13. 2025 05 29 Internal Audit Reports Issued
North Ayrshire Council · 29 May 2025
Back to Audit and Scrutiny Committee — 29 May 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
PUBLIC INFORMATION PUBLIC INFORMATION NORTH AYRSHIRE COUNCIL 29 May 2025 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed since March 2025. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed since March 2025. Internal control reviews have been completed in respect of the areas detailed in Appendix A to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix A includes the report and action plan from each audit. 2.3 The findings from 4 separate audit assignments are detailed at Appendix A to this report and the levels of assurance for each are noted in the table below: Audit Title Assurance Level Aids and Adaptations Reasonable Transformation and Change Management Substantial Community Equipment Store Reasonable Payroll Transaction Testing Reasonable
Page 2
PUBLIC INFORMATION PUBLIC INFORMATION 3. Proposals 3.1 It is proposed that the Committee notes the outcomes from the Internal Audit work completed since March 2025. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment. Mark Boyd Head of Service (Finance) For further information please contact John McCallum, Senior Manager (Audit, Fraud, Safety, Risk & Insurance), on 01294 324607. Background Papers None.
Page 3
PUBLIC INFORMATION Appendix A PUBLIC INFORMATION INTERNAL AUDIT REPORT AIDS AND ADAPTATIONS Assurance Level: Reasonable Version: Final Date: 31/03/2025 Author: Seun Adebanjo File Ref: 2025-PA-005 Classification: Public
Page 4
PUBLIC INFORMATION PUBLIC INFORMATION AIDS AND ADAPTATIONS 1 Background 1.1 Through the Health and Social Care Partnership (HSCP), the Council assists adults living with illness, disability or frailty to maintain their independence, by offering equipment and adaptations which allow them to continue living in their own homes. 1.2 On receipt of a referral, screening and triage will be carried out and if a need is identified, the referral will be allocated to the appropriate team. An Occupational Therapist (OT) will assess the service user and complete an OT specialist request form via the CareFirst system detailing the aids or adaptations required. A senior OT will approve the OT specialist request forms. 1.3 Jobs relating to Council tenants will either be carried out by Building Services or an external supplier. If the job is allocated to Building Services, a job is raised on the Building Services URM system. 1.4 Owner occupiers and private tenants can apply for financial assistance for aids and adaptations. Grants for Improvement/Repair are given by Local Authorities under a framework set out in the Housing (Scotland) Act 2006. This process requires the applicant to submit 3 quotes to the Council, which will be checked to ensure that the proposal meets their needs. Approval to progress the application will be granted by a Senior OT. 2 Objectives and Scope 2.1 The main objective of this audit was to review the controls in relation to aids and adaptations within the Health and Social Care Partnership by checking the implementation status of prior audit recommendations and to ensure that: • Detailed procedures exist for the aids and adaptations process incorporating changes to operations or legislation and its impact on aids and adaptations activities. • Adequate controls are in place for assessing and awarding aids and adaptations for Council tenants as well as ensuring that work and payments are properly approved, and follow-ups are carried out on a timely basis. • Adequate controls are in place for the grant application process for homeowners and private tenants as well as ensuring that; all paperwork is completed and retained, work and payments are properly approved, and follow- ups are carried out on a timely basis. • Reconciliations are undertaken to ensure that budget monitoring information is accurate and up to date. 2.2 The period covered by the audit is 1st April 2021 to 30th November 2024 3 Findings Aids and Adaptations Process for Council Tenants 3.1 The auditor reviewed the most current standard operating procedures (SOPs) for Council tenants and observed that the procedures are still a work-in-progress, as some of the documents were described as draft and did not adequately incorporate all
Page 5
PUBLIC INFORMATION PUBLIC INFORMATION of the relevant activities of the Council. The SOPs did not include the following to aid better understanding of the aids and adaptations process for Council tenants: • Brief description of Council tenants’ aids and adaptations activities. • Brief description of the regulations guiding aids and adaptations including Annual Return Charter (ARCs). • Brief descriptions of stakeholders’ activities e.g. Building Services, External Contractors etc. • Jobs categorisation and allocation process between Building Services and external suppliers/contractors. • No access guidelines, including mitigations to minimise additional charges. • Follow-up process, timelines, and escalation process. • Allowable variations and justification process. • Periodic reporting, timescales and purpose of each report. (action a) 3.2 The admin team currently update the budget monitoring spreadsheet, an operational access database and the CareFirst system at each stage of this process for all Council tenant jobs. All serve a different purpose. This is very time consuming for staff and increases the risk of keying errors being made. In addition, the access database is not supported by IT Services and is currently unprotected. (action b) 3.3 A new processing system (Eclipse) is being developed to replace the existing applications such as CareFirst, which is yet to be finalised, and is expected to go live by Mid-2025. 3.4 We reviewed the number of jobs completed during a three-month period and identified instances where the final invoice amount was higher than the agreed amount for the jobs, as keyed into the Building Services URM system. On further examination of the cases identified, we found that no further approval had been obtained from a senior OT, or Service Level Agreement (SLA) put in place between HSCP and Building Services, to support the additional charges. (action c) 3.5 In one of the jobs examined, we observed that the expected date of completion was surpassed by 50 days between the specialist request form being completed and the job being completed. Reasons for the delay were not documented in the Work-In- Progress (WIP) report as part of follow-up exercise. 3.6 We observed that some aids and adaptations jobs received and scoped between June and November 2024 amounting to £190,003 are still classified as WIP as of December 2024. The reason for the long wait was not indicated in the WIP report. Further engagement with Building Services by the auditor revealed that some of the jobs have been completed but were still classified as WIP. (action d) Aids and Adaptations Process for Owner Occupiers/Private Tenants 3.7 The auditor reviewed the grants budget monitoring spreadsheet for 2024-25 which contained 245 referrals for grant applications and there were 125 forms with applicants that have not progressed to the next stage. 22% of the 125 forms had been carried over from previous years and had been pending between 2021 and 2023. We noticed from the review of the 125 grant application forms that 29 application forms had comments alongside them explaining the status, whereas the other 96 forms did not. (action e)
Page 6
PUBLIC INFORMATION PUBLIC INFORMATION 3.8 The procedures and guidelines for monitoring applications did not include a guide for chasing up outstanding paperwork, setting and tracking of timelines for the closure of pending referrals, or the rationale for closing longstanding applications, e.g. those over 2 years old. The monitoring of applications procedure has been updated at the suggestion of the auditor during the audit. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the aids and adaptations process. An area of concern is the delay in a follow-up being carried out and the lack of evidence that a follow-up has been carried out. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 7
PUBLIC INFORMATION PUBLIC INFORMATION KEY FINDINGS AND ACTION PLAN AIDS AND ADAPTATIONS Action a Finding We have reviewed the most current standard operating procedures (SOPs) for Council tenants and observed that the procedures are still work-in-progress, as some of the documents were described as draft and did not adequately incorporate all of the relevant activities of the Council. Action Description The SOPs should be updated to include the for better understanding of the activities of aids and adaptations. For example, these should be updated to include: • Detailed procedures exist for the aids and adaptations process incorporating changes to operations or legislation and its impact on aids and adaptations activities. • Adequate controls are in place for assessing and awarding aids and adaptations for Council tenants as well as ensuring that work and payments are properly approved, and follow-ups are carried out on a timely basis. • Adequate controls are in place for the grant application process for homeowners and private tenants as well as ensuring that; all paperwork is completed and retained, work and payments are properly approved, and follow-ups are carried out on a timely basis. • Reconciliations are undertaken to ensure that budget monitoring information is accurate and up to date. Risk Inconsistent approach by staff, possible key tasks not being carried out and lack of business continuity if staff familiar with the process are not available. Priority (1, 2, 3) 2 Paragraph Reference 3.1 Managed by Sharon Hackney, AHP Senior Manager and Professional Lead Assigned to Beth Griffin, Team Manager OT Due Date 30/04/2025 Management Comment SOPs being updated to include requested action information. Completion due by 30/04/2025. SOP cover note/introduction developed to include aids and adaptations activities, descriptions of regulations and legislation guiding aids and adapts. ARC info and brief description of stakeholder activities included in cover note. Action b Finding The admin team currently update the budget monitoring spreadsheet, an operational access database and the CareFirst system at each stage of the process for all Council tenant jobs. All serve a different purpose. This is very time consuming for staff and increases the risk of keying errors being made. In addition, the access database is not supported by IT Services. Action Description Management should investigate the feasibility of streamlining the end-to-end process as part of the transition to Eclipse to minimise
Page 8
PUBLIC INFORMATION PUBLIC INFORMATION the number of instances where data input is required, where possible. In the meantime, management should ensure that the access database (DB) is restricted to a limited number of authorised users only and that the DB is suitably protected (e.g. by way of strong password) until such time as the new system has been implemented. Risk Inefficient use of staff time and increased risk of keying errors. Priority (1, 2, 3) 2 Paragraph Reference 3.2 Managed by Sharon Hackney, AHP Senior Manager and Professional Lead Assigned to Beth Griffin, Team Manager OT / Leigh-Ann Mitchell, Senior Manager (Governance) Due Date 30/09/2025 Management Comment Ongoing issue for a number of years with no clear resolution. Each system is required for individual functions, and as such requires updated separately. Carefirst/Eclipse – approvals route only. We will review our processes as part of the transition to Eclipse and will attempt to minimise multiple data inputs where possible. Database needed for waiting list (individuals awaiting adaptation). Management will ensure that the access database (DB) is restricted to a limited number of authorised users only and that the DB is suitably protected (e.g. by way of strong password) until such time as the new system has been implemented. Review of authorised users and use of a password to be completed by 30/04/2025 Spreadsheet needed for ARC, KPIs and budget monitoring. Integra reports for budget monitoring (this only shows invoiced, whereas the spreadsheet shows where work has been ordered and invoiced at different costs to original order) Action c Finding A review of jobs completed revealed instances where the final invoice amounts were higher than the agreed amount for the jobs as keyed into the Building Services URM system. On further examination of the cases identified, we found that no further approval had been obtained from a senior OT, or Service Level Agreement (SLA) put in place between HSCP and Building Services, to support the additional charges. Action Description An SLA should be developed between Housing, HSCP, Building Services and PMI services which outline the agreed arrangements for managing additional charges. The reasons for additional charges should be recorded and subsequently approved by HSCP management. Tolerances for additional costs that can be incurred without prior agreement should be agreed and kept under review, in order to avoid undue delays which increase the costs further. These
Page 9
PUBLIC INFORMATION PUBLIC INFORMATION additional costs should still be recorded and notified to HSCP in retrospect. Risk Unauthorised financial expenditure or inability to properly monitor budget due to unplanned expenditure. Priority (1, 2, 3) 2 Paragraph Reference 3.4 Managed by Sharon Hackney, AHP Senior Manager and Professional Lead, Yvonne Baulk, Head of Service (Housing & Public Protection) Assigned to Stephen Connor, Team Manager, Housing / Beth Griffin, Team Manager OT Due Date 30/04/2025 Management Comment SLA development and final sign off pending. Discussion at next Adaptations WG regarding tolerance levels and authorisations for unforeseen costs as per email trail. Action d Finding We observed that some aids and adaptations jobs received and scoped between June and November 2024, amounting to £190,003, are still classified as Work-in-Progress (WIP) as of December 2024.The reason for the long wait was not included in the WIP report. Further engagement with Building Services by the auditor revealed that some of the jobs have been completed but were still classified as WIP. Action Description HSCP and Building Services should articulate in the SLA the process for the completion of works and ensuring that performance measures are properly monitored by the HSCP. Adaptations Admin should be reminded to request a follow-up upon job completion, with OTs also reminded to record the outcome of the follow-up on CareFirst. Management should ensure that monitoring is carried out to identify and resolve instances where a follow-up has not been carried out in a timely manner. Risk Difficulty in determining the status of jobs and tracking progress. Follow-up to ensure that the service user is getting full benefit from their aids and adaptations is not timely. Priority (1, 2, 3) 2 Paragraph Reference 3.6 Managed by Sharon Hackney, AHP Senior Manager and Professional Lead, Yvonne Baulk, Head of Service (Housing & Public Protection) Assigned to Beth Griffin, Team Manager OT Due Date 30/04/2025 Management Comment HSCP are updated on individual job progress through email communication and regular meetings are held between both services. This process will be formalised within the cross service SLA along with the target timescales for job completion. Weekly completions report run on a Monday by Adaptations Team. Monthly meeting with Building Services to discuss Scoping, Quotes and Operations for both HSCP and BS – WIP hadn’t been a focus, however Agenda now developed to allow for
Page 10
PUBLIC INFORMATION PUBLIC INFORMATION WIP progress updates on a monthly basis to record progress and reasoning for any jobs falling out with timescales. BS to send weekly WIP email updates to inform monthly discussion. OT Team Managers to monitor follow up completions at monthly staff supervision sessions as part of caseload management discussions. SOP updated to reflect the above. Action e Finding The auditor reviewed the grants budget monitoring spreadsheet for 2024-25 which contained 245 referrals for grant applications and there were 125 forms with applicants that have not progressed to the next stage. Action Description Consideration should be given to implementing a process to chase up applications sent out, to determine if the application should be progressed or closed off as no longer required. Risk A client is continuing to struggle without the aids or adaptations required to maintain their independence. Priority (1, 2, 3) 2 Paragraph Reference 3.7 Managed by Sharon Hackney, AHP Senior Manager and Professional Lead Assigned to Beth Griffin, Team Manager OT Due Date Completed Management Comment SOP updated to include chasing up of application packs sent out to determine progress or closure. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 11
PUBLIC INFORMATION PUBLIC INFORMATION INTERNAL AUDIT REPORT TRANSFORMATION AND CHANGE MANAGEMENT Assurance Level: Substantial Version: Final Date: 3rd April 2025 Author: Anne-Marie Fenton File Ref: 2025-PA-004 Classification: Public
Page 12
PUBLIC INFORMATION PUBLIC INFORMATION TRANSFORMATION AND CHANGE MANAGEMENT 1 Background 1.1 In 2020, Audit Scotland recommended in its Best Value Assurance Report that the Council develops its transformation themes into projects and further developing the governance arrangements to ensure the council has the skills needed to implement the next stage of transformation and develops a robust benefits realisation tracker to assess whether the Council has achieved its aims. The annual audit 22-23 noted that all the recommendations from the 2020 report had been actioned. 1.2 The Council’s Strategic Risk Register includes a high risk SRR2425_R05 “There is a risk that transformation and change activities, which are core to the future delivery models and long-term financial sustainability of both the Council and Health and Social Care Partnership, fail to deliver at the level of scale and pace required.” 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • there are adequate governance arrangements in place for transformation workstreams. • adequate financial monitoring arrangements are in place for the transformation workstreams. • there are adequate programme management arrangements in place for transformation workstreams. 3 Findings Governance Arrangements 3.1 The Council’s Transformation Programme is overseen by the Transformation Board. The Board is chaired by the Chief Executive and includes all Directors and relevant Heads of Service. The Board meets six times per year and receives updates from all ongoing workstreams. 3.2 All workstreams are linked to a Council Plan priority and representation from relevant services on the Transformation Board and individual project boards ensure that the programme is linked to appropriate strategies and policies. Financial Monitoring 3.3 Financial information including target savings and costs associated with the projects is included in the reports to the Transformation Board. If a project diverges significantly from its budget, options would be developed by the Project Manager and their team to be discussed at the project board, Transformation Board or ELT, depending on the level of impact. 3.4 The savings from Transformation projects form part of the Council’s budget and the financial monitoring information for the Transformation programme at a very high level forms part of the revenue and capital budget monitoring reports that are presented to Cabinet approximately every 2 months. Material variances are reported to Cabinet.
Page 13
PUBLIC INFORMATION PUBLIC INFORMATION Programme Management 3.5 3 workstreams within the Transformation Programme were selected for more detailed audit testing. These were Digital, Sustainability and Waste Services. 3.6 The Digital workstream has recently been set up as the successor to the Accessing Our Council workstream. The projects from Accessing Our Council were largely completed in the summer of 2024. The first Working Group for the new Digital workstream took place in February 2025 and is planned to take place every two months, in line with the Transformation Board. The first individual project for this workstream is Purchase to Pay (P2P) which was in the “discovery” phase at the time of audit testing and a risk workshop to develop the risk register was planned but had not yet been arranged. 3.7 The Sustainability workstream has one large, high-profile capital project, which is the establishment of 2 Solar PV (photo-voltaic) farms at Nethermains and Shewalton. A second large project on Decarbonisation of the Council’s Fleet was in the process of setting up a project board at the time of audit testing. The Solar PV project has close scrutiny and risk management arrangements. 3.8 There are a number of smaller projects and activities within the Sustainability workstream that do not have their own project board and associated documentation, but they are reported upon at the 2-monthly Sustainability Project Board meetings, completing a standard template for each activity to update the board on progress. This template does include a section for risk management where risks that arise are noted. Following discussions with Internal Audit, the Project Manager for the Sustainability workstream is planning to prepare an overall risk register for the workstream. 3.9 The Waste Review similarly has one large project, the HWRC (Household Waste Recycling Centre) Booking System, which has recently had its own project board set up. The wider programme was previously discussed at service management meetings which only took place 3 times in 2024, but the service has now set up a formal programme board, meeting monthly since January 2025. 3.10 The risk log for the HWRC Booking System has been completed and recently updated. None of the other Waste Review projects are at a stage where a risk log would be established. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the governance and management of transformation projects within the Council. The programme is reviewed regularly at a senior level within the Council and proportionate governance arrangements for individual workstreams sit underneath this.
Page 14
PUBLIC INFORMATION PUBLIC INFORMATION Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 15
PUBLIC INFORMATION PUBLIC INFORMATION INTERNAL AUDIT REPORT COMMUNITY EQUIPMENT STORE Assurance Level: Reasonable Version: Final Date: 30th April 2025 Author: Claire Morris File Ref: 2025-PA-006 Classification: Public
Page 16
PUBLIC INFORMATION PUBLIC INFORMATION COMMUNITY EQUIPMENT STORE 1 Background 1.1 The Health and Social Care Partnership (HSCP) provides equipment to help individuals live more safely, comfortably and independently in their own home. 1.2 The Equipment Store (‘the Store’) in Irvine is responsible for managing three categories of such equipment:- • Standard equipment – this type of item is requested by Occupational Therapists to help service users around the home. Equipment includes items such as raised toilet seats, bath boards, bed rails etc. A stock of standard items is held in the Store. • ‘Telecare’ – this type of item is requested by Social Workers to improve the safety of service users within their home. Telecare includes items such as smoke alarms, heat sensors and door sensors, but does not include community alarms – which are managed by the HSCP’s Technology Enabled Care Lead Officer. A stock of telecare items is held in the Store. • ‘Special order equipment’ – this type of item is required when standard equipment does not meet the needs of the service user. A tailored piece of equipment will be ordered by the user’s Occupational Therapist and delivered to the Store. The Store will arrange its delivery to the service user. 2 Objectives and Scope 2.1 The objective of this audit was to ensure:- • Stock levels are accurate and well managed • The process for issuing stock is efficient • All equipment is maintained to ensure it remains safe to use • There is a process for dealing with equipment returned to the Store 3 Findings Stock Management 3.1 The Store uses dedicated software (ELMS) to manage and record the allocation of stock to service users. 3.2 The accuracy of the stock information in ELMS is checked via fortnightly stock counts. 3.3 Audit tested the accuracy of ELMS stock records by:- • Obtaining copies of stock count records for recent stock counts • Attending the Store and carrying out a stock count on a sample of items • Selecting a sample of equipment purchases from Integra and ensuring ELMS is being updated to reflect the delivered items timeously. 3.4 Whilst no issues were noted with obtaining stock count records or during the on-site stock count, Audit did identify 2 instances where equipment purchases (totalling £7,099) had not been reflected in ELMS. (action a) Issuing Stock 3.5 Requests for standard stock and telecare, or the delivery of special order items, are made by Occupational Therapists and Social Workers by completing the relevant requisition template and submitting it to the Store.
Page 17
PUBLIC INFORMATION PUBLIC INFORMATION 3.6 Templates from NAC officers are submitted via Carefirst and templates from NHS officers are submitted via email. 3.7 All requests are recorded in ELMS, with the Store:- • Recording the request against the service user • Allocating the item of stock to the service user • Recording the delivery date 3.8 The Store also notifies the original requester (via Carefirst or email) that the item has been delivered. 3.9 Audit selected a sample of requests and confirmed that:- • ELMS had been fully updated • The requisitioner had been notified of the delivery being complete. 3.10 We identified one instance of a user’s ELMS record not fully reflecting the installed items. This was corrected during the Audit. (action a) Equipment Maintenance 3.11 LOLER (Lifting Operations and Lifting Equipment Regulations) state that equipment being used to lift people should be thoroughly examined six monthly. 3.12 NAC has a collaborative contract with South and East Ayrshire for the testing of such lifting equipment. 3.13 The Store provides a list of all equipment needing LOLER inspection or servicing to the contractor for action. 3.14 Audit obtained a report of outstanding service dates as at 6 February 2025 and found that 42 equipment checks were overdue – with 26 of these relating to 2024. The Store confirmed an issue with the reporting of ‘non-access’ by the contractor had resulted in the overdue checks. (action b) 3.15 The Store has confirmed that all cases of non-access are now being reported by the contractor monthly. Returned Equipment 3.16 Users are asked to return equipment that they no longer need to the Store. 3.17 The Store has equipment to wash down metal and plastic items and uses an external company to clean fabric items. 3.18 After cleaning, the Store Technician will assess whether an item is suitable for re-use and record this in a log. The Store Manager will review this and make the final decision on whether to add the item back into stock or scrap it. 3.19 Audit selected a sample of items from the log and ensured that stock records in ELMS had been adjusted to reflect the re-use/scrap decision. No issues were noted during testing.
Page 18
PUBLIC INFORMATION PUBLIC INFORMATION 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard the controls within the Equipment Store. 4.2 Ensuring all outstanding LOLER testing is completed as soon as possible should be a priority for the Service. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 19
PUBLIC INFORMATION PUBLIC INFORMATION KEY FINDINGS AND ACTION PLAN COMMUNITY EQUIPMENT STORE Action a Finding Discrepancies in ELMS records were identified during the Audit. Action Description Stores should investigate these discrepancies and take corrective action as appropriate. Risk Delays in allocating equipment to users; decisions based on inaccurate information Priority (1, 2, 3) 1 Paragraph Reference 3.4, 3.10 Managed by Kerry Logan, Head of Service (Health & Community Care) Assigned to Lorraine Dyet, Senior Manager (Health & Community Care) Due Date 06/06/25 Management Comment A full investigation into ELMS records discrepancies has been undertaken and corrective action to ensure accurate records has been taken. Following this there has been implementation of an updated Store delivery process, with gaps in the previous process being the identified cause of discrepancies. Alongside the process, the Store Manager(s) will verify deliveries to ensure that the process is followed correctly and to highlight any errors/prevent risk of inaccuracies - this was implemented on the 21/03/25. Store processes and the issues highlighted by the audit have been placed on HCC service risk register and will be reviewed in an ongoing basis. Action b Finding Not all LOLER servicing is being undertaken within the 6 month timeframe set by HSE legislation. Action Description All incidences of non-access or incomplete servicing of equipment should be reported to the Care at Home Team as soon as possible. Co-ordinated action between the Stores and the Care at Home Team should be taken to arrange access. Risk Users and / or carers are injured by lifting equipment that has not been serviced timeously; breach of HSE legislation; reputational damage to the Council. Priority (1, 2, 3) 1 Paragraph Reference 3.14 Managed by Kerry Logan, Head of Service (Health & Community Care) Assigned to Lorraine Dyet, Senior Manager (Health & Community Care) Due Date 06/06/25 Management Comment Regular monthly meetings with the service provider, Arjo, are in place to monitor and manage timescales for LOLER servicing. These meetings will continue to be prioritised, and late service items is a standing agenda item. The Store Manager will liaise with the relevant Care at Home Manager(s) for care at home visit times where issue with access
Page 20
PUBLIC INFORMATION PUBLIC INFORMATION have been identified – this process has been agreed with the service provider and is in place. Arjo will now send weekly updates implemented from 02/04/25 in regard to no access to allow the store to follow up accordingly and ensure more timeous response to reduce risk. Communication has been issued to all Care at Home Managers and Care at Home Assistants regarding service/Loler dates for equipment within the community to ensure any issues are highlighted to the Store as appropriate to allow stores to action accordingly. As part of procurement exercise that Team Manager has been involved in, issues with outstanding Service/Loler relation to Slings has been raised and expectations clearly written into new contract. Store processes and the issues highlighted by the audit have been placed on HCC service risk register and will be reviewed in an ongoing basis. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 21
PUBLIC INFORMATION PUBLIC INFORMATION INTERNAL AUDIT REPORT PAYROLL TRANSACTION TESTING Assurance Level: Reasonable Version: Final Date: 30th April 2025 Author: Yvonne Trundle File Ref: 2025-PA-007 Classification: Public
Page 22
PUBLIC INFORMATION PUBLIC INFORMATION PAYROLL TRANSACTION TESTING 1 Background 1.1 This audit was conducted as part of the approved 2024/25 Internal Audit Plan and data analytic tools were used to interrogate the HR Payroll system and examined any anomalies which arose. 1.2 The HR Payroll system is called CHRIS. The Employee Account is used to access and complete internal online forms for contract amendments and terminations. Verint is the system used to submit contract amendments and terminations to Payroll and Resourcing. 1.3 The audit covered the following areas: • Overtime • Working time regulations • Last payment for leavers • Salary amendment • Pay Adjustments • High mileage claims • High travel and subsistence claims • Employee details • Allowances 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • High overtime payments are valid, properly authorised and no duplicate overtime payments have been made. • Employees working an average of 48+ hours per week have complied with the working time directive regulations. • Employees last pay is correct, properly authorised and any overpayments have been identified and rectified. • Salary amendments are valid and authorised. • Pay adjustments are valid, properly authorised and no duplicate pay adjustments have been made. • High mileage claims are in line with the Terms and Conditions of Employment, are valid and properly authorised. • Travel and subsistence expenses are in line with the Terms and Conditions of Employment, are valid and properly authorised. • Employee details are valid and complete. • Allowances are in line with the Terms and Conditions of Employment, are valid and properly authorised. 2.2 The audit covered the period 1st October 2023 to 30th September 2024.
Page 23
PUBLIC INFORMATION PUBLIC INFORMATION 3 Findings Overtime 3.1 The auditor selected a sample of 10 high overtime payments based on overtime of 50% more than base pay. This testing identified an overpayment of £335.62 to a Community Safety employee who was paid 25.6 hours as double time instead of basic rate. The service contacted the Payroll team and the overpayment will be recovered. 3.2 A Building Services employee did not complete the job details section of a standby timesheet, so only the daily totals are recorded. This was not corrected by the person approving the timesheet. In addition, although the overtime was approved the approver was not an authorised signatory and when processed by Building Services, no check was carried out against the authorised signatory list. (action a) 3.3 The normal overtime authorisation process was not followed by Transport resulting in an overtime spreadsheet being emailed to Resourcing which did not have approval from an authorised signatory. However, this was subsequently processed by Resourcing. (action b, c) 3.4 There were 35 potential duplicate overtime payments where payments have been made to employees for the same overtime period but paid in a different payrun. The auditor reduced this number to 17 by checking payments over £100. The results were passed to the services to investigate which resulted in a total of 10 duplicate overtime payments totalling £3,273.14 being identified. 3.5 The audit identified a duplicate overtime overpayment of £728.04 for a Facilities Management employee and Payroll advised the overpayment will be recovered. The overtime was processed twice by the Payroll team after the employee asked the Area Officer to check with Payroll if it had been paid. The Payroll Officer could not find the overtime paperwork and did not check the Payroll system, in line with the procedure, so it was rekeyed. Payroll have taken the necessary steps to remind the team member to follow the required procedure. 3.6 The audit identified 9 duplicate overpayments for HSCP totalling £2,545.10 and HSCP advised the overpayments will be recovered. The Business Support Officer in HSCP advised that changes have been made to their current processes, including fortnightly and monthly paid employees will no longer be keyed to CHRIS weekly and instead will be keyed as per the payroll deadline for the relevant payrun. Also, additional checks will be carried out on CHRIS when the system provides a warning that the overtime being keyed is for the same overtime period to verify it is not a duplicate payment and to ensure the employee is due overtime hours for working in a different area. Working Time Regulations 3.7 The auditor calculated the average weekly working hours for the period 1 January 2024 to 30 June 2024 and there were 35 employees working an average of more than 48 hours per week. It was noted that 24 of the employees have completed a working time regulation opt out form which is recorded on the Payroll system. There are 11 employees with no working time regulation opt out form recorded on the Payroll system (2 in Facilities Management, 8 in Waste Operations and 1 in Streetscene). The Senior Managers were contacted and all 11 employees have now completed the working time regulation opt out form.
Page 24
PUBLIC INFORMATION PUBLIC INFORMATION Leavers Last Pay 3.8 The auditor selected a sample of 10 leavers to check their final pays were correct and properly approved. This testing resulted in the identification of 2 overpayments totalling £3,257.41 due to the late submission of termination paperwork. Both had already been identified and rectified by the Payroll team. 3.9 There were 11 employees that left within 21 days of starting and the pays were checked to ensure they were only paid for the hours worked. This testing resulted in the identification of 4 overpayments totalling £11,931.77 due to late termination paperwork. All had been identified by the Payroll team and appropriate steps have been taken to recover the funds. This included an overpayment of £4,300.23 that was referred to the Corporate Fraud team and fully investigated. 3.10 The auditor carried out additional tests on leavers to identify overpayments. This resulted in 17 potential overpayments being queried with Payroll. Payroll confirmed there had been 14 overpayments and 13 had already been identified and rectified by Payroll. An overpayment of £334.32 (gross) for 27 November 2023 to 30 November 2023 was identified by the audit and Payroll advised an account was raised to recover the overpayment. 3.11 The auditor tested for employees that have left and returned to ensure there is no overlap in contracts. There were 3 employees found that had an overlap but further checking confirmed that there were no findings to note. Salary Amendments 3.12 A sample of 10 salary amendments were selected for audit testing. This test identified 4 of the amendment forms were submitted after the effective date. The payroll team have limited control over the timing of the information that they receive however do routinely remind contacts of the key payroll dates and deadlines. As such no further recommendation has been made. Pay Adjustments 3.13 The auditor summarised the pay adjustments per code and carried out audit testing on 3 of the codes. A total of 146 payments totalling just under £800k were made under the heading of compromise payments, a total of 2,516 payments totalling just under £1.3m were made for pay adjustment superannuation and a total of 324 payments totalling almost £26k were made for disturbance allowances. A sample of 15 were checked (5 for each selected payment code). There were no findings to note from this testing. 3.14 A sample of 5 potential duplicate pay adjustment payments over £500 to current employees were also selected for audit testing. There were no findings to report from this testing. High Mileage Claims 3.15 The auditor tested for mileage claims over 1000 miles and all 5 were checked. There were no findings to report from this testing.
Page 25
PUBLIC INFORMATION PUBLIC INFORMATION High Travel and Subsistence Claims 3.16 A sample of 5 high value travel and subsistence payments were selected for audit testing. One claim resulted in an overpayment of £205.15 as the employee keyed 373 miles under the travel column instead of the business miles column resulting in a payment of £373 instead of a payment of £167.85. The employee confirmed this was an error and Payroll confirmed the overpayment was recovered in their March pay. 3.17 The auditor identified a subsistence payment made to a staff member which was made up of 5 individual claims, however: • The back up for only 4 of the forms could be provided by the service. • The employee claimed mileage on each claim and claimed subsistence for fuel supported by fuel receipts resulting in an overpayment of £303 (excluding VAT). A further £983.58 subsistence (excluding VAT) has been claimed and management should review this to confirm whether additional overpayments have been made. The employee has not claimed subsistence since March 2024. (action d) Employee Details 3.18 The auditor tested for duplicate national insurance numbers, blank national insurance numbers, invalid national insurance format, blank date of birth, duplicate bank details and blank bank details. This resulted in 2 employees with the same bank details and same name but slightly different spellings of both the first name and surname, different NINO, different address and different date of birth. This indicates they are not the same person. It has been passed to Corporate Fraud to investigate further. Allowances 3.19 The auditor summarised the amount paid per allowance and selected the 3 allowance codes with the highest values to check the employees were entitled to the allowance payments. The allowances checked were Mental Health, Unsocial Hours and Cash Preservation. There were no findings to note from this testing. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to transactions on the payroll system. The audit identified a number of overpayments due to duplicate overtime claim forms being processed and errors when claiming subsistence. In addition, there were overpayments due to the late submission of termination forms, most of which had already been identified and rectified by the Payroll team.
Page 26
PUBLIC INFORMATION PUBLIC INFORMATION Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 27
PUBLIC INFORMATION PUBLIC INFORMATION KEY FINDINGS AND ACTION PLAN PAYROLL TRANSACTION TESTING Action a Finding A Building Services employee did not complete the job details section of a standby timesheet, so only the daily totals are recorded. This was not corrected by the person approving the timesheet. In addition, the overtime was approved but the approver is not an authorised signatory and when processed by Building Services, no check was carried out against the authorised signatory list. Action Description Building Services should remind employees to complete all sections of the standby timesheet, approvers should be reminded to reject standby timesheets that are not properly completed and the admin team should be reminded to check that overtime is approved by an authorised signatory before processing. Risk Employees overtime hours might be incorrect resulting in an over or under payment; breach of the Codes of Financial Practice. Priority (1, 2, 3) 2 Paragraph Reference 3.2 Managed by Yvonne Baulk, Head of Service (Housing & Public Protection) Assigned to Billy Borthwick, Senior Manager (Operations) Due Date 15/04/25 Management Comment All standby operatives have been briefed on how to complete the SBY timesheet correctly through a series of 30-minute workshops delivered by the Contract Performance team. All standby operatives have been updated on how to complete the SBY timesheet fully and correctly through text message reminder sent to all craft operatives’ mobile devices. All Supervisors have been reminded by Senior Officers of their responsibility to check that all timesheets are fully and correctly completed and will reject where this is not the case. Senior Officers will ensure that they add all new staff to the approved signatory list through BS Admin Team. BS Admin Team will check all signatures are from approved staff only and will reject where not. Action b Finding The normal overtime authorisation process was not followed by Transport resulting in an overtime spreadsheet being emailed to Resourcing which did not have approval from an authorised signatory. However, this was subsequently processed by Resourcing. Action Description The Resourcing team should be reminded to ensure that overtime is approved by a relevant authorised signatory before being processed and should be returned if proper approval is not provided. Risk Employees overtime hours might be incorrect resulting in an over or under payment; breach of the Codes of Financial Practice Priority (1, 2, 3) 2 Paragraph Reference 3.3
Page 28
PUBLIC INFORMATION PUBLIC INFORMATION Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Jackie Smillie, Senior Manager (People Services) Due Date Complete Management Comment The Resourcing team have been reminded of the importance of checking authorised signatories and have been advised that overtime which has not been authorised by a relevant signatory must be returned for appropriate approval. The Resourcing Team review the Authorised Signatory screen to confirm the relevant signatory is current. Action c Finding The normal overtime authorisation process was not followed by Transport resulting in an overtime spreadsheet being emailed to Resourcing which did not have approval from an authorised signatory. However, this was subsequently processed by Resourcing. Action Description Transport management should reinforce the overtime approval processes currently in place and to ensure that these are adhered to by admin staff to ensure that the email to Resourcing includes evidence of approval by an authorised signatory. Risk Employees’ overtime hours might be incorrect resulting in an over or under payment; breach of the Codes of Financial Practice Priority (1, 2, 3) 2 Paragraph Reference 3.3 Managed by Laurence Cree, Head of Service (Sustainability, Transport & Corporate Property) Assigned to Gordon Mitchell, Senior Manager (Transport) Due Date Complete Management Comment This was an administrative error as any weekly overtime / additional hours are sent to Resourcing on a Monday morning and authorised signatories are copied in for verification. Unfortunately on this occasion the employee forgot to include the relevant manager. The admin team have been reminded of the process and advised to be more careful going forward. Action d Finding The auditor identified a subsistence payment made to a staff member which was made up of 5 individual claims, however: • The back up for only 4 of the forms could be provided by the service. • The employee claimed mileage on each claim and claimed subsistence for fuel supported by fuel receipts resulting in an overpayment of £303 (excluding VAT). A further £983.58 subsistence (excluding VAT) has been claimed and management should review this to confirm whether additional overpayments have been made. The employee has not claimed subsistence since March 2024. Action Description The service should request the employee reimburses the £303 overpayment for subsistence. The service should investigate any additional overpayments that should be reimbursed by the employee. Risk Overpayment of travel and subsistence allowance
Page 29
PUBLIC INFORMATION PUBLIC INFORMATION Priority (1, 2, 3) 2 Paragraph Reference 3.17 Managed by Kerry Logan, Head of Service (Health & Community Care) Assigned to Loraine Dyet, Senior Manager (Locality Services) and Louise Davidson, Senior Manager (Health & Community Care) Due Date 30/05/25 Management Comment A number of meetings have taken place with the Business Support Team, Senior Management and Operational Team Manager to undertake a full review and to avoid ensure steps are put in place to prevent recurrence. The following actions have been implemented: • Detailed guidance to be included within sample mileage claims at CAH induction course. • Formal discussion has taken place with line manager and guidance reissued to full team. • Once total reimbursement figure has been confirmed by Business Support, they will inform Team Manager and Line Manager. • Line manager will confirm reimbursement payment with employee and formal discussion to be recorded within employee file. • Further claim forms submitted by the employee following date of audit period have been reviewed, no actions were required. • SOP and guidance issued to clerical team on Arran regarding mileage claims which will be audited internally by Business Support. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.