10. 2025 05 29 IA annual report 2024-25
North Ayrshire Council · 29 May 2025
Back to Audit and Scrutiny Committee — 29 May 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 29 May 2025 Audit and Scrutiny Committee Title: Internal Audit Annual Report 2024/25 Purpose: To provide the Committee with an annual report on the work of Internal Audit during 2024/25 and provide an opinion on the governance, risk management and internal control environment of the Council. Recommendation: The Committee is asked to note the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 1. Executive Summary 1.1 The purpose of this report is to present the annual report on the internal audit activity during 2024/25, and to provide an independent opinion on the adequacy and effectiveness of the Council’s governance, risk management and internal control systems for the year ended 31 March 2025. 2. Background 2.1 The Public Sector Internal Audit Standards (PSIAS) require that the Chief Internal Auditor prepares an annual report on the activities of Internal Audit and that the report should contain a view on the adequacy of the Council’s governance, risk management and internal control frameworks. The annual report for 2024/25 is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the section during the year and the key audit findings. It also contains the annual internal audit opinion. 2.2 The required annual report for financial year 2024/25, together with the statement on internal controls, is included in Appendix 1. 2.3 The internal audit plan for 2024/25 (approved by the Audit and Scrutiny Committee in March 2024 and updated in October 2024) has been substantially completed. Audit fieldwork remains in progress on seven assignments. Two audit assignments are at draft report stage, meaning the assurance opinion can be included in the overall annual audit opinion. 2.4 All audit findings during the year support and inform the objective opinion of the Senior Manager (Audit, Fraud, Safety, Risk & Insurance) on the adequacy of the Council’s
Page 2
governance, risk management and internal control environment. The assurance category given to each individual audit informs the overall level of assurance. 2.5 The annual internal audit opinion also contributes to the Annual Governance Statement which is published as part of the Council’s annual accounts and is included under separate cover to this Audit and Scrutiny Committee meeting for approval. 2.6 Based on the audit work carried out, the opinion of the Senior Manager (Audit, Fraud, Safety, Risk & Insurance) is that reasonable assurance can be placed on the adequacy and effectiveness of the Council’s systems of governance, risk management and internal control. 3. Proposals 3.1 It is proposed that the Committee notes the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None.
Page 3
5. Consultation 5.1 Council Services are consulted on the findings of Internal Audit throughout the year. No specific consultations have taken place in relation to this annual report. Mark Boyd Head of Service (Finance) For further information please contact John McCallum, Senior Manager (Audit, Fraud, Safety, Risk & Insurance), on 01294 324607. Background Papers None.
Page 4
Appendix 1 INTERNAL AUDIT ANNUAL REPORT 2024/25 1. Introduction 1.1. The purpose of this report is to summarise the Internal Audit activity for 2024/25 and provide an opinion on the overall adequacy and effectiveness of the Council’s governance, risk management and internal control frameworks. 1.2. The Council’s Section 95 Officer has overall responsibility for Internal Audit in North Ayrshire Council. The Senior Manager (Audit, Fraud, Safety, Risk & Insurance) reports to the Section 95 Officer, with the right of access to the Chief Executive and the Chair of the Audit and Scrutiny Committee on any audit matter. These rights of access help ensure the organisational independence of Internal Audit. 1.3. The presence of an effective internal audit function contributes towards, but is not a substitute for, effective control. It is the responsibility of management to have adequate controls in place and to ensure these controls are operating effectively. A sound control system will help safeguard assets, ensure records are reliable, promote operational efficiency and ensure adherence to the Council’s policies and procedures. Such systems of internal control can provide only reasonable and not absolute assurance against loss. 2. Reporting requirements of the Public Sector Internal Audit Standards (PSIAS) 2.1. During 2024/25 Internal Audit operated in accordance with the PSIAS requirements which are an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. The PSIAS helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. 2.2. Internal Audit operates within the Internal Audit Charter, most recently approved by the Audit and Scrutiny Committee in March 2025. 2.3. The PSIAS places a number of reporting obligations on the Chief Internal Auditor in respect of the annual report. These obligations are summarised below: PSIAS Ref Requirement Evidence 1110 The chief audit executive must confirm to the board, at least annually, the organisational independence of the internal audit activity. The Senior Manager reports directly to the Audit and Scrutiny Committee, and unfettered access is available to the Chief Executive as required. 1320 The results of the quality and assurance programme and progress against any improvement plans must be reported in the annual report. The results of the external quality assessment, carried out in 2022, were reported to the Audit and Scrutiny Committee in September 2022. All actions are complete.
Page 5
PSIAS Ref Requirement Evidence 2450 The chief audit executive must deliver an annual internal audit opinion and report that can be used by the organisation to inform its governance statement. This report to Audit and Scrutiny Committee provides the annual report and statement of assurance on internal controls. 2450 The annual internal audit opinion must conclude on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control. This report to Audit and Scrutiny Committee provides the annual statement of assurance at Annex B. 2450 The annual report must also include a statement on conformance with the Public Sector Internal Audit Standards and the results of the quality assurance and improvement programme. This report to Audit and Scrutiny Committee provides a statement on the conformance with the PSIAS at Section 5 below. 3. Planned and Actual Activity during 2024/25 3.1. The internal audit plan was approved by the Audit and Scrutiny Committee in March 2024 with a mid-year update to the plan approved in October 2024. Productive time is allocated in the plan to the delivery of audit assignments with a balance of time retained within the service for non-productive activities which includes management and strategy, attendance at meetings, administration and staff training and development. 3.2. The mid-year revised plan included 17 assignments where an audit output was anticipated with a further 3 unplanned investigations undertaken during the year as a result of issues arising which required audit input. 10 of these assignments have been completed, 2 are at draft report stage, 7 are currently work in progress and one has not yet started. 3.3. Of the 7 work in progress audits, 3 relate to the HSCP / North Ayrshire Integrated Joint Board (NAIJB), 2 relate the Corporate Services directorate and one relates to the Place directorate. The fieldwork for these audits has commenced and is at various stages of completion. 3.4. The audit that has not yet commenced relates to Income Management and although this was intended to be undertaken during 2024/25 it was agreed with service management, due to year-end priorities, to delay this for a short period of time. This will now commence during Q1 of 2025/26. The assurance levels and associated actions arising from this and the 7 work in progress assignments are therefore yet to be confirmed. The results of these assignments will be reported to a future meeting of the Audit and Scrutiny Committee. 3.5. In line with the Council’s defalcation procedures, all instances of suspected fraud and irregularity should be reported to Internal Audit. These are investigated by the specialist Corporate Fraud Team and are not included within this annual report.
Page 6
3.6. All audit reports finalised during 2024/25 were reported to meetings of the Audit and Scrutiny Committee. A summary of outputs achieved are included in Annex A. 3.7. The outcomes from the audit work during the year have generally been positive, with mostly substantial and reasonable assurance opinions. Five audit reports have been finalised during the year where elements of the scope have resulted in a limited assurance opinion. These are as follows: • Education Leavers and Movers – This audit reviewed the arrangements for managing staff who move post internally or leave the Council completely. A number of findings were identified resulting in limited assurance being obtained. These included a lack of formal notification procedures, forms not being completed in full and/or on time and a lack of routine reviews by school management to identify staff who had left or moved. A number of generic accounts and higher-than-expected levels of powerful account access were also identified. A number of actions were agreed to address the issues identified and these were implemented at pace following the audit. • Missing Laptops – A review of the arrangements surrounding the delivery and deployment of devices to Lockhart, in August 2021, was undertaken following the reporting of lost devices from Education. It was identified that standard receipting and deployment processes were not adhered to at the time and supporting documentation is no longer available due to staff leaving and a change in the IT case management system. As a result some devices are unaccounted for. Actions have been identified and implemented to improve the record keeping arrangements within Education and ICT and a full review of the school inventory has been carried out to improve the completeness of the records held. • Accounts Payable Transaction Testing – There was a notable uplift in the volume and value of duplicate payments identified during the 2024/25 accounts payable audit, including one significant duplicate. Instances of P-Card transactions being split into smaller portions in order to bypass approval limit thresholds were also identified, resulting in a limited level of assurance being obtained. Steps have been taken since the completion of the audit to recover the funds relating to the duplicate payments. • Community Associations – An audit of the arrangements for ensuring that community associations (CA) were complying with the terms of their SLAs was undertaken and, while these were reasonable for the majority of CAs reviewed, key control failures were noted in relation to one CA resulting in limited assurance being obtained. It was found that there was no formal process for monitoring compliance with SLAs and evidence of compliance was not always retained by the Council. Escalation processes for non-compliance were also required to be put in place. Actions were agreed to improve the process going forward and an enhanced monitoring regime has been implemented since the completion of the audit. • HSCP Online Bank Account – Following the notification of a potential breach of financial regulations within the HSCP, an audit investigation reviewed the circumstances around the set up and management of an online bank account within the Corporate Parenting team, which was outwith the Council’s corporate bank accounts. Whilst there was no suggestion of misappropriation of funds a number of findings were identified. The audit found that purchases had been made from the account that did not adhere to the Council’s procurement processes, the records held for the bank account were incomplete and staff
Page 7
responsible for the management of the account had not completed financial training. Actions have since been taken to close the account and to confirm that no other accounts of this nature exist. The HSCP have also taken steps to ensure that relevant staff are trained in financial management. 3.8. It is important to also highlight some of the most positive outcomes arising from the audit work concluded during the year. This includes reviews of Pupil Equity Funding and Transformation and Change Management, both of which are key areas of interest for the Council, and both concluded with substantial audit opinions. This provides evidence that the risks within these areas are being effectively managed in line with best practice. 3.9. These findings, together with those from other audits carried out and the individual assurance levels, contribute to the annual internal audit opinion in Annex B of this report. 4. Audit Resources 4.1. The Internal Audit section is directly managed by the Team Manager (Internal Audit), who reports to the Senior Manager (Audit, Fraud, Safety, Risk & Insurance). The Senior Manager is responsible for Internal Audit, as well as Corporate Fraud, Risk and Insurance and Corporate Health and Safety. 4.2. As well as the Team Manager, the Internal Audit team consisted of two part-time Internal Auditors, one of which was recruited during the year, as well as a part- time Computer Auditor. The Senior Manager role was vacant for a portion of the year until it was filled in August 2024. 4.3. All staff within the section hold a relevant qualification, either through an institute which is part of the Consultative Committee of Accountancy Bodies (CCAB) or the Institute of Internal Auditors (IIA). 4.4. The Internal Audit Charter requires the Senior Manager to report to the Section 95 Officer and the Audit and Scrutiny Committee if resources available fall below an acceptable level for the audit work required. No material instances of resource limitation have occurred during 2024/25. 5. Performance 5.1. During 2024/25, Internal Audit provided regular updates to the Audit and Scrutiny Committee on the activities of the service. Elected Members had the opportunity to discuss all Internal Audit reports and question either the Senior Manager or relevant officers from Council services. Elected Member training was provided to the Committee in May 2022, with individual training made available to new members joining the Committee during the year. 5.2. The Council’s performance management system, Pentana, is used to follow-up on audit action points. Officers with responsibility for implementing audit actions are required to update the system and updates are provided to the Audit and Scrutiny Committee on a quarterly basis. Where actions are overdue, officers are required to attend the Committee to update Elected Members on plans to ensure that actions are implemented.
Page 8
5.3. The Senior Manager is required to confirm annually internal audit’s compliance with the Public Sector Internal Audit Standards (PSIAS). A significant achievement during 2022/23 was the successful completion of the External Quality Assessment. Under the terms of the PSIAS, each organisation’s Internal Audit team is required to undertake an External Quality Assessment (EQA) at least once in each five-year period. This helps to ensure compliance with the standards. 5.4. A peer to peer review network of the Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) is in place. The review of the Council's Internal Audit team was completed by West Dunbartonshire Council and was reported to the Audit and Scrutiny Committee in September 2022. The review assessed the compliance of the Council's Internal Audit team with the 14 sections of the PSIAS and noted that the team fully conforms with 13 of the standards and generally conforms with the remaining one. Overall the assessor was able to provide substantial assurance that the Council's Internal Audit team complies with the requirements of the PSIAS. There were four minor routine recommendations for improvement to further improve compliance, and these have all been completed. In summary, the Internal Audit service continues to conform with the PSIAS. 5.5. Internal Audit has a strong working relationship with all Council services and is frequently asked for audit advice on an ad-hoc basis. The volume of these requests is outwith the control of Internal Audit however it is important that Internal Audit responds to these requests when asked, as it ensures advice is provided at the right time to ensure that organisational value is maximised. In 2024/25, there were 19 requests for service advice. Added to this, Internal Audit is included on the project board of a number of corporate working groups, and these are listed in Annex A. These assignments are for provision of advice and guidance and therefore do not result in an assurance report being brought to the Committee. 6. Other Responsibilities 6.1. The Senior Manager is also the Chief Internal Auditor for the NAIJB. In the interests of information sharing, the results of the NAIJB audit work are shared with the Audit and Scrutiny Committee. 7. Opinion 7.1. There is a formal requirement for the Chief Internal Auditor to prepare an assurance statement on the adequacy of internal control systems within the Council. The internal audit annual statement on the adequacy of internal controls is included in Annex B. 8. Conclusion 8.1. The 2024/25 internal audit plan has been substantially completed. There are no limitations of scope to the issued audit opinion.
Page 9
Summary of Internal Audit Work 2024/25 Annex A Type Audit Opinion Reported to A&S Committee Actions Arising Priority 1 Priority 2 Priority 3 Total COMPLETED WORK Assurance Code of Corporate Governance * Substantial 29 August 2024 0 0 0 0 Assurance Supply Teachers * Substantial 29 August 2024 0 0 0 0 Assurance Payroll Transaction Testing - (23/24) * Reasonable 29 August 2024 0 0 0 0 Assurance Leavers & Movers in Education * Limited 31 October 2024 3 6 0 9 Assurance Property Asset Management * Reasonable 31 October 2024 1 2 0 3 Assurance Housing Rent Arrears * Substantial 31 October 2024 0 1 0 1 Assurance Community Associations Limited 31 October 2024 3 1 0 4 Investigation HSCP - Online Bank Account Limited 31 October 2024 4 1 0 5 Assurance Supported Complex Needs Accommodation * Reasonable 23 January 2025 3 2 0 5 Assurance Regeneration – Governance of Funding * Substantial 23 January 2025 0 0 0 0 Assurance ICT Environmental and Physical Controls Reasonable 23 January 2025 1 1 0 2 Investigation Missing Laptops Limited 23 January 2025 2 1 0 3 Assurance Pupil Equity Funding Substantial 13 March 2025 0 0 0 0 Assurance iPay Impact * Reasonable 13 March 2025 2 2 0 4 Assurance Accounts Payable Transaction Testing Limited 13 March 2025 3 8 0 11 Assurance Aids and Adaptations Reasonable 29 May 2025 0 5 0 5 Assurance Transformation and Change Management Substantial 29 May 2025 0 0 0 0 Assurance Community Equipment Store Reasonable 29 May 2025 2 0 0 2 Assurance Payroll Transaction Testing - (24/25) Reasonable 29 May 2025 0 4 0 4 Annual Accounts Community Councils n/a n/a n/a n/a n/a n/a Annual Accounts Tenants and Residents Associations n/a n/a n/a n/a n/a n/a
Page 10
Summary of Internal Audit Work 2024/25 Annex A REPORTING PHASE** Investigation Housing Performance Indicators Reasonable/Limited tbc tbc tbc tbc tbc Assurance Locality Planning Reasonable tbc tbc tbc tbc tbc WORK IN PROGRESS Type Audit Opinion Reported to A&S Committee Actions Arising Priority 1 Priority 2 Priority 3 Total Assurance ICT Access Controls tbc tbc tbc tbc tbc tbc Assurance ICT Information Security Management tbc tbc tbc tbc tbc tbc Assurance Child Protection tbc tbc tbc tbc tbc tbc Assurance Procurement tbc tbc tbc tbc tbc tbc Assurance IJB - Transformation tbc tbc tbc tbc tbc tbc Assurance Ayrshire Growth Deal tbc tbc tbc tbc tbc tbc Assurance Homelessness tbc tbc tbc tbc tbc tbc NOT STARTED Assurance Income Management tbc tbc tbc tbc tbc tbc OTHER/ONGOING Consultancy O365/Information and Collaboration Project Board Not Applicable: These assignments are for the provision of advice and guidance and therefore do not result in an assurance report being brought to the Committee. Consultancy Artificial Intelligence Working Group Consultancy CRM Project Board Consultancy Corporate Telephony Project Board Consultancy Education – A365 Project Board Consultancy Connected Communities – Grant Funds Procedure Review Small Advisory 19 various requests * 2023/24 audit but not sufficiently concluded at the time of the 2023/24 annual report, therefore opinion included in 2024/25. ** Audits not yet finalised but sufficiently in draft to conclude on the level of assurance.
Page 11
Annex B Internal Audit Annual Statement on the Adequacy of Internal Controls To the Members and Chief Executive of North Ayrshire Council As Chief Internal Auditor for North Ayrshire Council, I am pleased to present my annual statement on the overall adequacy and effectiveness of the framework of governance, risk management and control of the Council for the year ended 31 March 2025. Respective responsibilities of management and internal auditors in relation to governance, risk management and control It is the responsibility of the Council’s senior management to determine, establish and maintain sound systems of governance, risk management and control to ensure that the organisation’s resources are properly applied in a manner and on the activities intended and that these arrangements are sufficient to address the risks facing their services. This includes responsibility for the prevention and detection of fraud. Management is also charged with monitoring the continuing effectiveness of these arrangements and taking action as appropriate. It is the responsibility of the Chief Internal Auditor to provide an annual assessment of the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control. Sound internal controls The main objectives of the Council’s internal control systems are to: • ensure adherence to management policies and directives in order to achieve the organisation’s objectives; • safeguard assets; • ensure the relevance, reliability and integrity of information, so ensuring as far as possible the completeness and accuracy of records; and • ensure compliance with statutory requirements. Any system of control can only ever provide reasonable and not absolute assurance that control weaknesses or irregularities do not exist or that there is no risk of material errors, losses, fraud, or breaches of laws or regulations. Accordingly, the Council is continually seeking to improve the effectiveness of its systems of internal control. The work of internal audit Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. During 2024/25 the Internal Audit section operated in accordance with United Kingdom Public Sector Internal Audit Standards (PSIAS) which came into force with effect from 1 April 2013 (updated in March 2017). The requirements under PSIAS represent best practice and are mandatory.
Page 12
Annex B The Chief Internal Auditor prepares an annual internal audit plan which outlines the programme of work to be undertaken. The plan is developed utilising a risk-based methodology and takes into account the requirement placed upon the Chief Internal Auditor to deliver an annual internal audit opinion. The plan needs to be flexible to reflect the changing risks and priorities of the organisation. The plan, and any material changes to the plan during the year, are approved by the Audit and Scrutiny Committee. All internal audit reports are brought to the attention of management, including system weaknesses and/or non-compliance with expected controls, together with agreed action plans. It is management’s responsibility to ensure that due consideration is given to internal audit reports and that appropriate action is taken on audit recommendations. This includes management taking remedial action where appropriate or accepting that there may be a level of risk exposure if the weaknesses identified are not addressed for operational reasons. Internal Audit is required to ensure that appropriate arrangements are made to determine whether action has been taken on internal audit recommendations or that management has understood and assumed the risk of not taking action. Matters arising from internal audit work are also reported to the Chief Executive, Head of Finance (as Section 95 Officer), Members of the Audit and Scrutiny Committee, and external audit. Summary of Internal Audit Activity 2024/25 A total of 19 internal audit reports have been issued during 2024/25. 6 audit opinions give substantial assurance, 8 reasonable assurance and 5 limited assurance. Two reports are in draft and are anticipated to have either a reasonable or reasonable / limited assurance opinion. A diverse range of audit areas have been covered during the year. As well as planned assignments, Internal Audit also offers advice and guidance on the Council’s control environment as and when required and will carry out non-fraud investigations which are brought to our attention. A range of recommendations have been raised in the areas covered by the 2024/25 internal audit plan. Many expected key controls have been in place and operating effectively, however Internal Audit has also identified scope for improvement in some systems. All 58 action points raised in the year have been accepted by management and will result in continued improvement of the Council’s governance, risk management and control environment. Basis of Opinion The evaluation of the control environment is informed by a number of sources: • the audit work undertaken by Internal Audit during the year to 31 March 2025; • the audit work undertaken by Internal Audit in previous years and knowledge of any significant audit findings after the year end; • the assessment of risk completed during the preparation of the annual audit plan; • reports issued by the Council’s external auditors and other review and inspection agencies; • knowledge of the Council’s governance, risk management and performance monitoring arrangements; and
Page 13
Annex B • any other items brought to the attention of internal audit by whatever means which may warrant further investigation. Opinion On the above basis, Internal Audit can provide reasonable assurance over the framework of governance, risk management and control and that adequate controls were in place and were operating throughout the Council in 2024/25. John McCallum CPFA Senior Manager (Audit, Fraud, Safety, Risk & Insurance) 29 May 2025