2025 08 28 Internal Audit Reports Issued
North Ayrshire Council · 28 August 2025
Back to Audit and Scrutiny Committee — 28 August 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 28 August 2025 Audit and Scrutiny Committee Title: Internal Audit Reports Issued Purpose: To inform the Committee of the findings of Internal Audit work completed since May 2025. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed since May 2025. Internal control reviews have been completed in respect of the areas detailed in Appendix A to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix A includes the report and action plan from each audit. 2.3 The findings from two separate audit assignments are detailed at Appendix A to this report and the levels of assurance for each are noted in the table below: Audit Title Assurance Level Procurement Substantial Locality Planning – Community Investment Fund Reasonable
Page 2
3. Proposals 3.1 It is proposed that the Committee notes the outcomes from the Internal Audit work completed since May 2025. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact John McCallum, Senior Manager (Audit, Fraud, Safety, Risk & Insurance), on 01294 324607. Background Papers None.
Page 4
PROCUREMENT 1 Background 1.1 The audit entailed an independent review of procurement activities in conjunction with the requirements of the PCIP (Procurement and Commercial Improvement Programme) external assessment to ensure good practice. 1.2 1.3 1.4 Consequently, the review focussed on the arrangements in place for ensuring that contract awards are compliant with internal governance and legislative requirements. CPU offers advice on procurement related matters such as contract terms, contract extensions, contract modifications and price increase requests. CPU also lead the management of modifications and extensions to the contract as required by the terms and conditions, and national procurement legislation. In-addition, CPU progress all procurements over £10k except for national framework direct awards up to £50k that the service teams can progress themselves. Internal service teams are responsible for the management and monitoring of contract and supplier performance against specification, terms and conditions and KPIs. Also, internal service teams will obtain updated documentation following expiry dates for insurances, accreditations and memberships. 2 Objectives and Scope 2.1 The main objective of this audit was to carry out an independent procurement review to: • Ensure standing orders are being applied to contracts procured across all Council services and followed for a competitive, fair, transparent process to optimise competition and value for money. • Obtain evidence that independent post project reviews are routinely carried out for high risk or high value procurements with lessons documented for future projects. 2.2 The period covered by the audit is 1st January 2024 to 31st March 2025 3 Findings Procurement application of Standing Orders 3.1 The Council’s Procurement manual and Standing Orders relating to Contracts set out the process for awarding a contract, depending on the different types of procurement procedure that must be followed, for the different thresholds of spend. These procedures are detailed in section 7 (Low Value Procurement) and section 8 (High Value Procurements). Contracts can be procured via framework call offs, tenders, quick quotes, and single tender actions. 3.2 A sample of 10 contracts consisting of supplies, services and works across different Council services with total spend greater than £50,000, all appointed within the last 12 months, including the 5 highest value, were reviewed to assess if the procurement procedures complied with the Procurement Manual and Standing Orders.
Page 5
3.3 The contracts reviewed generally complied with the Council’s Procurement manual and Standing Orders in the areas of Request for Procurement Action (RPA), contract strategies, evaluations, publication and award process such as tender outcome report, award and decline letters. 3.4 In one of the jobs examined, we observed that there was no evidence that the officers involved had completed the iLearn Module on Standing Ordering Relating to Contracts and Contract Procedure Rules, which is mandatory for all budget holders, and anyone involved in the procurement process. Budget holders are required to confirm, via a checkbox on the RPA, that the training has been completed however in this case, it had been left blank. This was not challenged by the CPU on receipt of the RPA. (action a). 3.5 We reviewed the most current procurement manual and observed that the procedures did not adequately incorporate all of the relevant activities relating to procurement as actual practices sightly differ from process in the following areas: • Procurement fraud impact assessment must be completed for all procurements over 10K (Supplies, Services and Works) as seen in the contract files reviewed, whereas this process is not incorporated in the procurement manual. • Information Sharing Protocol is part of the actual process as seen in the contract files reviewed whereas this process is not incorporated in the procurement manual. The current procurement manual has been updated at the suggestion of the auditor during the audit. Post Project Review 3.6 All of the sample contracts had completed and documented a post project review. Most of the reviews had identified learning points, either negative or positive, but in a couple of cases N/A had been recorded, indicating that no learning points had been identified. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the procurement of major contracts. The contracts reviewed generally complied with the Council’s Procurement Manual and Standing Orders in the areas of Request for Procurement Action (RPA), contract strategies, evaluations, publication and award process such as tender outcome report, award and decline letters. One action to improve the quality of compliance with procedures has been recommended.
Page 6
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 7
KEY FINDINGS AND ACTION PLAN PROCUREMENT Action a Finding In one of the jobs examined, we observed that there was no evidence that relevant officers had completed the iLearn Module on Standing Ordering Relating to Contracts and Contract Procedure Rules, which is mandatory for all budget holders, and anyone involved in the procurement process. The field within the RPA to confirm that training had been completed was left blank. Action Description CPU should always challenge service teams when instances of non-compliance are identified, such as failing to confirm that the iLearn Module had been completed. Risk Non-compliances with Standing Orders or procedures are not identified and corrected. Lack of adequate knowledge of procurement process will hamper effective contributions of participants. Priority (1, 2, 3) 2 Paragraph Reference 3.4 Managed by Mark Boyd, Head of Service (Finance) Assigned to Suzanne Bignell, Senior Manager (Corporate Procurement) Due Date Completed Management Comment CPU Managers have been instructed to challenge any service representative that has not stated if they have completed the CSO I-Learn training. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 8
LOCALITY PLANNING – COMMUNITY INVESTMENT FUND 1 Background 1.1 The Community Investment Fund (CIF) was created to support projects that address local priorities. 1.2 Community organisations apply for CIF funding via their Locality Partnership. 1.3 Locality Partnerships are responsible for assessing proposals and making funding recommendations to Cabinet. 1.4 £1.85m of this Fund remains unallocated (as per the most recent Cabinet paper, dated 18th February 2025). 2 Objectives and Scope 2.1 The objective of this audit was to ensure:- • there is a robust process for assessing and awarding CIF • Documentation to evidence the assessment and award process is being retained • Monitoring of actual spend is being undertaken 3 Findings Assessment Process 3.1 The Council has a guidance note that sets out the CIF scheme criteria, grant eligibility and an outline of the process for developing and approving an award. 3.2 The current approach for assessing and documenting funding decisions is as follows:- 1. Expression Of Interest template – completed by applicants and gives a broad outline of the proposal 2. Expression Of Interest checklist – used by Locality Officers to ensure the proposal meets the CIF criteria 3. Partnership meeting – the proposal will be discussed and a decision will be made to either reject it, request amendments/additional information or request a full application be submitted. The decision is recorded in the Partnership Action Note. 4. Application template – completed by applicants. This is a much more detailed document and requires the applicant to answer a number of key questions, including:- a. Summary of proposal b. What difference will this project make within the locality and to local services and programmes? c. What engagement has taken place in relation to the project? d. How will the project be managed? e. Amount of funding being requested f. Monitoring and evaluation process
Page 9
5. Partnership meeting – to discuss the application form and either reject it, request amendments/ additional information or agree the application should be presented to Cabinet to request funding. The decision is recorded in the Partnership Action Note. 6. Cabinet meeting – to discuss the application form and either reject it, request amendments/additional information or approve CIF funding. 3.3 Audit reviewed the above process and documents in detail and has recommended the following improvements:- • Updating the guidance note to make the submission of supporting documentation a mandatory part of the application process. These documents evidence that the applicant meets the CIF criteria (action a) • Updating the Expression of Interest checklist to include confirming the applicant has sufficient public liability and employers’ liability insurance (action b) • the introduction of a funding agreement to be signed by applicants prior to the receipt of funds. (action c) Evidence of decision-making process 3.4 Audit selected 1 award made by each of the 6 Localities and requested evidence of stages 1-6 as documented in 3.2 above. 3.5 The Service was unable to locate:- • The Expression of Interest checklists and corresponding supporting documentation for 4 of the awards • An action note showing the recommendation to move from the Expression of Interest to full application stage for 1 award 3.6 The Service indicated that staffing changes have contributed to issues with locating some of the above documents. The Service and Audit agreed that a standardised filing system would make mitigate this issue. (action d) Monitoring of Spend 3.7 Locality Officers are in regular contact with award recipients and are therefore aware of the general progress of projects. 3.8 The Service also requires award recipients to complete a monitoring template every 12 months. The template requests:- • information on actual spend, including copies of invoices • an update on progress towards project outcomes 3.9 Audit requested copies of monitoring forms and evidence of spend for each of the 6 awards tested at 3.4 above. 3.10 1 award had been made less than 12 months ago, and therefore a monitoring form wasn’t yet due. All other 5 had been awarded more than 12 months ago, and so monitoring reports should have been submitted. 3.11 Audit found 3 forms had been submitted approximately 12 months after the payment date, 2 had been submitted approximately 2 years after the payment date. (action e) 3.12 Audit also reviewed the evidence of spend submitted alongside each monitoring report.
Page 10
3.13 Audit found:- • 2 awards where invoices to fully evidence the CIF spend had been submitted • 2 awards where documents had been submitted, but these were not invoices and therefore not sufficient evidence of spend • 1 award where no invoices had been submitted (action f) 3.14 In addition to the monitoring form, the Service indicated that over the last few years applicants have been invited to Partnership meetings to provide an update on their project. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard the award of CIF funding. 4.2 Standardising and centralising the filing of CIF related documents will ensure all evidence to support awards can be located. This will also help to identify any gaps in evidence more easily. 4.3 The Service is currently working on improving the award monitoring process, which should address the issues raised above. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 11
KEY FINDINGS AND ACTION PLAN LOCALITY PLANNING – COMMUNITY INVESTMENT FUND Action a Finding The CIF Guidance Note currently states:- ‘Where appropriate, depending on the grant sum requested, the organisation will be expected to submit supporting documentation. All documentation will be used, alongside the application form, to assess against the grant criteria.’ Action Description Guidance should be updated to make the submission of documentation to prove eligibility for CIF funding mandatory. Officers should enforce this at the Expression of Interest stage (as per the Expression of Interest checklist), with funding requests not advancing to the application stage until all relevant documentation has been provided. Risk Insufficient information to confirm if the applicant meets the CIF scheme criteria; inappropriate awarding of CIF funds Priority (1, 2, 3) 2 Paragraph Reference 3.3 Managed by Rhonda Leith, Head of Service (Connected Communities) Assigned to Jacqueline Greenlees/Angela Morrell Due Date 31st August 2025 Management Comment Guidance updated; training for officers to take place August 2025 Action b Finding Expression Of Interest checklist does not cover all CIF scheme criteria. Action Description Checklist should be updated to ensure it references all criteria of the scheme. Risk Applicant that doesn’t meet the scheme criteria receives a CIF award Priority (1, 2, 3) 2 Paragraph Reference 3.3 Managed by Rhonda Leith, Head of Service (Connected Communities) Assigned to Jacqueline Greenlees Due Date 30th June 2025 Management Comment Guidance updated Action c Finding Successful applicants are not currently required to sign a funding agreement. Action Description With support from Legal, a funding agreement should be created for all CIF awards. This should include the need to comply with monitoring requirements and the requirement to be able to evidence ‘best value’. Risk No recourse if the award is not spent in line with approved application; no recourse if monitoring requirements are not adhered to; poor use of the public pound Priority (1, 2, 3) 1 Paragraph Reference 3.3 Managed by Rhonda Leith, Head of Service (Connected Communities) Assigned to Jacqueline Greenlees
Page 12
Due Date 30th September 2025 Management Comment Will be implemented by time next funding is agreed at Locality Partnerships. Action d Finding The Service was unable to locate CIF related documents. Action Description A standardised filing system should be introduced and used by all Officers. Risk Important documents can’t be located; unable to evidence decisions if challenged Priority (1, 2, 3) 2 Paragraph Reference 3.6 Managed by Rhonda Leith, Head of Service (Connected Communities) Assigned to Angela Morrell Due Date 30th September 2025 Management Comment A standardised filing system will be implemented. Action e Finding Monitoring templates are not always being submitted timeously. Action Description The timing of the issuing of the monitoring template should be changed. Providing the template when the award is paid gives the recipient plenty of time to review the form, raise any early queries and complete the form as they spend. Reminders could be sent to ensure recipients are aware that the return will be due at 12 months. Risk Service is unaware of the misuse of the CIF award Priority (1, 2, 3) 2 Paragraph Reference 3.11 Managed by Rhonda Leith, Head of Service (Connected Communities) Assigned to Jacqueline Greenlees/Angela Morrell Due Date 30th September 2025 Management Comment Template will be provided with award letter. Action f Finding Unsuitable documents are currently being accepted as ‘evidence’ of spend. Action Description The Service should remind Officers that only invoices can be accepted as evidence of spend. Officers should reconcile both the detail and total value of invoices submitted to the spend breakdown in the monitoring form. Risk Service is unaware of the misuse of the CIF award Priority (1, 2, 3) 2 Paragraph Reference 3.13 Managed by Rhonda Leith, Head of Service (Connected Communities) Assigned to Angela Morrell Due Date 30th September 2025 Management Comment Officer training to take place in August 2025.
Page 13
Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.