area mitigate against wider sector risks. • Ongoing development of strategic aims. • Review the IT control environment and communicate findings to members of the audit committee. Source: Audit Scotland 31. Our planned work on the wider scope areas is risk based and proportionate, and in addition to local risks, we may be asked by the Accounts Commission to consider specific risk areas which are impacting the public sector as a whole. We have not been asked to consider specific risks for 2023/24 audits, but we will remain cognisant of challenges identified in prior years such as climate change. Page 24 of 114
Page 25
Wider Scope and Best Value | 13 Best Value 32. Under the Code of Audit Practice, the audit of Best Value in councils is fully integrated within our annual audit work. Auditors are required to evaluate and report on the performance of councils in meeting their Best Value duties. 33. The arrangements to secure Best Value at Midlothian Council will be assessed over the period of the audit appointment and will include an annual evaluation of risks and improvement areas and public performance reporting. We will also follow up findings reported previously on Best Value to assess the pace and depth of improvement. This work will be integrated with the wider scope audit areas discussed above. 34. As part of our annual work on Best Value, we conduct thematic reviews as directed by the Accounts Commission. In 2023/24, the thematic review across the sector will be on workforce innovation and will consider how councils are responding to the current workforce challenges through building capacity, increasing productivity, and innovation. Our conclusions and judgements will be reported in a separate report to management and summarised in our Annual Audit Report. 35. At least once every five years, the Controller of Audit will report to the Accounts Commission on Midlothian Council’s performance in meeting its Best Value duties. Midlothian Council is included in the programme for 2025/26. Page 25 of 114
Page 26
Reporting arrangements, timetable, and audit fee | 14 Reporting arrangements, timetable, and audit fee Reporting arrangements 36. Matters arising from our audit will be reported on a timely basis and will include agreed action plans. Draft reports will be shared with the relevant officers to confirm factual accuracy. 37. We will provide: • an Independent Auditor’s Report to Midlothian Council and the Accounts Commission setting out our opinions on the annual accounts • Midlothian Council and the Accounts Commission with an Annual Audit Report containing observations and recommendations on significant matters which have arisen during the audit and conclusions on wider scope areas. 38. Exhibit 4 outlines the target dates for our audit outputs set by the Accounts Commission. In determining the target reporting date, due regard is paid to the dates for approving the annual accounts set out in regulations of 30 September 2024. 39. We will be unable to achieve the target date outlined above. This is due to the legacy of the late completion of prior year audits due to Covid-19 and ongoing resourcing challenges within Audit Scotland. We are working to prioritise the delivery of high-quality audits in line with messaging from the Financial Reporting Council who has made it clear that audit quality takes precedence. 40. We are working towards completion of the audit by the later date of 30 November 2024. We will work towards delivering the audit and audit outputs by target dates over the period of the audit appointment. We acknowledge that our planned dates are determined by the availability of audit resource and not by the council, which proposes to present unaudited accounts for audit by 30 June 2024. Exhibit 4 2020/21 Audit outputs Audit Output Target date Audit Committee Date Annual Audit Plan 31 March 2024 18 March 2024 Page 26 of 114
Page 27
Reporting arrangements, timetable, and audit fee | 15 Audit Output Target date Audit Committee Date Best Value Management Report 24 June 2024 24 June 2024 Independent Auditor's Report 30 September 2024 25 November 2024 Annual Audit Report 30 November 2024 25 November 2024 Source: Audit Scotland 41. All Annual Audit Plans and the outputs detailed in Exhibit 4, and any other outputs on matters of public interest, will be published on our website: www.audit- scotland.gov.uk. Timetable 42. To support an efficient audit, it is critical that the timetable for producing the annual accounts for audit is achieved. We have included a proposed timetable for the audit at Exhibit 5 that has been discussed with management. 43. We will continue to work closely with management to identify the most efficient approach as appropriate and will keep timeframes and logistics for the completion of the audit under review. Progress will be discussed with management and finance officers over the course of the audit. Exhibit 5 Proposed annual accounts timetable Key stage Provisional Date Consideration of the unaudited annual accounts by those charged with governance 24 June 2024 Latest submission date for the receipt of the unaudited annual accounts with complete working papers package. 28 June 2024 Latest date for final clearance meeting with the Director of Finance 17 October 2024 Issue of draft Letter of Representation and proposed Independent Auditor’s Report 11 November 2024 Agreement of audited and unsigned annual accounts 11 November 2024 Issue of Annual Audit Report to those charged with governance. 11 November 2024 Signed Independent Auditor’s Report 25 November 2024 Page 27 of 114
Page 28
Reporting arrangements, timetable, and audit fee | 16 Key stage Provisional Date Certified Non-Domestic Rates Return To be confirmed Certified Housing Benefit subsidy claim To be confirmed Latest date for WGA assurance (if required) To be confirmed Source: Audit Scotland Audit fee 44. In determining the audit fee, we have taken account of the risk exposure of Midlothian Council and the planned management assurances in place. Fee levels are also impacted by inflation which increases the cost of audit delivery. The planned audit fee for 2023/24 is £289,950 (2022/23: £273,550). 45. In setting the fee for 2023/24, we have assumed that Midlothian Council has effective governance arrangements and will prepare a comprehensive and accurate set of annual accounts for audit in line with the agreed timetable for the audit. The audit fee assumes there will be no major change in respect of the scope of the audit during the year and where our audit cannot proceed as planned, a supplementary fee may be levied. Page 28 of 114
Page 29
Other matters | 17 Other matters Internal audit 46. It is the responsibility of the Midlothian Council to establish adequate internal audit arrangements. We will review the internal audit plan and the results of internal audit’s work. While we are not planning to place formal reliance on the work of internal audit in 2023/24, we will review internal audit reports and assess the impact of the findings on our financial statements and wider scope audit responsibilities. Independence and objectivity 47. Claire Gardiner, your appointed auditor, is independent of Midlothian Council in accordance with relevant ethical requirements, including the Financial Reporting Council’s Ethical Standard. This standard imposes stringent rules to ensure the independence and objectivity of auditors. 48. Audit Scotland has robust arrangements in place to ensure compliance with Ethical Standard including an annual ‘fit and proper’ declaration for all members of staff. The arrangements are overseen by the Executive Director of Innovation and Quality, who serves as Audit Scotland’s Ethics Partner. 49. The Ethical Standard requires auditors to communicate any relationships that may affect the independence and objectivity of the audit team. I am not aware of any such relationships pertaining to the audit of Midlothian Council. Audit Quality 50. Audit Scotland is committed to the consistent delivery of high-quality public audit. Audit quality requires ongoing attention and improvement to keep pace with external and internal changes. A document explaining the arrangements for providing assurance on the delivery of high-quality audits is available from the Audit Scotland website. 51. The International Standards on Quality Management (ISQM) applicable to Audit Scotland for 2023/24 audits are: • ISQM (UK) 1 which deals with an audit organisation’s responsibilities to design, implement and operate a system of quality management (SoQM) for audits. Our SoQM consists of a variety of components, such as: our governance arrangements and culture to support audit quality, compliance with ethical requirements, ensuring we are dedicated to high-quality audit through our engagement performance and resourcing arrangements, and ensuring we have robust quality monitoring arrangements in place. Audit Scotland carries out an annual evaluation of our SoQM and has concluded that we comply with this standard. Page 29 of 114
Page 30
Other matters | 18 • ISQM (UK) 2 which sets out arrangements for conducting engagement quality reviews, which are performed by senior management not involved in the audit to review significant judgements and conclusions reached by the audit team, and the appropriateness of proposed audit opinions of high-risk audit engagements. 52. To monitor quality at an individual audit level, Audit Scotland also carries out internal quality reviews of a sample of audits. Additionally, the Institute of Chartered Accountants of England and Wales (ICAEW) carries out independent quality reviews. 53. Actions to address deficiencies identified by internal and external quality reviews are included in a rolling Quality Improvement Action Plan which is used to support continuous improvement. Progress with implementing planned actions is regularly monitored by Audit Scotland’s Quality and Ethics Committee. 54. Audit Scotland may periodically seek your views on the quality of our service provision. The team would also welcome feedback more informally at any time. Page 30 of 114
Page 31
Appendix 1: Your audit team | 19 Appendix 1: Your audit team The audit team involved in the audit of the Midlothian Council have significant experience in public sector audit. Claire Gardiner Audit Director cgardiner@audit-scotland.gov.uk Claire has over 19 years of public sector auditing experience. Claire has worked across the breadth of the public sector on financial audits. Patricia Fraser Senior Audit Manager pfraser@audit-scotland.gov.uk Patricia has considerable public sector audit experience and has delivered external audit services to a range of bodies including local authorities, health boards and central government bodies. Robert Dick Senior Auditor rdick@audit-scotland.gov.uk Robert has 5 years of public sector audit experience covering local authorities and central government.. 55. The local audit team is supported by a specialist technical accounting team, all of whom have significant experience of public bodies and work with accounting regulatory bodies. Page 31 of 114
Page 32
Appendix 1: Your audit team | 20 56. efficiency.fficiency. Audited Body Draft Annual Audit Plan 2023/24 Audit Scotland’s published material is available for download on the website in a number of formats. For information on our accessibility principles, please visit: www.audit-scotland.gov.uk/accessibility For the latest news follow us on social media or subscribe to our email alerts. Audit Scotland, 4th Floor, 102 West Port, Edinburgh EH3 9DN Phone: 0131 625 1500 Email: info@audit-scotland.gov.uk www.audit-scotland.gov.uk AS.4.0 Page 32 of 114
Page 33
Audit Committee Monday 18 March 2024 Item No 5.2 Internal Audit Work to February 2024 Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is asked to: a) Consider the Executive Summary of the final Internal Audit assurance report issued associated with the delivery of the approved Internal Audit Annual Plan 2023/24; b) Note the Internal Audit Consultancy and Other Work carried out in accordance with the approved Internal audit Charter; and c) Acknowledge the assurance provided on internal controls and governance arrangements in place for the areas covered by this Internal Audit work. 2 Purpose of Report/Executive Summary The purpose of this report is to provide members of the Audit Committee with details of the recent work carried out by Internal Audit and the findings and recommended audit actions agreed by Management to improve internal controls and governance arrangements. The Internal Audit Annual Plan 2023/24 was approved by the Audit Committee on 7 March 2023. Internal Audit has carried out work associated with the delivery of the plan to meet its objective of providing an opinion on the efficacy of the Council’s risk management, internal control and governance. An Executive Summary of the final Internal Audit assurance report issued, including audit objective, findings, good practice and recommendations (where appropriate), and the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area, is shown in Appendix 1. The Internal Audit function conforms to the professional standards as set out in Public Sector Internal Audit Standards (PSIAS) (2017) including the production of this report to communicate the results of the reviews. Date 5 March 2024 Report Contact: Duncan Stainbank duncan.stainbank@midlothian.gov.uk Page 33 of 114
Page 34
2 3 Progress Report 3.1 The Internal Audit Annual Plan 2023/24 was approved by the Audit Committee on 7 March 2023. Internal Audit has completed the following work in the period from 1 January to 29 February 2024 associated with the delivery of the plan to meet its objective of providing an opinion on the efficacy of the Council’s risk management, internal control and governance. 3.2 The Internal Audit function conforms to the professional standards as set out in Public Sector Internal Audit Standards (PSIAS) (2017), including the production of this report to communicate the results. 3.3 Internal Audit issued final assurance reports on the following subject: • Risk Management. 3.4 An Executive Summary of the final Internal Audit assurance report issued, including audit objective, findings, good practice and recommendations (where appropriate), and the Chief Internal Auditor’s independent and objective opinion on the adequacy of the control environment and governance arrangements within each audit area, is shown in Appendix 1. The definitions for Internal Audit assurance categories are as follows: Level Definition Comprehensive assurance Sound risk, control, and governance systems are in place. These should be effective in mitigating risks to the achievement of objectives. Some improvements in a few, relatively minor, areas may be required. Substantial assurance Largely satisfactory risk, control, and governance systems are in place. There is, however, some scope for improvement as current arrangements could undermine the achievement of objectives or leave them vulnerable to error or misuse. Limited assurance Risk, control, and governance systems have some satisfactory aspects. There are, however, some significant weaknesses likely to undermine the achievement of objectives and leave them vulnerable to an unacceptable risk of error or misuse. No assurance The systems for risk, control, and governance are ineffectively designed and operated. Objectives are not being achieved and the risk of serious error or misuse is unacceptable. Significant improvements are required. Internal Audit Consultancy and Other Work 3.5 Internal Audit staff have been involved in the following for the Council to meet its aims and objectives, and its roles and responsibilities in accordance with the approved Internal Audit Charter and Strategy: a) In its critical friend role provided an independent view and challenge at various forums including: Capital Plan and Asset Management Board, Chief Officers Risk & Resilience Group, Integrity Group, Children Young People Partnerships Estate Programme Board and Information Management Group. b) Learning and development during the research stage of new audit areas for all Internal Audit team members and through joining virtual audit forums (Computer Audit Sub-group) and meetings; and c) Monitored publication of Audit Scotland reports. Recommendations 3.6 Recommendations in reports are suggested changes to existing procedures or processes to improve the controls or to introduce controls where none exist. The grading of each recommendation reflects the risk assessment of non-implementation, being the product of the likelihood of the risk materialising and its impact: Page 34 of 114
Page 35
3 High: Significant weaknesses in existing controls, leaving the Council or Service open to error, fraud, financial loss or reputational damage, where the risk is sufficiently high to require immediate action within one month of formally raising the issue. Added to the relevant Risk Register and included in the relevant Assurance Statement. Medium: Substantial weaknesses in existing controls, leaving the Council or Service open to medium risk of error, fraud, financial loss or reputational damage requiring reasonably urgent action within three months of formally raising the issue. Low: Moderate weaknesses in existing controls, leaving the Council or Service open to low risk of error, fraud, financial loss or reputational damage requiring action within six months of formally raising the issue to improve efficiency, effectiveness and economy of operations or which otherwise require to be brought to attention of senior management. Outwith the report, Internal Audit informs operational managers about other matters as part of continuous improvement. 3.7 The table below summarises the number of Internal Audit recommendations made during 2023/24: Recs Rating 2023/24 Number of Recs High 0 Medium 5 Low 1 Sub-total reported this period 6 Previously reported 45 Total 51 Recommendations agreed with action plan 51 Not agreed; risk accepted 0 Total 51 4 Report Implications (Resource, Digital, Risk and Equalities) 4.1 Resource Resource implications of implementing Internal Audit recommendations are considered as part of the audit process to ensure these are reasonable and proportionate to the risks. 4.2 Digital There are no digital implications arising from this report. 4.3 Risk The PSIAS require Internal Audit to evaluate the effectiveness of the Council’s Risk Management arrangements and contribute to improvements in the process. At the start of each audit engagement, to capture potential areas of risk and uncertainty more fully, key stakeholders have been consulted and risk registers have been considered. During each audit engagement the management of risk has been tested. It is anticipated that improvements in the management and mitigation of risks will arise as a direct result of Management implementing the Internal Audit recommendations made. If audit recommendations are not implemented, there is a greater risk of financial loss and/or reduced operational efficiency and effectiveness, and Management may not be able to demonstrate improvement in internal control and governance arrangements, and effective management of risks. Page 35 of 114
Page 36
4 4.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. The Internal Audit work is carried out in accordance with the appropriate legislation and professional standards. The latter includes compliance by those within the Internal Audit function with the Code of Ethics set out in the PSIAS which is appropriate for the profession of Internal Audit founded as it is on trust placed in its independent and objective assurance about risk management, internal control and governance. 4.5 Additional Report Implications (See Appendix 1) 4.6 Appendices Appendix A – Additional Report Implications Appendix B – Risk Management Internal Audit Report Page 36 of 114
Page 37
5 APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable Midlothian Council to deliver its key priorities in support of achieving the Council’s objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s Internal Audit service provision to assist the Council in achieving its objectives. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” Implementation by Management of the actions associated with Internal Audit recommendations, that are designed to improve internal control and governance arrangements and management of risks, underpins the Council’s own continuous improvement arrangements to enhance its effectiveness, thus supporting the delivery of the Council’s best value duties. Page 37 of 114
Page 38
6 A.5 Involving Communities and Other Stakeholders The Chief Internal Auditor is accountable to the Audit Committee which, in fulfilling its governance role, acts as a bridge between the Council and other stakeholders. This report has been presented to the Corporate Management Team to outline the key messages of assurance and areas of improvement. Senior Management relevant to the areas audited have agreed the final Internal Audit assurance reports as set out in the relevant Executive Summary within Appendix 1. A.6 Impact on Performance and Outcomes The Findings and Recommendations from Internal Audit work during the year are designed to assist the Council in improving its performance and outcomes. A.7 Adopting a Preventative Approach Internal Audit assurance work includes assessments on when a preventative approach can be adopted. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Good governance is important to enable Midlothian Council to achieve its objectives. Page 38 of 114
Page 39
Report Summary of key findings and recommendations Recommendations Status H M L Subject: Risk Management Category: Assurance – Risk-based Date issued: 18/12/2023 Draft 27/02/2024 Final Level of Assurance: Substantial in relation to the Council’s Risk Management Policy and application of the policy at a strategic level. Limited over the application of the Risk Management Policy at the service (operational) level, the provision of training and guidance, and service level reporting and monitoring arrangements. The Council approved its revised Risk Management Policy and Strategy in August 2022. The Midlothian Integrated Joint Board (MIJB) have a separate Risk Management Policy which was last updated in December 2017; management have advised that the policy is currently under review and intend to update the policy this year. The Council’s Risk and Resilience Group meets quarterly to discuss and update the Council’s Strategic Risk Profile. The Council’s Corporate Management Team and Audit Committee receive quarterly updates on the Council’s strategic risks and steps being taken to mitigate these risks. The strategic risks for the MIJB are discussed and updated quarterly and presented to the MIJB Audit and Risk Committee. The MIJB risk registers have recently been updated to better reflect current risks. Although the Council’s performance reporting system, Ideagen Risk Management, was being used for tracking of actions, performance indicators, and to assist with the creation of quarterly performance reports, the risk management functions of the software were not being used effectively. Service risk registers within Ideagen for Adult Social Care, Children’s Services, and Education have not been updated in recent years therefore the risks detailed in the system no longer reflect the current risks within those services. Services advised that risks are reported more informally as part of the Divisional Management Team (DMT) meetings, but services have not been updating risk registers consistently in the more detailed format used in Ideagen. Service risk registers within Corporate Solutions and Place have had more recent updates for some of their services, however gaps were noted for some areas. The process for producing the quarterly service performance reports was reviewed and it was identified that in order to produce the report from the system, the service risks in the Ideagen system were being queried for high risks, but for most services this was not useful given that the service risk registers had not been updated in years and no longer represented a current assessment of their 0 5 1 Management have accepted the factual accuracy of the report and its findings, and agreed to implement the recommendations. Page 39 of 114
Page 40
Report Summary of key findings and recommendations Recommendations Status H M L risks. Service level reporting on risks within the quarterly performance reports has not been reliable or complete since prior to the Covid-19 pandemic. Although risk registers had been updated in 2023 and reported to their respective boards or committees for the Strategic Risk Profile, the MIJB Risk Register and the Community Planning Partnership Board, the Ideagen system had not been updated this year with the new risks / revised risk assessments reported. Internal Audit arranged for these updates to be made in the system during the audit. The previous Internal Audit of Risk Management in 2021 highlighted that there was limited training, support for managers or sufficient resource to support the Council’s risk management arrangements and this has not changed. Although some additional resource has been applied to this area, there is still limited resource in place. Internal Audit considers that the level of assurance is substantial in relation to the Council’s Risk Management Policy and application of the policy at a strategic level. Assurance is limited over the application of the Risk Management Policy at the service (operational) level, the provision of training and guidance, and service level reporting and monitoring arrangements. In order for management of risks at the strategic level to be fully effective, service risk registers should be up-to-date (i.e. if risks are not logged at the service level, the process for significant service risks to be escalated to the strategic level will not be fully effective). It was found that processes have not been established to formally report on risks to DMTs and escalate as required, annual reporting and quality assurance arrangements over risk management has not been established, there is limited risk management resource in place to support the Council, limited training and guidance is in place for risk management, the Strategic Risk Profile does not formally link to the Council’s objectives in the Single Midlothian Plan or operational objectives and significant project risks are not included in the Council’s performance reporting. Page 40 of 114
Page 41
Report Summary of key findings and recommendations Recommendations Status H M L Internal Audit made the following recommendations: • Management should ensure the Strategic Risk Profile links to organisational objectives as per the Risk Management Policy. A Terms of Reference should be created for the Risk and Resilience Group and meetings should be minuted. The risk management processes should ensure that independent action plans are drawn up for each Critical Risk that are then reviewed and assessed on at least a quarterly basis at CMT and Audit Committee to ensure that risks remain critical for no longer than absolutely necessary. (Low) • Annual reporting should be in place to provide the Audit Committee with assurance on compliance with the Risk Management Policy. Appropriate risk management procedures and guidance should be in place and available on the intranet and the officer level risk management group should be reinstated. (Medium) • The level of risk management resource required to support the Council should be considered as part of the planned review of Health, Safety, Risk and Resilience. (Medium) • Chief Officers and Head of Service should ensure that their service risk registers are appropriately updated by relevant managers within their service as required. Arrangements should be established to report on service risks to DMTs and escalate as required to CMT and the Strategic Risk Register. (Medium) • Management should review with services how to reflect significant project risks as part of the Council’s performance reporting arrangements and risk management framework. (Medium) • Appropriate risk management training and support should be provided to management including creating an e-learning module, mandatory for relevant managers, and ongoing periodic 1 to 1 support to facilitate update of their risk registers. (Medium) Page 41 of 114
Page 42
Page 42 of 114
Page 43
Audit Committee Monday 18 March 2024 Item No 5.3 Counter Fraud Annual Plan 2024/25 Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is invited to: a) Approve the Counter Fraud Annual Plan 2024/25 (Appendix 1). 2 Purpose of Report/Executive Summary The purpose of this report is to gain approval from the Audit Committee for the proposed Counter Fraud Annual Plan 2024/25 to support the delivery of the Council’s Counter Fraud Strategy and to demonstrate compliance with the Council’s Counter Fraud Policy Statement. Having robust fraud prevention and investigation arrangements in place contributes to safeguarding the Council’s financial resources, for delivery of services, as part of protecting the public purse. A focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud, theft, corruption and crime, and ensure these are embedded preventative practices as specific changes associated with the Counter Fraud Strategy approved by Council in August 2020. The Counter Fraud Annual Plan 2024/25 (Appendix 1) sets out the planned counter fraud activity to support the approach and culture of the Council in tackling fraud and corruption to deliver the Counter Fraud Strategy. This will enable the Council to demonstrate compliance with its Counter Fraud Policy Statement as its commitment to tackling fraud and reflects the Integrity Group’s assessment of counter fraud controls. Date 5 March 2024 Report Contact: Duncan Stainbank duncan.stainbank@midlothian.gov.uk Page 43 of 114
Page 44
3 Background 3.1 A review was carried out in 2019/20 of counter fraud management arrangements in place and to make improvements in light of the significant fraud investigations that have occurred within Midlothian Council in recent years, noting that some are ongoing. 3.2 The conclusion of the review included a refresh to the corporate policy and strategy for tackling fraud. A revised Counter Fraud Policy Statement and Counter Fraud Strategy and proposal to have 2 FTE Corporate Fraud Officers to deliver the revised Counter Fraud Policy and Strategy were approved by Midlothian Council in August 2020. 4 Counter Fraud Annual Plan 2024/25 4.1 Having robust fraud prevention and investigation arrangements in place contributes to safeguarding the Council’s financial resources, for delivery of services, as part of protecting the public purse. A focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud, theft, corruption and crime (including cybercrime and money laundering) and ensure these are embedded preventative practices as specific changes associated with the Counter Fraud Strategy approved by Council in August 2020. 4.2 The Counter Fraud Annual Plan 2024/25 (Appendix 1) sets out the planned Counter Fraud activity to support the change in approach and culture for the Council for tackling fraud and corruption to deliver the approved Counter Fraud Strategy. This will enable the Council to demonstrate compliance with its Counter Fraud Policy Statement as its commitment to tackling fraud and reflects the Integrity Group’s assessment of counter fraud controls (update submitted to the Audit Committee in January 2022). 5 Report Implications (Resource, Digital, Risk and Equalities) 5.1 Resource The primary responsibility for the prevention, detection and investigation of fraud rests with Management, supported by the Integrity Group and the Corporate Fraud Team. The purpose of the Integrity Group is to improve the Council’s resilience to fraud, corruption, theft and crime (including cybercrime and money laundering). The formal establishment of the Integrity Group with a Terms of Reference (approved by the Audit Committee on 22 June 2020) enables the shift to more holistic working in multi- disciplinary forums to tackle fraud in a consistent and collaborative way across the Council. The revised Counter Fraud Policy Statement and Counter Fraud Strategy and proposal to have 2 FTE Corporate Fraud Officers to deliver the revised Counter Fraud Policy and Strategy were approved by Midlothian Council in August 2020. The 2 Corporate Fraud Officers are line managed by the Principal Internal Auditor who reports to the Chief Internal Auditor. Page 44 of 114
Page 45
Savings will continue to be identified arising from Corporate Fraud Team activity, which will be stated within the Counter Fraud Annual Reports presented to the Audit Committee. 5.2 Digital None. 5.3 Risk The Council is committed to minimising the risk of loss due to fraud, theft, corruption or crime and to taking appropriate action against those who attempt to defraud the Council, whether from within the authority or from outside. The Counter Fraud Policy Statement sets out the roles and responsibilities for the prevention, detection and investigation of fraud. The Counter Fraud Strategy provides a shift in approach to focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud. The work undertaken by the Corporate Fraud Team in collaboration with other Services is designed to reduce the fraud risks within the Council. 5.4 Ensuring Equalities An Integrated Impact Assessment (IIA) Form was completed as part of the development of the revised Counter Fraud Policy and Strategy. The conclusion was that undertaking a Combined Impact Assessment was not necessary as the policy / proposal has little relevance to equality, negligible impact on the economy, and no impact on the environment. The revised Counter Fraud Policy and Strategy set out enhancements to internal Management arrangements though it is anticipated that there will be minimal impact on internal staff only; there is no change to the Whistleblowing external-facing arrangements. 5.5 Additional Report Implications (See Appendix A) Page 45 of 114
Page 46
APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change) by preventing and detecting fraud, additional resources might be available to support the Council’s objectives. Any loss of funds due to fraud, theft, corruption or crime might impact on the ability of Midlothian Council to achieve its key priorities. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s arrangements for tackling fraud as set out in the Counter Fraud Policy Statement and Counter Fraud Strategy that were approved by Council in August 2020. The shift to the key drivers for change is an intrinsic part of the change in approach and culture for the Council for tackling fraud and corruption. For example: (a) The formal establishment of an Integrity Group with a Terms of Reference (approved by the Audit Committee in June 2020) shifting to more holistic working in multi-disciplinary forums to tackle fraud in a consistent and collaborative way across the Council; (b) A focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud, theft, corruption, and crime and ensure these are embedded preventative practices; (c) Applying the minimum standard within the CIPFA Code of Practice on ‘Managing the Risk of Fraud and Corruption (2014)’ for counter fraud policy, strategy and other practices, and adopting the CIPFA Counter Fraud Maturity Model as a means of self-assessment moving forward will enable continuous improvement to be evaluated, managed and evidenced; and (d) Use of a blend of toolkits such as fraud risk assessments and e- learning packages that can be tailored to specific Services. Page 46 of 114
Page 47
A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value Having robust fraud prevention and investigation arrangements in place contributes to safeguarding the Council’s financial resources, for delivery of services, as part of protecting the public purse. The approved Counter Fraud Strategy states the Council will measure progress against the CIPFA Counter Fraud Maturity Model as a self- assessment approach to continuous improvement in order to continuous improvement to be evaluated, managed and evidenced demonstrate best value in the use of resources. A.5 Involving Communities and Other Stakeholders Ensuring awareness of the Whistleblowing facility to report areas of concern is important in the approach to tackling fraud. The facility has been promoted in recent years and is being utilised, as stated in the Counter Fraud Annual Report 2022/23 that reported outcomes of corporate fraud activity, some of which arose from whistleblowing received from staff, those within communities or other stakeholders. A.6 Impact on Performance and Outcomes The primary responsibility for the prevention, detection and investigation of fraud rests with Management, supported by the Integrity Group and the Corporate Fraud team. Internal Audit provides advice and independent assurance on the effectiveness of processes put in place by Management. The Findings and Recommendations from Internal Audit and Corporate Fraud work which are presented to the Audit Committee during the year assists the Council in maintaining and / or enhancing fraud prevention and detection controls. A.7 Adopting a Preventative Approach Having robust fraud prevention and investigation arrangements in place contributes to safeguarding the Council’s financial resources, for delivery of services, as part of protecting the public purse. A focus on enhancing fraud prevention and detection to improve Midlothian Council’s resilience to the risk of fraud, theft, corruption and crime, and ensure these are embedded preventative practices are specific changes associated with the approved Counter Fraud Strategy. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Good governance is important to enable Midlothian Council to achieve its objectives including sustainable outcomes. Page 47 of 114
Page 48
Midlothian Council Counter Fraud Annual Plan 2024/25 Appendix 1 Ref Category Activity Number of Days Commentary 1. Compliance Contract Management 40 Data analytics to test governance and internal controls in place over Contract Management arrangements with third parties to assess compliance with procurement rules. 2. Compliance Corporate Fraud Enquiries 155 Respond to whistleblowing notifications. 3. Data Match National Fraud Initiative 70 Co-ordinate the NFI exercise across Council services, finalise review and investigate remaining data matches from 2022/23 exercise, coordinate and finalise provision of data for 2024/25 exercise. 4. Compliance Social Housing 30 Social Housing enquiries and investigations. 5. Compliance Council Tax 15 Council Tax enquiries and investigations. 6. Other Corporate Fraud Policy Framework 15 Support the Integrity Group with monitoring of policies and procedures review, update and communication. Assist with the self-assessment of compliance against the CIPFA code on Managing the Risk of Fraud and Corruption. 7. Other Fraud Risk Assessments 60 Develop a risk assessment process and support operational Service Managers to assess fraud risks and develop improved mitigating controls in preparation for the implementation of government guidance on the implementation of UK government guidance on the Crime of Failure to Prevent Fraud. 8. Other Fraud Awareness Training 15 Develop and deliver fraud awareness training modules (face-to-face, virtual or via e-learning) to Management and Staff as required. 9. Other Integrity Groups 6 Attend and provide support to the Council’s Integrity Group. Corporate Fraud Total 406 Page 48 of 114
Page 49
Audit Committee Monday 18 March 2024 Item No 5.4 Internal Audit Charter Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is invited to: a) Note the changes to the Internal Audit Charter outlined in section 4 of this report in conformance with PSIAS; b) Approve the revised Internal Audit Charter shown at Appendix 1; and c) Note that the Internal Audit Charter will be reviewed annually. 2 Purpose of Report/Executive Summary This report provides the Audit Committee with the updated Internal Audit Charter for approval that defines the terms of reference for the Internal Audit function to carry out its role to enable the Chief Audit Executive to prepare annual Internal Audit opinions on the adequacy of the overall control environment for Midlothian Council, and for Midlothian Health and Social Care Integration Joint Board. The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” In accordance with the Public Sector Internal Audit Standards (PSIAS) (2017), the purpose, authority and responsibility of the Internal Audit activity must be formally defined in an Internal Audit Charter, consistent with the Definition of Internal Auditing, the Code of Ethics and the Standards. The Chief Audit Executive must periodically review the Internal Audit Charter and present it to senior management (Corporate Management team) and the board (Audit Committee) for approval. The Internal Audit Charter has been updated in conformance with the PSIAS for approval by the Audit Committee to ensure that Internal Audit is tasked to carry out its role in accordance with best Corporate Governance practice, and is shown in Appendix 1. Date 4 March 2024 Report Contacts Duncan Stainbank, Chief Internal Auditor duncan.stainbank@midlothian.gov.uk Page 49 of 114
Page 50
3 Background 3.1 The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” 3.2 The Midlothian Council Internal Audit function follows the professional standards as set out in the Public Sector Internal Audit Standards (PSIAS) which came into effect on 1 April 2013 (amended 2017), along with the CIPFA Local Government Application Note for the United Kingdom. The PSIAS have been developed by the standard setters (CIPFA for local government) through the Internal Audit Standards Advisory Board (IASAB) and have been based on the Institute of Internal Auditors International Standards of Professional Practice. 3.3 In accordance with the PSIAS, the purpose, authority and responsibility of the Internal Audit activity must be formally defined in an Internal Audit Charter, consistent with the Definition of Internal Auditing, the Code of Ethics and the Standards. The Chief Audit Executive must periodically review the Internal Audit Charter and present it to ‘senior management’ (Corporate Management Team) and the ‘board’ (Audit Committee) for approval. 3.4 Within the PSIAS a Public Sector requirement states the Internal Audit Charter must also: o define the terms ‘board’ and ‘senior management’ for the purposes of Internal Audit activity; o cover the arrangements for appropriate resourcing; o define the role of Internal Audit in any fraud-related work; and o include arrangements for avoiding conflicts of interest if Internal Audit undertakes non-audit activities. 3.5 Internal Audit assurance resources and services are also provided by Midlothian Council’s Internal Audit team to the Midlothian Health and Social Care Integration Joint Board (MIJB), including the appointed MIJB Chief Internal Auditor. The Internal Audit Charter and Strategy are applicable to each organisation. 4 Internal Audit Charter 4.1 The authority for Internal Audit to operate in Midlothian Council is contained in the Council’s Local Code of Corporate Governance, Standing Orders, and Financial Regulations. This Internal Audit Charter expands upon that framework. 4.2 The Internal Audit Charter as shown in Appendix 1 to this report: establishes the Internal Audit activity’s position within the organisation, including the nature of the Chief Audit Executive’s functional reporting relationship with the board; authorises access to records, personnel and physical properties relevant to the performance of engagements; and defines the scope of Internal Audit activities. Page 50 of 114
Page 51
4.3 The Internal Audit Charter, which was previously approved by the Audit Committee on 7 March 2023, has been updated by the Chief Audit Executive (shared Chief Internal Auditor). The summary of the changes reflect the following: • The Change in title of the Section 95 Officer. 4.4 The Internal Audit Charter should be considered alongside the Internal Audit Strategy and Plan 2024/25. The Internal Audit Strategy sets out the Council’s assurance framework within which Internal Audit operates, and the Chief Audit Executive’s strategy for discharging its role and providing the necessary annual assurance opinions to Midlothian Council and Midlothian Health and Social Care Integration Joint Board (MIJB). The Internal Audit Charter and Strategy are applicable to these organisations. There are separate Internal Audit Annual Plans for each organisation, which set out the range and breadth of audit activity. 5 Report Implications (Resource, Digital, Risk and Equalities) 5.1 Resource The Local Authority Accounts (Scotland) Regulations 2014 that came into force on 10 October 2014 require a local authority to operate a professional and objective internal auditing service. Internal Audit must have sufficient staff and other resources to enable it to carry out the objectives of the Charter and to deliver a programme of independent and objective audit assurance work alongside other available sources of assurance to enable the Chief Audit Executive to prepare annual opinions on the adequacy of the overall control environment for Midlothian Council and the MIJB. Internal Audit resources are set out in the Internal Audit Strategy and Plan 2022/23. 5.2 Digital There are no digital implications arising from this report. 5.3 Risk The authority for Internal Audit to operate in Midlothian Council is contained in the Council’s Local Code of Corporate Governance, Standing Orders, and Financial Regulations. This Internal Audit Charter expands upon that framework. Approval of the Internal Audit Charter (Appendix 1), as recommended in this report, will ensure that Internal Audit is tasked to carry out its role in accordance with PSIAS and best Corporate Governance practice. Page 51 of 114
Page 52
The PSIAS require Internal Audit to evaluate the effectiveness of the Council’s Risk Management arrangements and contribute to improvements in the process. The work of Internal Audit (including its opinion on the control environment) shall contribute to the Council’s review of its corporate governance arrangements the outcome of which is published in the Annual Governance Statement. At all times, Management’s responsibilities (led by the Corporate Management Team) include: o Designing and maintaining proper risk management, governance and internal control processes and systems for which they have responsibility to ensure probity in systems and operations, including the prevention, detection and resolution of fraud and irregularities. These are not fixed but evolve as the Council changes. o Checking that these governance arrangements and internal controls are operating effectively and obtaining assurances from internal compliance, risk, inspection, quality, and control functions. (The above are known as the first and second lines.) o Engaging with Internal Audit (the third line) in a positive way to achieve shared goals for robust internal control and governance, best value and improvement, and ensuring that Internal Audit can properly fulfil its role. o Considering and acting upon Internal Audit findings and recommendations, including implementation of audit recommendations within agreed timescales and updating Pentana performance system, or accepting responsibility for any resultant risk from not doing so. o Seeking advice and consultancy support from Internal Audit on existing controls and on changes to and transformation of governance, processes and procedures. 5.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. The Internal Audit work is carried out in accordance with the appropriate legislation and professional standards. The latter includes compliance by those within the Internal Audit function with the Code of Ethics set out in the PSIAS. This is of particular importance and relevance for the profession of Internal Audit founded as it is on trust placed in its independent and objective assurance about risk management, internal control and governance. 5.5 Additional Report Implications (See Appendix A) Page 52 of 114
Page 53
APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable Midlothian Council to deliver its key priorities in support of achieving the Council’s objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s Internal Audit service provision to assist the Council in achieving its objectives. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” Internal Audit is a key element of good governance which is important to enable Midlothian Council to achieve its objectives. Page 53 of 114
Page 54
Recommendations made by Internal Audit underpin the Council’s own continuous improvement arrangements to enhance its effectiveness, thus supporting the delivery of the Council’s best value duties. A.5 Involving Communities and Other Stakeholders The Chief Audit Executive is accountable to the Audit Committee which, in fulfilling its governance role, acts as a bridge between the Council and other stakeholders. A.6 Impact on Performance and Outcomes Applying the framework of the PSIAS will give the Audit Committee assurance that the Internal Audit function is compliant with legislative requirements and current best practice. A.7 Adopting a Preventative Approach The PSIAS are applicable from 1 April 2013 (amended 2017) which means the Internal Audit Service has taken steps to be fully compliant. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Internal Audit is a key element of good governance which is important to enable Midlothian Council to achieve its objectives including sustainable outcomes. Page 54 of 114
Page 55
1 INTERNAL AUDIT CHARTER Appendix 1 INTRODUCTION The Public Sector Internal Audit Standards (PSIAS) requires that the purpose, authority and responsibility of the Internal Audit activity must be formally defined in an Internal Audit Charter, consistent with the Definition of Internal Auditing, the Code of Ethics and the International Standards for the Professional Practice of Internal Auditing (Standards) detailed in the PSIAS. Midlothian Council has adopted from the PSIAS1: the definition of Internal Auditing “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes”, the Mission Statement of Internal Audit “To enhance and protect organisational value by providing risk-based and objective assurance, advice and insight” and the Core Principles. OBJECTIVES OF INTERNAL AUDIT Internal Audit’s responsibility is to report to Midlothian Council on its assessment of the adequacy of the entire control environment, through the Corporate Management Team (‘senior management’) and the Audit Committee (the ‘board’ for the purposes of Internal Audit activity). Internal Audit adds value to the organisation (and its stakeholders) by enhancing governance, risk management and control processes and objectively providing relevant assurance. As part of Midlothian Council’s system of corporate governance, Internal Audit’s purpose is to support the Council in its activities designed to achieve its declared objectives and to do so: ➢ In support of the Council’s vision, values and priorities. ➢ As a contribution to the Council’s corporate management of risk, including assisting Management to improve the risk identification and management process in particular where there is exposure to significant financial, strategic, reputational and operational risk to the achievement of the Council’s objectives. ➢ As an aid to ensuring that the Council and its elected members, employees and contracted third parties are operating within the law and relevant regulations, and that public money is safeguarded and properly accounted for, and used economically, efficiently and effectively. ➢ As a contribution towards establishing and maintaining a culture of honesty, integrity, openness, accountability and transparency throughout the Council in all its activities and transactions. ➢ As a contribution towards ensuring that financial statements and other published performance information are accurate and reliable. Midlothian Council’s Internal Audit function provides assurance services to the Midlothian Health and Social Care Integration Joint Board (MIJB) and will apply the same standards as defined in this Charter to any work undertaken for MIJB, with separate Internal Audit plans and reports presented to its ‘senior management’ (MIJB Chief Officer and MIJB Chief Finance Officer) and to the ‘board’ (MIJB Audit and Risk Committee). 1 Public Sector Internal Audit Standards (PSIAS) (2017) Midlothian Page 55 of 114
Page 56
2 POSITION OF INTERNAL AUDIT WITHIN MIDLOTHIAN COUNCIL In terms of the PSIAS, the status of Internal Audit should enable it to function effectively, with recognition of the independence of Internal Audit fundamental to its effectiveness. The Chief Audit Executive (CAE) should have “sufficient status to facilitate the effective discussion of audit strategies, plans, results and improvement plans with senior management of the organisation.2” The CAE within Midlothian Council (the shared Chief Internal Auditor) has full access to those charged with governance, specifically the Elected Members and the Corporate Management Team. The latter includes the Council’s statutory officers: head of paid service (Chief Executive), s95 finance officer (Chief Financial Officer), monitoring officer (Legal & Governance Manager) and chief social work officer (Chief Officer Children’s Services, Partnerships and Communities). The CAE has free and unfettered access to the Chair of each organisation’s ‘board’ to discuss any matters the members or auditors believe should be raised privately. In terms of accountability and independence to ensure conformance with PSIAS, the CAE reports functionally to the Midlothian Council Audit Committee. In this context functional reporting3 means the Audit Committee will: ➢ Approve the Internal Audit Charter. ➢ Approve the risk-based Internal Audit Annual Plan. ➢ Ratify the Internal Audit budget and resource plan to ensure that Internal Audit is adequately resourced to meet assurance and other key responsibilities. ➢ Receive communications from the CAE on the Internal Audit activity’s performance relative to its plan and other matters. ➢ Ratify all decisions regarding the appointment or removal of the CAE. ➢ Provide feedback to contribute to the performance appraisal of the CAE. ➢ Make appropriate enquiries of Management and the CAE to determine whether there are inappropriate scope or resource limitations. The CAE is line managed by the Chief Executive but retains responsibility for all operational audit activity and reports in their own name and retains final right of edit over all Internal Audit reports. The reporting line is managed in a manner which: ensures the CAE is accorded open and direct communication with Management; and ensures the CAE and the Internal Audit function have an adequate and timely flow of information concerning the activities, plans and initiatives of the Council and IJB. RIGHTS OF ACCESS The CAE and any member of the Internal Audit function authorised by them, relevant to the delivery of audit engagements for each of the organisations, has authority to: ➢ Have access at any reasonable times to all computer systems and records (paper/digital). ➢ Require and receive explanations concerning any matter under examination from personnel relevant to their roles including Elected Members / Board Members. ➢ Enter at all reasonable times and without notice any properties, provided that where such properties are leased to a third party the terms of the lease are observed. ➢ Require personnel to produce cash, stores, or other assets under their control. Internal Audit safeguards all information obtained in the carrying out of its duties, only uses it for defined purposes and makes no disclosure of any information held, unless this is authorised or there is a legal or professional requirement to do so. 2 Internal Audit Standards Advisory Board (IASAB) Public Sector Internal Audit Standards (PSIAS) (2017) 3 Chartered Institute of Internal Auditors (CIIA) – International Standards for Professional Practice of Internal Auditing Page 56 of 114
Page 57
3 SCOPE OF INTERNAL AUDIT ACTIVITY For each organisation Internal Audit shall systematically review, appraise, make appropriate recommendations for improvement, and report upon: • the governance arrangements and processes; • the design, implementation and effectiveness of ethics-related objectives, programmes and activities; • the information technology governance in support of strategies and objectives; • the systems and processes in place to ensure effective performance management and accountability; • the effectiveness and appropriateness of controls and other arrangements put in place to manage risk; • the potential for the occurrence of fraud and how fraud risk is managed; • the completeness, reliability, integrity and timeliness of information, both financial and operational; • the systems and processes established to ensure compliance with policies, plans, procedures, laws, and regulations, whether established internally or externally, and that employees’ actions are in compliance; • the action(s) taken to address significant legislative or regulatory issues; • the effectiveness of arrangements for safeguarding assets and interests; • the economy, efficiency and effectiveness with which resources are deployed; • the effectiveness and efficiency of operations and programmes; and • the extent to which operations are being carried out as planned and strategic objectives and goals are met. Internal Audit’s work covers: • all activities, systems, processes, controls, policies, and protocols that are currently existing or under development; • all records, personnel and properties; and • all services and other activities for which each organisation is responsible or accountable, whether delivered directly or by third parties through contracts, partnerships or other arrangements. AUDIT RESOURCES AND WORK PRIORITISATION The CAE ensures that Internal Audit resources are appropriate, sufficient and effectively deployed to achieve the approved plan. Appropriate refers to the mix of qualifications, knowledge, skills and other competencies needed to perform the plan such as compliance with the Code of Ethics set out in the PSIAS and with the Nolan principles established in the Seven Principles of Public Life. This is of particular importance and relevance for the profession of Internal Audit, founded as it is on the trust placed in its objective assurance about risk management, internal control and governance. The CAE holds a professional qualification (Bsc Hons, CIPFA) and is suitably experienced. Sufficient refers to the quantity of resources needed to accomplish the plan. Resources are effectively deployed when they are used in a way that optimises the achievement of the approved plan. The Internal Audit Strategy, as approved by the Midlothian Council Audit Committee, outlines the strategic direction for how Internal Audit will achieve its objectives in conformance with PSIAS. It guides the Internal Audit function in delivering high quality Internal Audit services to Midlothian Council and the MIJB. The Midlothian Council Internal Audit Annual Plan, as approved by the Audit Committee, is the main determinant of the relative priority to be placed on each part of the work of Internal Audit, with an Internal Audit Annual Plan specific to the MIJB being approved and monitored by its ‘senior management’ and ‘board’ (MIJB Audit and Risk Committee). The Internal Audit planning Page 57 of 114
Page 58
4 process, to determine the priorities of the Internal Audit activity consistent with the organisation’s goals, includes consideration of the organisation’s priorities, plans, strategies, objectives, risks and mitigating controls, and the internal and external assurances provided. The CAE determines the actual deployment of available resources covering the range and breadth of audit areas which are integral to the assurance process across the activities of Midlothian Council and MIJB in order to provide the statutory annual Internal Audit opinion to each organisation’s ‘senior management’ and ‘board’. This plan also requires to be sufficiently flexible to reflect the changing risks and priorities of each organisation. The Plan has within it the provision of resources as Contingency to respond to specific control issues highlighted during the year and covering other unforeseen variations in the level of resources available to Internal Audit, such as staff vacancies. The Plan has within it the provision of resources for Internal Audit ‘critical friend’ Consultancy that are valued by Management to support them in delivering innovation, change and transformation. Requests are considered and approved by the CAE subject to any consultancy activity being deliverable within the boundaries of the role of Internal Audit and the resources available. In the event that there is a need for a greater audit work to provide the statutory audit opinions than there are resources available, the CAE will identify the shortfall in the Plan and initially advise the Chief Executive followed by the Audit Committee. It will be for the Audit Committee to decide whether to accept the risks associated with the non-delivery of such audit work or to recommend to the Council that it requires Management to identify additional resources. NON-AUDIT ACTIVITIES The Internal Audit service preserves its independence and objectivity by: ensuring that staff are free from any conflicts of interest when undertaking assurance audits by following the requirements of relevant professional bodies and HR policies; and providing clarity on duties undertaken during audit consultancy engagements to ensure these do not impact on assurance audits and do not impair its independence and objectivity. APPROVAL The Internal Audit Charter was reported to and approved by the Midlothian Council Audit Committee at its meeting on 18 March 2024 and shall be subject to regular review by the CAE and the Audit Committee. Page 58 of 114
Page 59
Audit Committee Monday 18 March 2024 Item No 5.5 Internal Audit Strategy and Annual Plan 2024/25 Report by Chief Internal Auditor Report for Decision 1 Recommendations The Audit Committee is invited to: a) Note the changes to the Internal Audit Strategy outlined in section 4 of this report; b) Note the outline of the Internal Audit planning process outlined in section 5 of this report; c) Approve the Internal Audit Strategy (Appendix 1); and d) Approve the Internal Audit Annual Plan 2024/25 (Appendix 2). 2 Purpose of Report/Executive Summary The purpose of this report is to gain approval from the Audit Committee to the proposed Internal Audit Strategy and Annual Plan 2024/25 to enable the Chief Internal Auditor to prepare annual opinions on the adequacy of the overall control environment for Midlothian Council, and Midlothian Health and Social Care Integration Joint Board (MIJB). The Internal Audit Strategy at Appendix 1 outlines the strategic direction for how Internal Audit will achieve its objectives, which are set out in the Internal Audit Charter, in conformance with PSIAS. It guides the Internal Audit function in delivering high quality internal audit services to Midlothian Council and the MIJB. The Internal Audit Annual Plan 2024/25 at Appendix 2 has been developed by the shared Chief Internal Auditor and the Principal Internal Auditor. It sets out the proposed range and breadth of audit activity within the audit programme of work to enable the Chief Internal Auditor to prepare the independent and objective audit opinions for Midlothian Council and the MIJB. A separate Internal Audit Annual Plan 2024/25 for the MIJB will be presented to its Audit and Risk Committee. Key components of the audit planning process include a clear understanding of each organisation’s functions, associated risks, and assurance framework. Date 5 March 2024 Report Contacts Duncan Stainbank, Chief Internal Auditor duncan.stainbank@midlothian.gov.uk Page 59 of 114
Page 60
3 Background 3.1 The Local Authority Accounts (Scotland) Regulations 2014 that came into force on 10 October 2014 require a local authority to operate a professional and objective internal auditing service. This service must be provided in accordance with recognised standards and practices in relation to internal auditing. Recognised standards and practices are those set out in the Public Sector Internal Audit Standards: Applying the IIA International Standards to the UK Public Sector (PSIAS). The standards require internal audit to have suitable operational independence from the organisation. 3.2 The Midlothian Council Internal Audit function follows the professional standards as set out in Public Sector Internal Audit Standards (PSIAS) effective 1 April 2013 (updated 2017) which requires the Chief Audit Executive (CAE) to establish risk-based plans to determine the priorities of the Internal Audit activity, consistent with the organisation’s goals. The plans also require to be sufficiently flexible to reflect the changing risks and priorities pertaining to each organisation. 3.3 A fundamental role of the Council’s Internal Audit function is to provide senior management and members with independent and objective assurance, which is designed to add value and improve the organisation’s operations. In addition, the CAE is also required to prepare an Internal Audit annual opinion on the adequacy of each organisation’s overall control environment. 3.4 Internal Audit resources and services are also provided by Midlothian Council’s Internal Audit team to the Midlothian Health and Social Care Integration Joint Board (MIJB), including the appointed MIJB Chief Internal Auditor. The Internal Audit Charter and Strategy are applicable to each organisation. 4 Internal Audit Strategy 4.1 The key standards within the PSIAS which relate to Managing the Internal Audit Activity are summarised below: “The chief audit executive must effectively manage the internal audit activity to ensure it adds value to the organisation. The internal audit activity is effectively managed when: • The results of the internal audit activity’s work achieve the purpose and responsibility included in the internal audit charter; • The internal audit activity conforms with the Definition of Internal Auditing and the Standards; and • The individuals who are part of the internal audit activity demonstrate conformance with the Code of Ethics and the Standards. The internal audit activity adds value to the organisation (and its stakeholders) when it provides objective and relevant assurance, and contributes to the effectiveness and efficiency of governance, risk management and control processes.” Page 60 of 114
Page 61
4.2 The Chief Internal Auditor (CAE) and the Principal Internal Auditor have developed the Internal Audit Strategy at Appendix 1. It outlines the strategic direction for how Internal Audit will achieve its objectives, which are set out in the Internal Audit Charter, in conformance with PSIAS. It guides the Internal Audit function in delivering high quality internal audit services to Midlothian Council and the Midlothian Health and Social Care Integration Joint Board (MIJB). 4.3 The Internal Audit Strategy, since its previous approval by the Audit Committee on 7 March 2023, reflects the following: • 3.1 change in wording endorsed by the Chartered Institute of Internal Audit from lines of defence to lines of assurance; and • 4.2 change in title of the section 95 officer for Midlothian Council. 4.4 The Internal Audit Strategy: • Outlines the assurance framework, providing clarity of the respective responsibilities of Management for designing and monitoring governance and control systems and of the role of Internal Audit in providing independent assurance thereon; • States how the key themes which are integral to the assurance gathering process across the organisation’s activities will be covered to inform the annual Internal Audit opinion statement; • Describes the approach to the development of the risk based Internal Audit annual plan; • Sets out the relative allocation of Internal Audit resources; • Outlines how the Internal Audit programme of work will be delivered to add value; and • Describes the monitoring and reporting of Internal Audit findings from its work and progress with its plans to the relevant organisation’s audit committee/board. 5 Internal Audit Annual Plan 2024/25 5.1 The key standards within the PSIAS which relate to the preparation of the internal audit plan are summarised below: • Standard 2010 – Planning which states that “the chief audit executive must establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organisation’s goals” • Standard 2020 – Communication and Approval which states that “the chief audit executive must communicate the internal audit activity’s plans and resource requirements, including significant interim changes, to senior management and the board for review and approval. The chief audit executive must also communicate the impact of resource limitations.” 5.2 The CIPFA Publication ‘Audit Committees: Practical Guidance for Local Authorities and Police – 2018 Edition’ states that “The audit committee should seek to make best use of the internal audit resource within the assurance framework. In particular, the audit committee should seek confirmation from internal audit that the audit plan takes into account the requirement to provide an annual internal audit opinion that can be used to inform the Annual Governance Statement. Specific activities will include: Page 61 of 114
Page 62
• Approving (but not directing) the risk-based plan, considering the use made of other sources of assurance.” 5.3 The CIPFA Publication also states that “The committee will wish to seek assurance from the HIA that appropriate risk assessment has been carried out as part of the preparation of the internal audit plans when they are presented.” 5.4 The Chief Internal Auditor (CAE) and the Principal Internal Auditor have developed the Internal Audit Annual Plan 2024/25 at Appendix 2, based on the Internal Audit staff resources set out in 6.1. It sets out the proposed range and breadth of audit activity to be undertaken to provide the independent and objective audit opinions to Midlothian Council and the MIJB. 5.5 As part of the Internal Audit planning process, it was necessary to consider each organisation’s priorities, plans, strategies, objectives, risks and mitigating controls, and the internal and external assurances provided to determine the priorities of the Internal Audit activity consistent with the organisation’s goals, as follows: • Analysis was undertaken of Internal Audit work during the past 5 years against the Audit Universe which has been significantly revised and realigned by the Principal Internal Auditor to reflect the current strategic and operational management arrangements and approach to service delivery to ensure appropriate coverage; • The Strategic Risk Profile was checked to confirm coverage on key strategic risks, as reliance is placed on the risk assessments carried out by the Risk Owners taking account of the risk ratings and mitigations; and • Account was taken of known external audit and inspection activities to avoid duplication of assurance work. 5.6 It is envisaged that 2024/25 will continue to be a year of change for the Council and other partner organisations. Therefore the Internal Audit Annual Plan 2024/25 should be considered to be flexible and will be periodically reviewed, and amended as required, to reflect any new arrangement or changing risks and priorities or available resources. Any amendments relating to the Council will be brought to the Corporate Management Team and the Audit Committee for approval. 5.7 The Non-MLC days reflect the Council’s partnership working commitment to provide Internal Audit resource and services to the Midlothian Health and Social Care Integration Joint Board (MIJB). A separate Internal Audit Annual Plan 2024/25 has been presented to the MIJB Audit and Risk Committee for approval. Page 62 of 114
Page 63
6 Report Implications (Resource, Digital, Risk and Equalities) 6.1 Resource The Local Authority Accounts (Scotland) Regulations 2014 that came into force on 10 October 2014 require a local authority to operate a professional and objective internal auditing service. Internal Audit must have sufficient staff and other resources to enable it to carry out the objectives of the Charter and to deliver a programme of independent and objective audit assurance work alongside other available sources of assurance to enable the Chief Audit Executive to prepare annual opinions on the adequacy of the overall control environment for Midlothian Council, and the MIJB. The Internal Audit staff resource totalling 3.22 FTE comprises Chief Internal Auditor (0.5 FTE), Principal Internal Auditor (0.72 FTE) and Internal Auditor (2.0 FTE). Each member of the current Internal Audit team has a professional internal audit or accountancy qualification, and has suitable experience, knowledge, skills and competencies (such as the Code of Ethics set out in PSIAS and the Seven Principles of Public Life) needed to deliver the Plan. After deduction for estimated annual leave, public holidays, absence including staff turnover, learning and development, and management and supervision, this equates to a total of 522 days available for Internal Audit activity (2023/24 plan 522 days). 6.2 Digital There are no digital implications arising from this report. 6.3 Risk The Objectives of Internal Audit are set out in its Charter, including “As part of Midlothian Council’s system of corporate governance, Internal Audit’s purpose is to support the Council in its activities designed to achieve its declared objectives and to do so: as a contribution to the Council’s corporate management of risk.” Key components of the audit planning process include a clear understanding of the Council’s functions, associated risks, and potential range and breadth of audit activity for inclusion within the plan. As in previous years, to capture potential areas of risk and uncertainty more fully, reference has been made to the Strategic Risk Profile and key stakeholders have been consulted. The PSIAS require Internal Audit to evaluate the effectiveness of the Council’s Risk Management arrangements and contribute to improvements in the process. The work of Internal Audit (including its opinion on the control environment) shall contribute to the Council’s review of its corporate governance arrangements, the outcome of which is published in the Annual Governance Statement. At all times, Management’s responsibilities (led by the Corporate Management Team) include: Page 63 of 114
Page 64
o Designing and maintaining proper risk management, governance and internal control processes and systems for which they have responsibility to ensure probity in systems and operations, including the prevention, detection and resolution of fraud and irregularities. These are not fixed but evolve as the Council changes. o Checking that these governance arrangements and internal controls are operating effectively and obtaining assurances from internal compliance, risk, inspection, quality, and control functions. (The above are known as the first and second lines.) o Engaging with Internal Audit (the third line) in a positive way to achieve shared goals for robust internal control and governance, best value and improvement, and ensuring that Internal Audit can properly fulfil its role. o Considering and acting upon Internal Audit findings and recommendations, including implementation of audit recommendations within agreed timescales and updating Pentana performance system, or accepting responsibility for any resultant risk from not doing so. o Seeking advice and consultancy support from Internal Audit on existing controls and on changes to and transformation of governance, processes and procedures. 6.4 Ensuring Equalities This report does not relate to a new or revised policy, service or budget change, which affects people (the public or staff), so an Integrated Impact Assessment (IIA) is not an applicable consideration. The Internal Audit work is carried out in accordance with the appropriate legislation and professional standards. The latter includes compliance by those within the Internal Audit function with the Code of Ethics set out in the PSIAS. This is of particular importance and relevance for the profession of Internal Audit founded as it is on trust placed in its independent and objective assurance about risk management, internal control and governance. 6.5 Additional Report Implications (See Appendix A) Page 64 of 114
Page 65
APPENDIX A – Additional Report Implications A.1 Key Priorities within the Single Midlothian Plan Although this report does not relate directly to the key priorities within the Single Midlothian Plan to which Midlothian Council and its Community Planning Partners have made a commitment (Reducing the gap in economic circumstances; Reducing the gap in learning outcomes; Reducing the gap in health outcomes; and Reducing the impact of climate change), good governance is important to enable Midlothian Council to deliver its key priorities in support of achieving the Council’s objectives. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above Midlothian Council is committed to creating a great place to grow supported by the 9 drivers for change. Implementing the 9 drivers for change in practice is applicable to the Council’s Internal Audit service provision to assist the Council in achieving its objectives. A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious A.4 Delivering Best Value The definition of Internal Auditing within the Public Sector Internal Audit Standards (PSIAS) is “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.” Internal Audit is a key element of good governance which is important to enable Midlothian Council to achieve its objectives. Page 65 of 114
Page 66
Recommendations made by Internal Audit underpin the Council’s own continuous improvement arrangements to enhance its effectiveness, thus supporting the delivery of the Council’s best value duties. A.5 Involving Communities and Other Stakeholders The Chief Audit Executive is accountable to the Audit Committee which, in fulfilling its governance role, acts as a bridge between the Council and other stakeholders. The Audit Committee remit includes “To approve the risk-based internal audit plan, including internal audit’s resources requirements, the approach to using other sources of assurance and any work required to place reliance upon those other sources”. The Council Management Team has been consulted on the Internal Audit resources, risk-based audit approach and the resultant planned Internal Audit coverage to ensure it will provide assurance on controls and governance relating to the key risks facing the Council and to assist them in discharging their roles and responsibilities. A.6 Impact on Performance and Outcomes Applying the framework of the PSIAS will give the Audit Committee assurance that the Internal Audit function is compliant with legislative requirements and current best practice. The delivery of the Internal Audit strategy and annual plan assists the Council in improving its performance and outcomes. A.7 Adopting a Preventative Approach The PSIAS are applicable from 1 April 2013 (amended 2017) which means the Internal Audit Service has taken steps to be fully compliant. Specific audits within the 2024/25 plan will include assessments on when a preventative approach can be adopted by the Council. A.8 Supporting Sustainable Development This report does not relate directly to supporting sustainable development. Internal Audit is a key element of good governance which is important to enable Midlothian Council to achieve its objectives including sustainable outcomes. Page 66 of 114
Page 67
INTERNAL AUDIT STRATEGY APPENDIX 1 1. AIM OF STRATEGY 1.1. The aim of this strategy is to guide MLC Internal Audit function in delivering a high quality internal audit service to Midlothian Council (MLC) and Midlothian Health & Social Care Integration Joint Board (MIJB), which is capable of: • providing the statutory annual assurance and audit opinion on the adequacy of each organisation’s risk management, internal control and governance arrangements to the relevant organisation’s senior management and board/audit committee; • carrying out all other objectives contained in Internal Audit’s Charter; and • adding value to each organisation by influencing and offering ways to enhance the governance and internal control environment in alignment to their strategic priorities. 2. STRATEGY OBJECTIVES 2.1. The objectives of this strategy are to: • Outline the assurance framework which comprises assurances from within the organisation and from external providers of assurance to improve the organisational understanding of the expectations of Internal Audit; • State how the key themes which are integral to the assurance gathering process across the organisation’s activities will be covered to inform the annual audit opinion statement; • Describe the approach to the development of the risk based Internal Audit annual plan; • Set out the relative allocation of Internal Audit resources; • Outline how the Internal Audit programme of work will be delivered to add value and will be prioritised to ensure those areas of greatest risk are covered during the audit year; and • Describe the monitoring and reporting of the Internal Audit findings from its work and progress with its plans to the relevant organisation’s audit committee/board. 3. ASSURANCE FRAMEWORK 3.1. It is Management’s responsibility to design and maintain proper risk management, governance and internal control processes and systems to ensure probity in systems and operations, and mitigation of risks, including the prevention, detection and resolution of fraud and irregularities. Management is also responsible for checking that the arrangements and controls are operating effectively and obtaining assurances from internal compliance, risk, inspection, quality, and control functions. These are known as the first and second lines. Internal Audit, as the third line, is the review function which will provide independent assurance on the effectiveness of the first and second lines of assurance, challenge current practices, recommend best practice and improvements to lead to a strengthening of the control environment and management of risks, thus assisting the organisation in achieving its objectives. 3.2. The organisation’s assurance framework is the means by which the relevant organisation’s Senior Management and Audit Committee/Board ensures that they are properly informed on the risks of not meeting objectives or delivering appropriate outcomes and that it has adequate assurances on the design and operation of systems in place to mitigate those risks. 3.3. The assurance framework comprises assurances from within the organisation (from Management and compliance functions, and independent and objective assurance from Internal Audit) and from external providers of assurance. Examples of the latter include the Accounts Commission, External Audit (Audit Scotland for MLC and MIJB), Education Scotland, Care Inspectorate, Scottish Housing Regulator, and other regulators. 3.4. The assurances are considered during the annual review of the effectiveness of each organisation’s overall governance framework carried out by officers of each organisation and supported by Internal Audit. The output is the Annual Governance Statement which is included within the relevant organisation’s Annual Report and Accounts. Page 67 of 114
Page 68
3.5. Where audit assurance is required on services that are delivered jointly by public sector joint working arrangements which include the organisation as a partner, these assurances will be sought as appropriate from partners’ Internal Audit service providers and Management. 4. KEY THEMES INTEGRAL TO INTERNAL AUDIT ASSURANCE 4.1. Each organisation is responsible for ensuring that its business is conducted in accordance with the law and proper standards, and that public money is safeguarded and properly accounted for, and used economically, efficiently and effectively. Fundamentally corporate governance is about the systems and processes, and cultures and values that are used by the organisation to discharge those responsibilities in a timely, inclusive, open, honest and accountable manner. This includes: setting the strategic direction, vision, culture and values of the organisation; effective operation of corporate systems; processes and internal controls; engaging with and, where appropriate, lead communities; monitoring whether strategic objectives have been achieved and services delivered cost effectively; and ensuring that appropriate arrangements are in place for the managing risks. 4.2. The organisation’s statutory financial officer, Section 95 Officer or equivalent, i.e. Chief Financial Officer (MLC) and Chief Finance Officer (MIJB), is responsible for the proper administration of the organisation’s financial affairs. Under his/her direction, the organisation’s system of internal financial control is based on a framework of Financial Regulations (rules and regulations for financial management or administration arrangements linked to other key financial documents that set out the policy framework, associated strategy, and the more detailed procedures and guidelines), regular Management Information, administrative procedures (including segregation of duties), Management Supervision, and a system of Delegation and Accountability. 4.3. The continued use of and investment in technology to support service delivery, and digital change and transformation to improve operations is a key part of the vision for each organisation. Arrangements in place are underpinned by the overarching framework of the ICT security policy designed to ensure that computer systems are secure, reliable and conform to nationally agreed standards, and by the ICT Strategy linked to Corporate Priorities designed to support effective and modern service delivery and to meet service objectives. 5. APPROACH TO PERIODIC PLANNING 5.1. The Internal Audit Strategy and the Internal Audit Annual Plan 2024/25 have been prepared in conformance with the Public Sector Internal Audit Standards (PSIAS) to fulfil the requirement to produce the statutory annual assurance and audit opinion for each organisation. 5.2. As part of the Internal Audit planning process it was necessary to consider each organisation’s priorities, plans, strategies, objectives, risks and mitigating controls, and the internal and external assurances provided to determine the priorities of the Internal Audit activity consistent with the organisation’s goals, as follows: • Analysis was undertaken of Internal Audit work during the past 5 years against the Audit Universe, which has been significantly revised and realigned to reflect the current strategic and operational management arrangements and approach to service delivery, to ensure appropriate coverage; • The Strategic Risk Profile was checked to confirm coverage on key strategic risks, as reliance is placed on the risk assessments carried out by the Risk Owners taking account of the risk ratings and mitigations; and • Account was taken of known external audit and inspection activities to avoid duplication of assurance work. 5.3. The audit planning process involves consultation with key stakeholders including discussions with Senior Management of each organisation to capture potential areas of risk and uncertainty more fully. This is of particular importance during a period of change and transformation as each organisation responds to new legislation or service delivery arrangements that might affect plans, priorities and resources. Page 68 of 114
Page 69
6. ALLOCATION OF INTERNAL AUDIT RESOURCES 6.1. The Internal Audit staff resource totalling 3.22 FTE comprises Chief Internal Auditor (0.5 FTE), Principal Internal Auditor (0.72 FTE) and Internal Auditor (2.0 FTE). Each member of the Internal Audit team has a professional internal audit or accountancy qualification, and has suitable experience, knowledge, skills and competencies (such as the Code of Ethics set out in PSIAS and the Seven Principles of Public Life) needed to deliver the plan. The Available Days has been amended to reflect the Internal Audit resources after consideration of estimated annual leave, public holidays, absence including staff turnover, learning and development, and management and supervision. 6.2. It is estimated that around 80% of Available Days will be spent on assurance, and legislative and other compliance activities combined. The Assurance work includes sufficient work across a range and breadth of audit areas which assure those processes that are currently in place and which Management rely on to deliver services, and to enable preparation of the required annual audit opinion on the adequacy of the organisation’s control environment. 6.3. An estimate of 10% of Available Days will be spent on Other activities in support of the Internal Audit function meeting its wider objectives as set out in the Internal Audit Charter. 6.4. An estimate of around 4% of Available Days will be utilised on Consultancy activities which support Management in delivering innovation, change and transformation. Management seek this value added activity during this unprecedented period of change for Local Government though this allocation reflects a reasonable estimate of what is actually deliverable within the boundaries of the role of Internal Audit and the resources available. 6.5. It is estimated that around 6% of Available Days will be spent on the provision of Internal Audit services to Midlothian Health and Social Care Integration Joint Board (MIJB). This reflects MLC’s contribution of support resources as governance arrangements have changed in response to statutory partnership working for the provision of health and social care integration. 7. APPROACH TO DELIVERY OF PROGRAMME OF WORK 7.1. To facilitate operational delivery, an Internal Audit Programme of Work will be developed which provides an indication of when work will be scheduled during the year, taking account of discussions with Senior Management and the availability of Internal Audit resources. 7.2. For each Assurance audit, in line with recognised good practice, an Audit Assignment detailing the scope, objectives and timing will be prepared and agreed with the relevant Chief Officer/Head of Service and Manager prior to commencement of Internal Audit fieldwork. Within assurance work: • The organisation’s Local Code of Corporate Governance (MLC/MIJB) will be used by Internal Audit as an integrated toolkit to test the extent of compliance. • End to end reviews of financial management and administration processes will be undertaken by Internal Audit to test the extent of compliance (as integral part of protecting public finances, safeguarding assets, and delivering services effectively and sustainably), and substantive testing of transactions including data analytics will be carried out to ensure completeness and accuracy. • The Plans (Financial and Asset Management) to deliver the organisation’s strategies, plans and priorities will be reviewed against best practice standards. • Internal Audit will consider fraud risk and prevention and detection controls, and other appropriate cross- cutting risks and controls (such as risk management, performance management, community engagement, equalities, business continuity, and health and safety), highlight examples of effective internal controls, and share good practice across service areas. • The ICT arrangements in place to protect each organisation from attack in relation to data security, integrity and availability will be tested and ICT Plans will be reviewed to confirm they support delivery of the organisation’s strategies and priorities. Page 69 of 114
Page 70
• National reports that give rise to introducing best practice arrangements or lessons learned from other local authorities or other public sector bodies will be considered and applied by Internal Audit to influence and offer ways to enhance governance and internal controls. 7.3. The Legislative and Other Compliance work will include testing in accordance with the terms of the funders’ service level agreements or legislative requirements, as part of the wider assurance framework. 7.4. Within Consultancy activities, Internal Audit will add value to the Council as it transforms its service delivery models, re-designs its business processes, and utilises technology to automate processes by influencing and offering ways to ensure adequate governance, risk management and internal controls. Internal Audit in its ‘critical friend’ role will provide an independent view and challenge of a sample of programmes and projects, and an objective assessment of self-evaluation arrangements and improvement that underpin the provision of Best Value. 7.5. Other work will include: • Carrying out Follow-Up to monitor Management’s progress with implementation of Audit recommendations to: ensure that improvement actions have been timeously and effectively implemented; check that these have had the desired effect to manage identified risks; and demonstrate continuous improvement in internal control and governance. To facilitate the Internal Audit follow-up activity, Audit recommendations will continue to be input to the Ideagen system, the corporate performance management system, to assist relevant Management in tracking and recording their implementation in a consistent way; • Performing potentially high risk Contingency audits, investigations and review of issues highlighted during the year that may be the result of a weakness in internal controls or that may be requested by Management or the Audit Committee; and • Delivering the Help Desk Facility where Internal Audit guidance and advice is given to Management on internal controls. 8. MONITORING THE WORK OF INTERNAL AUDIT 8.1. The Public Sector Internal Audit Standards (PSIAS) requires periodic reporting on the Internal Audit activity to the relevant organisation’s Senior Management and Audit Committee/Board. 8.2. Internal Audit assurance work completed and work in progress, and consultancy and other work for the Council associated with the delivery of the Plan will be outlined within regular reports to its Audit Committee. Specifically relating to Internal Audit assurance work, this report will include an Executive Summary of the audit objective, good practice, findings, recommendations, and audit opinion of assurance for each Final Internal Audit Report issued to relevant Senior Management in the period. 8.3. Regular progress updates on implementation by Management of relevant Audit recommendations will be reported periodically during the year to the relevant organisation’s Senior Management and Audit Committee/Board. 8.4. Internal Audit’s compliance with its Strategy, delivery of its risk-based Annual Plan, and outcomes of assessment(s) against Public Sector Internal Audit Standards (PSIAS) will be considered by the Chief Internal Auditor on a regular basis and formally reported every six months to the Council’s Corporate Management Team and the Audit Committee, through a Mid-Term Performance Report and within the Annual Assurance Report. 8.5. The Internal Audit Annual Assurance Report for each organisation (Midlothian Council and MIJB) to their respective Senior Management and Audit Committee/Board will provide the statutory annual audit opinion on the levels of assurance based on Internal Audit findings over the year to inform each organisation’s Annual Governance Statement. 8.6. The PSIAS requires an annual Internal Self-Assessment and an External Quality Assessment (EQA) each five years by appropriately qualified and independent reviewers to assess conformance with the Definition of Internal Auditing and Standards and the application of the Code of Ethics. The Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) have implemented a “peer review” framework, in which MLC participates, as a cost effective means of complying with the EQA requirement. Reporting on outcomes includes a statement on conformance with PSIAS and the quality assurance and improvement plan (QAIP) to enable an evaluation of the Internal Audit quality management framework and to identify opportunities for improvement. Page 70 of 114
Page 71
Internal Audit Annual Plan 2024/25 Appendix 2 Category Activity Days Commentary Assurance - Cyclical MLC Annual Assessment of Internal Control and Governance 20 Prepare an annual assurance report for Management and the Audit Committee summarising the work undertaken by Internal Audit during the year and forming an opinion on adequacy of the Council’s arrangements for risk management, governance and internal control. Continuous audit approach on progress with areas of improvement. Annual evaluation of compliance with the Local Code of Corporate Governance covering the corporate whole and individual Directorates/Services. Assurance - Risk Midlothian Energy 30 Review the governance structures, ensure monitoring regimes are in place and operating to ensure long term delivery of outcomes for the Council and control over financial and operational risk. Assurance - Risk Fostering, Kinship Care and Adoption 30 Review the processes in place to operate the Fostering, Kinship Care and Adoption processes and ensure that the correct funding is being allocated appropriately for each young person. Assurance - Risk Education Additional Support Needs 30 Review of the processes in place to plan for and provide services for pupils with additional support needs across Education services, meeting the needs of young people in accordance with regulatory requirements. Assurance - Risk Purchase to Pay 30 Review the control process in place around the Council’s Purchase to Pay system to ensure that they are operating effectively and providing assurance that all expenditure is appropriately processed through systems and is being correctly authorised in accordance with the financial control processes of the Council. Assurance - Risk Social Work Children Services to Adult Services Transition 25 Review the processes in place for transitions from Childrens Social Work Services to Adult Social Work Services for clients with ongoing needs, to ensure efficient and effective transitions are planned and implemented. Assurance - Risk Business Continuity 20 Review the Business Continuity processes in place within the Council ensuring that they cover all key risks, including Page 71 of 114
Page 72
Category Activity Days Commentary cybersecurity incidents, power/energy losses etc. Assurance - Risk Budget Monitoring 25 Review the processes in place to ensure that services and service management are effectively monitoring and managing budgets throughout the financial year and identifying and escalating significant issues through finance and governance structures on a timely basis. Assurance - Cyclical School Funds 25 Review the processes in place to ensure appropriate management and controls processes are in place for school funds. Assurance - Cyclical SEEMIS (School Information Management System). 20 Review the control process in place to ensure accurate recording and use of management information within the SEEMIS System. Assurance - Cyclical IT Asset Management 20 Review the processes in place to ensure that IT assets are recorded, managed and maintained in an effective and efficient manner. Assurance - Risk Vehicle Maintenance and Fleet Management 30 Review of the controls, governance and compliance processes in place to ensure that Council vehicles are being adequately maintained in line with regulatory requirements. Assurance - Risk Property assets and property strategy 20 Review the processes of developing a property asset management strategy and the governance of the implementation. Consultancy Consultancy 20 In its ‘critical friend’ role provide: an independent view and challenge of a sample of programmes and projects (including Captial Plan and Asset Management Board, Learning Estate Strategy, Business Transformation Board, Information Management Group); and an objective assessment of self-evaluation arrangements. Other MLC Audit Committee Self- Assessment 5 Provide assistance to the Chair in undertaking a self-assessment of the Audit Committee against the CIPFA best practice guidance. Assurance - Cyclical MLC Recommendation Follow Up Reviews 30 Undertake 2 reviews: the first includes a sample check on the adequacy of new internal controls for Audit Actions flagged as closed, and the second assesses performance against closing Audit Actions by the agreed due date. Page 72 of 114
Page 73
Category Activity Days Commentary Other Contingency 30 Support / undertake any investigations and other reactive work to ensure high risk issues and concerns identified by Management or Audit Committee during the year are appropriately addressed. Other Help Desk Enquiry system 22 Provide guidance and advice to Management and Staff on internal controls. Other MLC Administration of Audit Scotland Reports 5 Monitor publication of Audit Scotland reports and co-ordinate submission by Management of Audit Scotland Reports to the relevant Committee. Other Risk Management Group 15 Attend and provide support to the Risk Management Group, and the Integrity Group. Other MLC Attendance at Boards / Committees 20 Prepare for and attend Audit Committee meetings and other Boards/Committees as relevant. Other MLC Audit Planning for 2024/25 10 Update the Audit Universe, check risk registers and other sources of assurance, and develop and consult on proposed coverage within the Internal Audit Annual Plan 2024/25. MIJB Assurance Midlothian Health and Social Care Integration Joint Board 40 Audit reviews and support to be determined and agreed by the Midlothian Health and Social Care Integration Joint Board Audit and Risk Committee for review of the adequacy of the MIJB’s arrangements for risk management, governance and internal control for delegated resources. Total Days 2024/25 522 Page 73 of 114
Page 74
Page 74 of 114
Page 75
Audit Committee Monday 18 March 2024 Item No 5.6 Risk Management Update – Strategic Risk Profile Quarter 3 2023/24 Report by Derek Oliver, Chief Officer Place Report for Information 1 Recommendations Audit Committee is recommended to: • Note the current risk landscape and organisational response to the most significant risks in Quarter 3 (Q3) 2023/24 (1 October to 31 December 2023). 2 Purpose of Report/Executive Summary The purpose of this report is to provide Audit Committee with: • An update on the risk responses Midlothian Council has implemented during Q3 2023/24 to respond to the current risk climate • Assurance that Midlothian Council took a proportionate and planned approach to prepare and respond to the current risk climate • The risk evaluation of current strategic risks and opportunities for the Council 08 March 2024 Report Contact: Derek Oliver, Chief Officer Place Derek.Oliver@midlothian.gov.uk Page 75 of 114
Page 76
2 3 Q3 risk management overview 3.1 Midlothian Council has delivered a wide range of services to the people of Midlothian throughout Quarter 3 2023/24. 3.2 The Council continues to manage and review risks recorded within the Strategic Risk Profile. The work required to maintain the necessary corporate oversight over the broader strategic landscape continues through the Risk and Resilience Chief Officer’s group and Corporate Management Team (CMT). 3.3 Audit Committee should note that there were no new risks added from the previous Quarter. Updates on actions taken are included in the full strategic risk profile (Appendix B). Strategic Risk Profile Summary 3.4 The SRP is split into three sections: • Strategic issues • Strategic risks • Opportunities STRATEGIC ISSUES - SUMMARY Strategic issues Likelihood Impact Score Evaluation Q3 Q2 23/24 COVID 19 1 4 4 Low Low The Change Programme 5 5 25 Critical Critical Financial Stability 5 5 25 Critical Critical National Care Service 3 5 15 Medium Medium COVID-19 3.5 The risk evaluation was reduced from Critical to High in Q1 22/23 and remained as high through 2022/23. With the recovery of the pandemic, the likelihood was re-evaluated and considered low in Q4 22/23 and continues to be low through to Q3 23/24. The Council continues to monitor and risk assess as appropriate, with its wider impacts assessed and controlled through relevant Strategic Risks. The Change Programme 3.6 The Change Programme remained at Critical throughout 22/23 and into Q1 23/24. The financial challenges of the underlying budget gap pose a significant challenge for benefits realisation. Council agreed to a Transformation Blueprint in June 2023 which is a 5-year transformation plan. Page 76 of 114
Page 77
3 Financial Sustainability 3.7 The scale of the financial challenge continues to be reported to Business Transformation Steering Group and Council. National Care Service 3.8 The first stage of the Bill has been delayed and it had been anticipated that an update would be available around December 2023. This has been moved to March 2024. STRATEGIC RISKS – SUMMARY Strategic Risks Likelihood Impact Score Evaluation Q3 Q2 23/24 Climate change 5 5 25 Critical Critical Financial Sustainability in future years 5 5 25 Critical Critical The Long Term Change Programme 5 5 25 Critical Critical Early Years Expansion (1140 Hours) 4 5 20 High . High Scottish Child Abuse Inquiry 4 4 16 High High UK decision to leave the EU 4 5 20 High High Growing Council 4 4 16 High High Cost of Living Crisis 3 5 15 Medium Medium Asset Management 3 5 15 Medium Medium Cyber Security 3 5 15 Medium Medium Health and Safety 3 5 15 Medium Medium Care at Home 3 4 12 Medium Medium Employee performance 3 4 12 Medium Medium Emergency planning and business continuity 3 4 12 Medium Medium Legal and Regulatory compliance 3 3 9 Medium Medium Governance and standards 2 4 8 Low Low Internal control environment 2 3 6 Low Low Corporate policies and strategies 2 3 6 Low Low Page 77 of 114
Page 78
4 STRATEGIC RISKS – RATED CRITICAL/HIGH Climate Change 3.13 The Council developed a Climate Change Action Plan as part of its Climate Change Strategy approved by Council in August 2020, as well as making the commitment to achieve Carbon Neutral by 2030. 3.14 A review of the current Climate Change Strategy and Action Plan is being undertaken and an update will be provided to Council in Q1 2024/25. The risk evaluation continues to remain Critical in Q3. Early Years Expansion (1140 hours) 3.17 Following the Scottish Government’s decision to increase the number of free early learning and childcare hours to 1140, the Council has continued to plan with its partners. The two key strands to the successful implementation are the recruitment and training of staff and the physical increase in estate capacity. These challenges are being considered in the wider context of the plan, in which the capacity and expansion of all funded providers (council, private and voluntary settings as well as childminders) combine to deliver the requirements. 3.18 This risk evaluation continues to remain High whilst the Council awaits an update on the funding provision. Scottish Child Abuse Inquiry (SCAI) 3.19 The SCAI risk remains High. UK decision to leave the EU 3.20 The rate of inflation is impacting on the cost of living crisis for Midlothian residents and posing significant risk to a number of Council Capital Programme work streams. This was reported to the Business Transformation Steering Group (BTSG) and also through progress reports on programmes to Council. This risk evaluation remains High. Growing Council 3.21 In Q2 22/23 the risk evaluation increased from Medium to High and remains High in Q3 2023/24. This is in response to the current financial challenge as described above and the increased pressure the Council faces with growth. Some current examples of this include: • Inflationary impact on the delivery of the capital programme • Cost of living crisis and rent freeze response that could risk the delivery of the house building programme • Pressure on the care sector as people are living longer and require more care provision Page 78 of 114
Page 79
5 • General population growth places additional demand on infrastructure such as GPs, schools, waste services etc. 3.25 Work is ongoing to review the Learning Estate Strategy and a reprioritisation of the Capital Programme. STRATEGIC OPPORTUNITIES Shawfair 3.26 The Shawfair development, with its new Rail link provides a major incentive for house builders, employers, retail and commercial interests including opportunities to secure a low carbon community through district heating from Zero Waste. The Energy Services Agreement with Shawfair LLP has now been signed and work progresses to deliver the Energy Centre. Easter Bush 3.27 Fast growing opportunities in Science, Technology, Engineering and Mathematics (STEM) with opportunities to link with education. Partnership links to schools and university sector at the 'Bush' to promote STEM. The rate of inflation is impacting on the costs of the A701 improvements which will was reported to Council at the end of June 2022. A funding application was submitted to the UK Government’s Levelling Up fund to close the funding gap. City Deal 3.28 Edinburgh and South East Scotland City Region Deal - bid for funding to Scottish and UK Governments to accelerate economic growth through investment in infrastructure/ housing/ skills and innovation was agreed by Council in June 2018. Projects continue to be progressed with realisation of regional enhancements and connectivity. Creating a world class education system 3.29 The Centres of Excellence model is a core part of the Council's strategy to create a world-class education system in Midlothian. Page 79 of 114
Page 80
6 4 Report Implications (Resource, Digital and Risk) 4.1 Resource There are no direct resource implications indicated in this report, although, individual risks have associated resource implications. 4.2 Digital None 4.3 Risk The risks reported in this report are understood with the Council able to demonstrate the current risk controls and actions being taken in response to these. The report provides an overview of the significant risks faced by the Council during Quarter 3 2023/24 and should act to provide assurance that Midlothian Council took a proportionate and planned approach to prepare and respond to each of these risks. 4.4 Ensuring Equalities (if required a separate IIA must be completed) There are no direct equalities issues arising from this report. 4.4 Additional Report Implications (See Appendix A) See Appendix A Appendices Appendix A – Additional Report Implications Appendix B – Strategic Risk Profile (Quarter 3 2023/24) Page 80 of 114
Page 81
7 APPENDIX A – Report Implications A.1 Key Priorities within the Single Midlothian Plan This report provides an overview of the Strategic Risk Profile of Midlothian Council at a defined point in time. The issues, risks and opportunities affecting or supporting delivery of the council priorities are set out within the Strategic Risk Profile. A.2 Key Drivers for Change Key drivers addressed in this report: Holistic Working Hub and Spoke Modern Sustainable Transformational Preventative Asset-based Continuous Improvement One size fits one None of the above A.3 Key Delivery Streams Key delivery streams addressed in this report: One Council Working with you, for you Preventative and Sustainable Efficient and Modern Innovative and Ambitious None of the above A.4 Delivering Best Value The Council’s commitment to best value and securing continuous improvement can best be delivered when decisions are made against a backdrop of understanding the risks and opportunities before an organisation. This report seeks to provide assurance that the current risk environment is understood and that Midlothian Council is taking appropriate action in response to those identified risks. A.5 Involving Communities and Other Stakeholders This Strategic Risk Profile report has been compiled with input from a range of internal key stakeholders. Page 81 of 114
Page 82
8 A.6 Impact on Performance and Outcomes This report seeks to provide an overview of the challenging risk environment within which the Council is operating at this time. Being in a risk aware position helps to inform current and future decision making, with the intention of enhancing decision making and the associated performance and outcomes which flow from well informed decision making. A.7 Adopting a Preventative Approach The Risk Management approach being taken by the Council is founded on a preventative approach to managing risks, where appropriate and more generally to decision making with far greater risk awareness. A.8 Supporting Sustainable Development Senior Managers must ensure the sustainability of the Council, which entails identifying, understanding and managing Strategic and Service level risks and opportunities. Page 82 of 114
Page 83
1 STRATEGIC RISK PROFILE, Q3 October - December 2023 SRP STRATEGIC RISK PROFILE SRP This risk register captures the main strategic issues, risks and opportunities that are corporate in nature. It identifies the nature of the risks, measures required to control the risks and their evaluation. It also details what further actions are required to reduce the likelihood and impacts of those risks to more acceptable and manageable levels with timescales. Strategic Issues SRP.IR.02 The Change Programme Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.IR.02 Risk cause The pace of transformation strands of activity, reporting to the Business Transformation Board, does not secure service transformation, delivery of outcomes or benefit realisation. Risk event Delayed progress or non-achievement of outcomes and benefits. Risk effect Slow or delayed financial benefits arising from service redesign, requiring the adoption of recovery plans or requiring short term service reductions which impact on the Council’s ability to deliver against its priorities. Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 1. Transformation Blueprint agreed at Council June 2023 which is a 5-year transformation plan. Revised governance for transformation agreed and revised Terms of Reference in place for the Business Transformation Board to oversee progress on change programme. 2. Regular reporting to Council setting out scale of financial challenge ahead with recurring expenditure for current service delivery projected to exceed recurring income. 3. Cross Party Business Transformation Steering Group are given updates on the progress of the Transformation programme. 4. Financial monitoring reports and work of the Financial Management Corporate Management Team evidence continued financial sustainability, in so far as services are delivered within the overall budget in year. 5 5 Related Action Code Related Action Related action latest note Managed By Due Date Status SPR.RA- 02.08 Transformation Blueprint 2023-28 delivery Q3 23/24: Regular review and updates to the Business Transformation Board which meets monthly. Transformation Manager in post and sprints initiated. Q2 23/24: Progress as detailed in Q1. Q1 23/24: Transformation Blueprint presented to Council in June 2023 and agreed. Transformation Manager appointed – expected start date Q2 2023/24. Review of BTB Chief Officer Corporate Solutions; Chief Executive; Chief Finance Officer; 30 June 2028 20% Page 83 of 114
Page 84
2 governance complete and closure report produced for BTSG Q2 2023/24. Chief Officer Place SRP.RA.0 2.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q3 23/24: As Q1. Preparations for MTFS at February Council. Q2 23/24: As Q1. Q1 23/24: The projected budget gap through to 2028/29 was presented to BTSG and contained in the Transformation Blueprint approved by Council. Updated projections will be presented to BTSG and to Council on a regular basis. Chief Executive; Chief Finance Officer 27-Feb-2024 0% SRP.IR.07 Financial Sustainability Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.IR.07 Risk cause Scottish Government Grant settlements fall short of the resources needed to sustain core services. Core funding falling short of inflation pressures, pay awards and demographic pressures arising from an Increasing ageing population of over 75’s Increasing population of 0-15 age group and at a time when there are rising customer expectations. Risk event Transformation activity and the flexibility available to Councils as part of the grant settlement does not address future years projected budget gaps. Risk effect Inadequate government funding makes securing balanced budgets challenging. This in turn erodes the Council’s ability to deliver services to the community and potentially means that resources available fall short of those the Council assess as required to meet its statutory obligations. Whilst transformation activity can help reshape services and ensure best value in the delivery of services it is not a solution to continued erosion of core funding. Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 1. There is an approved Capital Strategy and Reserves Strategy in place. The Capital Strategy is being updated in the context of ongoing and significant infrastructure pressures. 2. There is an approved budget for 2022/23. Services were delivered within the totality of that budget and the 2023/24 budget has been approved albeit with some reliance on one off funding. 3. There are effective arrangements in place to monitor financial performance including quarterly reporting to Council with draft reports considered at a dedicated CMT session each quarter to bring greater focus. 4. Directorates have budget boards in place to monitor and agree actions for those items which are identified as needing specific attention or present a risk to the financial position of services. 5. Strategic Boards in place and BTB focus and attention on driving transformation to support future year’s financial sustainability. 6. Working through COSLA to influence government spending decisions to influence Scottish Government’s budget allocation to Councils. 7. Capital Plan and Asset Management Board will scrutinise and challenge slippage on capital programmes recognising that slippage can have an adverse impact on financial sustainability and also the delivery on assets required to support capital growth. 8. Chief Executive continues to emphasise the need for effective financial control and underlined the benefit to the organisation of such an approach. Enhanced monitoring arrangements have been put in place across the Council. 9. Scottish Governments May 2022 Resource Spending Review provided planning parameters for term of parliament, albeit these are challenging and present a real terms reduction in grant funding of circa 7% over the period. 10. Report to Council 21 February 2023 sets out scale of financial challenge ahead with recurring expenditure for current service delivery projected to exceed recurring income. 11. “Mini Budgets” progressed in 2020/21 and in 2021/22 that removed non- deliverable legacy savings targets given focus on response to and recovery from pandemic. 12. Cross Party Business Transformation Steering Group engaged in consideration of measures to secure balanced budgets alongside the 5 5 Page 84 of 114
Page 85
3 development of a Strategic Plan to support decisions about what services, beyond those which are statutory can be provided. Related Action Code Related Action Related action latest note Managed By Due Date Status SPR.RA- 02.09 Transformation Blueprint 2023 to 2028 Q3 23/24: Regular review and updates to the Business Transformation Board which meets monthly. Transformation Manager in post and sprints initiated. Q2 23/24: Progress as detailed in Q1. Q1 23/24: Transformation Blueprint presented to Council in June 2023 and agreed. Transformation Manager appointed – expected start date Q2 2023/24. Review of BTB governance complete and closure report produced for BTSG Q2 2023/24. Chief Executive; Chief Finance Officer 30-June-2028 20% SRP.RA.0 2.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q3 23/24: As Q1. Preparations for MTFS at February Council. Q2 23/24: As Q1. Q1 23/24: The projected budget gap through to 2028/29 was presented to BTSG and contained in the Transformation Blueprint approved by Council. Updated projections will be presented to BTSG and to Council on a regular basis. Chief Executive; Chief Finance Officer 27-Feb-2024 0% SRP.RA- 02.10 Capital Plan Prioritisation Q3 23/24: Work continues on CPP. Q2 23/24: Work continues on CPP. Q1 23/24: The Capital Plan in its current format is unaffordable due to rising costs of construction, inflation and EU-Exit/post pandemic and other economic pressures. A review of the Capital Plan is underway to determine affordability, prioritisation and options presented to members for consideration in Q2 2023/24. Head of Development; Chief Finance Officer; Executive Director Place 31-Oct-2023 0% SRP.IR.10 COVID 19 Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.IR.10 Risk cause COVID 19 Virus Risk event Virus evident in all communities with rates of positive infection increasing. In a Sottish setting the focus on increase is within the central belt. Risk effect Potential for widespread impacts with the risk of significant levels of community transmission leading to increased government restrictions aimed at reducing community Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; HR Strategic 1. CIMT established to take the strategic approach to managing the response to COVID 19 and stands ready to be re-initiated at any time. 2. Hybrid working has been adopted by the Council as well as a dedicated Hybrid Working Board as part of the Transformation Programme 3. COVID-19 guidance monitored and continually revised, with particular focus on Adult Services, Children’s Services, Education and Communities and Lifelong Learning around how they would continue to maintain contact with children and young people who were deemed to be at risk. 4. Keeping employees briefed and supported through the Chief Executive’s weekly staff briefings; Communications weekly email and routine HR updates. (e-mailed to all employees through combination of work and personal e-mail addresses). Includes Wellbeing advice, guidance and support and signposting to PAM and EAP providers. 5. Promotion of digital tools to support employees and prevent employees becoming isolated. 1 4 Page 85 of 114
Page 86
4 transmission. Delivery of services making use of remote working solutions as far as possible. National lockdown measures to limit and control spread, impact on income generating services. Rapid pace of guidance changes following government announcements and expectation of quick changes to service delivery in line with new controls. Lead; Chief Officer Young People and Partnerships 6. Council website kept up-to date, providing details of which services were operating and any changes on how to access services. 7. A range of interventions, including digital equipment and tools such as MS Teams put in place to support remote and hybrid working 8. Following safe working guidance issued by Scottish Government relevant to sectors. 9. Economic Recovery Strategy 10. School and workplace based COVID risk assessments continually reviewed to support the identification and control of risk (and personal risk assessments where required) Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.1 0.1 Hybrid Working Q1 23/24: Hybrid Working Programme closed. Closure report presented to Place DMT and contained within BTB closure report. Workstreams relating to Estate Rationalisation have moved into Blueprint and continue under the themes of Hub & Spoke, Capital Plan and One Stop Shops. Project Team and Terms of Reference being established. Chief Officer Corporate Solutions; Chief Digital Officer; Chief Officer Place; Executive Director Place 31-Mar-2024 0% SRP.IR.11 National Care Service Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.IR.11 Risk cause In August 2022 the Scottish Government launched a 12-week consultation on the way in which social care is delivered in Scotland. The consultation followed recommendations made in the Independent Review of Adult Social care. The independent analysis of responses was published in February 2022. On 20 June 2022 the Scottish Parliament published the National Care Service (NCS) Bill which will provide the foundation for the NCS. Risk event A Bill passes through various Head of Adult and Social Care; Chief Executive; Director Health and Social Care; Executive Director Place; Chief Officer Young People and Partnerships 1. The first stage of the Bill has been delayed and it is anticipated that an update shall be available around December 2023. 2. Officer Working Group established to engage with the NCS Design School and to continue the existing work with COSLA, SOLACE, SOLAR and other relevant bodies 3. Ongoing briefings with elected members 4. Continued dialogue and engagement with Scottish Government and IJB/H&SCP/Children’s Services 3 5 Page 86 of 114
Page 87
5 Parliamentary stages. The Bill is currently in Stage 1 of the process. The most significant part of the legislation which poses the most risk is the intention to transfer social care responsibility from local authorities to a new, national service. Risk effect The details of the logistics of any transfer are not yet provided within the Bill. It is not clear the extent to which powers will be removed from local authorities or what the provision or delivery of services will or will not be. At this stage, the risk effect is anticipated to be significant financial impact to local authorities and IJBs, as well as the potential for impacts on staffing, transfer of property and facilities and the reshaping of the delivery of care. It should be noted that the initial impact on the Council is staff time to contribute to the ongoing discussions and understanding of the impact of the Bill. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.1 1.1 Officer Working Group Q3 23/24: Further information now expected late March 2024. Q2 23/24: National Care Service Bill has been delayed for any further decision until the 1st March 2024. Q1 23/24: Work on the NCS has been delayed and further information will not be available until around December 2023. Chief Executive 31-Mar-2024 100% Page 87 of 114
Page 88
6 Strategic Risks SRP.RR.01 Financial Sustainability in future years Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.0 1 Risk cause: Scottish Government Grant settlements fall short of the resources needed to sustain core services. Core funding falling short of inflation pressures, pay awards and demographic pressures arising from an Increasing ageing population of over 75’s. Increasing population of 0-15 age group and at a time when there are rising customer expectations. Policy decisions by UK & Scottish Governments which are not fully funded. Changes to the responsibilities of Local Government and the funding implication that arise from that, particularly in respect of the creation of a National Care Service. Future year pay award settlements. Risk event: Real terms reduction in core grant settlements. Policies decisions at Government level not fully funded to Council's. Implementation of a National Care Service and impact on grant settlements Securing the extent of change required in order to deliver financial sustainability and a change program that recognises the size of the challenge. Cost pressures exceeding budget estimates. Uncertainty around service delivery models and income streams and prospects for public finances associated with COVID impact and recovery. Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 1. The Strategic Plan, Transformation Blueprint and updated MTFS projections will all be presented to Council in June 2023. 2. Maintaining a level of reserves to deal with unforeseen or one-off cost pressures. 3. Capital and Reserves Strategies in place. The Capital Strategy is being updated in the context of ongoing and significant infrastructure pressures. 4. Working through COSLA to influence government spending decisions to influence Scottish Government’s budget allocation to Councils. 5. Implement a lobbying strategy with government to recognise the unique position Midlothian Council is in. 6. Best Value Audit report actions. 7. Strategic Boards in place to drive transformation in line with the Transformation Blueprint. 8. Dedicating capacity to understand impact of NCS Bill, but limited details mean this is challenging and many unanswered questions (refer to specific risk on NCS for further detail) 5 5 Page 88 of 114
Page 89
7 Risk effect: Gap in Council budget between budget commitments / pressures and funding level and inadequate options presented to address this, resulting in a structural deficit. The pace of growth coupled with the shortfall in grant settlements adds pressure to Council budgets which will be unable to deliver capital and revenue work programmes. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.0 2.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q3 23/24: As Q1. Preparations for MTFS at February Council. Q2 23/24: As Q1. Q1 23/24: The projected budget gap through to 2028/29 was presented to BTSG and contained in the Transformation Blueprint approved by Council. Updated projections will be presented to BTSG and to Council on a regular basis. Chief Executive; Chief Finance Officer 27-Feb-2024 100% SRP.RA.0 2.04 Transformation Blueprint 2023 to 2028 Q3 23/24: Regular review and updates to the Business Transformation Board which meets monthly. Transformation Manager in post and sprints initiated. Q2 23/24: Progress as detailed in Q1. Q1 23/24: Transformation Blueprint presented to Council in June 2023 and agreed. Transformation Manager appointed – expected start date Q2 2023/24. Review of BTB governance complete and closure report produced for BTSG Q2 2023/24. Chief Executive; Chief Finance Officer 30-June-2028 20% SRP.RA.0 2.06 Capital Plan prioritisation Q3 23/24: Work continues on CPP. Q2 23/24: Work continues on CPP. Q1 23/24: The Capital Plan in its current format is unaffordable due to rising costs of construction, inflation and EU-Exit/post pandemic and other economic pressures. A review of the Capital Plan is underway to determine affordability, prioritisation and options presented to members for consideration in Q2 2023/24. Head of Development; Chief Finance Officer; Executive Director Place 31-Oct-2023 0% SRP.RR.02 The Long-Term Change Programme Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.0 2 Risk cause: A MTFS that does not address the projected budget shortfall or contextual factors relating to the Midlothian area. Reduced resources Leadership fit for the future. Lack of clarity or clear compelling vision Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief 1. Development of Strategic Plan, Transformation Blueprint and MTFS projections which come together to provide a framework to effect change and to move the Council to a position of financial sustainability. 2. Leadership from all Elected Members, Executive Team and Senior Leadership Group. 3. Appropriate governance in place across the BTB Strategic Boards 4. Resilience planning. 5 5 Page 89 of 114
Page 90
8 for the future Delay or shortfall in securing savings Lack of or not securing transformational change in service provision Risk event: Delayed progress in applying various strands of the Change Programme including Delivering Excellence Framework Slow benefits realisation and budget savings Cuts in service provision rather than service transformation Risk effect: Objectives of change not actually met. Adverse impact on services Slow or delayed proposals/savings arising from service redesign. Potentially further eroding reserves or requiring short term service reductions which impact on Council's ability to deliver against its priorities. Staff morale negatively affected, Government step-in short term savings instead of transformation Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 5. Capacity to deliver change. 6. Dedicating capacity to understand impact of NCS Bill, but limited details mean this is challenging and many unanswered questions (refer to new risk on NCS for further detail) Related Action Code Related Action Related action latest note Managed By Due Date Status SPR.IA.02. 06 Transformation Blueprint 2023 - 2028 Q3 23/24: Regular review and updates to the Business Transformation Board which meets monthly. Transformation Manager in post and sprints initiated. Q2 23/24: Progress as detailed in Q1. Q1 23/24: Transformation Blueprint presented to Council in June 2023 and agreed. Transformation Manager appointed – expected start date Q2 2023/24. Review of BTB governance complete and closure report produced for BTSG Q2 2023/24. Chief Officer Corporate Solutions; Chief Executive; Chief Finance Officer; Chief Officer Place 30-June-2028 20% SRP.RA.0 2.03 Develop Medium Term Financial Strategy with greater oversight, clearer responsibility and accountability. Q3 23/24: As Q1. Preparations for MTFS at February Council. Q2 23/24: As Q1. Q1 23/24: The projected budget gap through to 2028/29 was presented to BTSG and contained in the Transformation Blueprint approved by Council. Updated projections will be presented to BTSG and to Council on a regular basis. Chief Executive; Chief Finance Officer 27-Feb-2024 0% Page 90 of 114
Page 91
9 SRP.RR.03 Legal and Regulatory Compliance Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.0 3 Risk cause Current or new legislation applying to Midlothian Council Risk event Council and or Services not identifying all applicable legislation impacting Council activities and Service requirements. Risk effect Council failing to meet its statutory obligations resulting in a potential negative impact for service users or employees. Reputational impact of not meeting statutory obligations. Head of Adult and Social Care; Legal and Governance Manager; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 1. Executive Directors, Chief Officer(s) and Head(s) of Service responsible for identifying applicable legislation and propose Council or Service responses to CMT and Cabinet/Council as required. 2. Annual Assurance Statement. 3. Internal Audit testing of internal controls as part of risk-based audit plan. 4. External Audit. 5. Range of external inspection. 6. BTSG oversight of new legislation 7. Central repository of applicable legislation. 3 3 Related Action Code Related Action Related action latest note Managed By Due Date Status NEW Review of policy and creation of a policy register Q3 2023/24: Corporate Solutions has initiated a review of policies in the Council, aligned to legislation changes and statutory requirements for the Local Authority. Work is ongoing to gather information across the Council to inform an action plan and a refreshed policy register. It is estimated that this work will take until end 2024 to be completed. Chief Officer Corporate Solutions 31 Dec 2024 10% SRP.RA.0 3.02 Rights of the Child Bill Q3 23/24: As Q2. Q2 23/24: Bill now adopted. Policy to be presented to Council May/June 2024. Chief Social Work Officer 31-Dec- 2023 0% SRP.RA.0 3.03 National Care Service Q3 23/24: As Q2. Q2 23/24: National Care Service Bill has been delayed for any further decision until the 1st March 2024. Q1 23/24: The first stage of the Bill has been delayed until December 2023. Chief Executive 31-Dec- 2023 0% Page 91 of 114
Page 92
10 SRP.RA.0 3.05 Review of Standing Orders, Scheme of Administration and Scheme of Delegation Q3 23/24: Workplan being developed by officer working group and will be presented to SOWG in March 2024 for approval. Q2 23/24: Work ongoing. Q1 23/24: Work ongoing. Legal and Governance Manager; Chief Officer Corporate Solutions; Executive Director Place 31 Dec 2024 20% SRP.RR.04 Employee performance Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.0 4 Risk cause Employees not suitably trained/developed for the roles required of them. Limited availability of qualified practitioners in certain sectors. Change program not informed by all key stakeholders. Ageing work force. Employees unclear on expected behaviours. Employees constrained to innovate as a result of management practice. Employee productivity rate below the required level because of ineffective use of the People Policies particularly Maximising Attendance. Salaries significantly lower in social work area in comparison to other LA’s resulting in recruitment issues particularly with trying to recruit experienced staff. Risk event Employees not engaged/consulted as part of organisational transformation. Experienced employees leaving the organisation. Inability to recruit suitably qualified / trained staff to fill vacancies negatively Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; HR Strategic Lead; Chief Officer Young People and Partnerships Over-riding risk control measure = Focus on having the right people, here, healthy, performing, behaving and well led via effective utilisation of the workforce strategy and accompanying action plan. Attendance / Wellbeing 1. Continuing implementation of the Wellness@Midlothian agenda. 2. Creation of an Employee Health and Wellbeing Strategy and supporting policy. 3. Maintaining the Healthy Working Lives Gold Award. 4. Proactive use of Occupational Health, Midlothian Physiotherapy, Employee Assistance Programme and the Workplace Chaplaincy Service. 5. Change of EAP supplier to ensure provision of best possible service. 6. Development of progressive People Policies. 7. Roll-out of mental health training for staff and managers. Performance 1. Service-level workforce plans. 2. Structured, robust, well established ‘Making Performance Matter’ Framework where expected standards of behaviour and Council values are re-enforced. 3. Continued re-enforcement of all People Policies involving various communication methods. 4. Development of a suite of management information to ensure Service Managers are informed e.g., turnover, absence levels/reasons etc. Organisational Change 1. Policy for Organisational Change includes strong emphasis on early engagement of employees. 2. Redeployment Procedure to ensure maximum chance of successful redeployment. 3 4 Page 92 of 114
Page 93
11 impacting on remaining workforce. Unacceptable behaviours demonstrated by employees. Stated organisational culture not consistently reinforced by managers. Poor employee performance will stifle transformational change. Risk effect Difficulties recruiting the right staff. Challenges retaining quality staff. Low skill levels. Low morale, especially during change. High absence rates, loss of experience in service areas. ‘A Great Place to Grow’ our values including respect, collaboration, pride and ownership not realised, potentially resulting in missing the opportunity to capitalise on the abilities, experience and ideas of team members. Poor employee performance will Exacerbate the financial challenge. Conduct 1. Resolution Policy encourages early intervention of workplace issues. 2. Professional standards and values build into the induction process and management development programme. Communication 1. A range of initiatives to keep staff informed of change (Chief Executive’s weekly email, Connect, All staff emails, tailored team briefings etc. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.0 2.04 Revisions to Service Workforce Plans - including analysis of future workforce requirements, gap analysis and gap closing strategies, and performance measures and target setting. Q3 23/24: As Q1. Q2 23/24: As Q1. Q1 23/24: Service plans were presented to June 2023 council. Supporting workforce plans are due to be fully in place for June 2024. The workforce planning process, guidance and documentation has been developed and approved for use by managers across the council. The HR team is available to support managers who wish help and guidance in the development of these workforce plans. HR Strategic Lead 31-Mar-2024 0% SRP.RA.0 2.06 Workforce wellbeing Q3 23/24: This will be delivered in Spring 2024. Q2 23/24: As Q1. Q1 23/24: Health and Wellbeing is part of the work ongoing under Theme 2 of the Blueprint. This work will report further as part of that reporting process, in the latter half of 2023. HR Strategic Lead 31-Mar-2024 0% SRP.RR.07 Care at Home Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation Page 93 of 114
Page 94
12 SRP.RR.0 7 Risk cause Internal and External providers of Care at Home services unable to meet service and quality requirements as a result of a lack of capacity. Risk event Capacity of Community Support outstripped by demand. Risk effect There is a risk that patients will have their discharge delayed because there is insufficient community supports to enable timely discharge leading to deterioration in their health, beds being blocked and elective operations potentially being cancelled. Head of Adult and Social Care; Director Health and Social Care 1. Care at Home winter assurance plan and business continuity plan complete 2. Development of Care at Home Service Improvement action plan near completion 3. External commissioning complete and ongoing contract monitoring in place 4. External provider audits complete 5. Re-established Multi-Agency Quality in Care at Home quarterly review meetings jointly with East Lothian 6. Weekly provider meetings in place 7. Additional locum team members and contracts with agency staff in place 8. Daily discharge meeting with Multidisciplinary and Multi-agency team planning to plan and coordinate discharge to ensure care at hone support in place 3 4 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.0 7.01 Independent review of adult and social care Q1 23/24: Pause remains in place. Head of Adult and Social Care; Chief Executive 31-Jan-2024 100% SRP.RR.08 Asset Management – buildings, vehicles, roads and Digital assets/networks Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.0 8 Risk cause Many of the assets the Council own by their nature are in a position of ongoing deterioration through their normal use, e.g., roads - normal wear and tear, streetlights and vehicles & buildings used to deliver services. Risk event Many assets will deteriorate under normal conditions although buildings, roads and streetlights as an example can be damaged during more extreme weather events or as a result of a lack of maintenance. Head of Adult and Social Care; Chief Officer Corporate Solutions; Head of Development; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive 1. There is provision in place within the capital plan for investment in the asset base. 2. Asset register 3. Condition Survey 4. Understanding of future asset needs 5. Asset Strategy: . Roads . Land . Fleet . Digital Service Network . Digital Service hardware 6. Capital program - investment in estate. 7. Ongoing monitoring of properties by: Maintenance Surveyors, Facilities Management and Property Users. 8. Established Capital Plan and Asset Management Board and dedicated Asset 3 5 Page 94 of 114
Page 95
13 Risk effect In the case of Roads Services there is a real risk of increased potholes and insurance claims, reduced skid resistance leading to higher accident potential and building up of higher costs in the future. In respect of vehicles, increased breakdowns, service failures, greater maintenance inevitable, higher short-term hire costs. In terms of property, health and safety issues arise, failure to meet current standards and higher running costs. There is also the risk of two-tier accommodation, some high quality, some low. Director Place; Chief Officer Young People and Partnerships Management Board 9. Establishment of 7 thematic Estate Safety and Management Groups chaired by Chief Officer Place 10. Building Accessibility Strategy Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.0 8.02 Plan for appropriate investment in capital works and remedial maintenance over the lifespan of each property asset. Q3 23/24: Surveyors have now completed the first phase of surveys that were due to have been completed by March 2024. A further phase will begin in April and run though until April 2025. Q2 23/24: As Q1. Q1 23/24: Surveyors Thompson Gray have been appointed and are progressing a schedule of condition surveys over a 2-3 year period. This is currently in hand with surveys progressing. Chief Officer Place 31-Mar-2024 33% SRP.RA.0 8.05 Learning Estate Strategy Q3 23/24: As Q1. Any delay to approval of required projects may impact on the statutory requirement to provide Education. Q2 23/24: As Q1. Q1 23/24: All Priority 1 projects as detailed in the Learning Estate Strategy have been approved by Council in June 2023, this includes Beeslack HS replacement and Penicuik HS refurbishment & extension. A number of Projects in the priority 2 tranche have been progressed to ensure schools to do not experience capacity breaches. Head of Development 31-Mar-2024 0% SRP.RA.0 8.06 Asset Management systems Q1 23/24: Identified for implementation through Transformation Blueprint and The Change Programme. SRP.IR.02. Chief Officer Place 31-Mar-2024 0% Page 95 of 114
Page 96
14 SRP.RR.09 Emergency Planning and Business Continuity Management Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.0 9 Risk cause The Council not preparing or timeously reviewing Emergency Plans and testing arrangements to respond to Civil Contingencies Incidents Risk event There are a wide range of potential events the Council may be expected to respond to e.g., Severe weather incident, Pandemic, Utility disruption etc. Risk effect Censure through non-compliance with the Civil Contingencies Act Not adequately recovering from the loss of major accommodation (e.g., secondary school, main offices), computer systems and staff Not able to respond to a major emergency in the community Fatal Accident Inquiries Head of Adult and Social Care; Chief Officer Corporate Solutions; Head of Development; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Senior Manager Protective Services; David Robertson; Chief Officer Young People and Partnerships 01 – Civil Contingencies Risk Register used to highlight key risks and record response, - Council’s plans developed and maintained in response to identified risks, - Risk and Resilience Group support development, peer review and roll out of plans. 02 – Establishment based incident response plans in place and maintained locally. 03 – Emergency response plan setting out general approach to respond to a major emergency in-line with key partner organisations. 04 – As part of the Council’s Emergency response the importance of recording decisions made and information available at the time is highlighted as this would be scrutinised in the event of an FAI. 05 – Care for People Group meeting 6 weekly to continue support for Communities in response to COVID – 19 to establish and co-ordinate support for people on a multi-agency basis. 06 – Care for People Group: Afghan, Ukrainian and UASC support programmes 3 4 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.0 9.02 Development of Emergency Planning Improvement Plan Q3 23/24: Service review of team has commenced. Q2 23/24: Service review to commence in Q3. Q1 23/24: The draft report has been prepared for CMT on Enhancing Organisational Resilience and Preparedness. This report also addresses progress with business continuity. A service review of the Health, Safety & Resilience team is scheduled to commence in Q2 2023/24. Chief Officer Place; Senior Manager Protective Services; David Robertson 31-Dec-2023 75% SRP.RA.0 9.03 Business Continuity System Q3 23/24: System review/upgrade has been considered and it is planned to present a report to CMT in Q4. Q2 23/24: Progress impacted by staff resource, conflicting pressures and pending service review. Q1 23/24: Following the loss of officer resource through resignation progress has slowed. Consideration of the appropriateness of procuring the system upgrade version will occur in Q2. Chief Officer Place; Senior Manager Protective Services; David Robertson 31-Mar-2024 25% Page 96 of 114
Page 97
15 SRP.RR.10 Governance and Standards in Public Life Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.1 0 Risk cause Code of conduct for Members and employees’ actions falling short of International Standards. Risk event Failure in openness, accountability, clarity. Risk effect Service, partnerships and project outcomes not achieved. Non- compliance with conduct standards and reduction in standards in public life. Legal and Governance Manager; Chief Officer Corporate Solutions; Chief Executive; Chief Officer Place; Executive Director Place 01 Annual Assurance Statement. 02 Standing Orders 03 Scheme of Administration 04 Scheme of Delegation 05 Elected Member Code of Conduct 06 Induction programme for new members and ongoing learning and development programme 07 Employee Code of Conduct 2 4 Related Action Code Related Action Related action latest note Managed By Due Date Status NEW Review of the employee onboarding and induction programme Q3 2023/24: CMT agreed to a refresh of the staff induction programme which include a compliance section. It is anticipated that the new programme will be fully completed by end Dec 2024, with a phasing of improvement actions being delivered throughout 2024. SRP.RA.0 3.05 Review of Standing Orders, Scheme of Administration and Scheme of Delegation Q3 23/24: Workplan being developed by officer working group and will be presented to SOWG in March 2024 for approval. Q2 23/24: Work ongoing. Q1 23/24: Work ongoing. Legal and Governance Manager; Chief Officer Corporate Solutions; Executive Director Place 31 Dec 2024 20% SRP.RR.1 0.01 Corporate Governance Q1 23/24: Annual Assurance Statement presented to Audit Committee in June 2023 and agreed. Completed Legal and Governance Manager; Chief Officer Corp Solutions; Executive Director Place 31-Mar-2024 100% Page 97 of 114
Page 98
16 SRP.RR.11 Corporate Policies and Strategies Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.1 1 Risk cause Policies may not match the aspirations of the Council's Strategic priorities or cultural perspective. Risk event Policies not monitored may become out of date. Policies not reviewed to ensure alignment with strategic priorities. Risk effect Policies not monitored could result in non-compliance with legislation Policies not aligned to strategic priorities will inhibit rather than support implementation of strategic priorities. Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 1. Single Midlothian Plan providing overarching direction 2. Service plans aligned to Single Midlothian Plan. 3. Leadership team to ensure correct approaches are adopted to get the right results. 4. Strategic housing investment plan, submitted to Scottish Government in October 2022 5. Capital Strategy 6. Integrated Joint Board (IJB) Plan 7. IJB Strategic needs assessment 8. Midlothian Local Development Plan 2017 – the Council’s corporate spatial strategy. 2 3 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.1 1.02 Accessibility Strategy Q1 23/24: Education accessibility strategy updated. Chief Operating Officer Education; Chief Officer Place; Senior Manager Property and Facilities Management 31-Oct-2023 100% NEW Review of policy and creation of a policy register Q3 2023/24: Corporate Solutions has initiated a review of policies in the Council, aligned to legislation changes and statutory requirements for the Local Authority. Work is ongoing to gather information across the Council to inform an action plan and a refreshed policy register. It is estimated that this work will take until end 2024 to be completed. Chief Officer Corporate Solutions 31 Dec 2024 10% SRP.RA.1 1.05 Antisocial Behaviour Policy Q3 22/23: Work continues. Chief Officer Place 31-Dec-2023 0% SRP.RA.1 1.06 Transformation Blueprint 2023 - 2027 Q3 23/24: Regular review and updates to the Business Transformation Board which meets monthly. Transformation Manager in post and sprints initiated. Q2 23/24: Progress as detailed in Q1. Chief Executive; Chief Finance Officer 30-June-2028 20% Page 98 of 114
Page 99
17 Q1 23/24: Transformation Blueprint presented to Council in June 2023 and agreed. Transformation Manager appointed – expected start date Q2 2023/24. Review of BTB governance complete and closure report produced for BTSG Q2 2023/24. SRP.RR.1 1.01 Parental Engagement Strategy Q2 23/24: Policy implemented. Q1 23/24: Draft Parental Involvement & Engagement Policy at consultation. Chief Operating Officer Education 31-Oct-2023 100% SRP.RR.12 Internal Control Environment Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.1 2 Risk cause Work procedures/process inadvertently create the capacity for fraud and waste to occur. Internal Controls requiring more time, effort or cost than the risk being managed. Mangers failing to follow procedures and keep systems updated with accurate information. Risk event Persons exploiting opportunities to commit fraud. Waste and errors Changing risk landscape associated with remote working solutions. Risk effect Waste and loss Risks over managed with risk controls costing more than the potential loss being managed. Increased opportunity for fraud or financial loss has direct impact on management information. Has adverse effect on service performance. Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 1. Services have been prompted to consider fraud and waste within Service Risk Registers. 2. Risk Management Guide provides direction on the need to balance time, effort and cost against benefit of risk controls. 3. Internal Audit examine internal control arrangements based largely on the risk registers. 4. Corporate Fraud team in place who assist managers to undertake fraud risk assessments in their areas (focused on priority areas) and provide advice and guidance on fraud related matters. Active participation in the National Fraud Initiative to investigate matches. 5. Whistleblowing Policy and Counter Fraud Policy in place (subject to review) with whistleblowing channels available to report concerns (anonymously if required). 6. Internal and external assurance. Annual Governance Statement which involves obtaining assurance from Management over controls in their Service. 7. E-learning for staff to complete mandatory training for fraud awareness. 8. Regular updates to Audit committee on progress with recommendations made by Internal Audit. 9. Remind staff to declare secondary employment/outside interests and gifts & hospitality 10. Induction for all new employees (with service exceptions), including legal, HR, procurement, health and safety. Control at entry to organisation. 11. The Integrity Group continues to meet to improve the Council’s resilience to fraud, corruption, theft and crime (including cybercrime), maintaining proper risk management, governance and internal control processes and systems to ensure probity in systems and operations, and mitigation of risks, including the prevention, detection and resolution of fraud and irregularities. Management is also responsible for checking that the arrangements and controls are operating effectively and obtaining assurances from internal compliance, risk, inspection, quality, and control functions. 2 3 Related Action Code Related Action Related action latest note Managed By Due Date Status Page 99 of 114
Page 100
18 SRP.RA.1 2.04 Review of Serious Organised Crime (SOC) group Q3 23/24: Work underway to refresh SOC Strategy, working with Police Scotland and neighbouring authorities. Draft report expected Q4. Chief Officer Place; Health, Safety & Resilience Manager 31-Mar-2024 50% SRP.RR.13 Climate Change Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.1 3 Risk cause Council Services not adequately engaged, resourced or directed to fulfil the requirements of the Climate Change Act. Risk event Council Services not responding to the Climate Change Act with sufficient pace. Risk effect Council failing to meet its obligation under the Climate Change (Scotland) Act 2009 and incurring the associated reputational damage. Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Planning, Sustainable Growth and Investment Manager; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 1. Statutory requirement to report on compliance with climate change duties. 2. Council Carbon Management Plan 3. Approval of a Corporate Climate Change Strategy and action plan 4. CPP Board for Climate Change to bring strategic focus and oversight of plans and progress. 5. Resilience Seminars 5 5 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.1 3.03 Recruitment of Climate Change Officer Q3 23/24: Recruitment process commenced. Climate Action Plan work to be presented to Council in Q1 24/25. Q1 23/24: Service Review continues. Planning, Sustainable Growth and Investment 31-Mar-2024 60% Page 100 of 114
Page 101
19 Manager; Chief Officer Place SRP.RA.1 3.04 Delivery of the BTB Board Carbon Neutral by 2030 Q4 22/23: This action will be progressed when the Council’s adopted Climate Change Strategy is reviewed in 2023/24. Planning, Sustainable Growth and Investment Manager; Chief Officer Place 31-Mar-2030 10% SRP.RA.1 3.05 Development of the Strategic Plan 2023-27 Q4 22/23: Carbon Neutral by 2030 is a strategic priority, with work continuing through 23/24. Planning, Sustainable Growth and Investment Manager; Chief Officer Place 31-Mar-2024 10% SRP.RR.14.1 Scottish Child Abuse Inquiry Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.1 4.1 Risk Cause: Midlothian Council and its legacy organisations, predating the creation of Midlothian Council in 1996, have been involved in the provision of care of children going back to living memory. During this time there is the likelihood that the care children received fell below standards of care now in place. There is the further potential that some people in the care of Midlothian Council and its legacy organisations were subject to abuse by those who were employed to care for them. Risk Event: The Scottish Government began an Inquiry into cases of Child Abuse occurring prior to 17 December 2014, the intention of this enquiry is to identify historic case of abuse which have to date gone unreported. The most recent Section 21 notice around the Foster Care Case Study is a significant piece of work. The request for information from 1930 to date is very challenging given the volume of files Chief Executive; Chief Social Work Officer The Council have set up an Abuse Inquiry Project Team to support the Council to prepare for information requests to support the Inquiry. In addition, we have a Claims Project Team who have mapped out how we shall manage any future claims reported against the Local Authority. The Inquiry Team have established a Project Plan covering: 1. Residential establishments, List D Schools and Foster Carers: identifying Children’s homes, Foster Carers and any List D Schools in Midlothian over the last 100 years and researching historic records. 2. Record Audit: reviewing the Council’s existing paper and electronic recordkeeping systems to identify relevant records and map them to residential establishments. This also includes, where possible, noting the Council’s historic recordkeeping policies, such as retention schedules. 3. Cataloguing/Indexing: checking and updating existing recordkeeping systems for accuracy and consistency, enabling effective information retrieval when requested by the Inquiry. The Project Team have established a Project Plan covering: 4. Ascertaining the succession and insurance position in relation to potential historic child abuse claims. 5. Ascertaining and agreeing Midlothian Council’s legal position/ approach in dealing with the potential historic child abuse claims. 6. Identifying the need for guidance, protocol, templates etc. should/if any claims be made against the council. 7. Consideration to identifying if additional staffing will be required as expected deluge of FOI’s SARs in 2018 from solicitors of potential claimants. 8. Project team is in place with project plan with a range of identified actions 4 4 Page 101 of 114
Page 102
20 that require to be read and analysed. Risk Effect: If the inquiry finds historic cases of abuse in Midlothian this could damage the reputation of the Council and could place doubt in the eyes of the public as to the safety of these currently in care. There is significant scope for a substantial financial impact arising from claims of historic abuse. Some existing employees may be affected by the inquiry and subsequent claims of abuse. We have requested an extension for Parts B, C & D of the last Section 21 to April 2020, which has been granted. To date there has been no evidence from the extensive file read to suggest there has been systemic abuse within our foster care system. which are being progressed. Monthly meetings to progress project plan. 9. The SCAI Social Worker is very competent and experienced in this area of work and provides quarterly updates on their findings from the file read. This is a real strength within this area of work. The CSWO and Principal Solicitor meet regularly with the social worker to discuss findings from the file read. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.1 4.03 Foster Care and Residential Care File Review Q3 23/24: Inquiry has heard all the evidence for the Sect 21 Q2 23/24: As Q1. Q1 23/24: Review complete submissions around foster care. We continue to await the findings by Lady Smith. The redress system is in place and there is a lot of activity around this area of work which requires significant input from our social worker within the Scottish Child Abuse team. Childrens Services Management Team; Chief Social Work Officer; Chief Officer Young People and Partnerships 31-Mar-2024 100% SRP.RR.16 Growing Council Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.1 6 Risk cause Population growth in Midlothian over the next 10 to 15 years will see Midlothian become the fastest growing Council in Scotland. Between 2014 and 2039, ages 0-15yrs, Head of Adult and Social Care; Director of Education; Chief Executive; Executive 1. Local development plan and supplementary guidance on developer contributions. 2. Services planning future service provision on the basis of anticipated service demands 3. The change programme 4. Learning Estate Strategy 4 4 Page 102 of 114
Page 103
21 population is projected to increase by 20% and for ages 75+ population projected to increase by 100%. Risk event Failure to resource and plan for these rises will significantly impact the Councils ability to fulfil its statutory obligations in relation to these groups. Risk effect Inadequate capacity within the school estate to cope with the projected increase in pupil numbers. In sufficient provision to support an aging population placing costly inefficiencies on other parts of the care sector. General population increase placing additional demand on infrastructure including GP services. Increased pressure on infrastructure, services e.g., waste collection and growth of road network as new development roads are adopted. Director Place; Chief Officer Young People and Partnerships 5. Capital Plan Prioritisation 6. Strategic Housing Investment Strategy 7. Rent Review Strategy 8. Joint needs assessment used to develop - IJB Strategic Plan 9. Capital Plan and Asset Management Board will scrutinise and challenge slippage on capital programmes recognising that slippage can have an adverse impact on financial sustainability and also the delivery on assets required to support capital growth. 10. City Deal provides the opportunity to support inclusive growth. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.1 6.01 Capital Programme Q3 23/24: The Capital Plan in its current format is unaffordable due to rising costs of construction, inflation and EU-Exit/post pandemic and other economic pressures. A review of the Capital Plan is underway to determine affordability, prioritisation and options presented to members. Director of Education; Executive Director Place 31-Mar-2024 75% SRP.RA.1 6.02 Capital Plan prioritisation Q3 23/24: Work continues on CPP. Q2 23/24: Work continues on CPP. Q1 23/24: The Capital Plan in its current format is unaffordable due to rising costs of construction, inflation and EU-Exit/post pandemic and other economic pressures. A review of the Capital Plan is underway to determine affordability, prioritisation and options presented to members for consideration in Q2 2023/24. Head of Development; Chief Finance Officer; Executive Director Place 31-Oct-2023 0% SRP.RR.17 UK Decision to leave the EU Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation Page 103 of 114
Page 104
22 SRP.RR.1 7 Risk cause UK vote to leave the European Union Risk event UK leaving the European Union Risk effect The impacts associated with the UK's decision to leave the UK have yet to be realised and will only become clear once the final terms of the UK's departure are finalised. There are some direct potential impacts such as an end to EU funding of Council co-ordinated projects and indirect impacts on industries undertaken within the geographical area which have relied on EU funding, such as agriculture. There are wider potential implications arising from uncertainty regarding the resident status of EU nationals, post any exit agreement, and the availability of workers from outside the UK accessing the job market here in the future. These factors have the potential to impact on the availability of the right people with the right skills being available to help grow the economy here in Midlothian. One area this could affect the Council could be in the delivery of future building projects within Midlothian which could curtail further economic growth. Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 01 – Risk and Resilience Group 02 – Taking a risk management approach to identifying and assessing anticipated impacts 03 – Working with a range of national and local bodies to inform preparatory arrangements. 04 – EU Settlement scheme promoted on Council Internet to support those living and working in Midlothian to access the Home Office scheme. 4 5 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.1 7.01 Refresh of Economic Strategy Q3 23/24: Draft Economic Strategy prepared; to be presented to Council in Q1 24/25. Chief Officer Place 30-June-2024 60% SRP.RR.19 Health & Safety Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.1 9 Risk cause Failing to identify and rectify non- Head of Adult and Social Care; 1 - Health Safety and Wellbeing Strategy & Service Plan 2 - Suite of Health and Safety Management Arrangements developed setting out 3 5 Page 104 of 114
Page 105
23 compliance with Health and Safety regulations. Risk event Employees required to undertake tasks they are not competent to. Statutorily driven health and safety protective arrangements for service users and employees not implemented correctly. Non-compliance with policy and procedure Not undertaking audits and inspections to confirm adherence to policy and legislative requirements. Risk effect Serious injury of ill health impact on employees and or service users. Negative impact on outcomes for customers/service users. Service users and employees exposed to hazards where statutory requirements exist. Statutory health and safety - duty of care over services users and employees not met. Criminal prosecution of the Corporate body and or individuals through Corporate Homicide (Corporate Manslaughter) Significant financial penalties from Criminal Prosecution. Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Senior Manager Protective Services; David Robertson; Chief Officer Young People and Partnerships council response to statutory obligations 3 - Comprehensive range of Health & Safety Management & Assessment based development opportunities for line managers 4 - Use of Health & Safety Management Information System (SPHERA) to enhance information transfer and organisational efficiency 5 - Comprehensive training programme in place to support those with responsibility for managing health and safety. 7 - Use of comprehensive audit programme to confirm the application of agreed management Arrangements and Council Policy. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.1 9.01 Delivery of Health, Safety and Wellbeing Service Plan Q3 23/24: Work continues. Q2 23/23: As Q1. Q1 23/24: Implementation of the 23/24 Protective Services Health, Safety & Resilience Service Plan has commenced. Note the Health Safety & Resilience Team Service Review is scheduled to commence in Q2. Chief Officer Place; Senior Manager Protective Services; David Robertson 31-Mar- 2024 25% SRP.RA.1 9.07 H&S audit across all Council estate Q3 23/24: Work continues. Q2 23/24: Work on audit report underway. Change to SFRS response incorporated into Fire Action Plans and Management Arrangements. Chief Officer Place; Senior Manager 31-Mar- 2024 75% Page 105 of 114
Page 106
24 Q1 23/24: Zurich Insurance high level audit of H&S scheduled for July 2023. Recommendations will be implemented where necessary. Protective Services; David Robertson SRP.RR.20 Early Years Expansion (1140 Hours) Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.2 0 Risk cause Population growth in Midlothian over the next 10 to 15 years will see Midlothian become the fastest growing Council in Scotland. Between 2014 and 2039, ages 0-15yrs, population is projected to increase by 20% In addition, the Scottish Government has made a commitment to increase the current provision of free early years care from 0600 to 1140 hours. Risk event Failure to resource and plan for these rises will significantly impact the Councils ability to fulfil its statutory obligations in relation to these groups. The sustainable rate review may lead to significant increase in funding to providers; maintaining current rate is not an option if not deemed sustainable. The result could lead to a funding gap in future years. Risk effect Inadequate capacity within the school estate and/or Early Years to cope with the projected increase in numbers. Lack of staffing and/or financial support to build new schools. Potential for Chief Executive; Chief Finance Officer; Executive Director Place 1. Learning Estate Strategy 2. Early Years Expansion to 1140 hours updates 3. Capital Strategy 4. School Roll Projections will be reviewed and updated 5. Business Support and Finance Business Partners reviewing external funding landscape closely for future funding options 4 5 Page 106 of 114
Page 107
25 additional unfunded request to place 4- year-olds with August to December birthdays requesting additional year of 1140 hours, not currently funded by Scottish Government. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RR.2 0.01 1140 future years funding Q1 23/24: Draft guidance from SG. Enhanced guidance due re sustainable rate but no additional funding for LAs. Young P & P, Exec Director Children; Chief Finance Off 31-Aug- 2023 0% SRP.RR.21 Cyber Security Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.2 1 Risk Cause Malicious attempts to damage, disrupt or gain unauthorised access to Council computer systems, networks or devices. Risk Event The Council is at significant risk of cyber-attack from Ransomware Phishing Emails, Advanced Persistent Threats (APT) and Distributed Denial of Service Attacks (DDOS) attacks. Hacking and Social Engineering. Risk Effect Access to Council systems by cyber criminals and foreign intelligence agencies for financial, commercial or information gathering reasons. This could lead to significant financial losses, data compromise and subsequent regulatory sanction if our technical and organisational measures are deemed insufficient. Severe business disruption including the almost total loss of critical IT systems and networks leading to significant service delivery challenges. Head of Adult and Social Care; Cyber Security Information Governance and Compliance Manager; Chief Officer Corporate Solutions; Head of Development; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Senior Manager Protective Services; David Robertson; Chief Officer Young People and Partnerships 1. Implementation of and compliance with the Scottish Government Cyber Resiliency Public Sector Action Plan 2. Cyber Essentials Plus Certification 3. Public Sector Network Certification 4. Appropriate technical and organisational measures deployed to reduce the likelihood and impact of an attack 5. Having adequate skills and knowledge in the organisation 6. Implementing Scottish Government Cyber Security Action Plan 7. Creating a Midlothian Cyber Defence Action Plan. 8. Adoption of the NCSC (National Cyber Security Centre) Active Cyber Defence programme 3 5 Page 107 of 114
Page 108
26 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.2 1.1 Appropriate Technical and Organisational Measures Q3 23/24: Action/mitigation includes: - 1. Updated cyber incident response plans. 2. Cyber security presentations to Elected Members and Place directorate. 3. Conducted phishing exercises. 4. Successfully responded to 13 cyber security events. Provided significant Information Governance and Security advice for the deployment of M365 and Google Workspace Q1 23/24: Action/mitigation includes:- 1. Achieved Cyber Essentials Plus Certification 2. Preparations completed for Q2 2023/2024 PSN Certification, including submission to Cabinet Office. 3. Provided significant Information Governance and Security advice for the deployment of M365 and Google Workspace 4. Responded to numerous threat alerts to ensure the security of the Council’s network 5. Engaged with Cyber Incident Response company to review the Councils Cyber Incident response capability in Q2 5. Cyber Security Information Governance and Compliance Manager; Chief Digital Officer 31-Mar- 2024 0% SRP.RR.22 Cost of Living Crisis Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.RR.2 2 Risk cause The UK is currently facing an unprecedented storm of increasing prices, bills and tax. The 40-year high inflation rate of 9% is the main driver of the cost of living crisis which has outstripped wage and benefit increases. Risk event Rapid ongoing rise of energy prices as well as food and drink prices. Risk effect Chief Executive; Director Health and Social Care; Executive Director Place 1. Council Cost of Living Task Force to oversee the Council’s response to the crisis 2. Allocation of LACER funding to support those most affected 3. Strategic Evaluation Partner appointed to create poverty profile 4. Community Planning Partnership has established a Midlothian Strategic Poverty Prevention Group co-chaired by Council Leader and Director of Public Health 5. New Child Poverty chair and lead appointed (Executive Director Children, Young People and Partnerships) 6. Child Poverty self-evaluation underway with Improvement Service 3 5 Page 108 of 114
Page 109
27 The impact on households is already being noted with 87% of adults in the UK reported an increase in their cost of living in April 2022 (Office for National Statistics; Francis-Devine et al, 2022). The price rises will impact low- income households the hardest as a larger proportion of their bills are on energy and food. The Resolution Foundation estimates an extra 1.3 million people will fall into absolute poverty in 2023, including 500,000 children. Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.RA.2 2.1 Cost of Living Task Force Q1 23/24: Meetings continuing. Chief Executive 31-Mar- 2024 100% SRP.RA.2 2.2 LACER funding Q2 22/23: Identification of 15 trusted partners to distribute funding in communities for food and fuel, wash and dry provision and support to establish reheatable food initiatives. Lifelong Learning and Employability 31-Mar- 2023 100% Page 109 of 114
Page 110
28 Strategic Opportunities SRP.OP.01 Shawfair Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.OP.0 1 The delivery of a new sustainable low carbon community at Shawfair. Head of Adult and Social Care; Chief Executive; Director Health and Social Care; Planning, Sustainable Growth and Investment Manager; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 1. Shawfair Landowners Group meets quarterly. 2. Legal agreement with developers to secure developer contributions (Section 75) towards infrastructure. 3. Approved masterplan and design guide for the entire community 4. Business and industrial provision, including small business incubator space. 5. Circa 4000 new homes 6. A school campus comprising Early Years, Nursery, Primary, Secondary & Life Long Learning provision 7. New Primary schools 8. Public Transport infrastructure including railway station. 9. Midlothian Energy Ltd (Joint Venture between MLC and Vattenfall) 5 4 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.OP.02 Borders Rail Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.OP.0 2 Passenger numbers after three years of operation are above projections. The railway has been, and continues to be a catalyst for economic development, access to training and labour markets, tourism growth, environmental improvements must notably in town centres, and access to the countryside. Chief Executive; Chief Officer Place; Executive Director Place 1. Monitored by Economic development. 2. Maximising the Impact: A blueprint for the Future - published by the blueprint group involving Scottish Government, Scottish Borders, Midlothian and City of Edinburgh Council, Transport Scotland, Scottish Enterprise and Visit Scotland. The document sets out the ambitions of the partners to realise the full potential of the new Railway. 3. Timely submission of bids for approval by the Blueprint Group 4. Close monitoring of approved funded projects. 5. Borders rail subgroup Chaired by Midlothian Council Chief Executive. 5 4 Page 110 of 114
Page 111
29 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.OP.03 Easter Bush - Penicuik Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.OP.0 3 One of Midlothian’s largest and most significant employment areas. Fast Growing opportunities in Science Technology Engineering and Mathematics (STEM) with opportunities to link with education. Partnership links to schools and university sector at the 'Bush' to promote STEM. Need to secure long-term strategic road access to ensure continued growth. Head of Development; Chief Executive; Director Health and Social Care; Executive Director Place 1. Planning in place around creating Secondary Schools as centres for excellence linked to specialisms including Science Technology Engineering and Mathematics (STEM). 2. Land allocated for expansion. 3. Midlothian Science Zone. 4. City Deal funding to provide for growth and strategic road access. 5 4 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.OP.0 3.A2 A701/A702 Trunk Road Improvements Q4 22/23: The funding gap associated with this project is estimated to be £33.2m. Midlothian Council submitted an application to the UKG Levelling Up Fund (LUF) to attract alternative funding into the project to close this gap. The application was unsuccessful. Alternative funding opportunities and means to phase and prioritise the programme are currently under consideration. A revision to alignments due to landfill avoidance and required increase in roundabout sizes at Bush Loan and the A702 Spur Road junctions was made to the specimen design. This is progressing with the target of submitting a planning application Q1 2024. Executive Director Place 31-Mar-2023 0% SRP.OP.04 City Deal Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.OP.0 4 South East Scotland Region City Deal - a bid for funding to Scottish and UK Governments to accelerate economic growth through investment in infrastructure/ housing/ skills and innovation. 200 Council Houses linked to the City Deal. Head of Adult and Social Care; Chief Officer Corporate Solutions; Chief Operating Officer Education; Chief 1. City Deal signed in August 2018. 2. Maintain strong Midlothian involvement through the City Deal governance structure. 3. Midlothian City Deal Key Officer (Internal) Group. 4. Securing best arrangements for Midlothian through close liaison with partners and conclusion of business cases. 4 5 Page 111 of 114
Page 112
30 Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.OP.0 4.02 Realisation of outcomes of respective workstreams Q3 23/24: Work continues on the relevant programmes. Q2 23/24: Work continues on the relevant programmes. Q1 23/24: Work continues on the relevant programmes. Executive Director Place 31-Mar-2024 10% SRP.OP.07 Creating a World Class Education System Risk Code Risk Identification Managed by Risk Control Measures Likelihood Impact Risk Evaluation SRP.OP.0 7 The Centres of Excellence model is a core part of the Council's strategy to create a world-class education system in Midlothian. This is an ambitious project designed to deliver excellence and equity with a particular emphasis on interrupting the cycle of poverty. Risk event The Phase 2 Equipped for Learning plan has a strong focus on transforming classroom practice and learner outcomes. This can only be achieved if effective technical support for EfL is in place to support this change. Risk Effect Without the technical support and appropriate infrastructure we will not achieve the change resulting in a negative impact on learners experiences and outcomes. Head of Adult and Social Care; Chief Officer Corporate Solutions; Head of Development; Chief Operating Officer Education; Chief Executive; Chief Finance Officer; Director Health and Social Care; Chief Officer Place; Executive Director Place; Chief Officer Young People and Partnerships 1. Digital Centre of Excellence at Newbattle Community High School 2. Partnership agreement with the University of Edinburgh 3. Beeslack Replacement High School, pilot project for next round of SFT funding – funding model building in energy efficiency targets 4. Accelerating our ambition – Digital Strategy 5. Review of Digital team to support Digital Centre for Excellence 4 5 Page 112 of 114
Page 113
31 Related Action Code Related Action Related action latest note Managed By Due Date Status SRP.OP.A. 07.01 Research and development Q1 23/24: CivTech project successfully completed the pre-contractual agreement stage. Further grant funding from SFT has enabled continuation of development of the platform and insights in Midlothian schools and expansion to incorporate monitoring and insights into Dalkeith office buildings. The project has been selected to present again at the Learning Places Scotland conference and is engaging with the Scottish AI Alliance. Director of Education 31-Aug-2023 0% SRP.OP.A. 07.03 Equipped for Learning Q3 23/24: As Q2. Q2 23/24: Refresh digital strategy, development of digital curriculum, development and implementation of MACO Director of Education 31 Mar 2024 31 July 2024 0% Page 113 of 114
Page 114
Page 114 of 114