Agenda Document Pack - Audit and Scrutiny Committee - 20/11/2025
North Ayrshire Council · 20 November 2025
Back to Audit and Scrutiny Committee — 20 November 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Ayrshire Council, Cunninghame House, Irvine KA12 8EE Audit and Scrutiny Committee A Meeting of the Audit and Scrutiny Committee of North Ayrshire Council will be held in the Council Chambers, Ground Floor, Cunninghame House, Irvine, KA12 8EE on Thursday, 20 November 2025 at 10:00 to consider the undernoted business. Meeting Arrangements - Hybrid Meetings This meeting will be held on a predominantly physical basis but with provision, by prior notification, for remote attendance by Elected Members in accordance with the provisions of the Local Government (Scotland) Act 2003. Where possible, the meeting will be live-streamed and available to view at https://north-ayrshire.public- i.tv/core/portal/home. 1 Declarations of Interest Members are requested to give notice of any declarations of interest in respect of items of business on the Agenda. 2 Minutes The accuracy of (a) the Minutes of the Meeting of the Audit and Scrutiny Committee held on 28 August 2025 and (b) the Minutes of the Special Meeting of the Audit and Scrutiny Committee held on 23 September 2025 will be confirmed and the Minutes signed in accordance with Paragraph 7 (1) of Schedule 7 of the Local Government (Scotland) Act 1973 (copy enclosed). 3 Audit and Scrutiny Committee Self-Evaluation 2025 Submit report by the Head of Democratic Services to report on the outcome of the annual self-evaluation of the Audit & Scrutiny Committee (copy enclosed). 4 Corporate Fraud Team Mid-Year Update Submit report by the Head of Finance to provide an update on the work of the Corporate Fraud Team between April and September 2025 (copy enclosed). 1
Page 2
North Ayrshire Council, Cunninghame House, Irvine KA12 8EE 5 Internal Audit and Corporate Fraud Action Plans : Quarter 2 Update Submit report by the Head of Finance to advise on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 30 September 2025 (copy enclosed). 6 Internal Audit Plan 2025/26 : Mid-Year Update Submit report by the Head of Finance to advise on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 30 September 2025 (copy enclosed). 7 Strategic Risk Register 2025/26 : Mid-year Update Submit report by the Head of Finance to provide an update on the progress with actions related to the Strategic Risk Register (copy enclosed). 8 IJB Annual Report 2024/25 and Audit Plan 2025/26 Submit report by the Head of Finance to inform of the IJB’s annual report for 2024/25 and the approved internal audit plan for 2025/26 (copy enclosed). 9 Internal Audit Reports Issued Submit report by the Head of Finance to inform the Committee of the findings of Internal Audit work completed since August 2025 (copy enclosed). 10 Standing Item of Business: Consideration of future business for scrutiny 11 Urgent Items Any other items which the Chair considers to be urgent. Exclusion of the Public - Para 1 Resolve in terms of Section 50(A)4 of the Local Government (Scotland) Act 1973, to exclude from the Meeting the press and the public for the following item of business on the grounds indicated in terms of Paragraph 1 of Part 1 of Schedule 7A of the Act. Non Disclosure of Information In terms of Standing Order 21 (Disclosure of Information), the information contained within the following report is confidential information within the meaning of Section 50A of the 1973 Act and shall not be disclosed to any person by any Member or Officer. 12 Internal Audit Reports Issued Submit report by the Head of Finance to inform the Committee of the findings of Internal Audit work completed since August 2025. 2
Page 3
North Ayrshire Council, Cunninghame House, Irvine KA12 8EE Webcasting Please note: this meeting may be filmed/recorded/live-streamed to the Council's internet site and available to view at https://north-ayrshire.public- i.tv/core/portal/home, where it will be capable of repeated viewing. At the start of the meeting, the Provost/Chair will confirm if all or part of the meeting is being filmed/recorded/live-streamed. You should be aware that the Council is a Data Controller under the Data Protection Act 2018. Data collected during the webcast will be retained in accordance with the Council’s published policy, including, but not limited to, for the purpose of keeping historical records and making those records available via the Council’s internet site. Generally, the press and public will not be filmed. However, by entering the Council Chambers and using the press or public seating area, you acknowledge that you may be filmed and that any information pertaining to you contained in the video and oral recording of the meeting will be used for webcasting or training purposes and for the purpose of keeping historical records and making those records available to the public. In making this use of your information the Council is processing data which is necessary for the performance of a task carried out in the public interest. If you have any queries regarding this and, in particular, if you believe that use and/or storage of any particular information would cause, or be likely to cause, substantial damage or distress to any individual, please contact dataprotectionofficer@north-ayrshire.gov.uk 3
Page 4
North Ayrshire Council, Cunninghame House, Irvine KA12 8EE Audit and Scrutiny Committee Sederunt John Bell (Chair) Donald Reid (Vice Chair) Eleanor Collier Cameron Inglis Tom Marshall Matthew McLean Davina McTiernan Donald L. Reid John Sweeney Chair: Apologies: Attending: 4
Page 5
Audit and Scrutiny Committee 28 August 2025 At a Meeting of the Audit and Scrutiny Committee of North Ayrshire Council at 2.00 p.m. involving participation by remote electronic means and physical attendance within the Council Chambers, Irvine. Present (Physical Participation) John Bell, Eleanor Collier, Cameron Inglis and Donald L. Reid. Present (Remote Participation) Davina McTiernan In Attendance (Physical Participation) R. McCutcheon, Executive Director (Place); M. Boyd, Head of Service, J. McCallum, Senior Manager (Audit, Fraud, Safety and Risk) (Finance); F. Walker, Head of Service (People and ICT); R. Leith, Head of Service (Connected Communities); A. McClelland, Head of Service (Education); E. Currie, Principal Manager (Finance) (Health and Social Care Partnership); Raymond Lynch, Senior Manager (Legal Services), C. Cheung, Digital, Media and Marketing Analyst (Communications) and H. Young, Senior Committee Services Officer (Democratic Services) (Corporate Services). Chair Councillor Bell in the Chair. Apologies Tom Marshall and John Sweeney. Due to a technical issue with the remote meeting platform, Councillor McTiernan was unable to participate in meeting. 1. Declarations of Interest There were no declarations of interest by Members in terms of Standing Order 11 and Section 5 of the Code of Conduct for Councillors. 2. Minutes The accuracy of the Minutes of (a) the Meeting of the Audit and Scrutiny Committee held on 29 May 2025 and (b) the Special Meeting of the Audit and Scrutiny Committee held on 19 June 2025 will be confirmed and the Minutes signed in accordance with Paragraph 7 (1) of Schedule 7 of the Local Government (Scotland) Act 1973. 3. 2024/25 Elected Member Requests Report Submitted report by the Head of Democratic Services informing of the Council's performance relating to Elected Member requests handled in Financial Year 2024/25. Agenda Item 2 5
Page 6
Officers responded to Members’ questions and the Committee agreed to note the report and the information provided. 4. 2024/25 Complaint Report Submitted report by the Head of Democratic Services informing of the Council's complaint performance and volumes and trends of complaints received in Financial Year 2024/25. The North Ayrshire Council Annual Complaint Report 2024 to 2025 was attached at Appendix 1 to the report. Officers responded to Members’ questions and the Committee agreed to note the report and the information provided. 5. Elected Member Development Submitted report by the Head of Democratic Services providing information and seeking views on the development sessions provided to Elected Members over the 12 months from September 2024 to August 2025, and on future planned development sessions. Officers responded to Members’ questions and the Committee noted the report and provided feedback (a) on the Elected Member Development sessions held in the period September 2024 to August 2025; (b) on means to support Elected Member attendance; (c) on how future programmes might be improved; (d) the future development sessions scheduled to date; and (e) to suggest additional topics for the next year. 6. Accounts Commission’s Briefing: Local Government Budgets 2025/26 Submitted report by the Head of Finance informing of the key messages identified within the recently published briefing. The Local Government Budgets 2025/26 was attached at Appendix 1 to the report. Officers responded to Members’ questions and the Committee noted (a) the key messages within the recent Accounts Commission briefing; and (b) the current position of North Ayrshire Council in relation to the key messages. 7. Internal Audits Reports Issued Submitted report by the Head of Finance informing of the findings of Internal Audit work completed since May 2025. Officers responded to Members’ questions and the Committee noted the outcomes from the Internal Audit work completed. 8. Internal Audit and Corporate Fraud Action Plans: Quarter 1 Update Submitted report by the Head of Finance advising on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 30 June 2025. Agenda Item 2 6
Page 7
Officers responded to Members’ questions and the Committee agreed to (a) note the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenge those Services that have not implemented actions within the previously agreed timescales. 9. Urgent Items There were no urgent items. Exclusion of the Public - Para 1 Resolve in terms of Section 50(A)4 of the Local Government (Scotland) Act1973, to exclude from the Meeting the press and the public for the following item of business on the grounds indicated in terms of Paragraph 1 of Part1 of Schedule 7A of the Act. Non Disclosure of Information In terms of Standing Order 21 (Disclosure of Information), the information contained within the following report is confidential information within the meaning of Section 50A of the 1973 Act and shall not be disclosed to any person by any Member or Officer. 10. Investigation Reports Issued Submitted report by the Head of Finance informing of investigation reports finalised since the last meeting. Officers responded to Members’ questions and the Committee agreed to (a) note the outcomes from the investigations carried out. The meeting ended at 11:25 a.m. The full meeting proceedings can be viewed at https://north-ayrshire.public-i.tv/core/portal/home Agenda Item 2 7
Page 8
Audit and Scrutiny Committee 23 September 2025 At a Special Meeting of the Audit and Scrutiny Committee of North Ayrshire Council at 10.00 a.m. within the Council Chambers, Irvine. Present John Bell, Eleanor Collier, Davina McTiernan, Donald L. Reid and John Sweeney. In Attendance D. Hammond, Executive Director; Y. Baulk, Head of Housing and Public Protection; and K. Henderson, Team Manager (Business Planning) (Housing and Public Protection) (Communities and Housing); M. Boyd, Head of Finance, D. Forbes, Senior Manager (Strategic Business Partner); and N. Graham, Team Manager (Financial Management and Revenues) (Finance); F. Walker, Head of People and ICT; R. Lynch, Senior Manager (Legal), S. Wilson, Committee Services Officer, and M. Sugden, Communications Officer (Media and Internal Communications) (Democratic Services) (Corporate Services). Also in Attendance F.M. Knight and D. Jamieson, Audit Scotland. Chair Councillor Bell in the Chair. Apologies Tom Marshall 1. Declarations of Interest There were no declarations of interest by Members in terms of Standing Order 11 and Section 5 of the Code of Conduct for Councillors 2. Annual Assurance Statement to the Scottish Housing Regulator 2024/25 Submitted report by the Executive Director (Communities and Housing) advising of the Council’s Annual Return on the Charter 2024/25 submission and seeking approval for its submission to the Scottish Housing Regulator. The North Ayrshire Council Annual Assurance Statement 2024/25 (unsigned), Supporting evidence document 2024/25 and Data corrections spreadsheet - North Ayrshire Council - 2023/24 were attached at Appendices 1-3, respectively, to the report. Officers responded to Members’ questions and the Committee agreed to (a) note (i) the Annual Return on the Charter submission 2024/25, (ii) the supporting evidence provided to demonstrate compliance with the regulatory framework and relevant legislation, (iii) the Council’s areas of non- compliance detailed at paragraphs 2.26- 2.30 and (iv) the amendments which have been made to the Annual Return on the Charter 2023/24 and submitted to the Scottish Housing Regulator; and (b) authorise the Chair to sign the Annual Assurance Statement 2024/25 attached at Appendix 1 to the report, for submission to the Scottish Housing Regulator. Agenda Item 2 8
Page 9
3. Our Council Plan Year End Progress Reporting including LGBF Analysis Submitted a report by the Head of Democratic Services for consideration and approval of Our Council Plan Year End Progress Reporting including LGBF Analysis. The Local Government Benchmarking Framework (LGBF) - Analysis of June 2025 Data Release, the six-monthly Council Plan 2023-28 Progress Update, Year End 2024/25 and the Annual Performance Report 2024/25 were attached at Appendices 1-3, respectively, to the report. The Chair requested a further report on the process for gathering data in terms of young people’s developmental milestones and the Service's action plan to assist those who are not meeting these milestones be brought to a future meeting of the Audit and Scrutiny Committee. Further information was requested regarding Education performance, whether there is a link between positive destinations and claimant count, Business Gateway start- ups performance relative to other local authorities and the relatively low numbers of people being supported into employment. Officers responded to Members’ questions and the Committee agreed to (a) note (i) progress within the LGBF Report as at June 2025 attached at Appendix 1 to the report, and (ii) that Cabinet approval related to the content of the report, not the layout or media used to ensure future flexibility for production of accessible format reports; and (b) note (i) Our Council Plan Six Monthly Progress Report 1 October to 31 March 2025 attached at Appendix 2 to the report, and (ii) Our Council Plan Annual Performance Report attached at Appendix 3 to the report. 4. External Audit Report on the 2024/25 Audit and Best Value Work Submitted report by the Head of Finance on the Annual Audit and Best Value report for 2024/25 and to consider the verbal report by the external auditor. Appendix 1 to the report included letters of representation to be signed by the Head of Finance as the responsible officer for North Ayrshire Council. The External Auditor’s report, which summarised the findings of their audit, was attached as Appendix 2 to the report. Fiona Mitchell-Knight and David Jamieson of Audit Scotland provided a verbal report on the appendices to the report, including highlighting key aspects in relation to the findings of their audit, and also responded to Members’ questions in relation to their report. Officers responded to Members’ questions and the Committee agreed to (a) note (i) the findings of the 2024/25 audit of the financial statements as contained in the external auditor’s Annual Audit Report at Appendix 2 to the officer’s report, (ii) the agreed Action Plans as outlined in Appendix 1 to the Report; and (b) approve the audited Annual Accounts for signature. Councillor Bell, Chair, thanked the Head of Finance and his team, along with the external audit team, for all their hard work and diligence in terms of this year’s audit process. Agenda Item 2 9
Page 10
The meeting ended at 10.50 a.m. The full meeting proceedings can be viewed at https://north-ayrshire.public-i.tv/core/portal/home Agenda Item 2 10
Page 11
NORTH AYRSHIRE COUNCIL 20 November 2025 Audit and Scrutiny Committee Title: Audit and Scrutiny Committee Self-Evaluation 2025 Purpose: To report on the outcome of the annual self-evaluation of the Audit and Scrutiny Committee. Recommendation: That the Committee (a) notes the findings of the self-evaluation, as set out at Appendix 1; and (b) agrees to repeat the self- evaluation exercise on an annual basis. 1. Executive Summary 1.1 The Audit and Scrutiny Committee’s self-assessment process for the financial year 24/25 which was undertaken on 29th October 2025. 1.2 The findings of the self-evaluation are set out at Appendix 1. 2. Background 2.1 Self-evaluation assessment forms part of the standard operating procedures of the Audit & Scrutiny Committee. 2.2 The current evaluation form is based on the CIPFA publication “Audit Committees: Practical Guidance for Local Authorities and Police – 2022 Edition”, with the evaluation carried out with specific reference to Appendix E “Self Assessment of Good Practice”. The checklist was added to, in order to ensure coverage of the scrutiny element as this relates to the remit of the Audit and Scrutiny Committee. Prior to the next self-evaluation exercise, the evaluation form will be further reviewed to remove elements of duplication and will be further informed by best practice. 2.3 The self-evaluation toolkit set out at Appendix 1 comprises 52 questions covering all aspects of the committee’s work under the broad headings of: • Audit Committee Purpose and Governance • Functions of the Committee • Membership and Support • Effectiveness of the Committee Agenda Item 3 11
Page 12
2.4 Members of the Audit and Scrutiny Committee were invited to consider the self- evaluation questions independently in the first instance, before coming together for a discussion session, facilitated by the Head of Service (Democratic) on 29th October 2025. 2.5 Appendix 1 to the report sets out the outcome of the discussion sessions, in terms of collating consensus responses to the toolkit questions. 3. Proposals 3.1 It is proposed that the Committee (a) notes the findings of the self-evaluation, as set out at Appendix 1; and (b) agrees to repeat the self-evaluation exercise on an annual basis. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 Sustainable Council. The self-evaluation process ensures review of the operation of the main scrutiny committee within the Council for assurance that there are robust arrangements in place for ensuring proper governance and risk management. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. Agenda Item 3 12
Page 13
United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 All Members of the Audit and Scrutiny Committee were invited to contribute to the self- evaluation. Aileen Craig Head of Service (Democratic) For further information please contact Aileen Craig, Head of Service (Democratic), on 01294 324125. Background Papers None Agenda Item 3 13
Page 14
1 Audit and Scrutiny Committee Self-Evaluation 2025 Appendix 1 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions Role of Audit & Scrutiny Cttee Members 1. Does the committee have written terms of reference which are subject to periodic review? X The terms of reference are set out in the Council’s Scheme of Administration (SOA), which is subject to annual review by the Council. 2. Is the role and purpose of the committee understood and accepted across the Council? X The SOA forms part of the Elected Member induction programme for new Members. The SOA is published on the Council’s website and is accessible to Members, officers and the public. 3. Do the committee members clearly understand their roles and responsibilities? X The SOA forms part of the Elected Member induction programme. Members have exhibited a keen awareness of their role as Committee Members. 4. Do committee members bring an independent mindset to their role? X No party whip has been declared at any meetings of the committee and its members are able to bring an independent mindset to their role. 5. Does the composition of the committee adequately reflect the political make-up of the Council? Are the majority of its members from outwith the Administration? X The committee comprises 7 Members: 3 from the main Labour Opposition Group, 2 from the Conservative Group,1 from the Reform UK Group, 1 Independent Member and 2 from the minority SNP Administration. The latter are not members of the Cabinet. The membership reflects the political make-up of the Council, with a majority of Members coming from outwith the Administration. Agenda Item 3 14
Page 15
2 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 6. Is the committee’s remit clearly defined in respect of the following? • performance • value for money • good governance • assurance • risk management and internal control • internal audit • external audit • financial reporting • scrutiny X All of the elements mentioned are included within the committee’s terms of reference, as set out in the Scheme of Administration. Skills and Expertise 7. Is an induction programme provided for new committee members, covering the role of the committee, its terms of reference and the key risk and issues facing the Council, as well as specialised areas such as treasury management? X New Members receive a full induction programme which includes the remit of the Audit and Scrutiny Committee. Additional training is also available on specific areas such as cyber security. A number of other relevant topics are delivered to all Members as part of the wider training and development programme. Further external training through the Improvement Service is being considered. Agenda Item 3 15
Page 16
3 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 8. Are the ongoing training requirements of committee members agreed each year according to their specific needs and developments arising? X Members have the opportunity to undertake a PPD exercise annually to identify training and development needs. There is also scope for Members to participate in 360-degree appraisal, as well as one-to-one feedback. The Committee also receives an annual report on Member training which reviews past training, consults on ways to improve and looks for suggestions for any necessary training. 9. Do members feel they can request training if they consider this would help them in their role? X Members have the opportunity to undertake a PPD exercise annually to identify training and development needs. There is also scope for Members to participate in 360-degree appraisal, as well as one-to-one feedback. In addition, Members can contact the Monitoring Officer or s95 Officer for any specific assistance they require. The Committee also receives an annual report on Member training which reviews past training, consults on ways to improve and looks for suggestions for any necessary training. Agenda Item 3 16
Page 17
4 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 10. Does the Chair have appropriate knowledge and skills? X The Chair is the Depute Leader of the Labour Group and is experienced in chairing this and other meetings. Members of the committee agree that he is knowledgeable and capable in his role as Chair. Behavioural and Operational Aspects 11. Is the number of meetings sufficient to meet the committee’s role and responsibilities (and not fewer than three per year)? X Five ordinary meetings a year are scheduled and there is provision for Special Meetings to be arranged, as required to consider call in requests and to allow more time to consider performance reporting. Over the previous year a number of Special Meetings have been arranged to consider Call-in requests and petitions. 12. Are committee meetings scheduled in good time in respect of important decisions and financial deadlines? And are the meetings are held to coincide with key dates within the financial reporting and audit cycle? Is there are clear plan for the year to ensure all matters within the committee’s remit are covered? X The calendar of meetings is agreed following consultation with officers and Members, and to accord with key audit dates. The forward planner of committee business ensures that business is scheduled appropriately. In instances where the volume of business is likely to be onerous, there is provision to arrange additional meetings. Following an improvement action identified in 2019, meetings are no longer scheduled in the same week as a Council meeting. This ensures that Members have time to fully consider the reports before the Committee. Agenda Item 3 17
Page 18
5 13. Does the Agenda allow for flexibility, or for further meetings to be held where appropriate, should the committee need to spend additional time on issues? X Yes. See above. 14. Are meetings of the committee well- attended, with the majority of committee members present at each meeting? X Attendance levels since the start of the current Administration range from 67-100% 15. Are all the committee members fully engaged and participative in meeting discussions? Do members participate in active discussion and debate around key agenda items, with appropriate contribution from each member? Do members ask questions, including ‘tough’ questions? X Members of the committee proactively engage and ask questions of officers and others attending the committee, and can ask for further clarification or reports, as required. All Members of the Committee are fully engaged with the remit of the Committee. 16. Has each committee member declared their business interests? Is the register of interests checked on a regular basis? Is the register easily accessible? X Members have declared their business interests, which are published on the Council’s website. A quarterly reminder to update the register of interests is issued. Agenda Item 3 18
Page 19
6 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 17. Does the committee have good working relations with key people and organisations, including external audit, internal audit and the chief financial officer? X The committee has a positive and constructive relationship with officers of the Council and the Council’s external auditors. Both attend committee to present their reports and are available to meet with the Chair outwith meetings. This has been recognised as a strength. 18. Does the committee hold periodic private discussions with the chief internal auditor and also with the external auditor? X Discussion with the internal and external auditors take place. These discussions tend to be in public, in the course of committee meetings. In addition, however, the Chair holds Pre-Agenda meetings with officers in private and there is also provision for the chief internal auditor to meet with the Chair if required. 19. Does the committee have clear criteria for assessing its effectiveness to inform their annual assessment? X The current self-evaluation process offers an opportunity and mechanism for the committee to assess its effectiveness. Given the level of business before the Committee in the financial year 24/25 and the positive way in which all Members were engaging with the Committee an evaluation was not undertaken. The exercise will now take place on an annual basis as was previous practice with the exception of the first year of an Administration where time is required to enable the Committee to gain experience. Agenda Item 3 19
Page 20
7 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions Information and Support 20. Do the clerking arrangements for the committee ensure that the members’ time is used effectively? For example: • is there a good reason for each item being on the agenda? • are all papers circulated sufficiently in advance (and none tabled) and distributed in sufficient time for members to give them due consideration? • do the reports prepared for the audit committee members make it clear what they are being asked to do/agree? X The draft Agenda is discussed in detail with the Chair/Vice-Chair at a Pre-Agenda meeting and the finalised Agenda then issued at least three clear days prior to the meeting. Papers are circulated in advance of the meeting as part of the Agenda. The standard report template includes sections setting out the proposals and detailed recommendations. 21. Does the committee have a mechanism to keep it aware of topical legal and regulatory issues and institutional developments, for example, by receiving circulars, training or briefing papers? Is the committee briefed on significant changes? X The committee can receive ad hoc briefings and updates in respect of topical matters. Agenda Item 3 20
Page 21
8 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 22. Do the committee members receive reports that are comprehensive but concise and tailored to their needs? Is the information they receive robust and objective? X The volume of business considered can be extensive. However, the format of reporting keeps the reports as concise as possible, with key points highlighted and further information provided via appendices/links to external material/reference to background papers. The provision of electronic Agendas (with Search functionality) has assisted in ensuring that Members have the salient information and as well as access to further reading. The appendices to some performance reports are, by necessity, lengthy, although the covering report does identify key messages and highlights. 23. Are Minutes taken and appropriately circulated to all committee members in a timely manner, with actions arising noted and their resolution tracked? X Minutes include the purpose of the report, the committee’s decision and how it is to be implemented. Committee Services publish the Minute within five working days of the meeting and Members receive an electronic link to the Minute. The recorded meeting is also available on the website for reference which contains the full detail of the discussion rather than simply a minute. Committee Services issue action notes to officers responsible for implementation as well as reminders about outstanding actions. A summary of overdue actions is also sent periodically to Executive Directors and Heads of Service. Agenda Item 3 21
Page 22
9 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions Activities and Functions: Performance 24. Does the committee receive regular detailed reports on the performance of services? X Council Plan progress reports are submitted annually and detailed reports on Service performance are considered twice yearly. 25. Is the committee involved in setting the strategy for performance review? X The committee does review performance, but it is the Council as a whole which takes responsibility for setting the strategy via the Council Plan. Any concerns may, however, be raised via the committee. Activities and Functions: Governance 26. Does the committee provide support to the Council in meeting the requirements of good governance? X The committee receives an annual Governance Statement prepared by the Senior Manager (Internal Audit, Risk and Fraud) and is able to question/challenge its contents. The Code of Corporate Governance prepared by the Head of Democratic Services is also prepared on an annual basis. Ad hoc advice is provided to the Committee if required at the meeting by the relevant officers. 27. Does the committee oversee an assessment of the governance arrangements of the Council and advise on their effectiveness? X See above. 28. Does the committee consider reports and recommendations from external audit and regulators/agencies as appropriate and their implications for governance, risk management and control? X The committee does receive regular reports from the internal and external audit functions and wider regulatory and inspection agencies. Agenda Item 3 22
Page 23
10 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 29. Does the committee monitor arrangements for ensuring value for money and for managing exposure to the risk of fraud and corruption? X The committee receives regular reports on managing fraud and corruption, including an annual corporate fraud report, quarterly updates on corporate fraud action reports and regular reports on the outcome of investigations by Internal Audit and the Corporate Fraud team. 30. Does the committee scrutinise and challenge the finance committee (Cabinet) effectively? X The committee does hold the Cabinet to account, including via the call-in process. The committee has considered a number of call-in requests in the past year. The Committee has in previous years recommended to Cabinet, on occasion, that it reconsiders its decision. Agenda Item 3 23
Page 24
11 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 31. Is the committee’s role in relation to whistle blowing clear? Does the committee review the arrangements by which staff may, in confidence, raise concerns about possible improprieties in matters of financial reporting or other matters? X The Council has a whistle-blowing policy and updated March 2023 version is available online at northayrshirecouncil.sharepoint.com /sites/EmployeeConduct/Shared Documents/Forms/AllItems.aspx?id= %2Fsites%2FEmployeeConduct%2FS hared Documents%2FWhistleblowing Policy %26 Procedure%2Epdf&parent=%2Fsites %2FEmployeeConduct%2FShared Documents The committee, therefore, has assurance that the processes are in place. 32. Is the committee’s role in relation to the Council’s fraud and corruption procedures clear? X The committee receives regular reports on corporate fraud investigations undertaken by the Council’s internal audit function. It also receives a quarterly update on the implementation of actions identified as a result of investigations undertaken and is invited to challenge Services which have not implemented actions within the agreed timescales. Activities and Functions: Assurance 33. Does the committee seek to ensure that assurance is planned and delivered? X The Senior Manager (Internal Audit, Risk and Fraud) prepares an Annual Governance Statement which is included within the annual accounts and explains how the Council complies with the Code of Governance Framework. Agenda Item 3 24
Page 25
12 34. Does the committee understand what assurance is available to support the annual governance statement? X The Council’s internal audit service carry out specific audits on the Code of Corporate Governance every 3-4 years and the outcome is reported to the committee. Also the wider programme of Internal Audit work, as defined in the Annual Audit Plan, all feeds into the assurance available to support the AGS, as well as some other sources of assurance, most notably the work of External Audit. The output from Internal and External Audit’s work (i.e. audit reports) are presented to the committee at the next available meeting after publication 35. Does the committee seek clarity regarding what assurance is required? X Yes. 36. Does the committee gain assurance that the Council’s risk management, control and governance arrangements are adequate and effective? X Yes. See above. Activities and Functions: Risk Management 37. Does the committee keep risk management on its agenda throughout the year? X The committee receives an annual report on Strategic Risk Register together with a Mid-Year report. These are standard agenda items for the consideration of the committee. 38. Does the committee monitor how the Council assesses risk? Does it review the Council’s risk register on a regular basis? X The Cabinet approves the Council’s Risk Management Strategy. However, the committee does receive an annual report on the Risk Register and is able to question/challenge its contents. The committee receives reports on specific areas of risk, including cyber security. Agenda Item 3 25
Page 26
13 39. Is the nature, source, format and frequency of information on risk management and internal control submitted to the committee fit for purpose? X Yes. See above. 40. Is the committee aware of the Council’s cyber risk activity? Does it receive regular updates on management and mitigation of cyber risk? Has it received appropriate training to meet its responsibilities? X Updates on Cyber Security are provided. Members have also received specific briefings on cyber security. It is proposed that further ongoing IT Security Training and briefings are provided to Elected Members. Activities and Functions: Internal Audit 41. Does the committee monitor and review the effectiveness of internal audit? X The committee receives an annual audit report, together with reports on the outcome of audits and is, therefore, able to question the work of the team. The Chair also meets with the Senior Manager (Internal Audit, Risk and Fraud) out with the formal meeting at pre-agenda meetings or ad hoc as required. 42. Does the committee approve, annually and in detail, the internal audit strategic and annual plans? Does it ensure that the internal audit plan is aligned to the key risks of the business? X The committee approves the Internal Audit plan and agrees the indicators and targets set out in the report. 43. Does the committee consider the actions management have taken to implement the recommendations of internal audit? Are follow up audits by internal audit monitored by the committee? X Yes. These are the subject of quarterly reports. 44. Does the committee receive regular progress reports from the internal audit service summarising internal audit activity? X The committee receives regular reports on internal audit reports issued. These include the key findings of audits undertaken and the management response. There is also a mid-year update on progress delivering the Annual Audit Plan and the Annual Report reviewing the year’s work. Agenda Item 3 26
Page 27
14 45. Is the internal audit plan sufficiently flexible and dynamic to help identify and address new risks and promptly meet the emerging needs of the audit committee? X The indicative programme of work is reviewed each year and may change to reflect the priorities at that time. The plan always has a contingency of time set aside for flexibility such as emerging risks. Proposed changes to the plan may be brought to the Committee at the mid-year update. 46. How does the committee ensure that a professional relationship is maintained between internal and external audit? X The Chair can meet separately with internal and external audit representatives. 47. Does the committee review the adequacy of internal audit staffing and other resources? X The committee receives information on audit staffing as part of the audit plan and the audit annual report. 48. Does the committee, in conjunction with the internal audit service and management, have a role in establishing and maintaining appropriate performance indicators to measure the work of the internal audit service? X The annual audit plan which is reported to committee includes performance indicators. Activities and Functions: External Audit 49. Are follow up audits by external audit monitored by the committee? X The Committee receives progress reports on action plans arising from external audit. 50. Does the committee consider the adequacy of implementation of external audit recommendations? X The external auditors include in their current report information on the action which has been undertaken by the Council to implement recommendations from the previous audit and this is duly presented to the committee. Additional meetings with the external auditor can be arranged as required. 51. Do the external auditors present their audit plans and strategy to the committee for review? X The committee receives an annual report on the External Audit plan. 52. Does the committee assess the performance of external audit? X External auditors attend the committee to present their reports and are, therefore, open to questions and challenge. Agenda Item 3 27
Page 28
15 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 53. Is the committee clear regarding its role in the rare event of external audit qualifying the Council’s financial statements? X If the Council’s accounts were qualified, the committee would require a further report and would undertake a review of areas qualified to ensure adequate improvement actions had been put in place. Activities and Functions: Financial Reporting 54. Does the committee monitor the integrity of financial statements and announcements and review significant financial reporting judgements? X In addition to the reports initiated by officers, the committee may also raise any other significant matters. 55. Does the committee review the financial statements, external auditor’s opinion and reports to members, and monitor management action in response to the issues raised by external audit? X This information is presented to committee for consideration. 56. Does the committee consider significant accounting policies and any changes to them? Does it at least annually assess whether the Council has adopted appropriate accounting policies? X The committee approves Accounting Policies annually. 57. Does the committee consider whether the financial statements satisfy all statutory and regulatory requirements to which the Council is subject? X The external auditors annual report provides assurance on the financial statement’s compliance with all statutory and regulatory requirements. The committee is guided by the professional advice of the officers presenting these reports and is able to question/scrutinise as appropriate. Agenda Item 3 28
Page 29
16 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions Activities and Function: Scrutiny 58. Does the committee consider key matters of their own initiative rather than relying solely on the work of the internal/external auditor or responding to call-in requests? X There is a standing agenda item to enable Members to raise matters of their own volition for consideration at future meetings. The Committee has initiated over the period a number of requests for reports to scrutinise aspects of Council business. Over the financial year 24/25 the following reports were brought to the Committee at its own instigation: • the Community Asset Transfer process • the Council’s Climate Change target and associated policies • statistical data in respect of staffing levels and costs of the Council, by Department, over the last 3 years. • the nature of housing tenancies and fraud. • To receive a report on supplier and quality issues of purple bin lids and the replacement process. Agenda Item 3 29
Page 30
17 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 59. Does the committee agree an annual programme of scrutiny and review activity? X A number of standing reports are timetabled to the Audit & Scrutiny Committee as a matter of practice e.g. Complaints Report, Council Plan update and performance reports. The standing agenda item for other areas for scrutiny enables Members to bring forward any pertinent matters they wish to have addressed. 60. Does the committee have sufficient resources to undertake investigations or review work? X The committee has received an assurance that the necessary resources would be made available to it in order to conduct reviews. Review 61. Does the committee assess its performance and effectiveness on a regular basis? Do members assess how they could carry out their business more effectively, e.g. timetabling of business? X The committee conduct self- evaluation work See previous comment. 62. Are there KPIs in place against which committee members can assess their performance? X The committee does not consider that KPIs are necessary given that the external auditor’s interim and final reports, internal audit reports and best value reports provide necessary assurance. Agenda Item 3 30
Page 31
18 Area for focus? Performing as Expected? Special Strength? Evidence for assessment Improvement Actions 63. Has the committee evaluated whether and how it is adding value to the Council? X The committee has not sought to evaluate the value it adds to the Council. It is not clear how such an evaluation might be undertaken. 64. Does the committee produce an annual report and have an action plan to improve any areas of weakness? X The committee does not produce an annual report or action plan. Members consider that to do so would represent duplication, in that its Minutes set out all of the business which has been transacted and this information is placed in the public domain. 65. Has the committee obtained feedback on its performance from those interacting with the committee or relying on its work? X The committee has not formally sought feedback on its performance. Members feel it would be difficult to establish who would be surveyed and how the outcome might be usefully interpreted. For instance, a petitioner attending a meeting of the Audit and Scrutiny Committee to speak to their petition, or an Elected Member attending to present a call-in request, might be satisfied with the committee’s work if they achieve their desired outcome, but this in itself will not necessarily be an effective gauge of the committee’s effectiveness. Agenda Item 3 31
Page 32
Agenda Item 3 32
Page 33
NORTH AYRSHIRE COUNCIL 20 November 2025 Audit and Scrutiny Committee Title: Corporate Fraud Team: Mid-year Update Purpose: To provide the Audit and Scrutiny Committee with an update report on the work of the Corporate Fraud Team between April and September 2025. Recommendation: That the Committee notes the work carried out by the Corporate Fraud Team. 1. Executive Summary 1.1 The Corporate Fraud Team provides the Council with the capacity to investigate fraud both within and against the organisation. 1.2 Committee receives bi-annual updates on the work of the team. This report provides an overview of the activity of the team between April and September 2025. 2. Background Referrals 2.1 Referrals for investigation have been made to the team from a number of different sources, including Revenues and Benefits and Housing, members of the public and other agencies and local authorities. The publicity used by the team, including posters and leaflets, advertising on Council vans and contact information on the Council website, continues to be successful in generating a stream of referrals. 2.2 Investigations have been carried out across a range of areas including employee- related matters as well as Council Tax, Discretionary Housing Payments, Scottish Welfare Fund, Blue Badges and Housing tenancy issues. Although responsibility for investigating Housing Benefit fraud now lies with the DWP Single Fraud Investigation Service (SFIS), issues may be identified by the Corporate Fraud Team which can result in changes being made to benefits in payment. Joint working arrangements are in place with the DWP for cases where there are suspected frauds relating to both DWP benefits and Council Tax Reduction. 2.3 The team investigates all tenancy abandonments which are referred by Housing. While Housing focus on recovering the tenancy, the Corporate Fraud Team can add value by locating the missing tenant, which can often lead to changes to benefits or discounts in payment elsewhere, as well as enabling Housing to recover costs associated with house clearances and cleaning. Agenda Item 4 33
Page 34
2.4 Employee-related investigations are the subject of a separate report to the appropriate Service and the findings are also reported to the Audit and Scrutiny Committee as each investigation is finalised. Financial outcomes for April to September 2025 2.5 The team received 165 referrals for investigation during the first half of 2025/26 (2024/25: 162 referrals). Analysis of these referrals shows that 119 referrals were received from internal sources (e.g. internal & external colleagues, or a by-product from another case) and 46 from external sources (i.e. members of the public). 2.6 The team investigates 100% of referrals made. During the period, 155 cases were closed (2024/25: 191 cases). These can be categorised as follows: Category Number of Cases Closed with no issues identified 78 Referred to another agency (including SFIS) or Council Service for investigation 30 Closed with results achieved (fraud, error or other recovery/action) 47 TOTAL 155 2.7 Of the 155 referrals received, almost half of these (76) related to tenancy cases, with 69 cases of suspected abandonment, 1 relating to tenancy succession with 6 other housing related cases (including 3 referrals from the Private Sector Housing Team). 2.8 Fraud and error totalling £0.036m were identified and are categorised in the table below: Category Value (£000) Council Tax (including CTR, Single Person Discount and other recoveries) 6.5 Business Rates (including the recovery of arrears) 27 Other (including employee investigations) 2.5 TOTAL 36 Non-financial outcomes for April to September 2025 2.9 In addition to the financial outcomes noted above, other outcomes/benefits were noted as follows: • 23 tenancies were recovered by Housing with some assistance from the Corporate Fraud Team. • 8 blue badges were recovered and a further 4 warning letters were issued for blue badge misuse. 2 blue badge cases were reported to the Procurator Fiscal for prosecution. One badge was cancelled which was no longer required. 8 verbal warnings were also issued, where appropriate. • One employee investigation has been undertaken by the Corporate Fraud Team which resulted in a report with actions. This also included conduct / disciplinary issues. • 9 corrections and updates to records have been made to ensure record keeping is up to date. Agenda Item 4 34
Page 35
International Fraud Awareness Week 2.10 International Fraud Awareness Week (IFAW) takes place from 16 – 22 November 2025. This year awareness will be through the promotion and sharing of fraud related social media posts, from across the UK public sector. National Fraud Initiative (NFI) 2.11 The NFI is a long-established exercise which takes place across the UK every two years and involves the matching of relevant datasets across public bodies to identify possible fraud or error for further investigation. 2.12 The Corporate Fraud Team coordinates the exercise for the Council and the 2024/25 National Exercise is now underway. Data sets for the exercise were submitted to the Cabinet Office in the Autumn of 2024 and matches have been released at various points since December 2024 and throughout early 2025. 2.13 The matches received thus far have been passed out to services for review and this is progressing well. Services have until March 2026 to complete their review of these matches, and the Corporate Fraud Team will continue to monitor progress throughout the exercise. 2.14 Data was uploaded as part of the non-mandatory ReCheck exercise in January of 2025, with matches being released back almost instantly. The review of these matches is in progress. 2.15 Adult Social Care data has been the subject of a legislative reform order and will now be extracted from Council Systems at the end of October 2025 and uploaded to the Cabinet Office, which will generate a further match release. 2.16 Progress updates will be provided at future Audit and Scrutiny Committee meetings, with the final outcomes expected to be reported by Audit Scotland in Summer 2026. 3. Proposals 3.1 It is proposed that the Committee notes the work carried out by the Corporate Fraud Team. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Agenda Item 4 35
Page 36
Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of the Corporate Fraud Team helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 No consultation has been required in the preparation of this report. Mark Boyd Head of Service (Finance) For further information please contact Karen Gray, Team Manager (Corporate Fraud), on 01294 324594. Background Papers None. Agenda Item 4 36
Page 37
1 NORTH AYRSHIRE COUNCIL 20 November 2025 Audit and Scrutiny Committee Title: Internal Audit and Corporate Fraud Action Plans: Quarter 2 Update Purpose: To advise the Audit and Scrutiny Committee on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 30 September 2025. Recommendation: That the Committee notes the current position with the implementation of Internal Audit and Corporate Fraud actions. 1. Executive Summary 1.1 The CIPFA document 'Audit Committee Principles in Local Authorities in Scotland' highlights that Audit Committees should monitor and review the progress made in implementing audit recommendations. 1.2 Service managers are responsible for ensuring that agreed actions arising from Internal Audit and Corporate Fraud reviews are implemented. This provides assurance that identified control weaknesses have been addressed and are being managed effectively. 1.3 All actions are monitored on the Pentana system and service managers are responsible for updating Pentana as they progress each action. This enables Internal Audit to monitor progress on a 'real-time' basis and address any delays in implementation. 1.4 This report details the position as at 30 September 2025. 2. Background 2.1 The last report to the Audit and Scrutiny Committee on 28 August 2025 highlighted that there were 14 actions outstanding at the end of June 2025 and all but one actions had not yet passed their due date. 2.2 In addition to these 14 carried forward actions, there have been 19 new actions agreed, giving a total of 33 action points for review. 2.3 Services have completed 26 actions since the last report. All Council Services are required to retain evidence of work carried out in completing their actions Agenda Item 5 37
Page 38
2 and Internal Audit carries out 'spot-checks' on a sample of completed actions on an ongoing basis. 2.4 Of the remaining 7 actions, 3 were only partially completed as at 30 September 2025 and the remaining 4 actions were not due for completion until after that date. 2.5 Appendix 1 to this report provides the Committee with full details of the 3 actions that were not completed within the agreed timescales. 3. Proposals 3.1 It is proposed that the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The effective implementation of agreed Internal Audit and Corporate Fraud actions helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) Agenda Item 5 38
Page 39
3 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 Council Services are consulted during the completion of each Internal Audit and Corporate Fraud review and have also provided updates on progress made in implementing action points. Mark Boyd Head of Service (Finance) For further information please contact Anne-Marie Fenton, Interim Senior Manager (Internal Audit), on afenton@north-ayrshire.gov.uk. Background Papers None. Agenda Item 5 39
Page 40
4 Appendix 1 - Actions due by 30 September 2025 but not started or partially completed Code IA2025PA005b Description Action Description: Management should investigate the feasibility of streamlining the end-to-end process as part of the transition to Eclipse to minimise the number of instances where data input is required, where possible. In the meantime, management should ensure that the access database (DB) is restricted to a limited number of authorised users only and that the DB is suitably protected (e.g. by way of strong password) until such time as the new system has been implemented. Finding: The admin team currently update the budget monitoring spreadsheet, an operational access database and the CareFirst system at each stage of the process for all Council tenant jobs. All serve a different purpose. This is very time consuming for staff and increases the risk of keying errors being made. In addition, the access database is not supported by IT Services. Risk: Inefficient use of staff time and increased risk of keying errors. Priority 2 Latest Note Current trial of reporting via Eclipse with a view to eliminating the need for the Access Database from process. Target date for removal of Access Database 30th November 2025. This action will streamline and remove the requirement for admin duplicate information across platforms. The spreadsheet and Eclipse data input will remain. Progress Bar Original Due Date 30-Sep-2025 Due Date 30-Sep-2025 Parent Code & Title IA2025PA005 Aids and Adaptations Managed By Head of Service (Housing & Public Protection); AHP Senior Manager & Professional Lead Assigned To Team Manager (Housing); Team Manager OT Agenda Item 5 40
Page 41
5 Code IA2025PA010a Description Audit Action: The revised Terms of Reference should be presented to the Transformation Board for approval. Audit Finding: It was noted that the Terms of Reference stated that action notes from the Board meetings would be shared at each IJB via the Director’s report, but this has not been done in practice, at the request of the IJB. However, the IJB have received 6-monthly updates on the progress of the Transformation Plan. The Senior Manager (Strategic Planning and Transformation) prepared a revised Terms of Reference to reflect the reporting arrangements to be presented to the Transformation Board in July 2025. Risk: The arrangements for reporting the progress against the Transformation Plan to the IJB are not compliant with the Terms of Reference of the Transformation Board. Priority 3 Latest Note The next meeting of the Transformation Board is scheduled to take place on the 5th December 2025 (3pm). The Terms of Reference will be addressed at this meeting due to the scheduled meeting for the 22nd of October 2025 being cancelled. Progress Bar Original Due Date 20-Aug-2025 Due Date 20-Aug-2025 Parent Code & Title IA2025PA010 IJB Transformation Managed By Director of Health & Social Care Assigned To Chief Social Work Officer Agenda Item 5 41
Page 42
6 Code IA2025SI003a Description Action description: Review the SHR guidance and audit recommendations to ensure Data Dictionaries are fully completed and issued to appropriate staff prior to 24/25 SHR ARC return being completed. This will ensure consistency in data collection from year to year. Data Dictionaries should also make reference to what evidence is required to be kept, which format is used to present it and where this should be centrally filed. Audit finding: No formal internal procedure notes are in place to ensure that Regulator guidance is followed and updated as required for the period tested - 23/24. Incomplete Data Dictionaries have been provided and are intended for use for 24/25, however there are currently in draft form. It was also noted that some staff responsible for collating the data for the ARC were not aware of the Data Dictionaries. Risk: Inaccurate reporting to ARC as required by SHR, due to inconsistent data collection. Lack of consistency reduces comparability of PIs and therefore usefulness for management decision-making. Lack of clear instructions for new staff if those who currently prepare the PIs are unavailable in the future. Priority 1 Latest Note Work has taken place on the ARC indicators to gather the data on a monthly basis. The Business Improvement Team are currently working on the new reports which will form part of the data dictionaries. This will allow teams to understand where the data is being pulled from and the inclusions, exclusions set out by the Scottish Housing Regulator. Work will be done to complete a 6 month return, which will enable the data dictionaries to be completed. The work will be completed by the 31st October 2025. Progress Bar Original Due Date 30-Sep-2025 Due Date 30-Sep-2025 Parent Code & Title IA2025SI003 Housing Indicators Managed By Head of Service (Housing & Public Protection); Assigned To Team Manager (Performance) Agenda Item 5 42
Page 43
NORTH AYRSHIRE COUNCIL 20 November 2025 Audit and Scrutiny Committee Title: Internal Audit Plan 25/26: Mid-year Update Purpose: To provide an update on progress made in delivering the 2025/26 Internal Audit Plan. Recommendation: That the Committee notes the current position with the 2025/26 internal audit plan and approves the inclusion of eight additional audit reviews in 2025/26. 1. Executive Summary 1.1 The current Internal Audit Plan for 2025/26 was approved by the Audit and Scrutiny Committee in March 2025. The plan sets out the areas of work which Internal Audit intends to cover during the year. 1.2 The Global Internal Audit Standards (GIAS) recognise that it is good practice to regularly review and adjust the plan, as necessary, in response to changes in the organisation’s business, risks, operations, programmes, systems and controls. 1.3 Additions to the internal audit plan have been agreed in consultation with Chief Officers across the Council’s directorates for 2025/26 and these are detailed within the report at Appendix B. 1.4 Appendix C outlines the audits listed within the rolling plan which will be drawn from during the year, if resource capacity allows. 2. Background 2.1 Appendix A to this report is the approved audit plan for 2025/26. For each audit additional information has been provided to show the actual activity to 30 September 2025. 2.2 In line with good practice, the plan should be reviewed during the year in light of experience gained from audit work carried out, emerging risks to the Council and the changing environment in which audit work is carried out. 2.3 Using a risk-based approach and in consultation with Chief Officers in each of the Council’s directorates, eight additions to the audit plan, for completion during Q3 & Q4, are noted in Appendix B. These have been selected from the rolling long list of audits that were presented to the committee in March 2025. An updated copy of the rolling long list of audits is in included at Appendix C and future audits will be drawn down from this where capacity allows. Agenda Item 6 43
Page 44
2.4 Any further material updates to the Audit Plan will be brought to the committee for consideration as the financial year progresses. 3. Proposals 3.1 It is proposed that the Committee notes the current position of the 2025/26 internal audit plan, as specified in Appendix A and approves the inclusion of the eight additional audit reviews noted in Appendix B in 2025/26. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. Agenda Item 6 44
Page 45
5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment. Services have also been consulted on the proposed changes to the internal audit plan. Mark Boyd Head of Service (Finance) For further information please contact Anne-Marie Fenton, Interim Senior Manager (Internal Audit) on afenton@north-ayrshire.gov.uk . Background Papers None. Agenda Item 6 45
Page 46
Internal Audit Plan 2025/26 Quarters 1 & 2 Appendix A Audit Area to Deliver in Plan Directorate / Service Planned Quarter Priority Link to Council Plan Link to Risk Registers Progress to Date HSCP - Overtime Controls HSCP Q1 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk Complete CT / NDR Refunds Finance/ People & ICT Q1 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Fieldwork Ongoing School Funds Education Q1 B N/A N/A Fieldwork Ongoing ICT - Asset Management People & ICT Q1 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Strategic Risk To Start Buildings and Estate Maintenance Place Q1 B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk To Start Social Care Establishments HSCP Q2 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Strategic Risk To Start Capital Monitoring Finance Q2 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate Risk Fieldwork Ongoing Accounts Payable Transactions People & ICT Q2 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Fieldwork Complete ELC Payments to Partner Nurseries Education Q2 B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A To Start Absence Management Corporate Q2 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk To Start Tenants & Residents Associations Communities & Housing Ongoing D Communities and Local Democracy – we will have active, inclusive and resilient communities N/A Complete Consultancy - Grant Compliance Place Ongoing B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk Ad Hoc Agenda Item 6 46
Page 47
Additions to the Internal Audit Plan 2025/26 for Quarters 3 & 4 Appendix B Audit Area to Deliver in Plan Directorate/Service Planned Quarter Priority Link to Council Plan Link to Risk Registers Grants Compliance Communities & Housing Q4 B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk School Inventory Management Education Q4 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A HSCP - Business Continuity Planning HSCP Q4 B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Corporate Risk and Operational Risk Payroll Transaction Testing People & ICT Q3 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Neighbourhood Services - Overtime Controls Place Q4 B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk Ayrshire Growth Deal Place Q4 A Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk IJB Financial Sustainability IJB Q3 A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk ICT Incident Detection People & ICT Q4 A N/A Strategic Risk Agenda Item 6 47
Page 48
Rolling Internal Audit Plan Appendix C These reviews will form part of the rolling plan for future audits. The plan will continue to be adjusted as the year progresses to reflect current organisational risks and issues. Ongoing risk assessments will be undertaken to determine the priority areas to include in the plan. Potential Future Audit Areas Directorate/Service Priority Link to Council Plan Link to Risk Registers Corporate - Performance All B All N/A Corporate - Business Continuity Planning All C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate Risk and Operational Risk Stores Controls Communities & Housing C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Community Associations Communities & Housing B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk ARC Compliance Testing Communities & Housing / Place B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Operational Risk Advisory - Equalities Democratic B N/A Strategic Risk Freedom of Information Democratic A A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Corporate Risk and Operational Risk Residential Placements Education B Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Child Poverty Policy Education C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Education - Handling of Medication Education C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A General Ledger Finance D N/A N/A Community Based Support - Young People HSCP B Communities and Local Democracy – we will have active, inclusive and resilient communities Operational Risk Financial Assessments - non- residential HSCP C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people N/A Care Home Sustainability HSCP B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities Strategic Risk Review of HSCP Charging Policy HSCP C A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Agency Staff & Workers (IR35) People & ICT B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Payroll – Non-standard payments / allowances People & ICT B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Fuel Controls Place B A Sustainable Council – a Community Wealth Building Council that is efficient and accessible, maximising investment and focusing resources towards our priorities N/A Flood Programme Place C Climate Change – achieving net-zero by 2030 Strategic Risk and Operational Risk Advisory - Decriminalised Parking Arrangements Place C N/A N/A Shared Prosperity Fund Place C Wellbeing – to transition to a wellbeing economy, delivering prosperity, wellbeing and resilience for local people Operational Risk Agenda Item 6 48
Page 49
NORTH AYRSHIRE COUNCIL 20 November 2025 Audit and Scrutiny Committee Title: Strategic Risk Register 2025/26: Mid-year Update Purpose: To provide the Audit and Scrutiny Committee with an update on the progress with actions related to the Strategic Risk Register. Recommendation: That the Committee notes the mid-year update on the 2025/26 Strategic Risk Register. 1. Executive Summary 1.1 The Council’s most significant risks are identified through the Strategic Risk Register, which is refreshed annually and was last approved by Cabinet in March 2025. 1.2 This report, together with Appendix 1, demonstrates progress made by the Council in mitigating against the potential impact of the strategic risks. 2. Background 2.1 The Council’s most significant risks are identified through the Strategic Risk Register, recognising the challenges facing the Council within the current financial year and demonstrating the arrangements in place for managing those risks. 2.2 The Strategic Risk Register is refreshed annually and was last approved by Cabinet in March 2025; thereafter it was reported to the Audit and Scrutiny Committee in May as this Committee has a remit for monitoring key risks. 2.3 The register is attached at Appendix 1 and provides an update on that approved by Cabinet in March. The next full refresh of the risk register will take place early in the new year, to be taken to Cabinet for approval in March 2026 and thereafter reported to the Audit and Scrutiny Committee. 2.4 Where relevant, key actions from the Council Plan have been linked to the risks and progress shown at the end of September. These actions are more strategic in nature. Some risks are managed as ‘Business as Usual’, through the appropriate operational plans within Services or through current controls. Very High Risks 2.6 There are five strategic risks classed as ‘Very High’ (scoring 17-25): Financial Environment (risk score 20) – this risk reflects the ongoing financial challenge faced by the Council. Agenda Item 7 49
Page 50
Inequalities (risk score 20) – this highlights the socio-economic inequalities faced in North Ayrshire. Financial Sustainability of the Health and Social Care Partnership (risk score 25) – this reflects the significant ongoing financial challenges faced by the Partnership and the risk these present to the Council which are increasing. This matter is currently being addressed by the Council through current financial performance reporting governance and through the recent Budget setting process for 2025/26 and future years. However it should be stressed that this position continues to present significant challenges for the financial sustainability of the Council. Property Asset Risk (risk score 20) – This reflects the impact of long-term restricted budgets on the Council’s ability to maintain these to a good standard. Community Capacity Building and Empowerment (risk score 20) – this highlights the challenges associated with delivering the Community Empowerment Act. High Risks 2.7 There are three strategic risks classed as ‘High’ (scoring 10-16): Cyber Security (risk score 16) – this reflects the ongoing risk from external cyber- attack which is being faced by all organisations. Climate Change (risk score 16) – this risk has been on the Strategic Risk Register following the declaration by the Council of a Climate Change Emergency during 2019. Transformation (risk score 12) – this reflects the wider risks associated with delivering the current Transformation Programme and developing a pipeline of future initiatives. Longer-term risks and horizon scanning 2.8 The Strategic Risk Register identifies the most significant risks which the Council faces at the present time. 2.9 The Corporate Risk Management Group identifies any new relevant risks though internal reviews and external horizon scanning utilising a number of sources. 3. Proposals 3.1 It is proposed that the Committee notes the mid-year update on the 2025/26 Strategic Risk Register. 4. Implications/Socio-economic Duty Financial 4.1 The Council continues to have a robust long and medium-term financial planning framework. Key strands include development of key transformation themes and the establishment of an Investment Fund that will generate future savings alongside delivery of a number of key Council priorities. Human Resources 4.2 None. Agenda Item 7 50
Page 51
Legal 4.3 None. Equality/Socio-economic 4.4 The risk to the Council is that North Ayrshire residents, and in particular certain groups, will experience increasing levels of poverty and its effects. Current control measures fall into two categories - measures to address the root causes of socio-economic inequalities - income through employment or benefits – and mitigation measures to minimise the impacts of poverty. Climate Change and Carbon 4.5 The Council has declared a climate change emergency and has in place an Environmental Sustainability and Climate Change Strategy. Significant work to help mitigate the risk of flooding is included within the Capital Plan. The Council is undertaking an ambitious renewable energy programme. Key Priorities 4.6 A successful risk management framework helps to underpin the delivery of the Council’s strategic priorities in the Council Plan 2023-2028. Community Wealth Building 4.7 The Council has an ongoing commitment to community empowerment and locality partnerships, together with an enabling approach with community partners and support with third sector interface to build capacity and identify opportunities for growth and sustainability. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 The Strategic Risk Register has been reviewed in consultation with the Executive Leadership Team. Mark Boyd Head of Service (Finance) Agenda Item 7 51
Page 52
For further information please contact Alex Fitzharris, Team Manager (Risk & Insurance), on 01294 324415. Background Papers None. Agenda Item 7 52
Page 53
Appendix 1 - Strategic Risk Report – Mid Year Update 2025/26 Risk Code SRR2526_R01 Risk Title Financial Sustainability Latest Note Date 16-Sep-2025 Risk Owner Mark Boyd Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact The risk is that the level of funding from Scottish Government to local government falls significantly below the level required to operate services effectively. This will require the Council to take increasingly difficult and challenging decisions. The revised 2025/26 local government settlement represents an increase in core funding of £7.254m (2.05%). This is against a backdrop of significant inflationary cost increases and risks, including and anticipated shortfall in funding for employer national insurance contributions for direct staff of £2.647m. The North Ayrshire position is further affected by a reducing overall population demographic and a growing elderly population. This will further impact the Council’s share of funding across the short, medium and long term. Although there is a commitment through the Verity House agreement for Councils and Scottish Government to work together there continues to be challenges around the level of flexibility the Council has on key areas of Budget, most notable in areas like HSCP funding and funding for teachers and support staff, where conditions remain. Cost pressures across the Council’s General Fund and the Health and Social Care Partnership present a significant risk to the sustainability of the Council’s finances. Scottish Government funding to support the Council’s capital programme has also not kept pace with rising costs. Set against high inflationary driven construction costs there is a risk that the 10-year capital programme will be unaffordable. This could require projects to be reduced in scale or even ceased. Funding not keeping pace with demand and inflationary cost pressures means that there will be a reduction in some service areas potentially resulting in higher risks for service users. The future delivery of balanced budgets will become increasingly challenging. The capital programme could also be significantly impacted leading to reduced levels of capital investment. Robust monitoring of the Council’s revenue and capital budgets is in place as well as regular reporting of financial performance of the IJB to Cabinet and Audit and Scrutiny. To assist financial planning The Medium and Long- Term Financial Outlook (LTFO) to 2033/34 was approved at Council on 13 December 2023 – this is the cornerstone of the Council's financial planning in the medium to long term. The annual budget process for the General Fund revenue and Capital Programmes and financial performance monitoring process will continue to provide the framework from which control measures will continue in addressing the financial position. Delivery of the Council’s Change Programme is also vital in addressing the Budget challenges and this is being progressed by the Council’s Transformation Board, which is chaired by the Chief Executive. Utilising the Council’s available statutory powers is another important area in addressing the financial challenges. 4 5 Status Risk Score Heat Map Change in Score Approach No change Treat Increasing Risk 20 Agenda Item 7 53
Page 54
Strategic Risk Action Plan Date Updated 16-Sep-2025 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Regular financial monitoring of Revenue and Capital Budgets. 26 February 2025: Recent finance reports trending towards break-even position for the Council’s general fund. Major challenges remain however regarding the financial performance of the IJB. The Council will require to make interim funds available to the IJB in 2024/25 and this will be on the basis of repayment in future years. This will be considered by Cabinet. 16 September 2025: Early indications for 25/26 position projects a net break-even or even a trending underspend. This position however does not include the HSCP position which could have funding implications for the Council. 31-Mar-2026 Mark Boyd Maintain Financial Governance Arrangements for IJB. 26 February 2025: The Finance Working group continues to progress transformation and recovery actions, however it is unlikely it will achieve financial balance in 2024/25. Information continues to be reported through to the Council’s Cabinet 31-Mar-2026 Mark Boyd Progress dialogue via COSLA with Scottish Government on a range of areas including fair funding, multi-year settlements, reduction in levels of ring-fenced resources, true costs of SG policy areas, financial flexibilities and a New Deal partnership with SG and local government. 26 February 2025: Further progress made in this area as part of the Local Government settlement through reduced levels of ring-fencing, however, further progress needs to be made as conditions remain around teacher numbers and HSCP funding. Financial flexibilities have been progressed by the Council through approval of 100% premium for second home-owners council tax and through a review of non-domestic rates empty property relief 31-Mar-2025 Mark Boyd Develop the 2026/27 to 2028/29 revenue budget (medium-term financial strategy) and capital programme taking account of all pressures and savings via Directorates and Transformation programme. 16 September 2025: The 2026/27 Budget process has commenced. Early budget engagement with elected members scheduled for 8th October 2025 and the Medium-Term financial Outlook planned for Council on 5 November 2025. 26-Feb-2026 Mark Boyd Agenda Item 7 54
Page 55
Risk Code SRR2526_R02 Risk Title Inequalities Latest Note Date 12-Sep-2025 Risk Owner Caroline Cameron; Sam Anson; David Hammond Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact North Ayrshire residents, and in particular certain excluded groups, will experience increasing levels of poverty and its effects, as a result both of the economic situation and further public sector funding challenges. Health inequality is closely linked to poverty, employment and people's earliest experiences as children, and will increase. The population of North Ayrshire is projected to fall over the next 10 years but there will also be a larger proportion of the population considered dependent (not economically active). The impact on specific risk groups is greatest for our children, young people and families, unemployed people and those in in- work poverty and people exposed to the risks of drug and alcohol addiction. Demand for HSCP and Council Services will increase. As reductions in resources increase, early intervention and prevention activities are at risk, thus increasing the potential for an increase in costly crisis interventions. The local economy will be impacted by reduced spending power by economically inactive residents. The Collaboration for Health Equity in Scotland (CHES) is an innovative two-year partnership between Public Health Scotland, the Institute for Health Equity and to improve healthy life expectancy and reduce health inequalities. The CHES programme was officially launched in Saltcoats Townhall in February 2025. This work has resulted in establishing three workstreams which will provide an enhanced focus on the marmot principles below in identified geographic areas: Marmot principle 1 – Give every child the best start in life (Irvine Fullarton / Castlepark / Bourtreehill) Marmot principle 3 – Fair employment and good work (Three Towns, Saltcoats Central / Ardrossan Central / Stevenston Hayocks) Marmot principle 6 – Strengthen the role of ill health prevention (Garnock Valley) The aims of CHES are to answer two fundamental questions: 1) What are the most impactful areas for intervention in Scotland to make meaningful progress in closing inequities in healthy life expectancy, and 2) how can national and local organisations work more effectively to close the gap between policy intent and impact in these areas? One of the key priorities in the HSCPs current strategic plan is ‘Tackling Inequalities’, and over the previous year has continued to deliver actions aimed at reducing inequalities. For example, our social work teams continue to host events during the year at critical times, such as back to school and Christmas, to get children supplies they need and participation in social events. The Money Smart service continues to offer advice and support for financial inclusion, with self-referrals to the Welfare Reform Advice team doubling between 2023 and 2024. A new financial advice strategy has been developed this year and once published will outline plans for further support to offer the community. The team is also engaged in a two-year initiative to implement Welfare Rights services within eleven GP practices throughout North Ayrshire. Since the project's inception, three Income Advisers have secured nearly £4 million in benefits for local patients and residents. The Justic Service Unpaid Work Teams Employability Mentors work with people with convictions that may face stigma or inequality associated with declaring a criminal record, or an unwillingness by some employers to provide those with criminal convictions with job opportunities. The mentors assist service users involved with the Justice system to obtain skills that will enable them to gain employment and training opportunities to support reintegration into the community. The HSCP is currently revising its Strategic Plan where it aims to move towards focussing on health improvement and long-term planning to meet the changing needs of the population within more efficient systems. It outlines 3 Strategic Priorities that aim do address some of the causes of poor health and respond to the inequalities within the population: 1. Supporting the Improvement of Population Health 2. Addressing the Changing Needs of an Ageing Population 3. Tackling the Root Causes of Health and Care Inequality Over the 3 year period following approval of the new approach, the HSCP aims to research and identify whether any changes to service delivery could lead to improved health and care outcomes. The HSCP also developed new Equality Outcomes in 2025, which aims to reduce inequalities when accessing health and care services for protected characteristics. A set of aims have been developed which include improving support for carers with additional barriers, such as ageing carers or those with disabilities, and improving accessibility for those with cultural or language barriers. 5 4 Agenda Item 7 55
Page 56
Investment in early intervention teams and approaches in Children’s Services to support vulnerable families, including in Child Protection and Whole Family Support. The Council considers reducing inequalities to be at the heart of its work. The Communities & Housing Directorate leads the Community Planning Partnership for the Council, and the CPP’s Local Outcomes Improvement Plan has a central purpose of reducing inequalities. Locality Planning priorities and Community Investment Fund funded initiatives are also focused on a range of inequalities, including poverty, age-related inequalities and digital inequalities. Recent CIF-funded projects have focused on employability, addictions and community food. A recent review of locality planning has refocused activity on addressing inequalities. Communities staff support a range of community led projects which address poverty within their areas, such as the organisations who are part of the NA Fairer Food Network. Sam Anson, Executive Director (Education) and David Hammond, Executive Director (Communities & Housing) led the work of the Child Poverty and Cost of Living Board, chaired by the Council Leader. The five strategic themes of the Board were: • No Wrong Door – access to services • Employability • Food • Islands • Childcare This work has now been mainstreamed by the Community Planning Partnership (CPP) to ensure greater partner visibility and impact. The work of the Partnership’s Wellbeing Alliance is also increasingly focused on the impact of child poverty and how this can be mitigated. Work to address child poverty and the Cost-of-Living crisis includes a range of employability initiatives to support parents and people with disabilities, each of whom are Scottish Government priority groups. Progress has been made with partners to undertake a review of the Child Poverty & Cost of Living approach, with recommendations being finalised for consideration by the Board. This is supported by the data and Single Shared Assessment projects being developed by the Transformation team, to provide holistic support for residents who need it most. The Child Poverty Early Intervention Fund is being used to address gaps in current planning and provision. Previous funding decisions were made as a consequence of the mini-enquiries to support employability and travel, childcare developments and support for care experienced young people and families. Further allocations are currently being developed and have been approved by the CPP Senior Officers Group. Through the Scottish Government’s Fairer Futures Partnership we have established a Child Poverty Strategy Team, who came into post in January 2025. This team are providing a key oversight role in collectively delivering holistic support, alongside the transition to a wellbeing economy, in reducing child poverty rates in North Ayrshire. The Scottish Government has provided a third year of funding to address inequalities on the islands. This has been used to fund energy support, welfare advice and support, third sector interventions and school activities. The commitment to reducing inequalities is also reflected in the following plans: • The Educational Service Improvement Plan • Connected Communities strategic plans and • Facilities Management plans. Examples of actions to reduce inequalities: • Deployment of Scottish Attainment Challenge funding to reduce the poverty related attainment gap in schools Agenda Item 7 56
Page 57
• Use of the Pupil Equity Fund to ensure equity of pupil experience in schools, at the discretion of head teachers • Cost of the School Day actions to reduce, for example, the cost of school uniforms and clothing, food and outings • Support for care experienced young people, both in schools and through youth services • Additional national and local investment in Active Schools to focus on inequalities and equity • The mainstreaming of community buildings as warm spaces and events to mitigate energy use and social isolation • Work to support “New Scots,” in schools, with families and in community settings through language support and capacity building, including women’s groups • LGBT support groups for young people and those over 18 • Mentoring support for young people in secondary schools through a partnership with MCR Pathways. Work is in hand with the Third Sector Chief Officers Group to co-design expenditure proposals from the Child Poverty & Early Intervention Fund on three priorities relating to child poverty, namely childcare, support in employability and financial inclusion. Funding for the final proposal of a collaborative approach by third sector organisations was agreed in June 2025 and work is progressing. In addition to the above, the HSCP re-affirmed its commitment to tackling Inequalities by continuing to consider it a key priority with the Partnership’s Strategic Plan. Through the HSCP strategic plan, the Partnership sets out actions to tackle inequality through its Partnership Pledge and across its strategic priorities. Tackling inequalities is addressed across HSCP service areas. An example of actions to help address local inequalities include: Establishing the Money Matters service in 9 GP practices and 7 local schools in the more deprived areas of North Ayrshire. This will improve accessibility of the service to those who would benefit most. Building on this approach through the launch of the Financial Inclusion Partnership bringing a range of key partners and stakeholders together to improve access and support for the most vulnerable NA residents. Increase the number of employability mentors in Justice Services, to support those with experience of the justice service into meaningful employment or training opportunities and to help divert away from criminal behaviours. Working closely with Housing colleagues to support transitions from care and ensuring care experienced young people can access a positive and stable housing destination. In our Drug and Alcohol Services, we are implementing actions to reduce the number of local drug and alcohol related harms and deaths. This includes implementing the national MAT (Medicated Assisted Treatment) standards and increasing the number of ABIs (Alcohol Brief Interventions) delivered across North Ayrshire. Through the Caring for Ayrshire programme, we have set out a phased approach to improve local primary care premises (GP Practices and Health Centres). This will improve overall professional capacity within GP practices for Multi-Disciplinary Teams, ensuring the right support is available for local people with health concerns. Investment in early intervention teams and approaches in Children’s Services to support vulnerable families, including in Child Protection and Whole Family Support. A range of strategies are in place to ensure our strategies and investment are informed by as wide a range of views as possible. The recent incorporation of the UNCRC has ensured that children and young people’s right to participate is upheld by all services. Agenda Item 7 57
Page 58
Status Risk Score Heat Map Change in Score Approach No Change Treat Stable 20 Agenda Item 7 58
Page 59
Strategic Risk Action Plan Date Updated 12-Sep-2025 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Global and national conditions which affect the cost-of-living and poverty continue to undermine the effectiveness of local control measures. Substantial work continues to mitigate inequalities but child poverty data, for example, continues to show an increase. National data collection methodologies have changed which explains the change in part, but North Ayrshire continues to have c. 29% of children living in poverty. Although unemployment has reduced, it continues to be a driver of poverty, with in-work poverty a key factor. Access to benefits is a key driver of poverty and the range of strategies described above continues to ensure we are maximising access to entitlements. The Single Shared Assessment work will improve this. 20 February 2025: The work of the CPCOL board has been mainstreamed* as a workstream of the CPP board following discussion with both groups and in recognition of the importance of the work as a core function of the partnership. This improves visibility and governance. Work is being developed around the codesigned use of an allocation of the Child Poverty and Early Intervention Fund along with the Third Sector Chief Officers Group. This will improve capacity for change across third sector initiatives delivering on child poverty outcomes. The recent review of Locality Partnerships has resulted in a series of recommendations designed to refocus the work of the partnerships on their prime driver of reducing inequality. 12 September 2025 The CPP Board continues to focus its strategic activity on CPCOL and the reduction of inequalities. Locality planning has a renewed focus on inequalities within areas and driving forward change at locality level. The Third Sector Chief Officers Group have begun implementing the project which was collaboratively proposed with a view to increasing their capacity and tackling child poverty outcomes. We are working on the delivery of the action plan around childcare which is associated with child poverty work. We continue to work to build and support capacity in community and voluntary organisations which mitigate the impacts of poverty. Work has begun on the new Active Communities strategy which will have a focus on reducing health inequalities through supporting activity across North Ayrshire. The Wellbeing Alliance has refined its approach to focus on the impacts of child poverty over the next three years and will deliver a range of targeted projects. A locality mapping exercise is under way to share information and gather a full picture of all supports available in each area. Continued support for the Fairer Food Network, including the allocation of additional funding from the CPEIF, ensures continued access to dignified food provision. We are working in collaboration with the Island Plan Delivery Groups to ensure effective spend of funding to address island related inequalities. 31-Mar-2025* Caroline Cameron Agenda Item 7 59
Page 60
Access to support and information around other interventions is made available through the library service. Agenda Item 7 60
Page 61
Risk Code SRR2526_R03 Risk Title Financial Sustainability of the Health and Social Care Partnership Latest Note Date 11-Sep-2025 Risk Owner Caroline Cameron Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact Resources have not kept pace with the demand for and cost of social care services. Financial modelling suggests significant ongoing challenges across the medium-term with 2026/27 being particularly challenging as the superannuation increase will cost £7m approx and this is prior to considering other pressures. There is no certainty around future funding against growing demand, increasing costs and demographic pressures, with one-year budget settlements remaining in place. The ongoing work to review the Integration Scheme and to develop new risk-sharing arrangements between the Council and Health Board in relation to the acute set aside and primary care prescribing present a financial risk to the Partnership and Council. Unearmarked reserves are depleted, there is no scope to absorb in-year variances, with any overspends requiring additional funding from partners. The wider system financial challenges and impact across the whole system, for example the financial position of NHS AA and the decisions taken to reduce the Board’s deficit may have impacts on other parts of the health and care system. The Partnership is projecting an overspend of £5.2m in 2025/26, reduced from the £1.2m if the approved recovery plan is fully delivered. The financial position throughout 2025/26 and into 2026/27 remains challenging for the IJB. Funding levels could result in savings being made that are not in alignment with the strategic plan. This could impact on the future demand levels e.g. reduction in early intervention and prevention means that future demand is increased. An in-year overspend position poses a financial risk to the Council and NHS Board as funding bodies. Funding levels increase the requirement to transform services at scale and pace. The IJB actively monitors the financial position with regular detailed reporting. Directors of Finance of the Council and Health Board have oversight, and regular updates are provided to the Council's Cabinet. There is an integrated approach to managing the totality of NHS and Council resources delegated to the IJB. A three-year Medium-term Financial Outlook is updated on a rolling basis each year. Previous financial settlements have seen both partners meet the Scottish Government settlement conditions with any additional resources passed to the IJB. The Partnership has developed a new 3-year Transformation Plan 2024-2027 which will be approved by the IJB in March 2024. There is £0.780mof earmarked reserves set aside to support service change and re-design. This is fully committed and any slippage at the year-end will be drawn down in-year to support the financial position. Services will continue to work towards implementing the recovery plan to deliver cost reduction targets while carefully managing the level of risk. The management actions and governance framework agreed in 2024/25 will continue throughout 2025/26. Additional actions approved for 2025/26: • Recruitment delay – there will be a recruitment drag with vacancy scrutiny approved vacancies being held for four weeks before they are advertised to create more payroll turnover. This will be for all vacancies except clinical or registered services vacancies or those which will incur cover costs. • High-cost care package group – the remit of this group will be expanded to include care packages for children with a disability and all UNPACs placement requests. • Oversight group for looked after and accommodated children in residential care – this group meets fortnightly to actively review all placements 5 5 Status Risk Score Heat Map Change in Score Approach Remains at 25 Treat Increasing risk 25 Agenda Item 7 61
Page 62
Strategic Risk Action Plan Date Updated 11-Sep-2025 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Budget Monitoring - Regular budget monitoring reports to IJB are effective. 16 January 2025: The capacity of the NHS finance team to provide up to date monitoring information has been raised and discussions are ongoing to ensure accurate and timely information is provided to the IJB. 11 September 2025: A pan Ayrshire reporting template is being developed for all Lead Partnership services to ensure consistent reporting across the Ayrshire HSCPs. 31-Mar-2025 Caroline Cameron Corrective Action – Transformation Board is effective 16 January 2025: The transformation board has a themes-based agenda e.g. children & families, community care & health etc. This has allowed a stronger focus on each area. Regular updates have been presented to the IJB on progress. 11 September 2025: A recent internal audit report on IJB Transformation reported substantial assurance with regard to the governance of the HSCP’s Transformation Plan. It stated ‘The current governance arrangements include clear reporting lines and involve senior managers at an appropriate level. The Transformation Board meets regularly and has a good overview of the projects, including access to a tracker which is summarised in a 1-page dashboard’. 31-Mar-2025 Caroline Cameron Enhanced Financial Controls 6 March 2025: The Finance Working Group has now met 6 times and covered a range of areas to support increased oversight and scrutiny of the financial position and transformation programme and to support detailed budget planning for future years. This has supported proposals for the 2025/26 budget coming forward before March 2025 for approval and an improved understanding of the scale of the financial challenge and the difficult decisions required to manage this. The Financial Recovery Plan is estimated to deliver £4m of benefit in-year, with the forecast outturn reported to be £5m, a reduction from the £6.5m reported in August 2024. Some of the benefit of the plan has been eroded by unexpected financial pressures in-year. 11 September 2025 Continued operation of the Finance Working Group. In preparation for the 2026/27 budget there are meetings ongoing with every senior manager with their Head of Service, Chief Officer and Chief Finance Officer to review their budget and services provided. 31-Mar-2025 Caroline Cameron Agenda Item 7 62
Page 63
Sessions with the extended PSMT to outline the financial landscape. National Influence/Escalation 6 March 2025: Through the NA Chief Officer, the IJB have raised concerns nationally with Scottish Government, with Civil Servants and Politically re the impact of the financial position aligned to performance, for example the priority of the Delayed Discharge Mission. Scottish Government plans to publish an NHS Renewal plan at the end of March 2025 which will describe how the £200m funding set out as part of the budget will be deployed to improve performance. As part of this, and through NHS Boards, HSCPs were requested to submit costed improvement plans. North Ayrshire HSCP submitted a request for £9.5m of additional funding of which the majority of funding is for social care, the HSCP await feedback following submission by all Boards to Scottish Government. Concerns have also been raised nationally by Audit Scotland through their Finance Bulletin on IJBs published on 6th March and by Chief Officers as a collective, Chief Officers shared the national scale of financial challenge with Scottish Government officials and politicians on 5th March with a request that IJB requests for funding are prioritised. 11 September 2025: Continued representation at the Chief Officers and CFO networks. 31-Mar-2026 Caroline Cameron Agenda Item 7 63
Page 64
Risk Code SRR2526_R04 Risk Title Cyber Security Latest Note Date 18 Sept 25 Risk Owner Fiona Walker Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact The potential compromise of business operations or a data breach orchestrated via either digital channels or the IT infrastructure. This can include targeting of the user base. Risk derives from both Council operations and those of its supply chain. The increasing importance of delivering services through digital channels and maximising efficiency through effective and secure use of technology. This includes a growing adoption of cloud-based computing resources which extend processing capabilities, and associated risks, beyond the Council’s network. Hybrid remote and mobile working is now the normal working practice for over 3,000 staff. Such a distributed work force increases the complexity of protecting against cyber and data protection risks. Failure by Services to adopt and comply with strategies, policies and procedures may result in a failure to adequately ensure the desired levels of cyber-security required to maintain and protect council systems and data. There may be a significant impact on the authority through the release of personal and/or sensitive information resulting in a loss of public confidence and significant financial loss incurred through fines and service disruption. A successful cyber-attack (malicious external or internal action) on the Council’s IT environments could also result in significant service disruption, loss of income streams and possible data loss/exposure. Impacts of a cyber-attack could include economic (i.e. inability to collect online payments), societal disruption (i.e. loss of diaries and client appointments), and reputational damage (i.e. loss of public confidence in digital services). It is recognised that it is not possible for any organisation to expect to be completely protected against continually evolving cyber threats. A threat actor with sufficient motivation, resource and capability will be able to compromise the most secure system. The Council takes a sociotechnical approach to reducing risk by continually developing protective measures through technical, organisational and people-focused controls. Technical controls are implemented in areas such as network defences, secure configuration of systems, user authentication, malware protection, and vulnerability management. These are based on best practice and independently tested on an annual basis to confirm their effectiveness in accordance with compliance schemes. The Council employ a fully managed Security Operations Centre (SOC) service which provides advanced monitoring, detection and response capabilities on a 24 hours a day, 365 days a year basis. The Council maintains a comprehensive set of policies, standards, guidelines, metrics and reporting mechanisms as part of its information security governance structure. A comprehensive training and awareness programme is delivered to nurture a cyber- aware workforce and culture. Recent high profile cyber incidents affecting both the UK retail and public sectors demonstrate a continued increase in the sophistication and severity of cybercrime. However, the bolstering of the Council’s Cyber Security programme through additional resource, technology and improved processes alongside wider efforts in improving the Council’s resilience mean that the overall risk severity score remains stable. The cyber security landscape continues to evolve rapidly, and this position will be routinely monitored and reviewed. 4 4 Status Risk Score Heat Map Change in Score Approach No change Treat Stable 16 Agenda Item 7 64
Page 65
Strategic Risk Action Plan Date Updated 18-Sep-25 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Incident Detection and Response – Recent cyber-attacks on public sector organisations highlight the need for robust incident detection and response procedures and technologies. The current response procedures been shown to be effective based on incidents experienced so far, however detection capabilities will need to be reviewed and improved. 15 January 2025: Following a process of market consultation and vendor engagement, the Council have recently procured a Managed Security Operations Centre (SOC) service for an initial period of three years. The project is currently in the implementation phase, and we anticipate the service being fully operational by the end of February 2025. 18 September 2025: The Council’s Managed Security Operations Centre (SOC) service is fully operational. The deadline for completion of this activity has been achieved. This will however remain on the SRR as tuning and refinement are required to ensure effective detection and response capabilities. 31-Mar-2025 – achieved. Ongoing Fiona Walker Training and Awareness 15 January 2025: The mandatory Cyber Security Essentials E-Learning course remains our training initiative with the greatest reach. This course has been fully re-written and is now live for all employees to complete annually. The mandatory E-Learning course is being supplemented by a range of further initiatives to include all-staff webinars, awareness raising news posts and other communications, this approach aims to ensure messaging is kept current and reflects the rapidly evolving threat landscape. Phishing simulations continue to be used to validate effectiveness of training and awareness initiatives. 18 September 2025: Cyber Security awareness raising initiatives continue to be delivered. The newly revamped Cyber Security Essentials iLearn module has been launched and the effectiveness of this can be seen from the most recent phishing simulation exercise which demonstrates a continuation of the clear downward trend in terms of staff interactions alongside an increase in those reporting suspicious messages for further analysis. A phishing specific iLearn module is being scoped for development and those staff who interact with phishing simulation messages will be required to complete this. Targeted engagement with Education is underway to ensure school based staff have the opportunity to attend Cyber Security awareness raising events and initiatives. Ongoing Fiona Walker Agenda Item 7 65
Page 66
Risk Code SRR2526_R05 Risk Title Transformation Latest Note Date 16-Sep-2025 Risk Owner Mark Boyd Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact There is a risk that transformation and change activities, which are core to the future delivery models and long-term financial sustainability of both the Council and Health and Social Care Partnership, fail to deliver at the level of scale and pace required. Failure to deliver transformational change will impact on the Council’s financial sustainability, effectiveness of service delivery and delivery of the outcomes set out in the Council Plan 2023-28 and the Local Outcome Improvement Plan (LOIP). Failure to deliver the HSCP Transformation programmes across the Partnership, involving North Ayrshire Council (NAC) and NHS Ayrshire & Arran (NHSAA) services may lead to the identified outcomes not being delivered; resulting in financial instability, reduced performance, deteriorating patient outcomes, and reputational damage within North Ayrshire Health and Social Care Partnership (NAHSCP). Failure to embed cultural transformation activities may lead to difficulties in building future workforce capacity and in ensuring we have an engaged, skilled and knowledgeable workforce to meet service demand. The transformation programme aligns to the Council Plan and is monitored via the Transformation Board. The Board is chaired by the Chief Executive. Workstreams have been developed across Transport and Travel, Digital, Land and Property assets, Sustainability, Financial Inclusion as well as ongoing reviews across Waste Services, ELC, Learning Resources and Housing. HSCP have an established Transformation Board to closely monitor progress with plans, regular updates on programme to the IJB and regular meetings with the Chief Executive and S95 Officer to review progress and mitigation plans. Cultural transformation activities continue to evolve to support the Council’s transformation and improve effectiveness and capability. This includes sharing learning and skills, engagement, design experiments and a whole systems approach to transformation and change. Our workforce planning approach utilises a variety of tools and techniques, such as career development, succession planning, vacancy management, redeployment and early release schemes to ensure our workforce requirements for the future, in terms of skills and capabilities, are planned. Each Head of Service has a workforce plan, and these are monitored six-monthly with continued HR support and guidance to ensure service review and redesign of the workforce is on track. 3 4 Status Risk Score Heat Map Change in Score Approach No Change Treat Stable 12 Agenda Item 7 66
Page 67
Strategic Risk Action Plan Date Updated 11-Sep-2025 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Existing project level governance and controls remain effective and are constantly reviewed. 25 February 2025: Scoping has commenced to inform the next stages of a further property transformation workstream, focusing maximising the benefits that can be derived from the property estate (i.e., capital receipts, community wealth building, net-zero, etc). 11 September 2025: A recent internal audit report on IJB Transformation reported substantial assurance with regard to the governance of the HSCP’s Transformation Plan. It stated ‘The current governance arrangements include clear reporting lines and involve senior managers at an appropriate level. The Transformation Board meets regularly and has a good overview of the projects, including access to a tracker which is summarised in a 1-page dashboard’. Quarterly Mark Boyd / Chief Executive and Executive Directors Review current governance arrangements and project delivery in view of land and property workstream to seek optimal delivery aligned to the council’s net zero ambitions. 25 February 2025: Regional Land and Assets workstream being further developed with NAC as lead organisation. Work to deliver the Irvine Locality Workstream, approved by Cabinet in March 2024, is well progressed with the majority of staff now occupying Cunninghame House. 26-Feb-2025 Mark Boyd / Chief Executive and Executive Directors Agenda Item 7 67
Page 68
Risk Code SRR2526_R06 Risk Title Climate Change Latest Note Date 11-Sep-2025 Risk Owner Russell McCutcheon Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact Climate change is expected to continue and worsen in the future if no action is taken, with increases to mean global temperatures, sea level rises and the increasing frequency and severity of weather events such as floods, heatwaves, droughts and storms. More frequent and intense heavy rainfall events increase the risk of soil erosion and flooding. Rises in mean sea level increases risks of coastal erosion, flooding, saltwater intrusion and soil salinisation (risk to agricultural land and freshwater habitats). Severe weather is already affecting public services across Scotland, with operational, reputational, financial and legal consequences. There is also an ongoing impact of severe winter weather including snowfall and freezing temperatures which impact service delivery and the integrity of our roads open space and buildings infrastructure. This shift in weather patterns caused by climate change is also affecting biodiversity across Scotland. Increased frequency of severe weather conditions and flooding events may lead to more instances of damage to Council infrastructure and property, interruptions to service delivery and increased demands on services, often with little notice. Risk to life, transport disruption and pollution to the local environment, as well as impact adversely on the local economy if businesses are unable to operate. Council requirement to provide immediate response and manage the adverse effects of more frequent and severe weather emergency situations, including support to local communities and businesses. The Council is required to comply with the ‘Public Bodies Climate Change Duties’ under the Climate Change (Scotland) Act 2009. These duties require the Council to assess the risks, threats and opportunities associated with climate change and identify actions to increase resilience to climate change. North Ayrshire Council declared a Climate Emergency in June 2019, committing to act on climate change and reduce carbon emissions. In January 2020 the Council approved the target to become net-zero carbon by 2030, for both Council estate emissions and area-wide emissions. Following implementation of the Council’s third Environmental Sustainability and Climate Change Strategy (2021-23), Cabinet approved the new Sustainable North Ayrshire Strategy (2024-27) in December 2023. This strategy provides a road map to achieve the net zero carbon emissions by 2030 target. There are 5 workstreams within the Sustainable North Ayrshire strategy, namely Energy, Nature, Transport, Waste and Adaptation. We continue to utilise Adaptation Scotland’s Capability Framework to ensure North Ayrshire takes a strong, proactive approach to adapting to climate change. Officers are participating in the Sustainable Scotland Network’s ‘Adaptation Scotland Benchmarking Group’ to learn and share best practice with other local authorities. Adaptation actions are identified within the Ayrshire Flood Risk Management Plan (2021), the Ayrshire Local Flood Risk Management Plan (2022), the Ayrshire Shoreline Management Plan and in the Adaptation Capability Framework. Flood studies are undertaken to help the Council identify areas that are at risk of flooding and to appraise options to reduce flood risk to communities and infrastructure. In addition, actions to mitigate Climate Change risk are held within strategies such as the Local Transport and Active Travel Strategy, Local Biodiversity Action Plan, Vacant and Derelict Land Strategy and Weather and Winter Emergencies Plan. Asset management plans are in place which are regularly reviewed for our Roads, Fleet, Housing, Property and Open Spaces. Furthermore, through the Ayrshire Civil Contingencies Team there are emergency planning arrangements in place in the event of severe weather and flooding conditions causing major disruption and damage to the area or to individual communities within it. 4 4 Status Risk Score Heat Map Change in Score Approach No change Treat Stable 16 Agenda Item 7 68
Page 69
Strategic Risk Action Plan Date Updated 11-Sep-2025 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Reducing Carbon Emissions: North Ayrshire Council declared a Climate Emergency in June 2019, committing to act on climate change and reduce carbon emissions. In January 2020 the Council approved the target to become net-zero carbon by 2030, for both Council estate emissions and area-wide emissions. The Council has taken action against climate change since our first Carbon Management Plan in 2006/07, by working to reduce emissions associated with Council services, and using the baseline year of 2005/06 from which to measure progress. Since the baseline year of 2005/06, Council estate emissions have reduced by 67%, from 63,334 tonnes of carbon dioxide equivalent (tCO2e) to 20,745 tCO2e. Area-wide emissions are published by BEIS. Current records show total emissions have reduced across North Ayrshire by 42.6%, from 1,454 kilo-tonnes of carbon dioxide (ktCO2) in 2005 to 835 ktCO2 in 2019. To ensure North Ayrshire Council can develop a leading, cross- sector and community led approach we established a Climate Change Steering Group (CCSG) in 2021. The CCSG is chaired by the Cabinet Member for Green Environment and Economy, and brings together young people, local businesses and community organisations from across North Ayrshire. Existing controls remain effective and are under review as our response to climate change develops and we progress towards achieving net zero by the 2030 target. 24 February 2025 Business and Sustainability Fund agreed through 2024/25 budget in delivery including appointment of Programme Manager and development of Islands Net Zero Accelerator (NZA) and Phase Two Mainland NZA programmes. Islands NZA Programme supported by £25k funding from Zero Waste Scotland. Wider Place strategy updates continue to be provided through Pentana and governed through the Place Project Board. 11 September 2025 Following delays in the testing and energisation of the Solar Farms, these will now be connected to the grid and generating clean electricity (and income to the Council) in the Autumn of 2025. A recent SALIX recycling funding application has secured £184k, to be match funded by the Council. This will assist us in our on-going work to decarbonise the estate. Reporting to ELT of energy use and site-by-site performance across the Council now takes place. A programme of 14 Electric Vehicle Charge point installation is underway. In addition, work continues in partnership with the Ayrshire Roads Alliance to deliver 307 charge points across Ayrshire. It is anticipated a contractor will be appointed for this work in Q1 2026. 31-Mar-2027 Russell McCutcheon Agenda Item 7 69
Page 70
Strategic Risk Action Plan Date Updated 11-Sep-2025 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Flood Risk Management Plan: Cycle 2 of the Ayrshire Local Flood Risk Management Plan has been developed and was published on 31st December 2022. Studies and modelling will be undertaken to identify and prioritise vulnerable areas where financial damage and risk to life are most likely. There is an ongoing programme of monthly inspections of debris screens which have been installed to prevent vulnerable culverts from blocking and causing flooding. CCTV inspections of culverts are also undertaken to identify blockages and deterioration of assets that might cause flooding. This has been effective in reducing flooding, although there are capacity issues h that this process cannot address. The Upper Garnock Valley FPS has been completed and is currently providing flood protection. Ayrshire Shoreline Management Plan: The Ayrshire Shoreline Management Plan will be replaced with a Coastal Change Adaptation Plan. The adaptation plan will enable the Council and other stakeholders to effectively plan our future actions whilst allowing for flexibility in response to future changes. It will incorporate recent international and UK advances in adaptation and shoreline management planning to allow for local interpretation and involvement. 24 February 2025: 1. The construction of the Millport Coastal Flood Protection Scheme is complete. The scheme performed well during Storm Éowyn and no significant reports of coastal flooding in Millport were received. A pre-tender notification for the Millport Mill Burn Flood Protection Scheme was issued in January 2025. It is anticipated that the contract will be awarded in Autumn 2025, that construction will commence in late 2025, and that completion will be in 2026. 2. The first stage of the Three Towns Flood Study was completed in February 2025 and the scope has been agreed for the second stage. 3. The scheduled clearance and repair work continues to be implemented to help reduce flood impacts to people and property. 4. Following completion of the coastal management studies for Stevenston & Irvine, progress is being made to develop local Coastal Change adaptation plans for the study areas. A site investigation is planned to confirm the presence of contaminated spoil and how exposed this material could be to future coastal erosion. 5. Following completion of the Upper Garnock Flood Protection Scheme and an update of the Lower River Irvine hydraulic model, a consultant has been appointed to update the relevant parts of the Council’s flood resilience plan, including measures at Cunninghame House and Marress House. 11 September 2025: No Further update at this time. 30-Jun-2028 Thomas Reaney Agenda Item 7 70
Page 71
Risk Code SRR2526_R07 Risk Title Community Capacity Building and Empowerment Latest Note Date 16-Sep-2025 Risk Owner Rhonda Leith Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact Unrealistic timescales for progressing of aspects of legislation of the Community Empowerment Act (Scotland) 2015, such as Community Asset Transfer. Potential changes to national legislation and unintended consequences that impact upon our local community structures and support. Pressure to support community capacity building and the variation of needs within a reducing workforce. Duplication of effort across HSCP and Locality Partnerships to foster community participation and deliver engagement activities. Complying with the complex and resource intensive consultation legislation in service redesign. Rising energy and utility costs relating to property management. Budget savings and pressure on property maintenance budgets. Where the risk is not managed effectively the potential benefits of community capacity building and empowerment may be lost. Widening inequality gap between those communities where levels of capacity and engagement with the empowerment agenda are high and those with less social capital where interest remains low, which constrains the ability to influence the planning and delivery service. Any disconnect between the Council’s aspirations, community appetite for increasing ownership of assets and what communities themselves feel able and prepared to commit to can result in community assets reverting back to Council. Accelerating asset transfer risks losing services and facilities and risks the ability to plan, connect and deliver strategic services. Over-engagement carries disengagement and engagement fatigue. Increased property costs can be a deterrent for organisations engaging and completing the CAT process. Lack of budget to undertake proactive maintenance is resulting in NAC buildings falling into disrepair detracting organisations from progressing to lease and or ownership of NAC assets. Ongoing commitment to community empowerment and locality partnerships from CPP. Six locality partnerships and alignment with HSCP locality arrangements. Leadership of the CPP Senior Officers’ Group. Enabling approach with community partners and support with third sector interface to build capacity and identify opportunities for growth and sustainability. Reviewed guidance and processes relating to community empowerment functions. Participatory budgeting approach local grants, commitment to PB with partners and leading practice in mainstreaming participatory approaches. External funding bid help for groups through regular meetings with third sector, funders and funding officer. Joint support for training with Scottish Community Development Centre. Investment from Community Asset Transfer Start Up Fund, prioritising additional staffing capacity to support CAT in TACT. A collaboration and shared resource approach across Connected Communities Teams will be taken to ensure the Service deliver on this priority. Community Engagement Network supports staff across the Council and partners to implement the National Standards for Community Engagement in their work. Careful monitoring of staffing capacity to ensure legislation is met. Standing item at Senior Manager Meetings to assess impact Progress discussions with key stakeholders re dependencies on the progress and impact of delays. 5 4 Status Risk Score Heat Map Change in Score Approach No change Treat Increasing 20 Agenda Item 7 71
Page 72
Strategic Risk Action Plan 16-Sep-2025 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Implementation of Community Empowerment Act: Existing controls remain effective and are kept under review. 16 September 2025 6-month progress report completed and scrutinised by CPP Board; annual update underway. 31-Mar-2025 Rhonda Leith 16 September 2025 No further changes – work still continuing as above. 31-Dec-2024 Rhonda Leith Staff capacity: Existing controls remain effective however forthcoming VER structure changes will result in a reduction of CLD professional staff and risks further pressures on staff to deliver effectively to key outcomes. 20 February 2025: Ongoing discussions being held with key stakeholders re capacity across Council services and impact on timescales. 16 September 2025 Capacity remains a concern. Ongoing monitoring taking place. 31-Dec-2024 Rhonda Leith Duplication of effort: Clearly defined roles and lean processes are reviewed and maintained to avoid duplication of effort and minimise time and resource wastage. The team foster open communication channels with both staff and key stakeholders. 16 September 2025 Consideration of admin functions still ongoing. 31-Dec-2024 Rhonda Leith Consultation: Existing controls remain effective. Existing controls remain effective and hybrid engagement models have been implemented post covid to encourage and provide greater access to participation. 20 February 2025: An extensive programme of budget engagement took place between 10 October and 25 November 2024 including surveys across six main themes as well as in person and online focus groups. The approach was designed to support our residents to contribute their views, make the surveys more accessible and avoid digital exclusion. This has resulted in 4,461 responses and almost 40 community conversations across the six budget themes, more detailed feedback on proposals and considerable engagement with community groups across North Ayrshire. The engagement has also enabled our residents to bring petitions on specific options to the Audit and Scrutiny Committee and Cabinet, demonstrating a high level of engagement with democracy within our communities 16 September 2025 Work on the 2026/27 budget engagement exercise is about to commence. Further consultation on various service design decisions are under way. Joint training with Scottish Community Development Centre is being planned following the Connected Leadership programme on Communities and Local Democracy. 31-Mar-2025 Rhonda Leith Agenda Item 7 72
Page 73
Increased property costs and lack of investment in community assets. 20 February 2025: Strategic plan for use of CAT investment funds in place. ELT oversight continues of plan and spend. Horizon scanning for other potential investment opportunities carried out on an ongoing basis. 16 September 2025 Strategic plan continues to be delivered with ELT oversight. Connected Communities and PMI staff meet regularly to prioritise work. External funding routes are being explored and maximised on an ongoing basis. 31-Mar 2025 Rhonda Leith Agenda Item 7 73
Page 74
Risk Code SRR2526_R08 Risk Title Property Asset Risk Latest Note Date 11-Sep-2025 Risk Owner Russell McCutcheon Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact The long-term impact of restricted budget availability for investment in the Council’s property assets means these assets are in declining condition and have greater long term investment needs. Systemic building safety issues have been evidenced by issues such as national high profile safety issues, and the presence of RAAC through the public sector property portfolio. These have highlighted the substantial increasing burden of property asset management. There have been a number of near misses or critical failures of aging heating plant and equipment which the council cannot afford to replace on a programmed basis. Inflationary pressures, and on-going volatility in the construction & related activities sphere, place further difficulties in the ability of restricted budgets to address all priorities. Maintenance issues and failure of building components are increasingly likely to result in disruption to service delivery. There is also an increasing risk of health and safety and statutory compliance obligations not being achieved. Property events requiring significant interventions leading to service disruption, closure of facilities, decant etc. are in increasing in frequency and often over-lapping (often coinciding with weather events). Property condition information is gathered and recorded within the Council’s electronic asset management system, providing a baseline to measure building element lifecycle replacement requirements across the corporate estate. The limited investment available is therefore targeted on priorities. Reactive maintenance, and statutory compliance are also undertaken corporately by PMI, by appropriately trained / experienced staff. There is an on-going Transformation programme workstream focusing on property rationalisation as a means of reducing the financial burden of the estate through reducing overall area occupied (aligned to carbon reductions). Post Incident reviews and lessons learned exercises with actions undertaken where feasible to do so. Risk based property reviews are underway to examine, on a property by property basis, where property risks have the potential to impact service delivery. The information gathered influences both investment plans and business continuity plans. This work is on-going in respect of the school estate and is being rolled-out to other services’ assets. An additional £0.5m has been allocated in the 25/26 budget to the Property Lifecycle Budget to address condition issues within the corporate estate. In addition, £0.5m has been allocated to undertake energy efficiency measures in the property estate and a joint Sustainability / PMI working group has been established to identify and progress relevant investment. This will be coordinated to ensure optimal benefit for both energy efficiency and property condition. Business Continuity Planning, taking cognisance of the risks posed by potential building unavailability is also being strengthened. 4 5 Status Risk Score Heat Map Change in Score Approach No Change Treat Stable 20 Agenda Item 7 74
Page 75
Strategic Risk Action Plan Date Updated 11-Sep-2025 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG CC&M team within PMI managing reactive maintenance and statutory compliance. Team resources stretched; however, restricted budgets are principal risk. 21 February 2025: Although previous vacancies were successfully filled, further staff departure now requires recruitment process – continuing to stretch resources. 11 September 2025 Vacancies in the team have now been filled; however, a further post will become available in October 2025 due to retirement. Ongoing Russell McCutcheon Asset management team within PMI collecting asset condition information and leading prioritisation of lifecycle investment. Improved asset management system is being investigated; however, restricted budgets are principal risk. 11 September 2025 Scoping for a new asset management system is well advance, and a pressure bid has been prepared to secure funding to take this forward. Ongoing Russell McCutcheon Property rationalisation programme Locality based property review work currently underway to increase scale and pace of implementation. 21 February 2025: The programme of accommodation moves flowing from the Irvine Property Review is well advanced and scoping has commenced for further review of the Council’s estate across all localities. Ongoing Russell McCutcheon Risk based property review process Requires up to date property information, including client information and cross service buy-in to be effective. 21 February 2025 In addition to the estate review meetings noted above, Business Continuity Planning, taking cognisance of the risks posed by potential building unavailability is also being strengthened. 11 September 2025 Review of the Communities Estate has been undertaken, and on-going quarterly meetings have also been established, following the same process as established in respect of Education. Ongoing Russell McCutcheon Agenda Item 7 75
Page 76
Agenda Item 7 76
Page 77
NORTH AYRSHIRE COUNCIL 20 November 2025 Audit and Scrutiny Committee Title: IJB Annual Report 2024/25 and Audit Plan 2025/26 Purpose: To inform the Committee of the IJB’s annual report for 2024/25 and the approved internal audit plan for 2025/26. Recommendation: That the Committee notes the IJB annual report and approved internal audit plan. 1. Executive Summary 1.1 Section 21.7 of the North Ayrshire Integration Joint Board’s Financial Regulations states: “The Integration Joint Board Chief Internal Auditor will submit an annual audit report of the Internal Audit function to the Chief Officer and the Performance and Audit Committee indicating the extent of audit cover achieved and providing a summary of audit activity during the year. As a minimum the annual audit report and Chief Internal Auditor’s opinion will also be reported to the Audit Committees of the NHS Ayrshire & Arran Board and North Ayrshire Council”. 1.2 The remit of the IJB’s Performance and Audit Committee (PAC) includes the review of the overall internal control arrangements of NAIJB. The IJB annual report for 2024/25 and the proposed internal audit plan for 2025/26 were provided to the PAC on 27 June 2025. 1.3 The annual report and audit plan will also be provided for information to the Audit and Risk Committee of NHS Ayrshire and Arran on 20 November 2025. 2. Background Annual Report 2024/25 2.1 The 2024/25 IJB internal audit plan was approved by the PAC in August 2024 and included a review of the IJB’s Transformation Plan. The audit has been finalised and overall, substantial assurance was obtained in relation to the arrangements for monitoring progress against the Plan and for ensuring that issues are escalated in a timely and effective manner. 2.2 The opinion on the control environment of the IJB is also influenced by the audit findings relating to the key systems of North Ayrshire Council and NHS Ayrshire and Arran and by relevant audit work within service areas that are part of the Health and Social Care Partnership. The annual report on audit work within North Ayrshire Council was presented to the Audit and Scrutiny Committee of the Council on 29 May 2025. The annual report for NHS Ayrshire and Arran was presented to the Audit and Risk Committee of the NHS on 24 June 2025. Agenda Item 8 77
Page 78
2.3 Based on the audit work carried out in the IJB and relevant work carried out in the parent bodies, my opinion is that reasonable assurance can continue to be placed on the adequacy and effectiveness of the IJB’s systems of governance, risk and internal control. Internal Audit Plan 2025/26 2.4 The internal audit plan for 2025/26 was approved by the PAC on 27 June 2025. The IJB has its own audit plan which includes 25 days drawn from the Internal Audit service of North Ayrshire Council – 15 days being utilised to carry out the approved audit assignment for the year. 2.5 A further 10 days have been set aside to fulfil the IJB Chief Internal Auditor role; this will include preparing reports for the IJB, attending meetings and providing training and support to members of the IJB Performance and Audit Committee. 2.6 It was agreed that the 15 days will focus on the IJB’s arrangements for ensuring its ongoing financial sustainability. This follows on from the Audit Commission report ‘Integration Joint Boards – Finance Bulletin 2023/24’ (released in March 2025) which highlights the local and national financial challenges facing IJBs. 2.7 NHS Ayrshire and Arran (NHSAAA) has contracted out the delivery of Internal Audit services to Azets. 3. Proposals 3.1 It is proposed that the Committee notes the North Ayrshire Integration Joint Board annual report for 2024/25 and the approved internal audit plan for 2025/26. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities Agenda Item 8 78
Page 79
4.6 The work of Internal Audit helps to support the efficient delivery of the IJB’s strategic priorities. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 In preparing the draft IJB audit plan, consultation has taken place with the Director and the Chief Finance and Transformation Officer of the North Ayrshire IJB and with the internal auditors of the East and South Ayrshire Integration Joint Boards. Mark Boyd Head of Service (Finance) For further information please contact Anne-Marie Fenton, Interim Senior Manager (Internal Audit), on afenton@north-ayrshire.gov.uk. Background Papers None. Agenda Item 8 79
Page 80
Agenda Item 8 80
Page 81
NORTH AYRSHIRE COUNCIL 20 November 2025 Audit and Scrutiny Committee Title: Internal Audit Reports Issued Purpose: To inform the Committee of the findings of Internal Audit work completed since August 2025. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed since August 2025. Internal control reviews have been completed in respect of the areas detailed in Appendix A to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix A includes the report and action plan from each audit. 2.3 The findings from 5 separate audit assignments are detailed at Appendix A to this report and the levels of assurance for each are noted in the table below: Audit Title Assurance Level Housing Indicators Reasonable / Limited IJB Transformation Substantial HSCP – Overtime Controls Reasonable HSCP – Child Protection Substantial Accounts Payable Transaction Testing Reasonable Agenda Item 9 81
Page 82
3. Proposals 3.1 It is proposed that the Committee notes the outcomes from the Internal Audit work completed since August 2025. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment. Agenda Item 9 82
Page 83
Mark Boyd Head of Service (Finance) For further information please contact Anne-Marie Fenton, Interim Senior Manager (Internal Audit), on afenton@north-ayrshire.gov.uk. Background Papers None. Agenda Item 9 83
Page 84
Appendix A Housing Indicators 2023-2024 1 Background 1.1 The function of this Audit was to validate a sample of Performance Indicators submitted via the Annual Return on the Charter (ARC) for the period 2023-2024. This is a Scottish Housing Regulator (SHR) requirement for social landlords to demonstrate how they are achieving the outcomes and standards contained within the charter. There are no targets set by the Regulator of what they would expect the Landlord to achieve. 1.2 A potential consequence of incorrect reporting and/or missing evidence could be the requirement to re-calculate and submit data to the SHR. There could also be more regular engagement required between the Landlord and Regulator going forward, with a possibility of validation checks being carried out by the Regulator. 1.3 The Auditor was provided with a list of all indicators which were contained within the ARC, and this was reduced to only include those which had not already been previously validated via the Scottish Housing Network. The final sample of 5 was decided after identifying the themes covered by each to ensure it covered a range of PI’s. The 5 Performance Indicators (PIs) tested were as follows:- Indicator 6 – 6.1 – 6.2.2 % of stock meeting SHQS (Scottish Housing Quality Standard) Indicator 12 % of tenants who have had a repairs or maintenance carried out in last 12 months satisfied with the repairs and maintenance service Indicator 15 % of anti-social behaviour cases reported in the last year which were resolved Indicator 21 Average length of time to complete adaptations Indicator 24 % of homeless households referred to RSLs under section 5 and through other referral routes 1.4 We received further information to advise which teams were responsible for gathering the data for the return from the Senior Manager (Governance/Building Services) Performance Indicator Team Responsible Collating Data Housing 6 Property Management & Investments (PMI) 12 Building Services 15 Housing 21 Health & Social Care Partnership (HSCP) 24 Housing Agenda Item 9 84
Page 85
2 Objectives and Scope 2.1 The objectives of the audit were as follows:- Obtain a list of Return on the Charter Performance Indicators and select a sample of 5 for detailed testing. From the sample selected conduct the following tests:- • Obtain any guidance from the regulator regarding definitions of the PIs and how they should be calculated. • Obtain any internal procedure notes describing how the PIs will be calculated and what processes are in place to ensure these are routinely reviewed and kept up to date, especially when national PI’s change. • Review the process for obtaining data for the PI calculation and check for procedures to ensure consistency. • Receive back up evidence for recently published PI’s and confirm calculations are arithmetically correct 3 Findings Applicable to all Performance Indicators 3.1 A copy of the most recent SHR Guidance (2023) was provided and the service stated that any changes to this are advised by the regulator, usually by means of a meeting between the regulator and Landlord/Local Authorities. Any amendments would be provided in PDF format and cascaded to relevant departments and staff members involved in preparing data for ARC. 3.2 There are no formal internal procedure notes in place to ensure the regulator guidance was adhered to for 23/24 or updated where necessary. The auditor was provided with Data Dictionaries (by the Team Manager – Performance – Housing & Public Protect) which are to be used for 24/25. However, these are in draft form and incomplete, therefore it was not possible to review them in full as part of this audit. The Technical Definition (Regulator Guidance) section was completed for all PI Data Dictionaries, however it was noted that some data was missing. Staff responsible for data gathering for each PI were unaware of the Data Dictionaries being a work in progress and intended for use for 24/25. Recommendations for improvement have been advised by email to the Senior Manager (Governance/Building Services) in relation to the internal procedures (Data Dictionaries). (action a) PI 6 - Percentage of stock meeting SHQS 3.3 The following is the final submission figures for Indicator 6. The overall percentage figure for both testing period and projected for following year has been correctly calculated based on the figures below. Agenda Item 9 85
Page 86
3.4 PMI did not provide an internal procedure note for this indicator. PMI were able to provide verbal guidance and show how the figure was calculated for 6.1.1 - The total number of properties within the scope of the SHQS using the Apex system and Iworld. This also included guidance on how properties outwith the scope were excluded. The figure matched what was reported - 13329. The verbal guidance should be included in the Data Dictionaries going forward. (action a) 3.5 It was noted during testing that the figure for 6.1.1 included properties classed as “in abeyance”, which appears to contradict the SHR guidance for the PI. However, the figures in PI6 are not input directly to the return, but pulled through from the figures input to the contextual PI C9. The guidance for C9 does not state that properties subject to abeyance or exemption should be excluded. Officers from PMI contacted the SHR for clarification and they confirmed that the current approach (including properties in abeyance) was correct. Therefore, there is an issue with the guidance document from the SHR which appears to contradict itself regarding the issue of properties subject to exemption or abeyance in these 2 PIs, which should be the same, due to the fact that only one of them is input by the landlord and the other is calculated automatically from that data. (action b). 3.6 PMI were able to provide verbal guidance on how the data was collated however not how the final figure was calculated for 6.1.2, 6.2.1 or 6.2.2. In the absence of internal procedure notes or evidence to support the Auditor was unable to recalculate. Limited assurance is provided for PI 6. (action a) PI 12 – Percentage of tenants who have had repairs or maintenance carried out in the last 12 months satisfied with the repairs and maintenance service 3.7 The following are the final submission figures for Indicator 12. The overall percentage figure has been correctly calculated based on the figures below. Agenda Item 9 86
Page 87
3.8 Building Services were able to provide verbal guidance and show how the figures were calculated for the indicator. A step-by-step guide of the process and systems used (Rocc) was provided, however this requires to be expanded to ensure regulator guidance is followed and updated as required and should form part of the Data Dictionaries going forward. (action a) 3.9 The auditor was satisfied that the surveys were carried out within the correct testing period following the regulator guidance. A total of 1564 tenants took part in the survey which was request by the contractor using a handheld device at the end of the repair works. The evidence provided was summarised into response categories using a Pivot which was re-tested by the auditor confirming the figures submitted were correct for each response. The auditor recalculated the total and percentage satisfied with the repairs service and agreed with the figures in the submission. 3.10 The Guide to Surveying Tenants states the following with regards to PI 12:- “SHR permits landlords to submit existing performance data on repairs and maintenance rather than collect it via the survey. Landlords wishing to use existing performance data should:- (a) ensure the question used in their regular performance monitoring matches the wording of indicator 12. (b) inform the SHR of their intention to use performance rather than survey data. (c) ensure their submission includes details of the time period covered, number of feedback requests issued and the number of returns on which results are based." The auditor found that the SHR had not been advised reporting was via performance data rather than survey for 23/24 and the additional information required (noted in point c) had also not been provided. (action c) 3.11 It was found by the auditor that the wording for the available answers was not as advised within the SHR guidance. It currently reads Satisfied and Dissatisfied (within the Rocc Mobile application) should have read Fairly Satisfied and Fairly Dissatisfied in the survey available answers as per the ARC. This does not have a material impact on the overall percentage reported. It is however suggested the wording is amended Agenda Item 9 87
Page 88
within the Rocc survey to reflect that of the regulator guidance going forward. Reasonable assurance is provided for PI 12. (action c) PI 15 – Percentage of anti-social behaviour cases reported in the last year which were resolved 3.12 The following are the final submission figures for Indicator 15. The overall percentage figure has been correctly calculated based on the figures below. 3.13 Housing (Local Housing Offices and ASBIT) were able to provide verbal guidance and show how the figures were calculated for the indicator. A step-by-step guide of the process/systems used (Access) was provided by ASBIT only - this requires to be expanded to ensure regulator guidance is followed and updated as required and should form part of the Data Dictionaries going forward. (action a) 3.14 The evidence provided for PI 15 does not match what was reported for 15.1 – The number of cases of anti-social behaviour reported in the last year. 961 were reported to the ARC however the total from the evidence was 1030. The discrepancy was identified within the Local Office figures for Irvine with 69 cases not included in the count between the months of January 24 - March 24. The service believes this to have been caused by a typing error. The Data Dictionaries should be updated to ensure that there is a data validation process in place prior to submission to ARC. (action a) 3.15 The evidence provided for PI 15 does not match what was reported for 15.2 – of those at 15.1, the number of cases resolved in the last year. 882 cases were reported resolved to the ARC and the total from the evidence was 891. The discrepancies were identified as follows: • Irvine reported 253, evidence suggests 254 • Kilwinning reported 68, evidence suggests 69 • Three Towns reported 177, evidence suggests 178 • Kilbirnie reported 42, evidence suggests 48 If the overall percentage were to be re-calculated for this PI it would change to 86.50%, meaning the reported figure has been overstated by 5.28 percentage points. (action d) 3.16 The local offices had not retained the required evidence for 15.2 at original report dates (23/24). The report was re-produced in March 2025. If any of the original cases were edited this could provide a reason for the differences. The auditor is unable to confirm this. Limited assurance is provided for PI 15. (action d) Agenda Item 9 88
Page 89
PI 21 – The average time to complete adaptations 3.17 The following is the final submission figures for Indicator 21. The overall percentage figure has been correctly calculated based on the figures below. 3.18 HSCP did not provide an internal procedure note for this indicator. HSCP were able to provide verbal guidance and show how the figure was calculated for both 21.1 and 21.2. In the absence of a procedure note it was unclear as to which date should be used as the starting point. The auditor was verbally advised it should be date approved by Occupational Therapy (OT) however calculations have been based on date assessed by OT. In most cases these dates are the same, but not always. A full procedure note should be created and added to the Data Dictionaries, referring to SHR guidance. (action a) 3.19 The auditor agreed the total adaptations for 23/24 were 860 (2.12). However, it was noted that due to incorrect completion dates being input into the spreadsheet some adaptation days to complete had a negative figure. The reported figure of 77905 is therefore inaccurate. There are a total of 5 negative figures within this data. The service were advised and corrected the 5 identified as errors and a new total of 78387 days was obtained. This would then change the final figure for average time to complete adaptations to 91.15 days. There is also a risk of further keying errors affecting the rest of the data, which are not as easily identified. Limited assurance can be provided for PI 21 (action e) PI 24 – The percentage of homeless households referred to RSLs under section 5 and other referral routes 3.20 The following is the final submission figures for Indicator 24. The overall percentage figure has been correctly calculated based on the figures below. 3.21 Homelessness Prevention and Housing Advice were unable to provide an internal procedure note for PI 24. However, we were verbally advised that reports are run Agenda Item 9 89
Page 90
from Civica and figures are collated by the Co-ordinator - Performance – Housing and Public Protect prior to ARC submission. A pivot is created to summarise results. The auditor assessed the data and re-ran the pivot tables using the evidence provided and it was found to match what was reported. The Data Dictionaries should be updated to provide staff with a step-by-step procedure note, making reference to the SHR guidance for definition, inclusions and exclusions. Reasonable assurance can be provided for PI 24. (action a) 4 Internal Audit Opinion 4.1 An overall Audit opinion was provided as follows for each Performance Indicator:- Performance Indicator 06 - Limited Performance Indicator 12 - Reasonable Performance Indicator 15 - Limited Performance Indicator 21 - Limited Performance Indicator 24 - Reasonable Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. Agenda Item 9 90
Page 91
KEY FINDINGS AND ACTION PLAN Housing Indicators 2023-2024 Action a Finding No formal internal procedure notes are in place to ensure that Regulator guidance is followed and updated as required for the period tested - 23/24. Incomplete Data Dictionaries have been provided and are intended for use for 24/25, however there are currently in draft form. It was also noted that some staff responsible for collating the data for the ARC were not aware of the Data Dictionaries. Action Description Review the SHR guidance and audit recommendations to ensure Data Dictionaries are fully completed and issued to appropriate staff prior to 24/25 SHR ARC return being completed. This will ensure consistency in data collection from year to year. Data Dictionaries should also make reference to what evidence is required to be kept, which format is used to present it and where this should be centrally filed. Risk Inaccurate reporting to ARC as required by SHR, due to inconsistent data collection. Lack of consistency reduces comparability of PIs and therefore usefulness for management decision-making. Lack of clear instructions for new staff if those who currently prepare the PIs are unavailable in the future. Priority (1, 2, 3) 1 Paragraph Reference 3.2, 3.4, 3.6, 3.8, 3.13, 3.14, 3.18, 3.21 Managed by Head of Service (Housing & Public Protection) Assigned to Team Manager (Performance) Due Date 30th September 2025 Management Comment Draft data dictionaries will be updated to reflect comments within the audit report. The Performance Team in HPP will ensure that all indicators have a data dictionary and that these are completed and signed off by the appropriate service. Agenda Item 9 91
Page 92
Action b Finding It was noted during testing that the figure for 6.1.1 included properties classed as “in abeyance”, which appears to contradict the SHR guidance for the PI. However, the figures in PI6 are not input directly to the return, but pulled through from the figures input to the contextual PI C9. The guidance for C9 does not state that properties subject to abeyance or exemption should be excluded. Officers from PMI contacted the SHR for clarification and they confirmed that the current approach (including properties in abeyance) was correct. Therefore there is an issue with the guidance document from the SHR which appears to contradict itself regarding the issue of properties subject to exemption or abeyance in these 2 PIs, which should be the same due to the fact that only one of them is input by the landlord and the other is calculated automatically from that data. Action Description Management should consider writing to the SHR to formally raise the issue that there is inconsistency in their guidance document regarding the inclusion of properties subject to exemption or abeyance in the PIs 6 and C9. Risk Different landlords, or officers preparing the return in different years, will interpret the guidance differently, detracting from the usefulness of the PI for comparison over time or between organisations. Priority (1, 2, 3) 3 Paragraph Reference 3.5 Managed by Head of Service (Housing & Public Protection), Head of Service (Sustainability, Transport & Corporate Property) Assigned to Head of Service (Housing & Public Protection) Due Date 30th June 2025 Management Comment Although the SHR have confirmed NAC’s current interpretation of the guidance is accurate, Housing Services will approach the SHR to discuss the ambiguity in the wording of the guidance. This will form part of a scheduled meeting on 11 June and any follow- up actions agreed with the SHR at that time will be progressed in liaison with PMI. Agenda Item 9 92
Page 93
Action c Finding For PI 12, the wording for the available answers “Satisfied” and “Dissatisfied” should have read “Fairly Satisfied” and “Fairly Dissatisfied” in the survey available answers as per the SHR Guidelines and ARC submission. SHR had not been advised reporting is via performance data rather than survey for 23/24 and the additional information required had also not been provided (as per the guide to surveying tenants) Action Description The available options for the stand-alone questionnaire provided to tenants for reactive repairs via the Rocc Mobile Application should be amended to reflect the SHR guidelines, by adding the word “fairly” as follows (words to be added underlined);- Very Satisfied Fairly Satisfied Neither satisfied or dissatisfied Fairly Dissatisfied Very Dissatisfied Going forward Data Dictionaries should be updated with procedures to ensure SHR are advised of the use of performance data rather than survey and provide additional information they require when using performance data as per the guide to surveying tenants. Risk We are not following the structured wording for the survey as per current SHR guidelines. There is a very small chance that some respondents might have answered differently given the different wording. We have also not followed the procedure set out by SHR when using performance data rather than survey. Priority (1, 2, 3) 3 Paragraph Reference 3.10, 3.11 Managed by Head of Service (Housing & Public Protection) Assigned to Senior Officer (Systems & Intelligence) Due Date Complete Management Comment System has been updated to reflect changes. In the submission of the 2024/25 ARC the following was added to the Comments (Housing quality and maintenance) section: "...Tenant satisfaction with reactive repairs is gathered using transactional surveys throughout the reporting period to ensure feedback is captured timeously and appropriate action taken to address any areas of concern." Agenda Item 9 93
Page 94
Action d Finding For PI 15, incorrect data has been reported to the ARC for 15.1 & 15.2. Action Description ASBIT and Local Housing Offices should review the SHR requirements and ensure data validation checks are in place. Any evidence used in calculations should be retained. This procedure should be contained within the Data Dictionaries. Risk Inaccurate reporting to ARC due to data not being verified prior to submission. Priority (1, 2, 3) 1 Paragraph Reference 3.15, 3.16 Managed by Head of Service (Housing & Public Protection) Assigned to Senior Manager (Housing Operations) Due Date 31st July 2025 Management Comment Monthly ARC reporting will be undertaken, and records will be validated at this point to prevent errors - this will be documented within the data dictionaries. Action e Finding For PI 21, incorrect data has been reported to the ARC due to an error in the data manually typed into the ‘Adaptations Completed’ spreadsheet for 23/24. Action Description Additional quality control checks should be introduced to ensure the start/end dates input to the ‘Adaptations Completed’ spreadsheet are correct, as this affects the overall data reported to ARC. Risk Inaccurate reporting to ARC due to data not being verified prior to submission. Priority (1, 2, 3) 1 Paragraph Reference 3.19 Managed by AHP Senior Manager & Professional Lead Assigned to Service Manager (Community Occupational Therapy, Adaptations and Dirrans Centre) Due Date 30th September 2025 Management Comment Quality checks will be undertaken prior to the information being submitted, ensuring data can be validated and dates are reflective of the work undertaken. This will include an ARC reporting SOP. Data dictionaries will also be updated to note this. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. Agenda Item 9 94
Page 95
IJB TRANSFORMATION 1 Background 1.1 North Ayrshire Health & Social Care Partnership (HSCP) is subject to a significant budget challenge and a recovery plan was agreed in June 2024. It has a large and complex Transformation Plan which aims to achieve significant cost reductions as well as improvements to services. 1.2 In March 2024, a new Transformation Plan covering the period 2024-27 was agreed by the IJB (Integration Joint Board). At the time of this renewal of the plan, the governance arrangements for the Transformation Plan were also reviewed. The projects cover all areas of the HSCP and include large workstreams and small individual projects, and governance arrangements are adjusted according to the scale of the activities. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • there are adequate governance arrangements in place for transformation workstreams • adequate financial monitoring arrangements are in place for the transformation workstreams • that there are adequate programme management arrangements in place for transformation workstreams. 3 Findings Governance Arrangements 3.1 All projects are allocated to a Planning Manager in the HSCP’s Transformation team. The team use a tracker in Microsoft Lists which details all of the projects (79 at the time of audit testing) and can be accessed by all members of the Transformation Board. The fields recorded in the tracker include ownership, anticipated savings, quarterly updates and deliverables and a RAG status. The Planning Managers update the tracker at least once a quarter. 3.2 The information on the tracker is used to produce a one-page dashboard to give a high-level indication of the progress of the Transformation Plan. The dashboard can also be filtered to show information for a particular service. The dashboard is still being refined and some small discrepancies in classification of projects were noted, which the Senior Manager (Strategic Planning and Transformation) stated she would investigate and discuss with the Planning Managers. However, in general the dashboard is a very useful tool for giving an overall impression of the progress being made against the Transformation Plan as a whole. It was agreed during the audit period that the tracker would be presented to the Transformation Board as a standing item on a quarterly basis. 3.3 The Transformation Board meets approximately monthly and is chaired by the Director of the HSCP, or in her absence the Chief Social Work Officer. Agendas and minutes were reviewed by the auditor. It is regularly attended by all of the Partnership’s Senior Management Team, relevant managers from the partnership and other Council Agenda Item 9 95
Page 96
services involved in the projects, and members of the Transformation team. It has an agreed Terms of Reference document which outlines the membership, purpose, remit and reporting lines. It was noted that the Terms of Reference stated that action notes from the Board meetings would be shared at each IJB via the Director’s report, but this has not been done in practice, at the request of the IJB. However, the IJB have received 6-monthly updates on the progress of the Transformation Plan, including a copy of the dashboard mentioned at 3.2. The Senior Manager (Strategic Planning and Transformation) prepared a revised Terms of Reference to reflect the reporting arrangements to be presented to the Transformation Board in July 2025. (action a) 3.4 The Transformation team have developed a suite of template documents for use in project management, including a Project Request Form, Project Initiation Document (PID), Exception Report and Project Closure Report. These documents are required since the governance arrangements were reviewed in March 2024, but they were not required in retrospect for projects that had already commenced. There are too many projects for the Transformation Board to receive an update every time, so reporting is by exception. They receive a PID for every project and receive reports on issues and exceptions. 3.5 The template documents are generally of a high standard, laying out clearly all the information required at the appropriate stage of projects. However, it was noted that in the PID template, the risk section consisted of a standard paragraph referring to the HSCP’s risk approach and stating that “Risks and issues are regularly reviewed and updated as part of project monitoring.” The auditor suggested that it would be appropriate for the PID stage that the risks identified up to that point in the project should be included in the information presented to the board and the Senior Manager (Strategic Planning and Transformation) agreed to add this in. Financial Monitoring 3.6 The Section 95 Officer for the IJB is usually the Head of Service for both Finance and Transformation, although the post is currently vacant and therefore the Principal Manager (Finance) is the interim Section 95 Officer. The Head of Service and the Principal Manager (Finance) are both members of the Transformation Board. Savings attached to the transformation projects are monitored through the tracker. Achievement of savings are also reported to the IJB regularly as part of the budget monitoring reports. The budget monitoring reports do not focus on the Transformation projects or separate them out from other projects and activities. However, the reports are timely and clearly laid out and any variance significant enough to affect the overall outlook of the HSCP would clearly be highlighted given the format and parameters of the reports. 3.7 Each project or programme manages their own budget and any significant deviation would be reported by exception to the Transformation Board. Any that impacted the overall position of the HSCP would also be reported to the IJB as mentioned at 3.4. No significant budgetary divergences have occurred but the processes to be followed are clear. The frequency of reporting and membership of the groups ensure that divergences would be highlighted to senior managers and IJB members in a timely manner. Programme Management 3.8 A sample of 3 projects was selected for review of project management arrangements: Brighter Pathways, Blue Badges and Trakcare. These projects cover different services and are of different sizes, therefore they had different governance Agenda Item 9 96
Page 97
arrangements appropriate to the size. Further details of this testing is outlined at paragraphs 3.10-3.20 below. 3.9 Further to the sample projects, Internal Audit noted during the review of Transformation Board papers discussions relating to the Magic Notes project, which involves use of AI-based software and is expected to bring significant financial savings and improve recruitment and retention of social workers. However, the Council’s Information Governance and IT Customer Teams sent out emails in September 2024 and February 2025 respectively that stated that services must not implement any AI- based solutions without involving the Information Governance and Cyber Security teams at the outset. Assurance was obtained that these teams had been involved and that Data Protection Impact Assessment and corporate procurement processes were being followed. Brighter Pathways 3.10 Brighter Pathways is a large workstream consisting of 7 projects relating to remodelling children and young people’s care options. The Council’s Housing, Education and HR services are involved in some of the projects, alongside the HSCP. The workstream has its own programme board and the individual projects also have project boards. 3.11 The programme has a well-structured risk register, including named responsible officers and mitigating actions. The risk register is reviewed monthly at the Programme Board meeting. A risk was highlighted to the Transformation Board in February 2025 regarding poor attendance, which had led to Programme and Project Board meetings being cancelled. The Planning Manager for the workstream gave assurance that attendance has improved since this exception was highlighted. 3.12 The Head of Service (Children, Families & Justice) is the main budget holder for this workstream. There is a Senior Accountant in the HSCP’s Finance team with responsibility for that service and she provides financial monitoring information to the Head of Service and other managers as part of the routine budget monitoring. She regularly meets with the senior managers in the service to review and discuss the financial position as this is a high-risk area (low volume / high-cost services areas e.g. Children’s residential placements). She regularly prepares projections based on assumed discharge dates etc. She provides the project managers with any costings required for the Brighter Pathways work. Blue Badge Service 3.13 The Blue Badge Service project consisted of a review of the Blue Badge Policy and processes for the administration of blue badges. The project commenced before the current governance structures for the Transformation Plan were in place, but it followed the PRINCE2 project management methodology. The project was completed in November 2024 and a closure report was presented to the Transformation Board in January 2025. 3.14 A risk register was prepared for the project and reviewed regularly by the Planning Manager and the project lead, the Service Manager (Community Occupational Therapy, Adaptations and Dirrans Centre). Only 1 risk was identified. This risk was the subject of an exception report to the Transformation Board and was subsequently resolved. Agenda Item 9 97
Page 98
3.15 The project was completed within existing resources and did not have any savings targets attached to it; therefore no specific financial monitoring was undertaken. Trakcare 3.16 Trakcare is an IT system for the management of appointments and performance reporting, which is being rolled out to all Mental Health services in North, South and East Ayrshire. The project initially commenced in 2020 but has faced delays due to a variety of factors including the complex governance arrangements of working across the different organisations, the complexity of implementing the system in the numerous different specialities and teams within Mental Health, changes of personnel and sickness and maternity leave within the project team. There are 28 teams expected to move over to the system, of which 18 had gone live at 2nd June 2025. The remaining teams are expected to go live by March 2026. 3.17 The project has a project board with a large membership. There were some issues with attendance, which led to a number of meetings being cancelled in the later part of 2024. The frequency of the meetings has been reduced since, but this has ensured that they went ahead as planned. The Planning Manager maintains a project plan spreadsheet to monitor progress of the rollout and produces monthly highlight reports which are shared with the project board. 3.18 The project has a risk register which includes ownership and mitigating actions. Live risks are included in the highlight reports and discussed at the project board meetings. The auditor queried a particular mitigating action which had been uncompleted for several months, as it required sign-off from a specific Clinical Governance Group within NHS Ayrshire & Arran. The planning manager stated that there had been a number of barriers but that a short life working group was being pulled together to ensure that it would be signed off. 3.19 There has been an issue with benefit realisation as the required development of reports in Trakcare, which would allow other databases to be shut down, thus improving the efficiency of administrative processes, has not been as quick as hoped, but this was raised at the Transformation Board and meetings are being held to address the issue. 3.20 There are no savings targets attached to this project and it is generally being managed within existing resources, other than a one-off investment to pay for staff overtime to migrate patient records and appointments. Therefore, there is no specific financial monitoring for the project. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the governance of the HSCP’s Transformation Plan. The current governance arrangements include clear reporting lines and involve senior managers at an appropriate level. The Transformation Board meets regularly and has a good overview of the projects, including access to a tracker which is summarised in a 1-page dashboard. A low priority action has been recommended to correct a discrepancy in the Terms of Reference for the Board. 4.2 Projects have governance arrangements which are appropriate to their size. The documentation required for the projects is clearly laid out and includes the requisite elements to give managers and sponsors the information they require for decision- Agenda Item 9 98
Page 99
making. Risk registers are maintained for the projects and regularly reviewed. Exceptions are escalated and appropriate actions put in place. Financial monitoring arrangements are in place that would highlight any significant divergences from budget. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. Agenda Item 9 99
Page 100
KEY FINDINGS AND ACTION PLAN IJB TRANSFORMATION Action a Finding It was noted that the Terms of Reference stated that action notes from the Board meetings would be shared at each IJB via the Director’s report, but this has not been done in practice, at the request of the IJB. However, the IJB have received 6-monthly updates on the progress of the Transformation Plan. The Senior Manager (Strategic Planning and Transformation) prepared a revised Terms of Reference to reflect the reporting arrangements to be presented to the Transformation Board in July 2025. Action Description The revised Terms of Reference should be presented to the Transformation Board for approval. Risk The arrangements for reporting the progress against the Transformation Plan to the IJB are not compliant with the Terms of Reference of the Transformation Board. Priority (1, 2, 3) 3 Paragraph Reference 3.3 Managed by Director (HSCP) Assigned to Chief Social Work Officer Due Date 20th August 2025 Management Comment The Transformation Board in July was cancelled due to leave, the Terms of Reference is on the agenda for the next meeting on 20th August. At which point this action will be complete. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. Agenda Item 9 100
Page 101
HSCP OVERTIME CONTROLS 1 Background 1.1 Following the finalisation of the 2024/25 outturn position, the Integration Joint Board (IJB) agreed some initial recovery actions at the meeting in June 2024. In line with the requirements of the integration scheme, work has continued to develop the financial recovery plan and identify further targets for financial improvements until the year-end. 1.2 1.3 To strengthen the on-going financial recovery plan to deliver cost reduction targets, it is important to review the controls put in place by HSCP to restrict all but essential overtime working by carrying out control testing against the overtime process. Consequently, the review focussed on the arrangements in place for ensuring that controls around the authorisation and payment of overtime across HSCP are compliant with internal governance and conform with the recovery plan to deliver cost reduction targets, while carefully managing the level of risk. 1.4 A trend analysis of HSCP overtime payments was carried out to compare the cost of overtime over the last two financial years. There has been an overall decrease of 14.92% across both care at home and non-care at home, which amounts to £229k as shown in the table below. Description £ Care At Home Non- Care At Home Overtime amount 23/24 1,537,620.03 1,008,689.67 528,930.36 Overtime amount 24/25 1,308,185.74 955,877.53 352,308.21 Difference 229,434.29 52,812.14 176,622.15 % Decrease 14.92% 5.24% 33.39% 1.5 The drivers for the large expenditure on overtime across the services are reported by HSCP managers to be sickness, staff absence, training issues, safer staffing levels, unforeseen events, vacancies, retirement, to complete short notice court reports and to support children and families in crisis at weekends. 2 Objectives and Scope 2.1 The main objective of the audit was to carry out a detailed review of controls around the authorisation and payment of overtime across HSCP to: • Ensure documented procedures are in place to cover the process of arranging, recording, approving and paying overtime. • Ensure overtime payments are valid, properly authorised and no duplicate overtime payments have been made. 2.2 The period covered by the audit is 1st April 2024 to 31st March 2025 Agenda Item 9 101
Page 102
3 Findings Procedures and Reports 3.1 Care at Home (CAHs) and non-Care at Home (NCAH) overtime process documents relating to arranging, recording, approving and paying overtime were reviewed. 3.2 The review of the most current process notes and operating procedures for HSCP overtime found that they did not incorporate the following, to aid better understanding of the activities involved in overtime processing: • A brief description of each of the activities e.g Transaction upload process, Bank report, Additional time report, Community alarm, Contracted staff etc. • The objective of each activity in the overtime process or procedural documents • Brief descriptions of the systems or applications for capturing overtime activities e.g CM (care management) system, CHRIS (Comprehensive Human Resource Integrated Solution) • An overview of the periodic reporting arrangements e.g. the report type and frequency. • The process for dealing with excess overtime payments in conjunction with finance debt recovery team. (action a) HSCP Overtime Process, Authorisation and Payment 3.3 A sample of 20 overtime payments consisting of Care at Home (CAHs) and non-Care at Home (NCAH) across the HSCP within the last 12 months were reviewed to assess if overtime payments complied with the Overtime Payment procedures. 3.4 The overtime payments generally complied with the HSCP Overtime Control process. However, some issues with adequacy of some individual documents were identified and are summarised below: • Reason stated on a timesheet for overtime was not valid or detailed as only office/visits was captured as reason for some overtime payment totalling £1,019.67. (NB Subsequent to the audit fieldwork, this was highlighted as a potential overpayment and has been referred to the Corporate Fraud Team for further investigation.) • The reasons for 2 overtime payments were not indicated on the timesheets or supporting documents amounting to £1,400.76 • An amendment of the overtime hours on a timesheet was not signed off by the supervisor or authorised signatory to authenticate the amendment. (action b) 3.5 Through a review of the potential overtime duplicate reports, we found that 30 overtime payments, totalling £3,639.28, were overpaid to employees of which 14 payments have been resolved while 16 payments, amounting to £2,397.51, were unresolved but have now been transferred to the finance debt recovery team for recovery. This included 13 overpayments amounting to £2,082.49 to a single employee between August and October 2024 which had been marked as passed to debtors by the team, but had actually been missed and had not been passed to debt recovery. This was passed to debt recovery when highlighted by the auditor. Payment recovery is currently in progress for all the unresolved overpayments and legal proceedings had commenced on one of the debtors. (actions c, d) Agenda Item 9 102
Page 103
3.6 We observed that HSCP overtime payments especially non-CAH and Senior Care at Home are still being processed manually by inputting overtime hours from timesheets into CHRIS. This partly accounted for the duplicate overtime payments and use of incorrect rate or hours in the overtime calculations. The majority of the payments have been recovered from the affected employees. (action c) 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the overtime control process. The overtime payments generally complied with the HSCP Overtime Control process. However, some issues with adequacy of some individual documents were identified to improve the quality of compliance with procedures. An oversight had led to a significant overpayment not being followed up. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. Agenda Item 9 103
Page 104
KEY FINDINGS AND ACTION PLAN OVERTIME CONTROLS PROCESS Action a Finding We have reviewed the most current process notes and operating procedures for HSCP Overtime Controls and observed that the procedures did not adequately incorporate all of the activities of the HSCP Overtime Controls process. Action Description The process notes or operating procedure should be updated to include all activities to aid better understanding of the HSCP Overtime Controls processes. For example, these should be updated to include: • A brief description of each of the activities e.g Transaction upload process, Bank report, Additional time report, Community alarm, Contracted staff etc. • The objective of each activity in the Overtime process or procedural documents • Brief descriptions of the systems or applications for capturing overtime activities e.g CM, CHRIS • An overview of the periodic reporting arrangements e.g. the report type and frequency. • The process for guiding excess overtime payments in conjunction with finance debt recovery team Risk Inconsistent approach by staff, possible key tasks not being carried out and lack of business continuity if staff familiar with the process are not available. Priority (1, 2, 3) 2 Paragraph Reference 3.2 Managed by Director (HSCP) Assigned to Principal Manager (Business Support) Due Date Complete Management Comment HSCP Overtime Controls processes have been updated to reflect the above clarification Action b Finding The overtime payments generally complied with the HSCP Overtime Control process. However, some issues relating to the adequacy of some individual documents were identified such as, the reasons for overtime stated on timesheets were not sufficiently detailed and the amendment of overtime hours on a timesheet was not signed off. Action Description HSCP Admin should always challenge service teams when instances of non-compliance relating to inadequacy of overtime documentations are identified. Risk Non-compliance with process notes or procedures are not identified and corrected which can lead to errors in overtime payments. Poor use of officer time correcting errors. Priority (1, 2, 3) 2 Paragraph Reference 3.4 Managed by Director (HSCP) Assigned to Principal Manager (Business Support) Due Date Complete Agenda Item 9 104
Page 105
Management Comment All HSCP employees have been emailed reminder as to how the overtime claim form should be completed and to ensure the reason for overtime is detailed. HSCP Resourcing team have been reminded to ensure the reasons for overtime are adequately detailed and if not, return the form. Any amendment of overtime hours on a timesheet will be signed off by Administrative Officer. Action c Finding Through a review of the potential overtime duplicate reports, we found that 30 overtime payments totalling £3,639.28 were overpaid to employees of which 14 payments have been resolved, while 16 payments amounting to £2,397.51 were unresolved but had now been transferred to the finance debt recovery team for recovery. We observed that HSCP overtime payments especially non-CAH and Senior Care at Home are still being processed manually by inputting overtime hours from timesheets into CHRIS. This partly accounted for the duplicate overtime payments, use of incorrect rate or hours in the overtime calculations. Action Description The HSCP Business Admin Manager should remind the team to always check the accuracy of payments when they are processing claims to prevent errors. Risk Loss of funds due to errors leading to overtime overpayments. Poor use of officer time correcting errors. Priority (1, 2, 3) 2 Paragraph Reference 3.5, 3.6 Managed by Director (HSCP) Assigned to Principal Manager (Business Support) Due Date Complete Management Comment HSCP Resourcing team have been reminded to always check the accuracy of payments when they are processing claims to prevent errors - once calculated a second staff member checks the claim for accuracy. Once the claim is keyed to CHRIS the Admin Officer checks the keying for accuracy. Action d Finding Through a review of the potential overtime duplicate reports, we found that 30 overtime payments, totalling £3,639.28, were overpaid to employees of which 14 payments have been resolved while 16 payments, amounting to £2,397.51, were unresolved but had now been transferred to the finance debt recovery team for recovery. This included 13 overpayments amounting to £2,082.49 to a single employee between August and October 2024 which had been marked as passed to debtors by the team, but had actually been missed and had not been passed to debt recovery. Action Description HSCP Business Admin should periodically review the overpayments passed to debt recovery to obtain an updated position on progress of the recovery. Risk Overpayments are not recovered in a timely manner. Priority (1, 2, 3) 2 Paragraph Reference 3.5 Agenda Item 9 105
Page 106
Managed by Director (HSCP) Assigned to Principal Manager (Business Support) Due Date Complete Management Comment HSCP Business Admin will undertake a 6-8 weekly check with Debt Recovery to ensure that all overpayments are in progress. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. Agenda Item 9 106
Page 107
GOVERNANCE OF CHILD PROTECTION 1 Background 1.1 Chief Officers (defined by the Scottish Government (SG) as the Chief Constable, Chief Executive of Health Boards and Chief Executive of Local Authorities) are responsible for ensuring their agencies, both individually and collectively, work to protect children and young people. 1.2 The Child Protection Committee (CPC) is the local strategic planning partnership through which Chief Officers discharge this responsibility. The CPC is responsible for developing and implementing child protection policy and strategy across and between agencies. 1.3 The SG published an updated version of the ‘National Guidance for Child Protection in Scotland’ in August 2023. 2 Objectives and Scope 2.1 The objective of this audit was to ensure HSCP can evidence it:- • considered the SG Guidance update and made any necessary changes to procedures and working practices • Clearly communicated any updates to staff • Continues to monitor the impact of North Ayrshire’s approach to child protection to ensure it remains aligned with the aspirations of the Scottish Government guidance 2.2 This audit has focussed on reviewing the governance structure around child protection in North Ayrshire. Individual child protection cases were not considered, or assessed, as part of this Audit. 3 Findings Guidance 3.1 In response to the updated SG Guidance, the Child Protection Lead Officer from each of the 3 Ayrshire councils came together to produce the ‘Ayrshire Multi-Agency Child Protection Practitioner Procedures’. 3.2 These procedures condense information from the SG guidance, but also include:- • key information boxes – to highlight the changes from earlier guidance • practice notes – which give examples of the application of the guidance • flowcharts – to aid understanding of processes 3.3 North Ayrshire’s CPC supplemented the Pan-Ayrshire procedures with briefing notes. These were produced by a short-life multi-agency implementation sub-group set up for this specific task. 3.4 By September 2023, 6 briefings had been produced. These were:- • Child Protection Risk Factors Briefing • Contextual safeguarding 7 minute brief • CP Guidance Risk Factors Agenda Item 9 107
Page 108
• Interim Safety Plan Briefing • Inter-Agency Referral Discussion (IRD) Briefing • Open IRD Process Briefing 3.5 The Service confirmed that briefing notes continue to be produced as necessary. This was evidenced by the Child Protection Lead Officer being involved in the production of guidance on working with 16-17 year olds in May 2024. 3.6 The Head of Service (Children, Families & Justice) confirmed to CPC that the new national guidance was implemented by North Ayrshire in September 2023. Communication 3.7 Each member of the CPC implementation sub-group was responsible for distributing briefings within their own agency. 3.8 Within NAHSCP, briefings were shared with all Team and Senior Managers within Social Work, for further dissemination to relevant officers. Emails were provided by the Service to evidence this. 3.9 There is no central storage location for child protection procedures within HSCP. (action point a) Monitoring 3.10 In order to assess how CPCs were implementing the Child Protection National Guidance, the SG required all CPCs to complete a self-evaluation toolkit and submit their findings. 3.11 This toolkit required CPCs to look at 8 key areas in the Guidance – answer direct questions on implementation with either ‘in full’, ‘in part’ or ‘yet to start’, and then provide narrative responses detailing progress, success and challenges relating to the implementation. 3.12 North Ayrshire’s submission was reviewed by the CPC prior to submission. The Service has confirmed that areas for improvement highlighted by the assessment were incorporated into the CPC Improvement Plan and the related sub-group action plans. 3.13 The ongoing application and impact of child protection procedures across North Ayrshire is monitored in a number of ways:- Pan-Ayrshire 3.14 The CPC Chair, Child Protection Lead Officer and Chief Social Work Officer from each of the 3 Ayrshires meet regularly. This provides an opportunity to share findings, issues etc. CPC 3.15 The CPC maintains an overview of child protection across North Ayrshire agencies via its quarterly meetings. 3.16 As standard, these meetings include:- • updates from Services – (Education, Child Protection Health Team, Children, Families & Justice Services, SCRA, Police Scotland) on current workloads Agenda Item 9 108
Page 109
and emerging issues • updates from CPC sub-groups on current tasks 3.17 The update from the Management Information sub-group includes a quarterly data report on child protection activity in North Ayrshire. This report includes:- • standard indicators set by the Centre for Excellence for Children’s Care and Protection (CELCIS). These have been designed to help CPCs consistently collect, analyse, and report on child protection data. • Additional indicators requested by the CPC to support them with identifying trends within North Ayrshire. 3.18 The above ensures the CPC has timeous information on what is happening across all partner agencies in North Ayrshire and is aware of any areas of concern. 3.19 In addition to the routine monitoring noted above, the CPC also monitors its strategic direction via its 3 year Improvement Plan (2023-2026). This Plan comprises detailed actions for each of its 3 key priorities. Each action in the Plan has monitoring criteria such as how performance will be monitored, reporting frequency and RAG status. All actions are allocated to 1 of the 5 CPC sub-groups for action. HSCP 3.20 Monitoring within HSCP is primarily via professional supervision by a more senior manager. 3.21 Audit has placed reliance on managers having regular updates with their teams. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to North Ayrshire’s overall governance approach to child protection. 4.2 No opinion has been formed on the detail included in procedures, briefing notes or the accuracy of CPC findings as these are specialist in nature, and therefore outwith the knowledge base of the Internal Audit Team. Agenda Item 9 109
Page 110
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. Agenda Item 9 110
Page 111
KEY FINDINGS AND ACTION PLAN GOVERNANCE OF CHILD PROTECTION IN NORTH AYRSHIRE Action a Finding There is no central storage location for child protection procedures within HSCP. Action Description Consideration should be given to creating a central ‘library’ of procedures and guidance notes – accessible by all officers with a role in child protection. Risk Officers are unaware of procedures; officers are using an outdated version of a procedure Priority (1, 2, 3) 2 Paragraph Reference 3.9 Managed by Head of Service (Children, Families & Justice) Assigned to Head of Service (Children, Families & Justice) Due Date 22/12/25 Management Comment We are currently exploring the feasibility of establishing a centralised repository to house all child protection policies and guidelines, with the aim of enabling the workforce to access them more efficiently and with greater ease. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. Agenda Item 9 111
Page 112
ACCOUNTS PAYABLE TRANSACTION TESTING 1 Background 1.1 This audit was conducted as part of the approved 2025/26 Internal Audit Plan and used data analytics to interrogate the Accounts Payable (AP) system on Integra and the procurement card system and examine any anomalies which arose. 1.2 There were 4,672 active Trade Suppliers (for processing payments to standard suppliers, individuals, and social services) and 931 Sundry Suppliers (for processing one-off sundry payments) on Integra as at 8th May 2025. 1.3 There were 100,708 invoices paid to trade and sundry suppliers from 1st July 2024 to 30th April 2025, totalling just over £354.4 million. 1.4 There were 19,110 procurement card transactions made during the period of the audit totalling just under £4.5 million. The SDOL system is the Royal Bank of Scotland Smart Data Online system used to record and manage procurement card transactions. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • duplicate suppliers are identified and de-activated to minimise the risk of duplicate invoices being paid. • duplicate invoices have not gone undetected. • advance payments have been reported to Financial Management for the list of pre-payments at financial year-end. • high value invoices have been properly authorised. • invoices paid to employees are bona fide. • card purchases are in line with the policy and there is adequate separation of duties. 2.2 The audit period was 1st July 2024 to 30th April 2025. 3 Findings Supplier Testing 3.1 Testing was carried out to identify duplicate trade suppliers on Integra. Testing identified 43 duplicate suppliers either by name or bank details. These were passed to the AP team to review and deactivate as appropriate. (action a) Invoice Testing 3.2 The auditor tested for duplicate payments to suppliers, including sundry suppliers, and identified possible duplicates that were investigated further. This check confirmed 126 were duplicates that had already been identified and action taken by the AP team by either processing a reversal, keying a credit or requesting a BACS recall. This testing identified a further 14 potential duplicate invoices totalling £162,301.71 which had not already been identified by the AP team. The potential duplicates have been passed to the AP team to check and arrange recovery. (action b) Agenda Item 9 112
Page 113
3.3 The auditor tested for purchase orders that have been requisitioned and approved by the same person and none were found. There were 2 users with requisitioner and approver roles, but there was a separation of duties in all such cases. E-Procurement has since confirmed the users no longer have both roles. 3.4 There were 12 invoices paid before the invoice date and there were 285 invoices paid more than 1 year after the invoice date. All were checked and there were no findings to note. Advance Payment Testing 3.5 The auditor extracted all payments over £20,000 and tested a sample of 50. There were 26 invoices passed to Financial Management to confirm the payments have been posted to the correct financial year end before the accounts are finalised. The remaining 24 were checked by the auditor and found to be correctly accounted for. Financial Management advised that an invoice totalling £57,217.50 was accrued in error and a reversal was processed to correct it. High Value Payment Testing 3.6 The auditor selected a sample of 10 invoices between £10,000 and £100,000. There were 5 PO invoices and 5 non-PO invoices checked. There were 2 non-PO invoices where the authorised signatory was copied into the email to AP for processing rather than AP being provided with explicit approval from the authorised signatory. (action c) 3.7 The auditor tested a sample of 20 invoices over £100,000. There were 10 PO invoices and 10 non-PO invoices checked. There were 2 non-PO invoices where the authorised signatory was copied into the email to AP for processing rather than AP being provided with explicit approval from the authorised signatory. (action c) Payments to Employees Testing 3.8 The auditor tested for sundry payments to employees. This testing found a £7,000 payment was made to an employee for an Alcohol and Drugs Partnership (ADP) grant for 2024/25 instead of being paid to the Irvine Youth Legacy Centre. The employee took corrective action the same day the money was received by transferring the £7,000 to the group’s bank account as evidenced by the bank statements provided. 3.9 The auditor investigated the circumstances which resulted in such a payment being made. The proper process was not followed by the ADP team within HSCP as the sundry payment request form was sent to AP without any evidence of bank details. AP contacted the (ADP) team to request the missing evidence. On receipt of the evidence, AP did not carry out a check on bank details in line with their process, as the payment was processed even though the bank details on the sundry payment request form differed from the bank statement provided as evidence. If the ADP team and the AP team had carried out checks on the bank details in line with their individual processes, this error would have been avoided. (action d) 3.10 The employee, who works in a different team within the HSCP and volunteers with this group, was asked by the ADP team to complete the details of payment section on the sundry payment request form which includes the bank details. The employee was unable to explain why they completed their personal bank details instead of the groups bank details. In addition, the employee did not notify the ADP team of this error and the corrective action taken. Agenda Item 9 113
Page 114
3.11 The Lead Officer (ADP) confirmed that the ADP team has been advised to return to sending out a form for organisations to complete their bank details, which will be used by the ADP team to complete the sundry payment request form independently of the organisation. 3.12 The auditor found an employee on sick leave with the Council but still receiving payments as a supplier on Integra for providing a service. This has been passed to the Service to investigate further. The Service has also been advised to take action to ensure the employee’s declared interest is properly recorded in line with the Employee Code of Conduct. Procurement Card Testing 3.13 The procurement card report listed 19,110 transactions between 1 July 2024 and 30th April 2025. As at 13th May 2025, there were 142 card transactions totalling £11,966.95 that had not been reviewed or approved and there were 180 card transactions totalling £15,017.23 that had been reviewed but not approved. As per the procurement card policy and procedure, all transactions must be reviewed and approved by 28th of each month and must be checked 48 hours after to ensure all transactions are reviewed and approved before the statement is paid. (action e) 3.14 The card transactions not reviewed and approved have been analysed by Service. Service Number of Cardholders Number of Card Transactions Communities & Housing 8 46 Corporate Service 3 5 Education 13 43 HSCP 14 37 Place 4 11 TOTALS 42 142 The card transactions reviewed but not approved have been analysed by Service. Service Number of Cardholders Number of Card Transactions Communities & Housing 10 37 Corporate Service 1 1 Education 17 45 HSCP 15 92 Place 3 5 TOTALS 46 180 3.15 There are 6 users that are cardholders and approvers, which agreed to the list held by e-Procurement. Transactions by users with this dual role were checked and there were no findings to note. There are small number of exceptions which require a user to have dual roles and a valid reason for this needs to be provided. 3.16 There were 3 transactions reviewed and approved by the same user although the cardholder was different. E-Procurement confirmed that an email was sent to the user Agenda Item 9 114
Page 115
reminding them that transactions should not be reviewed and approved by the same person and there have been no further instances since the reminder email. 3.17 The auditor tested for potential duplicate card transactions. There was a duplicate transaction for £244.12, and the cardholder is contacting the supplier to arrange a refund. There was a duplicate transaction for £147.02, and the cardholder is liaising with the supplier to arrange a refund. 3.18 There were 7 cardholders with transactions above their single transaction limit when compared to the user information report provided by e-Procurement. Further investigation showed that the single transaction limit was higher on SDOL which meant no transactions were made above the single transaction limit. However, the user information report maintained by e-Procurement had not been updated when the procurement card limit amendment e-form was received. E-Procurement has since updated the e-form to include a checkbox to update the user information report to reduce the risk of this happening again. 3.19 There was a cardholder with 1 transaction above the e-Procurement single transaction limit however when SDOL was checked we found that the user had an unlimited single transaction limit, which is the default amount set by the Royal Bank of Scotland when processing a card application (unless otherwise specified). This should have been manually change by e-Procurement as part of the new cardholder process. Although the single transaction limit was not changed at this time, the monthly limit was set to £5,000. This was immediately rectified, and e-Procurement checked all single card transaction limits on SDOL and confirmed that no other cardholder has an unlimited limit. 3.20 The auditor tested for instances of orders being split to bring the purchase below the single transaction limit which is against the procurement card policy and procedure. The auditor found 9 instances where this has happened and related to 6 different cardholders. The cardholders have been contacted and been advised to speak to their line manager to review their single transaction limit or to request a temporary increase to allow for the purchase of one-off high value orders. (action f) 3.21 The auditor noted that £3,336.06 card transactions paid to Amazon were not purchased via an Amazon Business account; however, Procurement advised that Amazon monitors this and contacts users to request they join the Business account. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the controls around the processing of invoices and card payments. Although a number of findings were identified during the audit, the financial impact of these is not material when compared to the total number and overall value of transactions. Agenda Item 9 115
Page 116
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. Agenda Item 9 116
Page 117
KEY FINDINGS AND ACTION PLAN ACCOUNTS PAYABLE TRANSACTION TESTING Action a Finding Testing was carried out to identify duplicate trade suppliers on Integra. Testing identified 43 duplicate suppliers either by name or bank details. These were passed to the AP team to review and deactivate as appropriate. Action Description The AP team should review the list of duplicate suppliers and deactivate suppliers as appropriate. The AP team should be reminded to check if the supplier is already on the system before they are added again. Risk Duplicate invoices may be paid to the same supplier via different supplier numbers. Priority (1, 2, 3) 1 Paragraph Reference 3.1 Managed by Head of Service (People & ICT) Assigned to Team Manager (Customer Services) Due Date 31/12/2025 Management Comment AP team will review the list and deactivate duplicate suppliers identified. Action b Finding Duplicate testing identified 14 potential duplicate invoices totalling £162,301.71 which had not already been identified by the AP team. The potential duplicates have been passed to the AP team to check and arrange recovery. Action Description The AP team should review the potential duplicate payments and arrange for recovery of monies paid twice. Risk The Council has paid the same invoice twice and the money has not been recovered. Priority (1, 2, 3) 1 Paragraph Reference 3.2 Managed by Head of Service (People & ICT) Assigned to Team Manager (Customer Services) Due Date 28/02/2026 Management Comment AP team will review the list of duplicate invoices and take necessary action to recover these from suppliers. Action c Finding Approval testing found 4 non-PO invoices where the authorised signatory was copied into the email to AP for processing rather than AP being provided with explicit approval from the authorised signatory. Action Description AP should advise all approvers that they must specifically state within the email to AP that they approve an invoice for payment. The AP team should be advised only to accept emails with explicit approval from the authorised signatory and should not accept instances where the approver is copied into the email. Risk Authorised signatory may not check email before payment is made resulting in an unauthorised payment; lack of proper audit trail for the approval of invoices. Priority (1, 2, 3) 1 Paragraph Reference 3.6, 3.7 Agenda Item 9 117
Page 118
Managed by Head of Service (People & ICT) Assigned to Senior Manager (Customer Services) Due Date Complete Management Comment AP have now implemented a new process which states that an email must be sent directly from the approving manager authorising payment. An email has been issued to all services advising payment will not be processed until this has been received. Action d Finding The auditor investigated the circumstances which resulted in an ADP grant being paid to an employee instead of being paid to the Irvine Youth Legacy Centre, which the employee volunteers with. The proper process was not followed by the ADP team within HSCP as the sundry payment request form was sent to AP without any evidence of bank details. AP contacted the ADP team to request the missing evidence. On receipt of the evidence, AP did not carry out a check on bank details in line with their process, as the payment was processed even though the bank details on the sundry payment request form differed from the bank statement provided as evidence. If the ADP team and the AP team had carried out checks on the bank details in line with their individual processes, this error would have been avoided. Action Description The AP team should be reminded to check evidence of bank details provided matches bank details on the sundry payment request form. Risk Payment is made to the incorrect recipient which may not be recoverable. Priority (1, 2, 3) 2 Paragraph Reference 3.9 Managed by Head of Service (People & ICT) Assigned to Senior Manager (Customer Services) Due Date Complete Management Comment AP team have put in additional checks to tighten up this area and ensure bank details are correct before payment is processed. Action e Finding The procurement card report listed all transactions up to 30th April 2025. As at 13th May 2025, there were 132 card transactions totalling £11,966.95 that had not been reviewed or approved and there were 174 card transactions totalling £15,017.23 that had been reviewed but not approved. As per the procurement card policy and procedure, all transactions must be reviewed and approved by 28th of each month and must be checked 48 hours after to ensure all transactions are reviewed and approved before the statement is paid. Action Description Cardholders and approvers should be reminded to review and approve transactions by the 28th of each month in line with the Procurement Card Policy and Procedure. There should be an escalation process in place if transactions continue not to be reviewed and approved. Risk Purchases are paid before they have been reviewed and approved. Delayed transfer of transactions to the general ledger which impacts budget monitoring. Agenda Item 9 118
Page 119
Priority (1, 2, 3) 2 Paragraph Reference 3.13 Managed by Head of Service (People & ICT) Assigned to Senior Manager (Customer Services) Due Date Complete Management Comment A system generated email is currently issued 3 times per week to all SDOL users to remind them to review and approved transactions. A quarterly report is issued to Senior Managers which highlights those that are outstanding for action. Emails issued advise that access will be removed from users who are persistently late in reviewing / approving. Action f Finding The auditor tested for instances of orders being split to bring the purchase below the single transaction limit which is against the procurement card policy and procedure. The auditor found 9 instances where this has happened and related to 6 different cardholders. The cardholders have been contacted and been advised to speak to their line manager to review their single transaction limit or to request a temporary increase to allow for the purchase of one-off high value orders. Action Description e-Procurement should issue a reminder to cardholders that transactions should not split to bring the purchase below the single transaction limit which is against the procurement card policy and procedure. If such cardholders need the single limit to be amended, the cardholder should complete the amend a limit form and get the appropriate approval for such a change. Risk Non-compliance with the procurement card policy and procedure; circumventing authorised limit. Priority (1, 2, 3) 2 Paragraph Reference 3.20 Managed by Head of Service (People & ICT) Assigned to Senior Manager (Customer Services) Due Date Complete Management Comment Further to the last audit where this same issue was picked up and an email issued to users to remind them that this is against the policy, another reminder email has been issued. Staff across services are responsible for ensuring that they comply with the policy. Agenda Item 9 119
Page 120
Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. Agenda Item 9 120