Internal Audit Reports Issued
North Ayrshire Council · 20 November 2025
Back to Audit and Scrutiny Committee — 20 November 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 20 November 2025 Audit and Scrutiny Committee Title: Internal Audit Reports Issued Purpose: To inform the Committee of the findings of Internal Audit work completed since August 2025. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed since August 2025. Internal control reviews have been completed in respect of the areas detailed in Appendix A to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix A includes the report and action plan from each audit. 2.3 The findings from 5 separate audit assignments are detailed at Appendix A to this report and the levels of assurance for each are noted in the table below: Audit Title Assurance Level Housing Indicators Reasonable / Limited IJB Transformation Substantial HSCP – Overtime Controls Reasonable HSCP – Child Protection Substantial Accounts Payable Transaction Testing Reasonable
Page 2
3. Proposals 3.1 It is proposed that the Committee notes the outcomes from the Internal Audit work completed since August 2025. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact Anne-Marie Fenton, Interim Senior Manager (Internal Audit), on afenton@north-ayrshire.gov.uk. Background Papers None.
Page 4
Appendix A Housing Indicators 2023-2024 1 Background 1.1 The function of this Audit was to validate a sample of Performance Indicators submitted via the Annual Return on the Charter (ARC) for the period 2023-2024. This is a Scottish Housing Regulator (SHR) requirement for social landlords to demonstrate how they are achieving the outcomes and standards contained within the charter. There are no targets set by the Regulator of what they would expect the Landlord to achieve. 1.2 A potential consequence of incorrect reporting and/or missing evidence could be the requirement to re-calculate and submit data to the SHR. There could also be more regular engagement required between the Landlord and Regulator going forward, with a possibility of validation checks being carried out by the Regulator. 1.3 The Auditor was provided with a list of all indicators which were contained within the ARC, and this was reduced to only include those which had not already been previously validated via the Scottish Housing Network. The final sample of 5 was decided after identifying the themes covered by each to ensure it covered a range of PI’s. The 5 Performance Indicators (PIs) tested were as follows:- Indicator 6 – 6.1 – 6.2.2 % of stock meeting SHQS (Scottish Housing Quality Standard) Indicator 12 % of tenants who have had a repairs or maintenance carried out in last 12 months satisfied with the repairs and maintenance service Indicator 15 % of anti-social behaviour cases reported in the last year which were resolved Indicator 21 Average length of time to complete adaptations Indicator 24 % of homeless households referred to RSLs under section 5 and through other referral routes 1.4 We received further information to advise which teams were responsible for gathering the data for the return from the Senior Manager (Governance/Building Services) Performance Indicator Team Responsible Collating Data Housing 6 Property Management & Investments (PMI) 12 Building Services 15 Housing 21 Health & Social Care Partnership (HSCP) 24 Housing
Page 5
2 Objectives and Scope 2.1 The objectives of the audit were as follows:- Obtain a list of Return on the Charter Performance Indicators and select a sample of 5 for detailed testing. From the sample selected conduct the following tests:- • Obtain any guidance from the regulator regarding definitions of the PIs and how they should be calculated. • Obtain any internal procedure notes describing how the PIs will be calculated and what processes are in place to ensure these are routinely reviewed and kept up to date, especially when national PI’s change. • Review the process for obtaining data for the PI calculation and check for procedures to ensure consistency. • Receive back up evidence for recently published PI’s and confirm calculations are arithmetically correct 3 Findings Applicable to all Performance Indicators 3.1 A copy of the most recent SHR Guidance (2023) was provided and the service stated that any changes to this are advised by the regulator, usually by means of a meeting between the regulator and Landlord/Local Authorities. Any amendments would be provided in PDF format and cascaded to relevant departments and staff members involved in preparing data for ARC. 3.2 There are no formal internal procedure notes in place to ensure the regulator guidance was adhered to for 23/24 or updated where necessary. The auditor was provided with Data Dictionaries (by the Team Manager – Performance – Housing & Public Protect) which are to be used for 24/25. However, these are in draft form and incomplete, therefore it was not possible to review them in full as part of this audit. The Technical Definition (Regulator Guidance) section was completed for all PI Data Dictionaries, however it was noted that some data was missing. Staff responsible for data gathering for each PI were unaware of the Data Dictionaries being a work in progress and intended for use for 24/25. Recommendations for improvement have been advised by email to the Senior Manager (Governance/Building Services) in relation to the internal procedures (Data Dictionaries). (action a) PI 6 - Percentage of stock meeting SHQS 3.3 The following is the final submission figures for Indicator 6. The overall percentage figure for both testing period and projected for following year has been correctly calculated based on the figures below.
Page 6
3.4 PMI did not provide an internal procedure note for this indicator. PMI were able to provide verbal guidance and show how the figure was calculated for 6.1.1 - The total number of properties within the scope of the SHQS using the Apex system and Iworld. This also included guidance on how properties outwith the scope were excluded. The figure matched what was reported - 13329. The verbal guidance should be included in the Data Dictionaries going forward. (action a) 3.5 It was noted during testing that the figure for 6.1.1 included properties classed as “in abeyance”, which appears to contradict the SHR guidance for the PI. However, the figures in PI6 are not input directly to the return, but pulled through from the figures input to the contextual PI C9. The guidance for C9 does not state that properties subject to abeyance or exemption should be excluded. Officers from PMI contacted the SHR for clarification and they confirmed that the current approach (including properties in abeyance) was correct. Therefore, there is an issue with the guidance document from the SHR which appears to contradict itself regarding the issue of properties subject to exemption or abeyance in these 2 PIs, which should be the same, due to the fact that only one of them is input by the landlord and the other is calculated automatically from that data. (action b). 3.6 PMI were able to provide verbal guidance on how the data was collated however not how the final figure was calculated for 6.1.2, 6.2.1 or 6.2.2. In the absence of internal procedure notes or evidence to support the Auditor was unable to recalculate. Limited assurance is provided for PI 6. (action a) PI 12 – Percentage of tenants who have had repairs or maintenance carried out in the last 12 months satisfied with the repairs and maintenance service 3.7 The following are the final submission figures for Indicator 12. The overall percentage figure has been correctly calculated based on the figures below.
Page 7
3.8 Building Services were able to provide verbal guidance and show how the figures were calculated for the indicator. A step-by-step guide of the process and systems used (Rocc) was provided, however this requires to be expanded to ensure regulator guidance is followed and updated as required and should form part of the Data Dictionaries going forward. (action a) 3.9 The auditor was satisfied that the surveys were carried out within the correct testing period following the regulator guidance. A total of 1564 tenants took part in the survey which was request by the contractor using a handheld device at the end of the repair works. The evidence provided was summarised into response categories using a Pivot which was re-tested by the auditor confirming the figures submitted were correct for each response. The auditor recalculated the total and percentage satisfied with the repairs service and agreed with the figures in the submission. 3.10 The Guide to Surveying Tenants states the following with regards to PI 12:- “SHR permits landlords to submit existing performance data on repairs and maintenance rather than collect it via the survey. Landlords wishing to use existing performance data should:- (a) ensure the question used in their regular performance monitoring matches the wording of indicator 12. (b) inform the SHR of their intention to use performance rather than survey data. (c) ensure their submission includes details of the time period covered, number of feedback requests issued and the number of returns on which results are based." The auditor found that the SHR had not been advised reporting was via performance data rather than survey for 23/24 and the additional information required (noted in point c) had also not been provided. (action c) 3.11 It was found by the auditor that the wording for the available answers was not as advised within the SHR guidance. It currently reads Satisfied and Dissatisfied (within the Rocc Mobile application) should have read Fairly Satisfied and Fairly Dissatisfied in the survey available answers as per the ARC. This does not have a material impact on the overall percentage reported. It is however suggested the wording is amended
Page 8
within the Rocc survey to reflect that of the regulator guidance going forward. Reasonable assurance is provided for PI 12. (action c) PI 15 – Percentage of anti-social behaviour cases reported in the last year which were resolved 3.12 The following are the final submission figures for Indicator 15. The overall percentage figure has been correctly calculated based on the figures below. 3.13 Housing (Local Housing Offices and ASBIT) were able to provide verbal guidance and show how the figures were calculated for the indicator. A step-by-step guide of the process/systems used (Access) was provided by ASBIT only - this requires to be expanded to ensure regulator guidance is followed and updated as required and should form part of the Data Dictionaries going forward. (action a) 3.14 The evidence provided for PI 15 does not match what was reported for 15.1 – The number of cases of anti-social behaviour reported in the last year. 961 were reported to the ARC however the total from the evidence was 1030. The discrepancy was identified within the Local Office figures for Irvine with 69 cases not included in the count between the months of January 24 - March 24. The service believes this to have been caused by a typing error. The Data Dictionaries should be updated to ensure that there is a data validation process in place prior to submission to ARC. (action a) 3.15 The evidence provided for PI 15 does not match what was reported for 15.2 – of those at 15.1, the number of cases resolved in the last year. 882 cases were reported resolved to the ARC and the total from the evidence was 891. The discrepancies were identified as follows: • Irvine reported 253, evidence suggests 254 • Kilwinning reported 68, evidence suggests 69 • Three Towns reported 177, evidence suggests 178 • Kilbirnie reported 42, evidence suggests 48 If the overall percentage were to be re-calculated for this PI it would change to 86.50%, meaning the reported figure has been overstated by 5.28 percentage points. (action d) 3.16 The local offices had not retained the required evidence for 15.2 at original report dates (23/24). The report was re-produced in March 2025. If any of the original cases were edited this could provide a reason for the differences. The auditor is unable to confirm this. Limited assurance is provided for PI 15. (action d)
Page 9
PI 21 – The average time to complete adaptations 3.17 The following is the final submission figures for Indicator 21. The overall percentage figure has been correctly calculated based on the figures below. 3.18 HSCP did not provide an internal procedure note for this indicator. HSCP were able to provide verbal guidance and show how the figure was calculated for both 21.1 and 21.2. In the absence of a procedure note it was unclear as to which date should be used as the starting point. The auditor was verbally advised it should be date approved by Occupational Therapy (OT) however calculations have been based on date assessed by OT. In most cases these dates are the same, but not always. A full procedure note should be created and added to the Data Dictionaries, referring to SHR guidance. (action a) 3.19 The auditor agreed the total adaptations for 23/24 were 860 (2.12). However, it was noted that due to incorrect completion dates being input into the spreadsheet some adaptation days to complete had a negative figure. The reported figure of 77905 is therefore inaccurate. There are a total of 5 negative figures within this data. The service were advised and corrected the 5 identified as errors and a new total of 78387 days was obtained. This would then change the final figure for average time to complete adaptations to 91.15 days. There is also a risk of further keying errors affecting the rest of the data, which are not as easily identified. Limited assurance can be provided for PI 21 (action e) PI 24 – The percentage of homeless households referred to RSLs under section 5 and other referral routes 3.20 The following is the final submission figures for Indicator 24. The overall percentage figure has been correctly calculated based on the figures below. 3.21 Homelessness Prevention and Housing Advice were unable to provide an internal procedure note for PI 24. However, we were verbally advised that reports are run
Page 10
from Civica and figures are collated by the Co-ordinator - Performance – Housing and Public Protect prior to ARC submission. A pivot is created to summarise results. The auditor assessed the data and re-ran the pivot tables using the evidence provided and it was found to match what was reported. The Data Dictionaries should be updated to provide staff with a step-by-step procedure note, making reference to the SHR guidance for definition, inclusions and exclusions. Reasonable assurance can be provided for PI 24. (action a) 4 Internal Audit Opinion 4.1 An overall Audit opinion was provided as follows for each Performance Indicator:- Performance Indicator 06 - Limited Performance Indicator 12 - Reasonable Performance Indicator 15 - Limited Performance Indicator 21 - Limited Performance Indicator 24 - Reasonable Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 11
KEY FINDINGS AND ACTION PLAN Housing Indicators 2023-2024 Action a Finding No formal internal procedure notes are in place to ensure that Regulator guidance is followed and updated as required for the period tested - 23/24. Incomplete Data Dictionaries have been provided and are intended for use for 24/25, however there are currently in draft form. It was also noted that some staff responsible for collating the data for the ARC were not aware of the Data Dictionaries. Action Description Review the SHR guidance and audit recommendations to ensure Data Dictionaries are fully completed and issued to appropriate staff prior to 24/25 SHR ARC return being completed. This will ensure consistency in data collection from year to year. Data Dictionaries should also make reference to what evidence is required to be kept, which format is used to present it and where this should be centrally filed. Risk Inaccurate reporting to ARC as required by SHR, due to inconsistent data collection. Lack of consistency reduces comparability of PIs and therefore usefulness for management decision-making. Lack of clear instructions for new staff if those who currently prepare the PIs are unavailable in the future. Priority (1, 2, 3) 1 Paragraph Reference 3.2, 3.4, 3.6, 3.8, 3.13, 3.14, 3.18, 3.21 Managed by Head of Service (Housing & Public Protection) Assigned to Team Manager (Performance) Due Date 30th September 2025 Management Comment Draft data dictionaries will be updated to reflect comments within the audit report. The Performance Team in HPP will ensure that all indicators have a data dictionary and that these are completed and signed off by the appropriate service.
Page 12
Action b Finding It was noted during testing that the figure for 6.1.1 included properties classed as “in abeyance”, which appears to contradict the SHR guidance for the PI. However, the figures in PI6 are not input directly to the return, but pulled through from the figures input to the contextual PI C9. The guidance for C9 does not state that properties subject to abeyance or exemption should be excluded. Officers from PMI contacted the SHR for clarification and they confirmed that the current approach (including properties in abeyance) was correct. Therefore there is an issue with the guidance document from the SHR which appears to contradict itself regarding the issue of properties subject to exemption or abeyance in these 2 PIs, which should be the same due to the fact that only one of them is input by the landlord and the other is calculated automatically from that data. Action Description Management should consider writing to the SHR to formally raise the issue that there is inconsistency in their guidance document regarding the inclusion of properties subject to exemption or abeyance in the PIs 6 and C9. Risk Different landlords, or officers preparing the return in different years, will interpret the guidance differently, detracting from the usefulness of the PI for comparison over time or between organisations. Priority (1, 2, 3) 3 Paragraph Reference 3.5 Managed by Head of Service (Housing & Public Protection), Head of Service (Sustainability, Transport & Corporate Property) Assigned to Head of Service (Housing & Public Protection) Due Date 30th June 2025 Management Comment Although the SHR have confirmed NAC’s current interpretation of the guidance is accurate, Housing Services will approach the SHR to discuss the ambiguity in the wording of the guidance. This will form part of a scheduled meeting on 11 June and any follow- up actions agreed with the SHR at that time will be progressed in liaison with PMI.
Page 13
Action c Finding For PI 12, the wording for the available answers “Satisfied” and “Dissatisfied” should have read “Fairly Satisfied” and “Fairly Dissatisfied” in the survey available answers as per the SHR Guidelines and ARC submission. SHR had not been advised reporting is via performance data rather than survey for 23/24 and the additional information required had also not been provided (as per the guide to surveying tenants) Action Description The available options for the stand-alone questionnaire provided to tenants for reactive repairs via the Rocc Mobile Application should be amended to reflect the SHR guidelines, by adding the word “fairly” as follows (words to be added underlined);- Very Satisfied Fairly Satisfied Neither satisfied or dissatisfied Fairly Dissatisfied Very Dissatisfied Going forward Data Dictionaries should be updated with procedures to ensure SHR are advised of the use of performance data rather than survey and provide additional information they require when using performance data as per the guide to surveying tenants. Risk We are not following the structured wording for the survey as per current SHR guidelines. There is a very small chance that some respondents might have answered differently given the different wording. We have also not followed the procedure set out by SHR when using performance data rather than survey. Priority (1, 2, 3) 3 Paragraph Reference 3.10, 3.11 Managed by Head of Service (Housing & Public Protection) Assigned to Senior Officer (Systems & Intelligence) Due Date Complete Management Comment System has been updated to reflect changes. In the submission of the 2024/25 ARC the following was added to the Comments (Housing quality and maintenance) section: "...Tenant satisfaction with reactive repairs is gathered using transactional surveys throughout the reporting period to ensure feedback is captured timeously and appropriate action taken to address any areas of concern."
Page 14
Action d Finding For PI 15, incorrect data has been reported to the ARC for 15.1 & 15.2. Action Description ASBIT and Local Housing Offices should review the SHR requirements and ensure data validation checks are in place. Any evidence used in calculations should be retained. This procedure should be contained within the Data Dictionaries. Risk Inaccurate reporting to ARC due to data not being verified prior to submission. Priority (1, 2, 3) 1 Paragraph Reference 3.15, 3.16 Managed by Head of Service (Housing & Public Protection) Assigned to Senior Manager (Housing Operations) Due Date 31st July 2025 Management Comment Monthly ARC reporting will be undertaken, and records will be validated at this point to prevent errors - this will be documented within the data dictionaries. Action e Finding For PI 21, incorrect data has been reported to the ARC due to an error in the data manually typed into the ‘Adaptations Completed’ spreadsheet for 23/24. Action Description Additional quality control checks should be introduced to ensure the start/end dates input to the ‘Adaptations Completed’ spreadsheet are correct, as this affects the overall data reported to ARC. Risk Inaccurate reporting to ARC due to data not being verified prior to submission. Priority (1, 2, 3) 1 Paragraph Reference 3.19 Managed by AHP Senior Manager & Professional Lead Assigned to Service Manager (Community Occupational Therapy, Adaptations and Dirrans Centre) Due Date 30th September 2025 Management Comment Quality checks will be undertaken prior to the information being submitted, ensuring data can be validated and dates are reflective of the work undertaken. This will include an ARC reporting SOP. Data dictionaries will also be updated to note this. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 15
IJB TRANSFORMATION 1 Background 1.1 North Ayrshire Health & Social Care Partnership (HSCP) is subject to a significant budget challenge and a recovery plan was agreed in June 2024. It has a large and complex Transformation Plan which aims to achieve significant cost reductions as well as improvements to services. 1.2 In March 2024, a new Transformation Plan covering the period 2024-27 was agreed by the IJB (Integration Joint Board). At the time of this renewal of the plan, the governance arrangements for the Transformation Plan were also reviewed. The projects cover all areas of the HSCP and include large workstreams and small individual projects, and governance arrangements are adjusted according to the scale of the activities. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • there are adequate governance arrangements in place for transformation workstreams • adequate financial monitoring arrangements are in place for the transformation workstreams • that there are adequate programme management arrangements in place for transformation workstreams. 3 Findings Governance Arrangements 3.1 All projects are allocated to a Planning Manager in the HSCP’s Transformation team. The team use a tracker in Microsoft Lists which details all of the projects (79 at the time of audit testing) and can be accessed by all members of the Transformation Board. The fields recorded in the tracker include ownership, anticipated savings, quarterly updates and deliverables and a RAG status. The Planning Managers update the tracker at least once a quarter. 3.2 The information on the tracker is used to produce a one-page dashboard to give a high-level indication of the progress of the Transformation Plan. The dashboard can also be filtered to show information for a particular service. The dashboard is still being refined and some small discrepancies in classification of projects were noted, which the Senior Manager (Strategic Planning and Transformation) stated she would investigate and discuss with the Planning Managers. However, in general the dashboard is a very useful tool for giving an overall impression of the progress being made against the Transformation Plan as a whole. It was agreed during the audit period that the tracker would be presented to the Transformation Board as a standing item on a quarterly basis. 3.3 The Transformation Board meets approximately monthly and is chaired by the Director of the HSCP, or in her absence the Chief Social Work Officer. Agendas and minutes were reviewed by the auditor. It is regularly attended by all of the Partnership’s Senior Management Team, relevant managers from the partnership and other Council
Page 16
services involved in the projects, and members of the Transformation team. It has an agreed Terms of Reference document which outlines the membership, purpose, remit and reporting lines. It was noted that the Terms of Reference stated that action notes from the Board meetings would be shared at each IJB via the Director’s report, but this has not been done in practice, at the request of the IJB. However, the IJB have received 6-monthly updates on the progress of the Transformation Plan, including a copy of the dashboard mentioned at 3.2. The Senior Manager (Strategic Planning and Transformation) prepared a revised Terms of Reference to reflect the reporting arrangements to be presented to the Transformation Board in July 2025. (action a) 3.4 The Transformation team have developed a suite of template documents for use in project management, including a Project Request Form, Project Initiation Document (PID), Exception Report and Project Closure Report. These documents are required since the governance arrangements were reviewed in March 2024, but they were not required in retrospect for projects that had already commenced. There are too many projects for the Transformation Board to receive an update every time, so reporting is by exception. They receive a PID for every project and receive reports on issues and exceptions. 3.5 The template documents are generally of a high standard, laying out clearly all the information required at the appropriate stage of projects. However, it was noted that in the PID template, the risk section consisted of a standard paragraph referring to the HSCP’s risk approach and stating that “Risks and issues are regularly reviewed and updated as part of project monitoring.” The auditor suggested that it would be appropriate for the PID stage that the risks identified up to that point in the project should be included in the information presented to the board and the Senior Manager (Strategic Planning and Transformation) agreed to add this in. Financial Monitoring 3.6 The Section 95 Officer for the IJB is usually the Head of Service for both Finance and Transformation, although the post is currently vacant and therefore the Principal Manager (Finance) is the interim Section 95 Officer. The Head of Service and the Principal Manager (Finance) are both members of the Transformation Board. Savings attached to the transformation projects are monitored through the tracker. Achievement of savings are also reported to the IJB regularly as part of the budget monitoring reports. The budget monitoring reports do not focus on the Transformation projects or separate them out from other projects and activities. However, the reports are timely and clearly laid out and any variance significant enough to affect the overall outlook of the HSCP would clearly be highlighted given the format and parameters of the reports. 3.7 Each project or programme manages their own budget and any significant deviation would be reported by exception to the Transformation Board. Any that impacted the overall position of the HSCP would also be reported to the IJB as mentioned at 3.4. No significant budgetary divergences have occurred but the processes to be followed are clear. The frequency of reporting and membership of the groups ensure that divergences would be highlighted to senior managers and IJB members in a timely manner. Programme Management 3.8 A sample of 3 projects was selected for review of project management arrangements: Brighter Pathways, Blue Badges and Trakcare. These projects cover different services and are of different sizes, therefore they had different governance
Page 17
arrangements appropriate to the size. Further details of this testing is outlined at paragraphs 3.10-3.20 below. 3.9 Further to the sample projects, Internal Audit noted during the review of Transformation Board papers discussions relating to the Magic Notes project, which involves use of AI-based software and is expected to bring significant financial savings and improve recruitment and retention of social workers. However, the Council’s Information Governance and IT Customer Teams sent out emails in September 2024 and February 2025 respectively that stated that services must not implement any AI- based solutions without involving the Information Governance and Cyber Security teams at the outset. Assurance was obtained that these teams had been involved and that Data Protection Impact Assessment and corporate procurement processes were being followed. Brighter Pathways 3.10 Brighter Pathways is a large workstream consisting of 7 projects relating to remodelling children and young people’s care options. The Council’s Housing, Education and HR services are involved in some of the projects, alongside the HSCP. The workstream has its own programme board and the individual projects also have project boards. 3.11 The programme has a well-structured risk register, including named responsible officers and mitigating actions. The risk register is reviewed monthly at the Programme Board meeting. A risk was highlighted to the Transformation Board in February 2025 regarding poor attendance, which had led to Programme and Project Board meetings being cancelled. The Planning Manager for the workstream gave assurance that attendance has improved since this exception was highlighted. 3.12 The Head of Service (Children, Families & Justice) is the main budget holder for this workstream. There is a Senior Accountant in the HSCP’s Finance team with responsibility for that service and she provides financial monitoring information to the Head of Service and other managers as part of the routine budget monitoring. She regularly meets with the senior managers in the service to review and discuss the financial position as this is a high-risk area (low volume / high-cost services areas e.g. Children’s residential placements). She regularly prepares projections based on assumed discharge dates etc. She provides the project managers with any costings required for the Brighter Pathways work. Blue Badge Service 3.13 The Blue Badge Service project consisted of a review of the Blue Badge Policy and processes for the administration of blue badges. The project commenced before the current governance structures for the Transformation Plan were in place, but it followed the PRINCE2 project management methodology. The project was completed in November 2024 and a closure report was presented to the Transformation Board in January 2025. 3.14 A risk register was prepared for the project and reviewed regularly by the Planning Manager and the project lead, the Service Manager (Community Occupational Therapy, Adaptations and Dirrans Centre). Only 1 risk was identified. This risk was the subject of an exception report to the Transformation Board and was subsequently resolved.
Page 18
3.15 The project was completed within existing resources and did not have any savings targets attached to it; therefore no specific financial monitoring was undertaken. Trakcare 3.16 Trakcare is an IT system for the management of appointments and performance reporting, which is being rolled out to all Mental Health services in North, South and East Ayrshire. The project initially commenced in 2020 but has faced delays due to a variety of factors including the complex governance arrangements of working across the different organisations, the complexity of implementing the system in the numerous different specialities and teams within Mental Health, changes of personnel and sickness and maternity leave within the project team. There are 28 teams expected to move over to the system, of which 18 had gone live at 2nd June 2025. The remaining teams are expected to go live by March 2026. 3.17 The project has a project board with a large membership. There were some issues with attendance, which led to a number of meetings being cancelled in the later part of 2024. The frequency of the meetings has been reduced since, but this has ensured that they went ahead as planned. The Planning Manager maintains a project plan spreadsheet to monitor progress of the rollout and produces monthly highlight reports which are shared with the project board. 3.18 The project has a risk register which includes ownership and mitigating actions. Live risks are included in the highlight reports and discussed at the project board meetings. The auditor queried a particular mitigating action which had been uncompleted for several months, as it required sign-off from a specific Clinical Governance Group within NHS Ayrshire & Arran. The planning manager stated that there had been a number of barriers but that a short life working group was being pulled together to ensure that it would be signed off. 3.19 There has been an issue with benefit realisation as the required development of reports in Trakcare, which would allow other databases to be shut down, thus improving the efficiency of administrative processes, has not been as quick as hoped, but this was raised at the Transformation Board and meetings are being held to address the issue. 3.20 There are no savings targets attached to this project and it is generally being managed within existing resources, other than a one-off investment to pay for staff overtime to migrate patient records and appointments. Therefore, there is no specific financial monitoring for the project. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the governance of the HSCP’s Transformation Plan. The current governance arrangements include clear reporting lines and involve senior managers at an appropriate level. The Transformation Board meets regularly and has a good overview of the projects, including access to a tracker which is summarised in a 1-page dashboard. A low priority action has been recommended to correct a discrepancy in the Terms of Reference for the Board. 4.2 Projects have governance arrangements which are appropriate to their size. The documentation required for the projects is clearly laid out and includes the requisite elements to give managers and sponsors the information they require for decision-
Page 19
making. Risk registers are maintained for the projects and regularly reviewed. Exceptions are escalated and appropriate actions put in place. Financial monitoring arrangements are in place that would highlight any significant divergences from budget. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 20
KEY FINDINGS AND ACTION PLAN IJB TRANSFORMATION Action a Finding It was noted that the Terms of Reference stated that action notes from the Board meetings would be shared at each IJB via the Director’s report, but this has not been done in practice, at the request of the IJB. However, the IJB have received 6-monthly updates on the progress of the Transformation Plan. The Senior Manager (Strategic Planning and Transformation) prepared a revised Terms of Reference to reflect the reporting arrangements to be presented to the Transformation Board in July 2025. Action Description The revised Terms of Reference should be presented to the Transformation Board for approval. Risk The arrangements for reporting the progress against the Transformation Plan to the IJB are not compliant with the Terms of Reference of the Transformation Board. Priority (1, 2, 3) 3 Paragraph Reference 3.3 Managed by Director (HSCP) Assigned to Chief Social Work Officer Due Date 20th August 2025 Management Comment The Transformation Board in July was cancelled due to leave, the Terms of Reference is on the agenda for the next meeting on 20th August. At which point this action will be complete. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 21
HSCP OVERTIME CONTROLS 1 Background 1.1 Following the finalisation of the 2024/25 outturn position, the Integration Joint Board (IJB) agreed some initial recovery actions at the meeting in June 2024. In line with the requirements of the integration scheme, work has continued to develop the financial recovery plan and identify further targets for financial improvements until the year-end. 1.2 1.3 To strengthen the on-going financial recovery plan to deliver cost reduction targets, it is important to review the controls put in place by HSCP to restrict all but essential overtime working by carrying out control testing against the overtime process. Consequently, the review focussed on the arrangements in place for ensuring that controls around the authorisation and payment of overtime across HSCP are compliant with internal governance and conform with the recovery plan to deliver cost reduction targets, while carefully managing the level of risk. 1.4 A trend analysis of HSCP overtime payments was carried out to compare the cost of overtime over the last two financial years. There has been an overall decrease of 14.92% across both care at home and non-care at home, which amounts to £229k as shown in the table below. Description £ Care At Home Non- Care At Home Overtime amount 23/24 1,537,620.03 1,008,689.67 528,930.36 Overtime amount 24/25 1,308,185.74 955,877.53 352,308.21 Difference 229,434.29 52,812.14 176,622.15 % Decrease 14.92% 5.24% 33.39% 1.5 The drivers for the large expenditure on overtime across the services are reported by HSCP managers to be sickness, staff absence, training issues, safer staffing levels, unforeseen events, vacancies, retirement, to complete short notice court reports and to support children and families in crisis at weekends. 2 Objectives and Scope 2.1 The main objective of the audit was to carry out a detailed review of controls around the authorisation and payment of overtime across HSCP to: • Ensure documented procedures are in place to cover the process of arranging, recording, approving and paying overtime. • Ensure overtime payments are valid, properly authorised and no duplicate overtime payments have been made. 2.2 The period covered by the audit is 1st April 2024 to 31st March 2025
Page 22
3 Findings Procedures and Reports 3.1 Care at Home (CAHs) and non-Care at Home (NCAH) overtime process documents relating to arranging, recording, approving and paying overtime were reviewed. 3.2 The review of the most current process notes and operating procedures for HSCP overtime found that they did not incorporate the following, to aid better understanding of the activities involved in overtime processing: • A brief description of each of the activities e.g Transaction upload process, Bank report, Additional time report, Community alarm, Contracted staff etc. • The objective of each activity in the overtime process or procedural documents • Brief descriptions of the systems or applications for capturing overtime activities e.g CM (care management) system, CHRIS (Comprehensive Human Resource Integrated Solution) • An overview of the periodic reporting arrangements e.g. the report type and frequency. • The process for dealing with excess overtime payments in conjunction with finance debt recovery team. (action a) HSCP Overtime Process, Authorisation and Payment 3.3 A sample of 20 overtime payments consisting of Care at Home (CAHs) and non-Care at Home (NCAH) across the HSCP within the last 12 months were reviewed to assess if overtime payments complied with the Overtime Payment procedures. 3.4 The overtime payments generally complied with the HSCP Overtime Control process. However, some issues with adequacy of some individual documents were identified and are summarised below: • Reason stated on a timesheet for overtime was not valid or detailed as only office/visits was captured as reason for some overtime payment totalling £1,019.67. (NB Subsequent to the audit fieldwork, this was highlighted as a potential overpayment and has been referred to the Corporate Fraud Team for further investigation.) • The reasons for 2 overtime payments were not indicated on the timesheets or supporting documents amounting to £1,400.76 • An amendment of the overtime hours on a timesheet was not signed off by the supervisor or authorised signatory to authenticate the amendment. (action b) 3.5 Through a review of the potential overtime duplicate reports, we found that 30 overtime payments, totalling £3,639.28, were overpaid to employees of which 14 payments have been resolved while 16 payments, amounting to £2,397.51, were unresolved but have now been transferred to the finance debt recovery team for recovery. This included 13 overpayments amounting to £2,082.49 to a single employee between August and October 2024 which had been marked as passed to debtors by the team, but had actually been missed and had not been passed to debt recovery. This was passed to debt recovery when highlighted by the auditor. Payment recovery is currently in progress for all the unresolved overpayments and legal proceedings had commenced on one of the debtors. (actions c, d)
Page 23
3.6 We observed that HSCP overtime payments especially non-CAH and Senior Care at Home are still being processed manually by inputting overtime hours from timesheets into CHRIS. This partly accounted for the duplicate overtime payments and use of incorrect rate or hours in the overtime calculations. The majority of the payments have been recovered from the affected employees. (action c) 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the overtime control process. The overtime payments generally complied with the HSCP Overtime Control process. However, some issues with adequacy of some individual documents were identified to improve the quality of compliance with procedures. An oversight had led to a significant overpayment not being followed up. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 24
KEY FINDINGS AND ACTION PLAN OVERTIME CONTROLS PROCESS Action a Finding We have reviewed the most current process notes and operating procedures for HSCP Overtime Controls and observed that the procedures did not adequately incorporate all of the activities of the HSCP Overtime Controls process. Action Description The process notes or operating procedure should be updated to include all activities to aid better understanding of the HSCP Overtime Controls processes. For example, these should be updated to include: • A brief description of each of the activities e.g Transaction upload process, Bank report, Additional time report, Community alarm, Contracted staff etc. • The objective of each activity in the Overtime process or procedural documents • Brief descriptions of the systems or applications for capturing overtime activities e.g CM, CHRIS • An overview of the periodic reporting arrangements e.g. the report type and frequency. • The process for guiding excess overtime payments in conjunction with finance debt recovery team Risk Inconsistent approach by staff, possible key tasks not being carried out and lack of business continuity if staff familiar with the process are not available. Priority (1, 2, 3) 2 Paragraph Reference 3.2 Managed by Director (HSCP) Assigned to Principal Manager (Business Support) Due Date Complete Management Comment HSCP Overtime Controls processes have been updated to reflect the above clarification Action b Finding The overtime payments generally complied with the HSCP Overtime Control process. However, some issues relating to the adequacy of some individual documents were identified such as, the reasons for overtime stated on timesheets were not sufficiently detailed and the amendment of overtime hours on a timesheet was not signed off. Action Description HSCP Admin should always challenge service teams when instances of non-compliance relating to inadequacy of overtime documentations are identified. Risk Non-compliance with process notes or procedures are not identified and corrected which can lead to errors in overtime payments. Poor use of officer time correcting errors. Priority (1, 2, 3) 2 Paragraph Reference 3.4 Managed by Director (HSCP) Assigned to Principal Manager (Business Support) Due Date Complete
Page 25
Management Comment All HSCP employees have been emailed reminder as to how the overtime claim form should be completed and to ensure the reason for overtime is detailed. HSCP Resourcing team have been reminded to ensure the reasons for overtime are adequately detailed and if not, return the form. Any amendment of overtime hours on a timesheet will be signed off by Administrative Officer. Action c Finding Through a review of the potential overtime duplicate reports, we found that 30 overtime payments totalling £3,639.28 were overpaid to employees of which 14 payments have been resolved, while 16 payments amounting to £2,397.51 were unresolved but had now been transferred to the finance debt recovery team for recovery. We observed that HSCP overtime payments especially non-CAH and Senior Care at Home are still being processed manually by inputting overtime hours from timesheets into CHRIS. This partly accounted for the duplicate overtime payments, use of incorrect rate or hours in the overtime calculations. Action Description The HSCP Business Admin Manager should remind the team to always check the accuracy of payments when they are processing claims to prevent errors. Risk Loss of funds due to errors leading to overtime overpayments. Poor use of officer time correcting errors. Priority (1, 2, 3) 2 Paragraph Reference 3.5, 3.6 Managed by Director (HSCP) Assigned to Principal Manager (Business Support) Due Date Complete Management Comment HSCP Resourcing team have been reminded to always check the accuracy of payments when they are processing claims to prevent errors - once calculated a second staff member checks the claim for accuracy. Once the claim is keyed to CHRIS the Admin Officer checks the keying for accuracy. Action d Finding Through a review of the potential overtime duplicate reports, we found that 30 overtime payments, totalling £3,639.28, were overpaid to employees of which 14 payments have been resolved while 16 payments, amounting to £2,397.51, were unresolved but had now been transferred to the finance debt recovery team for recovery. This included 13 overpayments amounting to £2,082.49 to a single employee between August and October 2024 which had been marked as passed to debtors by the team, but had actually been missed and had not been passed to debt recovery. Action Description HSCP Business Admin should periodically review the overpayments passed to debt recovery to obtain an updated position on progress of the recovery. Risk Overpayments are not recovered in a timely manner. Priority (1, 2, 3) 2 Paragraph Reference 3.5
Page 26
Managed by Director (HSCP) Assigned to Principal Manager (Business Support) Due Date Complete Management Comment HSCP Business Admin will undertake a 6-8 weekly check with Debt Recovery to ensure that all overpayments are in progress. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 27
GOVERNANCE OF CHILD PROTECTION 1 Background 1.1 Chief Officers (defined by the Scottish Government (SG) as the Chief Constable, Chief Executive of Health Boards and Chief Executive of Local Authorities) are responsible for ensuring their agencies, both individually and collectively, work to protect children and young people. 1.2 The Child Protection Committee (CPC) is the local strategic planning partnership through which Chief Officers discharge this responsibility. The CPC is responsible for developing and implementing child protection policy and strategy across and between agencies. 1.3 The SG published an updated version of the ‘National Guidance for Child Protection in Scotland’ in August 2023. 2 Objectives and Scope 2.1 The objective of this audit was to ensure HSCP can evidence it:- • considered the SG Guidance update and made any necessary changes to procedures and working practices • Clearly communicated any updates to staff • Continues to monitor the impact of North Ayrshire’s approach to child protection to ensure it remains aligned with the aspirations of the Scottish Government guidance 2.2 This audit has focussed on reviewing the governance structure around child protection in North Ayrshire. Individual child protection cases were not considered, or assessed, as part of this Audit. 3 Findings Guidance 3.1 In response to the updated SG Guidance, the Child Protection Lead Officer from each of the 3 Ayrshire councils came together to produce the ‘Ayrshire Multi-Agency Child Protection Practitioner Procedures’. 3.2 These procedures condense information from the SG guidance, but also include:- • key information boxes – to highlight the changes from earlier guidance • practice notes – which give examples of the application of the guidance • flowcharts – to aid understanding of processes 3.3 North Ayrshire’s CPC supplemented the Pan-Ayrshire procedures with briefing notes. These were produced by a short-life multi-agency implementation sub-group set up for this specific task. 3.4 By September 2023, 6 briefings had been produced. These were:- • Child Protection Risk Factors Briefing • Contextual safeguarding 7 minute brief • CP Guidance Risk Factors
Page 28
• Interim Safety Plan Briefing • Inter-Agency Referral Discussion (IRD) Briefing • Open IRD Process Briefing 3.5 The Service confirmed that briefing notes continue to be produced as necessary. This was evidenced by the Child Protection Lead Officer being involved in the production of guidance on working with 16-17 year olds in May 2024. 3.6 The Head of Service (Children, Families & Justice) confirmed to CPC that the new national guidance was implemented by North Ayrshire in September 2023. Communication 3.7 Each member of the CPC implementation sub-group was responsible for distributing briefings within their own agency. 3.8 Within NAHSCP, briefings were shared with all Team and Senior Managers within Social Work, for further dissemination to relevant officers. Emails were provided by the Service to evidence this. 3.9 There is no central storage location for child protection procedures within HSCP. (action point a) Monitoring 3.10 In order to assess how CPCs were implementing the Child Protection National Guidance, the SG required all CPCs to complete a self-evaluation toolkit and submit their findings. 3.11 This toolkit required CPCs to look at 8 key areas in the Guidance – answer direct questions on implementation with either ‘in full’, ‘in part’ or ‘yet to start’, and then provide narrative responses detailing progress, success and challenges relating to the implementation. 3.12 North Ayrshire’s submission was reviewed by the CPC prior to submission. The Service has confirmed that areas for improvement highlighted by the assessment were incorporated into the CPC Improvement Plan and the related sub-group action plans. 3.13 The ongoing application and impact of child protection procedures across North Ayrshire is monitored in a number of ways:- Pan-Ayrshire 3.14 The CPC Chair, Child Protection Lead Officer and Chief Social Work Officer from each of the 3 Ayrshires meet regularly. This provides an opportunity to share findings, issues etc. CPC 3.15 The CPC maintains an overview of child protection across North Ayrshire agencies via its quarterly meetings. 3.16 As standard, these meetings include:- • updates from Services – (Education, Child Protection Health Team, Children, Families & Justice Services, SCRA, Police Scotland) on current workloads
Page 29
and emerging issues • updates from CPC sub-groups on current tasks 3.17 The update from the Management Information sub-group includes a quarterly data report on child protection activity in North Ayrshire. This report includes:- • standard indicators set by the Centre for Excellence for Children’s Care and Protection (CELCIS). These have been designed to help CPCs consistently collect, analyse, and report on child protection data. • Additional indicators requested by the CPC to support them with identifying trends within North Ayrshire. 3.18 The above ensures the CPC has timeous information on what is happening across all partner agencies in North Ayrshire and is aware of any areas of concern. 3.19 In addition to the routine monitoring noted above, the CPC also monitors its strategic direction via its 3 year Improvement Plan (2023-2026). This Plan comprises detailed actions for each of its 3 key priorities. Each action in the Plan has monitoring criteria such as how performance will be monitored, reporting frequency and RAG status. All actions are allocated to 1 of the 5 CPC sub-groups for action. HSCP 3.20 Monitoring within HSCP is primarily via professional supervision by a more senior manager. 3.21 Audit has placed reliance on managers having regular updates with their teams. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to North Ayrshire’s overall governance approach to child protection. 4.2 No opinion has been formed on the detail included in procedures, briefing notes or the accuracy of CPC findings as these are specialist in nature, and therefore outwith the knowledge base of the Internal Audit Team.
Page 30
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 31
KEY FINDINGS AND ACTION PLAN GOVERNANCE OF CHILD PROTECTION IN NORTH AYRSHIRE Action a Finding There is no central storage location for child protection procedures within HSCP. Action Description Consideration should be given to creating a central ‘library’ of procedures and guidance notes – accessible by all officers with a role in child protection. Risk Officers are unaware of procedures; officers are using an outdated version of a procedure Priority (1, 2, 3) 2 Paragraph Reference 3.9 Managed by Head of Service (Children, Families & Justice) Assigned to Head of Service (Children, Families & Justice) Due Date 22/12/25 Management Comment We are currently exploring the feasibility of establishing a centralised repository to house all child protection policies and guidelines, with the aim of enabling the workforce to access them more efficiently and with greater ease. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 32
ACCOUNTS PAYABLE TRANSACTION TESTING 1 Background 1.1 This audit was conducted as part of the approved 2025/26 Internal Audit Plan and used data analytics to interrogate the Accounts Payable (AP) system on Integra and the procurement card system and examine any anomalies which arose. 1.2 There were 4,672 active Trade Suppliers (for processing payments to standard suppliers, individuals, and social services) and 931 Sundry Suppliers (for processing one-off sundry payments) on Integra as at 8th May 2025. 1.3 There were 100,708 invoices paid to trade and sundry suppliers from 1st July 2024 to 30th April 2025, totalling just over £354.4 million. 1.4 There were 19,110 procurement card transactions made during the period of the audit totalling just under £4.5 million. The SDOL system is the Royal Bank of Scotland Smart Data Online system used to record and manage procurement card transactions. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • duplicate suppliers are identified and de-activated to minimise the risk of duplicate invoices being paid. • duplicate invoices have not gone undetected. • advance payments have been reported to Financial Management for the list of pre-payments at financial year-end. • high value invoices have been properly authorised. • invoices paid to employees are bona fide. • card purchases are in line with the policy and there is adequate separation of duties. 2.2 The audit period was 1st July 2024 to 30th April 2025. 3 Findings Supplier Testing 3.1 Testing was carried out to identify duplicate trade suppliers on Integra. Testing identified 43 duplicate suppliers either by name or bank details. These were passed to the AP team to review and deactivate as appropriate. (action a) Invoice Testing 3.2 The auditor tested for duplicate payments to suppliers, including sundry suppliers, and identified possible duplicates that were investigated further. This check confirmed 126 were duplicates that had already been identified and action taken by the AP team by either processing a reversal, keying a credit or requesting a BACS recall. This testing identified a further 14 potential duplicate invoices totalling £162,301.71 which had not already been identified by the AP team. The potential duplicates have been passed to the AP team to check and arrange recovery. (action b)
Page 33
3.3 The auditor tested for purchase orders that have been requisitioned and approved by the same person and none were found. There were 2 users with requisitioner and approver roles, but there was a separation of duties in all such cases. E-Procurement has since confirmed the users no longer have both roles. 3.4 There were 12 invoices paid before the invoice date and there were 285 invoices paid more than 1 year after the invoice date. All were checked and there were no findings to note. Advance Payment Testing 3.5 The auditor extracted all payments over £20,000 and tested a sample of 50. There were 26 invoices passed to Financial Management to confirm the payments have been posted to the correct financial year end before the accounts are finalised. The remaining 24 were checked by the auditor and found to be correctly accounted for. Financial Management advised that an invoice totalling £57,217.50 was accrued in error and a reversal was processed to correct it. High Value Payment Testing 3.6 The auditor selected a sample of 10 invoices between £10,000 and £100,000. There were 5 PO invoices and 5 non-PO invoices checked. There were 2 non-PO invoices where the authorised signatory was copied into the email to AP for processing rather than AP being provided with explicit approval from the authorised signatory. (action c) 3.7 The auditor tested a sample of 20 invoices over £100,000. There were 10 PO invoices and 10 non-PO invoices checked. There were 2 non-PO invoices where the authorised signatory was copied into the email to AP for processing rather than AP being provided with explicit approval from the authorised signatory. (action c) Payments to Employees Testing 3.8 The auditor tested for sundry payments to employees. This testing found a £7,000 payment was made to an employee for an Alcohol and Drugs Partnership (ADP) grant for 2024/25 instead of being paid to the Irvine Youth Legacy Centre. The employee took corrective action the same day the money was received by transferring the £7,000 to the group’s bank account as evidenced by the bank statements provided. 3.9 The auditor investigated the circumstances which resulted in such a payment being made. The proper process was not followed by the ADP team within HSCP as the sundry payment request form was sent to AP without any evidence of bank details. AP contacted the (ADP) team to request the missing evidence. On receipt of the evidence, AP did not carry out a check on bank details in line with their process, as the payment was processed even though the bank details on the sundry payment request form differed from the bank statement provided as evidence. If the ADP team and the AP team had carried out checks on the bank details in line with their individual processes, this error would have been avoided. (action d) 3.10 The employee, who works in a different team within the HSCP and volunteers with this group, was asked by the ADP team to complete the details of payment section on the sundry payment request form which includes the bank details. The employee was unable to explain why they completed their personal bank details instead of the groups bank details. In addition, the employee did not notify the ADP team of this error and the corrective action taken.
Page 34
3.11 The Lead Officer (ADP) confirmed that the ADP team has been advised to return to sending out a form for organisations to complete their bank details, which will be used by the ADP team to complete the sundry payment request form independently of the organisation. 3.12 The auditor found an employee on sick leave with the Council but still receiving payments as a supplier on Integra for providing a service. This has been passed to the Service to investigate further. The Service has also been advised to take action to ensure the employee’s declared interest is properly recorded in line with the Employee Code of Conduct. Procurement Card Testing 3.13 The procurement card report listed 19,110 transactions between 1 July 2024 and 30th April 2025. As at 13th May 2025, there were 142 card transactions totalling £11,966.95 that had not been reviewed or approved and there were 180 card transactions totalling £15,017.23 that had been reviewed but not approved. As per the procurement card policy and procedure, all transactions must be reviewed and approved by 28th of each month and must be checked 48 hours after to ensure all transactions are reviewed and approved before the statement is paid. (action e) 3.14 The card transactions not reviewed and approved have been analysed by Service. Service Number of Cardholders Number of Card Transactions Communities & Housing 8 46 Corporate Service 3 5 Education 13 43 HSCP 14 37 Place 4 11 TOTALS 42 142 The card transactions reviewed but not approved have been analysed by Service. Service Number of Cardholders Number of Card Transactions Communities & Housing 10 37 Corporate Service 1 1 Education 17 45 HSCP 15 92 Place 3 5 TOTALS 46 180 3.15 There are 6 users that are cardholders and approvers, which agreed to the list held by e-Procurement. Transactions by users with this dual role were checked and there were no findings to note. There are small number of exceptions which require a user to have dual roles and a valid reason for this needs to be provided. 3.16 There were 3 transactions reviewed and approved by the same user although the cardholder was different. E-Procurement confirmed that an email was sent to the user
Page 35
reminding them that transactions should not be reviewed and approved by the same person and there have been no further instances since the reminder email. 3.17 The auditor tested for potential duplicate card transactions. There was a duplicate transaction for £244.12, and the cardholder is contacting the supplier to arrange a refund. There was a duplicate transaction for £147.02, and the cardholder is liaising with the supplier to arrange a refund. 3.18 There were 7 cardholders with transactions above their single transaction limit when compared to the user information report provided by e-Procurement. Further investigation showed that the single transaction limit was higher on SDOL which meant no transactions were made above the single transaction limit. However, the user information report maintained by e-Procurement had not been updated when the procurement card limit amendment e-form was received. E-Procurement has since updated the e-form to include a checkbox to update the user information report to reduce the risk of this happening again. 3.19 There was a cardholder with 1 transaction above the e-Procurement single transaction limit however when SDOL was checked we found that the user had an unlimited single transaction limit, which is the default amount set by the Royal Bank of Scotland when processing a card application (unless otherwise specified). This should have been manually change by e-Procurement as part of the new cardholder process. Although the single transaction limit was not changed at this time, the monthly limit was set to £5,000. This was immediately rectified, and e-Procurement checked all single card transaction limits on SDOL and confirmed that no other cardholder has an unlimited limit. 3.20 The auditor tested for instances of orders being split to bring the purchase below the single transaction limit which is against the procurement card policy and procedure. The auditor found 9 instances where this has happened and related to 6 different cardholders. The cardholders have been contacted and been advised to speak to their line manager to review their single transaction limit or to request a temporary increase to allow for the purchase of one-off high value orders. (action f) 3.21 The auditor noted that £3,336.06 card transactions paid to Amazon were not purchased via an Amazon Business account; however, Procurement advised that Amazon monitors this and contacts users to request they join the Business account. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the controls around the processing of invoices and card payments. Although a number of findings were identified during the audit, the financial impact of these is not material when compared to the total number and overall value of transactions.
Page 36
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 37
KEY FINDINGS AND ACTION PLAN ACCOUNTS PAYABLE TRANSACTION TESTING Action a Finding Testing was carried out to identify duplicate trade suppliers on Integra. Testing identified 43 duplicate suppliers either by name or bank details. These were passed to the AP team to review and deactivate as appropriate. Action Description The AP team should review the list of duplicate suppliers and deactivate suppliers as appropriate. The AP team should be reminded to check if the supplier is already on the system before they are added again. Risk Duplicate invoices may be paid to the same supplier via different supplier numbers. Priority (1, 2, 3) 1 Paragraph Reference 3.1 Managed by Head of Service (People & ICT) Assigned to Team Manager (Customer Services) Due Date 31/12/2025 Management Comment AP team will review the list and deactivate duplicate suppliers identified. Action b Finding Duplicate testing identified 14 potential duplicate invoices totalling £162,301.71 which had not already been identified by the AP team. The potential duplicates have been passed to the AP team to check and arrange recovery. Action Description The AP team should review the potential duplicate payments and arrange for recovery of monies paid twice. Risk The Council has paid the same invoice twice and the money has not been recovered. Priority (1, 2, 3) 1 Paragraph Reference 3.2 Managed by Head of Service (People & ICT) Assigned to Team Manager (Customer Services) Due Date 28/02/2026 Management Comment AP team will review the list of duplicate invoices and take necessary action to recover these from suppliers. Action c Finding Approval testing found 4 non-PO invoices where the authorised signatory was copied into the email to AP for processing rather than AP being provided with explicit approval from the authorised signatory. Action Description AP should advise all approvers that they must specifically state within the email to AP that they approve an invoice for payment. The AP team should be advised only to accept emails with explicit approval from the authorised signatory and should not accept instances where the approver is copied into the email. Risk Authorised signatory may not check email before payment is made resulting in an unauthorised payment; lack of proper audit trail for the approval of invoices. Priority (1, 2, 3) 1 Paragraph Reference 3.6, 3.7
Page 38
Managed by Head of Service (People & ICT) Assigned to Senior Manager (Customer Services) Due Date Complete Management Comment AP have now implemented a new process which states that an email must be sent directly from the approving manager authorising payment. An email has been issued to all services advising payment will not be processed until this has been received. Action d Finding The auditor investigated the circumstances which resulted in an ADP grant being paid to an employee instead of being paid to the Irvine Youth Legacy Centre, which the employee volunteers with. The proper process was not followed by the ADP team within HSCP as the sundry payment request form was sent to AP without any evidence of bank details. AP contacted the ADP team to request the missing evidence. On receipt of the evidence, AP did not carry out a check on bank details in line with their process, as the payment was processed even though the bank details on the sundry payment request form differed from the bank statement provided as evidence. If the ADP team and the AP team had carried out checks on the bank details in line with their individual processes, this error would have been avoided. Action Description The AP team should be reminded to check evidence of bank details provided matches bank details on the sundry payment request form. Risk Payment is made to the incorrect recipient which may not be recoverable. Priority (1, 2, 3) 2 Paragraph Reference 3.9 Managed by Head of Service (People & ICT) Assigned to Senior Manager (Customer Services) Due Date Complete Management Comment AP team have put in additional checks to tighten up this area and ensure bank details are correct before payment is processed. Action e Finding The procurement card report listed all transactions up to 30th April 2025. As at 13th May 2025, there were 132 card transactions totalling £11,966.95 that had not been reviewed or approved and there were 174 card transactions totalling £15,017.23 that had been reviewed but not approved. As per the procurement card policy and procedure, all transactions must be reviewed and approved by 28th of each month and must be checked 48 hours after to ensure all transactions are reviewed and approved before the statement is paid. Action Description Cardholders and approvers should be reminded to review and approve transactions by the 28th of each month in line with the Procurement Card Policy and Procedure. There should be an escalation process in place if transactions continue not to be reviewed and approved. Risk Purchases are paid before they have been reviewed and approved. Delayed transfer of transactions to the general ledger which impacts budget monitoring.
Page 39
Priority (1, 2, 3) 2 Paragraph Reference 3.13 Managed by Head of Service (People & ICT) Assigned to Senior Manager (Customer Services) Due Date Complete Management Comment A system generated email is currently issued 3 times per week to all SDOL users to remind them to review and approved transactions. A quarterly report is issued to Senior Managers which highlights those that are outstanding for action. Emails issued advise that access will be removed from users who are persistently late in reviewing / approving. Action f Finding The auditor tested for instances of orders being split to bring the purchase below the single transaction limit which is against the procurement card policy and procedure. The auditor found 9 instances where this has happened and related to 6 different cardholders. The cardholders have been contacted and been advised to speak to their line manager to review their single transaction limit or to request a temporary increase to allow for the purchase of one-off high value orders. Action Description e-Procurement should issue a reminder to cardholders that transactions should not split to bring the purchase below the single transaction limit which is against the procurement card policy and procedure. If such cardholders need the single limit to be amended, the cardholder should complete the amend a limit form and get the appropriate approval for such a change. Risk Non-compliance with the procurement card policy and procedure; circumventing authorised limit. Priority (1, 2, 3) 2 Paragraph Reference 3.20 Managed by Head of Service (People & ICT) Assigned to Senior Manager (Customer Services) Due Date Complete Management Comment Further to the last audit where this same issue was picked up and an email issued to users to remind them that this is against the policy, another reminder email has been issued. Staff across services are responsible for ensuring that they comply with the policy.
Page 40
Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.