9 - Internal Audit Reports Issued
North Ayrshire Council · 29 January 2026
Back to Audit and Scrutiny Committee — 29 January 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 29 January 2026 Audit and Scrutiny Committee Title: Internal Audit Reports Issued Purpose: To inform the Committee of the findings of Internal Audit work completed since November 2025. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed since November 2025. Internal control reviews have been completed in respect of the areas detailed in Appendix A to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix A includes the report and action plan from each audit. 2.3 The findings from 3 separate audit assignments are detailed at Appendix A to this report and the levels of assurance for each are noted in the table below: Audit Title Assurance Level Council Tax and NDR Refunds Reasonable Homelessness Substantial Income Collection Substantial
Page 2
3. Proposals 3.1 It is proposed that the Committee notes the outcomes from the Internal Audit work completed since November 2025. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact Paul Brown, Senior Manager (Internal Audit), on paulbrown01@north-ayrshire.gov.uk. Background Papers None.
Page 4
Appendix A Council Tax and NDR Refunds 1 Background 1.1 On 12 December 2024, the Accounts Commission considered a report from the Controller of Audit (under powers in s102 (1) of the Local Government (Scotland) Act 1973) in relation to a significant council tax refund fraud perpetrated against one of the Local Authorities in Scotland. 1.2 This audit was prompted by the fraud case to ensure that controls are in place to prevent such an incident in North Ayrshire Council. 1.3 Consequently, the review focussed on the arrangements in place for ensuring that controls around the Council Tax and NDR (Non-Domestic Rates, also known as Business Rates) Refunds are operating effectively and will safeguard public assets. 1.4 Customer Service team are responsible for processing Council Tax (CT) refunds while Business Rates team in Finance are in charge of NDR (Non-Domestic Rates) refunds. 1.5 A trend analysis of Council Tax (CT) refunds was carried out to gain insight of the amount of refunds in the last five financial years. There has been an average increase of 13% over the years, which amounts to £369k as shown in the table below. 1.6 Customer Service team are responsible for processing Council Tax (CT) refunds while Business Rates team in Finance are in charge of NDR (Non-Domestic Rates) refunds. 1.7 The reasons for the refunds as reported by the Financial Management & Revenue team and Customer Service team were due to account termination, refund arising from moving out of an area, refunds from property sold, Disabled Banding Reduction, Council Tax overpayment, Long Term Care Exemption and other Council Tax exemptions.
Page 5
2 Objectives and Scope 2.1 The main objective of the audit was to carry out the review of controls around the Council Tax and NDR (Non-Domestic Rates, also known as Business Rates) Refunds to ensure they are operating effectively and will safeguard public assets to: • Ensure documented procedures are in place to cover the process of Council Tax and NDR refunds. • Ensure Council Tax and NDR refunds are valid, authorised and correctly paid into appropriate individual accounts. 2.2 The period covered by the audit is 1st April 2024 to 31st March 2025. 3 Findings Procedures, Segregation of duties and Reconciliation 3.1 Council tax (CT) refunds and Non-Domestic Rates (NDR) refund operating procedures, covering the oversight controls, refunds authorisation and correctness of refunds payment into appropriate individual accounts, were reviewed. 3.2 The review of the most current process notes or operating procedures for CT refund found that they did not incorporate the following, to aid better understanding of the activities involved in refund processing: • A brief description of CT refund activities stating how customer would make or initiate a request for refund or through account update. • Customer requirements and refund methods detailing list of documents required before refunds are processed. • Brief descriptions of the systems or applications for capturing refund activities e.g NEC RBLive (revenues) and Integra. • The operating procedures should mention that all supporting documents for any process that would trigger a fund should be obtained before processing a refund. • Refunds of £200 and above must all be audit checked (within the Council Tax team) as stated in the procedures. Meanwhile, details of the 100% checks were not documented in the current process notes or operating procedures to guide compliance. Refunds under £200 should have 10% audit checked (within the Council Tax team) as stated in the procedures. Meanwhile, details of the 100% checks were not documented in the current process notes or operating procedures to guide compliance. (action a) 3.3 We noticed that refund approval limits were not outlined in the Business Rates procedures. However, the review of the authorisation email sent to Accounts Payable team revealed that Senior Manager approval limit was £10M while Manager approval limit was £250,000. The current business rate refund process has been updated to reflect the gap at the suggestion of the auditor during the audit 3.4 We observed that CT staff are aware of the roles of Council's Corporate Fraud Team and that they can report any cases they have concerns over, to them for investigation.
Page 6
However, this is yet to be documented in the operating procedures or process documents. (action b) 3.5 The review of Finance Service Risk Register revealed that there is no evidence that risk of fraud and error in relation to NDR refunds have been assessed, mitigated and documented in the risk register to prevent risk crystallization. Also, we noticed that the risk register for Customer Services in respect of CT is currently undergoing review by Finance. (action c) Council Tax (CT) and NDR Refunds Process, Authorisation and Payment 3.6 A sample of 20 Council Tax (CT) refunds and 20 NDR refunds processed within the last 12 months were reviewed to assess if controls aren’t being overridden by confirming authorisation and correctness in line with procedures. 3.7 On NDR refunds, the review generally complied with the refund process. However, some issues with adequacy of some individual documents were identified and are summarised below: • A confirmation letter of new bank details from a customer was not signed. Although, the NDR team said business email was provided within the content of the email and sufficient to carry out the bank details update. (action d). • Business Rates Refunds Procedure states that if the refund is greater than £1,000 then the Debt Recovery Team (DRT) should be contacted to check that there are no outstanding accounts on their system for the Ratepayer, alternatively the Corporate Arrears Recovery System (CARS) can be checked. Although the checklist was ticked that DRT checks have been done, there were no documents in the files to substantiate that the DRT check was carried out for the audit trail. (action d) 3.8 We compared the recipients’ bank details of the sampled CT and NDR refunds against the bank details held by payroll to ensure that refunds are valid and have been processed by an unrelated member of staff. No issues were noted. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the Council Tax and NDR refunds. The Council Tax and NDR processes generally complied with the operating procedures. However, some issues with adequacy of some individual documents were identified to improve the quality of compliance with procedures. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management
Page 7
and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 8
KEY FINDINGS AND ACTION PLAN COUNCIL TAX AND NDR REFUNDS Action a Finding We have reviewed the most current process notes and operating procedures for CT refunds found that they did not incorporate all of the activities of CT, to aid better understanding of the activities involved in refund processing. Action Description The process notes or operating procedure should be updated to include all activities to aid better understanding of the CT processes. For example, these should be updated to include • A brief description of CT refund activities stating how customer would make or initiate a request for refund or through account update. • Customer requirements and Refund methods detailing list of documents required before refunds are processed. • Brief descriptions of the systems or applications for capturing refund activities e.g NEC RBLive (revenues) and Integra. • The operating procedures should mention that all supporting documents for any process that would trigger a refund should be obtained before processing a refund. • Refunds of £200 and above must all be audit checked as stated in the procedures. Meanwhile, details of the 100% checks were not documented in the current process notes or operating procedures to guide compliance. • Refunds under £200 should have 10% audit checked as stated in the procedures. Meanwhile, details of the 100% checks were not documented in the current process notes or operating procedures to guide. Risk Inconsistent approach by staff, possible key tasks not being carried out and lack of business continuity if staff familiar with the process are not available Priority (1, 2, 3) 2 Paragraph Reference 3.2 Managed by Head of Service (People & ICT) Assigned to Team Manager (Customer Services)) Due Date 31 January 2026 Management Comment The CT refund process notes and operating procedures have been updated to address the findings from the audit. The updated procedures are currently with Audit for review. Once approved, the revised procedures will be issued to the team, and staff briefings will be held to ensure everyone is aware of the requirements.
Page 9
Action b Finding We observed that CT staff are aware of the roles of Council's Corporate Fraud Team and that they can report any cases they have concerns over, to them for investigation. However, this is yet to be documented in the operating procedures or process documents. Action Description The process notes or operating procedure should be updated to include the roles of Council's corporate fraud team and commitment to report cases they have concerns over, to them for investigation. Risk Cases that require further investigations may not be channelled appropriately which could impact necessary actions in accordance with the Council’s policy. Priority (1, 2, 3) 3 Paragraph Reference 3.4 Managed by Head of Service (People & ICT) Assigned to Team Manager (Customer Services) Due Date 31 January 2026 Management Comment The CT refund process notes and operating procedures have been updated to address the findings from the recent audit regarding the role of the Council’s Corporate Fraud Team. The updated procedures are with Audit for review. Once approved the revised guidance will be issued to the team and staff briefings will be held to ensure everyone understands the requirements. Action c Finding The review of Finance Service Risk Register revealed that there is no evidence that risk of fraud and error in relation to NDR refunds have been assessed, mitigated and documented in the risk register to prevent risk crystallization. Also, we noticed that the risk register for Customer Services in respect of CT is currently undergoing review by Finance. Action Description Financial Management should ensure risks around potential errors or frauds are assessed and controls to prevent crystallizing are documented in the risk register for monitoring. Risk Risks not proactively identified, assessed, mitigated and monitored may cause business disruptions. Priority (1, 2, 3) 2 Paragraph Reference 3.5 Managed by Head of Service (Finance) Assigned to Team Manager (Revenues) Due Date 31st December 2025 Management Comment The risk of fraud for Non-Domestic Rates refunds will be incorporated within the Financial Services Risk Register and scored appropriately with mitigations identified.
Page 10
Action d Finding The NDR refunds generally complied with the Business Rate Operating procedures. However, some issues relating to the adequacy of some individual documents were identified such as, confirmation letter of a new bank details from a customer was not signed and the checklist was ticked that DRT checks have been done but there were no documents in the files to substantiate that the DRT check was carried out as audit evidence. Action Description The Team Manager (Revenues)/Financial Mgmt&Revenues) should always challenge the processor when instances of non- compliance relating to inadequacy of refund documentations are identified. The Team Manager (Revenues)/Financial Mgmt&Revenues) should ensure that the change in the bank details was confirmed by ensuring the confirmation letter is signed and the signature on the letter align with records on the Council system. Risk Non-compliance with process notes or procedures are not identified and corrected which can lead to errors in refund payments. Priority (1, 2, 3) 2 Paragraph Reference 3.7 Managed by Head of Service (Finance) Assigned to Team Manager (Revenues) Due Date Completed Management Comment Staff have been and will continue to be reminded that when setting up a Direct Debit or completing a change of bank details, this should only be carried out on receipt of a completed Direct Debit mandate. Within the refund procedure document, the check for arrears can either be a check with the Debt Recovery Team, or a check on the Corporate Arrears Recovery System (CARS) by the person requesting the refund. Therefore, the DRT check column within the “Authorisation for Online Business Rates refunds” sheet is completed when any check is carried out for arrears as part of the procedure. Following the recommendations from this report, a separate column has now been added to the Authorisation for Online Business Rates refunds sheet, with the heading “CARS check”. This will allow the refund to be clearly documented on which part of the procedure was used for the arrears check. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 11
Homelessness 1 Background 1.1 The Scottish Government declared a national Housing Emergency on 15 May 2024 and 13 local authorities have declared their own housing emergencies due to the unprecedented pressure to meet their statutory responsibilities towards homeless people and other priority groups in housing need. On 2 September 2025, the Scottish Government published its Housing Emergency Action Plan, with three main areas of focus: • Ending children living in unsuitable accommodation. • Supporting the housing needs of vulnerable communities; and • Building our future - maximising investment in Scotland’s housing sector. 1.2 North Ayrshire Council has not declared a housing emergency. It has identified measures in the Local Housing Strategy 2023-28 to increase housing supply and manage demand from homeless people. 1.3 The Council is currently developing its first Homelessness Prevention Strategy. The original timeline was adjusted to allow incorporation of the new prevention duties introduced by the Housing (Scotland) Act 2025. The Strategy’s development is on track, with a report due to be presented to Cabinet in June 2026. 1.4 People who present as homeless or at risk of homelessness to North Ayrshire Council are assisted by the Housing Advice team and, if required, the Temporary Accommodation team. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • the Council has suitable arrangements in place for planning and monitoring of the Homelessness service, in order to meet legislative requirements and Council priorities • suitable procedures are in place to process cases timeously and in line with legislation, Council policy and performance targets • adequate monitoring of performance takes place and that performance data and issues arising within the service are reported to those with oversight • personal and sensitive data is adequately protected. 2.2 The audit focussed on the work of the Housing Advice and Temporary Accommodation teams. Review of Temporary Accommodation was limited to processes relating to homeless presentations, which interface with the work of the Housing Advice team. 3 Findings Governance Arrangements 3.1 There is a large amount of legislation governing the work of the Housing Advice and Temporary Accommodation teams, including the most recent Housing (Scotland) Act 2025, which was enacted during the period of audit testing. North Ayrshire Council is an active participant in several different professional networks and is in regular contact with the Scottish Government, in order to keep up-to-date with legislation and best practice in the field.
Page 12
3.2 The Local Housing Strategy (2023-28) contains a detailed action plan and Cabinet received updates on the progress in implementing this plan in January and September 2025. 3.3 Housing participates in a joint risk management process with Property Management & Investment, due to shared responsibilities for housing assets, including those with tenants in situ. The Integrated Asset Management (Housing) risk register is reviewed regularly. It includes 5 risks relating to homelessness, which all have mitigating actions identified, and assurance was obtained during the audit that these actions are being implemented. Processing of Cases 3.4 The Housing Advice and Temporary Accommodation teams provided a large number of procedure documents which were reviewed on a sample basis. One document reviewed was subsequently established to be no longer in use. All other documents reviewed were well laid-out and up-to-date, except for a section in the Homelessness Procedures document, relating to Inquiries into Local Connection, which had been highlighted by the team as requiring update in the most recent review, but not updated. This was updated during the period of the audit. 3.5 Cases are not prioritised per se. They are assessed to ensure that they are unintentionally homeless, as defined in the legislation, but all homeless cases are high priority. 3.6 A sample of homeless applications processed between June and August 2025 were reviewed in the Abritas system. No significant issues were identified. 3.7 A sample of temporary accommodation cases during the same period were also reviewed in the Abritas system. No significant issues were identified. Monitoring and Reporting 3.8 The Housing service have a variety of internal performance monitoring processes and indicators that ensure that performance is kept under review and any corrective actions can be identified promptly. This is the case at all levels from supervision of individual cases up to performance reporting to the Head of Service (Housing and Public Protection). Furthermore, performance statistics are reported quarterly to the Scottish Government and the Scottish Housing Network undertake an annual audit. Information Security and Data Protection 3.9 The teams record a large amount of personal data, including some highly sensitive data such as details of medical conditions and criminal history. Some is contained in attachments, such as forms filled in during interviews and copies of proof of ID, but the officers record notes in the Notes and CRM screens of Abritas which can also contain highly sensitive data. However, for serious offenders subject to SOLO (Serious Offender Liaison Officer) or MAPPA (Multi Agency Public Protection Arrangements) the notes are minimised. 3.10 Abritas has retention period of 3 years for attachments built in, but this does not apply to the notes input by officers. The Team Manager (Housing Innovation and Digital Development) contacted Civica, the provider of the Abritas system, during the audit period to ask for advice on data retention in the notes.
Page 13
3.11 The team also use the NEC Housing system and it was confirmed that this system has a process for anonymising the data and any data generated in the system is available for download for a year and then archived to an area that only IT can access. 3.12 The data held on network drives requires to be reviewed to ensure that records are deleted once they have gone beyond their retention period. However, Housing are due to move to MS Sharepoint in 2026/27 as part of the Council-wide rollout. The implementation of Sharepoint includes a complete review of all documents in the network drives and those transferred to Sharepoint will be allocated to a retention policy within the system. 3.13 Most paper records are shredded as soon as they are scanned in. Temporary Accommodation retain hard copies of tenancy agreements, which are sent to archive. 3.14 User lists were obtained from the Abritas and NEC Housing systems for users with access to the Homelessness and Temporary Accommodation functions within those systems. These were matched to the Council’s payroll system to identify any leavers and ensure that all users had appropriate roles to have access to those functions. 3.15 For Abritas there were no leavers, and all users were found to require access to the Homelessness and Temporary Accommodation functions for their job roles 3.16 For the NEC system, there were 64 leavers set up in the system, but the auditor was informed that it was necessary to keep leavers in the system, in order to retain the records associated with them, but that their accounts are locked so they wouldn’t be able to log into the system. The auditor also sent several queries to the team as follows: • 2 users that did not match to an employee in CHRIS • 7 pairs of possible duplicate accounts • 8 employees in roles outwith the Housing Advice and Temporary Accommodation teams. The team subsequently confirmed that: • 1 non-match is a current employee who has had a change of name • The other non-match is believed to be an inspector from the regulator, but this account has been inactivated anyway • The duplicate accounts are because the system doesn’t allow changes of name, so a new account has to be created and the old one deactivated • 2 users from other teams within Housing and 1 within HSCP require the access for their roles, the other 5 employees from other teams are inactive 3.17 User lists were obtained for the HAPA and Homeless Prevention Team network drives and these were also matched to payroll. This identified that only current employees had access, but it did identify 2 employees (1 from HSCP and 1 from Customer Services) who had access to the Homeless Prevention Team folder but do not require it for their job roles. The service contacted IT to get this access removed from those 2 users during the period of the audit. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to homelessness. The Council has suitable arrangements in place for planning and monitoring of the Homelessness service, in order to meet legislative requirements and Council priorities.
Page 14
Suitable procedures are in place to process cases timeously and in line with legislation, Council policy and performance targets. Personal and sensitive data is generally adequately protected – the supplier has been approached about possible improvements to the removal of expired data in the Abritas system. The service will be moving to MS Sharepoint next year, which will improve the management of records within the shared drives. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 15
INCOME COLLECTION 1 Background 1.1 Civica is the income management system used by NAC. 1.2 In 2022/23, Audit carried out a review of the user controls within Civica to ensure that access was being suitably limited and controlled. A ‘Reasonable’ audit opinion was given, and 2 action points were raised. These 2 actions have been revisited as part of this audit. 1.3 The current audit focussed on ensuring the accuracy of the information moving through Civica. 2 Objectives and Scope 2.1 The objective of this audit was to ensure:- • the overall security of the Civica system, • officers are appropriately trained prior to using Civica, • individuals’ payment details are protected, irrespective of the method of payment used, • there are processes in place to confirm the accuracy of the information in Civica, • there are processes in place to ensure information transferred out of Civica is accurate, • there is evidence that the actions identified during the 2022/23 audit have been completed.
Page 16
3 Findings Security of Data Processed via Civica 3.1 The Council procured Civica (originally known as CivicaPay) in 2019 to replace PARIS. Procurement was via a direct award through the Crown Commercial Framework. 3.2 In 2023 NAC modified its contract with Civica to include Midcall. Midcall is a Payment Card Industry Data Security Standard (PCI DSS) compliant system for taking telephone card payments. 3.3 Reliance has been placed on the supplier review undertaken by Crown Commercial as evidence of Civica’s ability to adhere to the security standards listed in the contract. Remote Access to Civica 3.4 The Council’s ‘ICT Acceptable Use Policy’ states that “Multifactor authentication is mandatory for all remote and/or privileged access and is strongly encouraged for all other Council systems access.” 3.5 Discussions with ICT highlighted that whilst the Civica system does not support Microsoft365 (which multifactor authentication is a function of), alternative access controls are in place in the form of a trusted IP whitelist held by Civica, which limits access to the portal to NAC devices Training of Officers 3.6 Individual Services are responsible for ensuring their Civica users are appropriately trained. 3.7 Audit reviewed the spread of Civica users across the Council and asked the 3 Services with the highest number of users to confirm their approach to training. Responses from Financial Management, Customer Services and Housing were all found to be satisfactory. 3.8 Audit also reviewed the training records of all users who have the authority to record cash transactions in Civica to ensure that cash handling training has been completed. Only 1 employee was found to have not yet completed the training. The Service has agreed to rectify this as soon as possible. Income Collection 3.9 There are a number of methods through which individuals can make payments to the Council. Audit has reviewed each of these to ensure the risk to the individuals payment details have been minimised:- 3.10 Income collected via NAC website – when an individual makes a payment via the NAC website they are linked directly to Civica to complete the transaction. The individual inputs their own card details and there is no council officer intervention required in the process. 3.11 Income collected via an in-person card transaction – the council officer taking the payment has no role in the input of the card details. The officer records the transaction details in Civica and then activates the PIN Entry Device (PED) for the payee to input
Page 17
their card and PIN. The officer gets notification when the transaction has been completed successfully but doesn’t have access to the card details. 3.12 Income collected via phone – in 2023 the Council modified its contract with Civica to include the Midcall system. Midcall is used to take card payments over the phone. With Midcall, the officer records the transaction in Civica and then uses Midcall to allow the caller to input their own card details. The officer cannot see card details at any point of the transaction and the keypad tones are distorted. Midcall is Payment Card Industry Data Security Standard (PCI DSS) compliant. 3.13 Cash/cheques – the risk to personal details is minimal when paying by cash/cheque. Income via cash/cheques is very low – with only 0.02% of all income input directly into Civica in 2024/25 being in the form of cash, and 4% as cheques. 3.14 Income originating in other independent systems (such as Paypoint, ParentPay, DWP, standing orders direct to Council’s bank account etc) and then imported into Civica - the security of these independent systems has been deemed outwith the scope of this audit. Information in Civica 3.15 There are a number of processes in place that confirm the accuracy of the information recorded in Civica. These include:- • Financial Management completing a voucher daily. The voucher summarises the income taken by fund, by method of payment and also the total income to be included in export files. • Financial Management transferring Civica income information from the voucher into the Council’s cashbook daily. The cashbook is reconciled to the Council’s bank statement, thereby confirming that the income recorded in Civica matches the actual income received. • Financial Management reviewing any transactions that have ended up in suspense daily. These transactions are incomplete (normally due to the wrong reference number being used) and so can’t be processed. Once corrected these transactions can move through the Civica processing process. • ICT receiving an email alert if any of the daily import files from independent systems fail. This ensures any issues are identified timeously. 3.16 Audit tested the above processes by:- • Confirming there are procedure notes covering the completion of the voucher, the transfer of information to the cashbook and the review of the suspense account. All procedures were found to be detailed and contain screenshots, filepaths etc to assist the reader. • Confirming the completion of the voucher and accurate transfer of information into the cashbook for a sample of dates in 2025/26. • Confirming with ICT that the email alert system remains in place for all import files Transfers of data out of Civica 3.17 Every night export files are automatically generated to transfer transaction information from Civica into other Council systems – such as Integra, Council Tax, NDR etc. 3.18 Processes are in place to ensure the accurate transfer of transactions from Civica into Integra and its back-end systems. These include:-
Page 18
• Financial Management confirming the total of the export report from Civica matches the total income per the Civica Voucher daily. This gives assurance of the completeness of the export file. • Financial Management carrying out a daily check to ensure that all transactions that affect customer accounts eg rent, council tax etc have been fully cleared out of Civica during the export process. Any balances left behind would result in double counting and incorrect balances in customer accounts when the next night’s export file ran. • ICT receiving an email alert if any of the daily export files fail. This ensures any issues are identified timeously. 3.19 Audit tested the above processes by:- • Reviewing the export reports retained by Financial Management and ensuring the total matched the Civica voucher (for the same sample dates as tested in 3.16 above). • Reviewing the evidence of the checks that ensure all transactions had been cleared out of Civica (for the same sample dates tested at 3.16 above) • Confirming with ICT that the email alert system remains in place for all export files Follow Up on 2022/23 Audit Findings 3.20 Action a required the password criteria for Civica to be increased to a minimum of 12 characters. 3.21 ICT was able to supply evidence that this has been completed 3.22 Action b required the Service to ensure that all Civica users, both internal or external to the Council (eg NHS officers) had accepted the Council’s Acceptable Use Policy (AUP). 3.23 This remains an ongoing issue which ICT are working on. This point has been included as an action within the 2024/25 ICT Access Controls Audit and has therefore not been duplicated as part of this audit’s findings. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard income being recorded through Civica. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and
Page 19
control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.