6 - Internal Audit and Corporate Fraud Action Plans - Quarter 3 Update
North Ayrshire Council · 12 March 2026
Back to Audit and Scrutiny Committee — 12 March 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 OFFICIAL INFORMATION OFFICIAL INFORMATION NORTH AYRSHIRE COUNCIL 12 March 2026 Audit and Scrutiny Committee Title: Internal Audit and Corporate Fraud Action Plans: Quarter 3 Update Purpose: To advise the Audit and Scrutiny Committee on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 31 December 2025. Recommendation: That the Committee notes the current position with the implementation of Internal Audit and Corporate Fraud actions. 1. Executive Summary 1.1 The CIPFA document 'Audit Committee Principles in Local Authorities in Scotland' highlights that Audit Committees should monitor and review the progress made in implementing audit recommendations. 1.2 Service managers are responsible for ensuring that agreed actions arising from Internal Audit and Corporate Fraud reviews are implemented. This provides assurance that identified control weaknesses have been addressed and are being managed effectively. 1.3 All actions are monitored on the Pentana system and service managers are responsible for updating Pentana as they progress each action. This enables Internal Audit to monitor progress on a 'real-time' basis and address any delays in implementation. 1.4 This report details the position as at 31 December 2025. 2. Background 2.1 The last report to the Audit and Scrutiny Committee on 20 November 2025 highlighted that there were 7 actions outstanding at the end of September 2025, with 4 having not passed their due date. 2.2 In addition to these 7 carried forward actions, there have been 11 new actions agreed, giving a total of 18 action points for review.
Page 2
2 OFFICIAL INFORMATION OFFICIAL INFORMATION 2.3 Services have completed 13 actions since the last report. All Council Services are required to retain evidence of work carried out in completing their actions and Internal Audit carries out 'spot-checks' on a sample of completed actions on an ongoing basis. 2.4 Of the remaining 5 actions, 2 were only partially completed as at 31 December 2025 and the remaining 3 actions were not due for completion until after that date. 2.5 Appendix 1 to this report provides the Committee with full details of the 2 actions that were not completed within the agreed timescales. 3. Proposals 3.1 It is proposed that the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The effective implementation of agreed Internal Audit and Corporate Fraud actions helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028. Community Wealth Building 4.7 None.
Page 3
3 OFFICIAL INFORMATION OFFICIAL INFORMATION Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 Council Services are consulted during the completion of each Internal Audit and Corporate Fraud review and have also provided updates on progress made in implementing action points. Mark Boyd Head of Service (Finance) For further information please contact Paul Brown, Senior Manager (Audit, Fraud, Safety, Risk and Insurance), on paulbrown1@north-ayrshire.gov.uk. Background Papers None.
Page 4
4 OFFICIAL INFORMATION OFFICIAL INFORMATION Appendix 1 - Actions due by 31 December 2025 but not started or partially completed Code IA2022PA019b Description Audit Action: A minimum technical standard for CCTV systems should be set for the Council. A Council-wide audit of CCTV inventory should be carried out to assess compliance of CCTV assets against the standards, which will give an indication of the level of capital investment required to bring the Council’s CCTV systems up to an appropriate standard and form the basis of a bid for capital. An approval process should be introduced to ensure new CCTV purchases meet the requirements of the standards. Audit Finding: Audit were advised that there are various capital budgets in place covering vehicles and property lifecycle investment. However, there is no formal replacement programme for CCTV equipment. Risk: Substandard systems that aren’t fit for the intended purpose. CCTV footage is not available or not usable when required. Priority 2 Latest Note Work in relation to the assessment of non-public space CCTV assets continues. A contractor is currently carrying out the surveys which are more than 25% complete. The target date for 100% completion of the surveys is the 28th February. Shortly after this date, a full CCTV asset register will be available for the first time, along with a risk rated prioritisation list for investment in rectification and risk reduction work which will take place thereafter. Some immediate work may be required prior to full completion of the list if deemed necessary due to data or physical risk. DPIAs for CCTV systems across the Council continue to be assessed as and when required and the I-Learn CCTV awareness course continues to be used. Estimated completion date is 31st October 2026. Progress Bar Original Due Date 30-Jun-2022 Due Date 31-Dec-2025 Parent Code & Title IA2022PA019 CCTV in Council Buildings and Vehicles Managed By David Hammond Assigned To David Hammond; Scott McKenzie
Page 5
5 OFFICIAL INFORMATION OFFICIAL INFORMATION Code IA2025PA012a Description Action Description: Consideration should be given to creating a central ‘library’ of procedures and guidance notes – accessible by all officers with a role in child protection. Finding: There is no central storage location for child protection procedures within HSCP. Risk: Officers are unaware of procedures; officers are using an outdated version of a procedure. Priority 2 Latest Note A SharePoint central repository will be created to store all Child Protection policies and guidance, ensuring easy and consistent access for all HSCP staff. Once established, the Children, Families and Justice Service will upload all relevant information and will continue to update and refresh the site on an ongoing basis to ensure staff have access to the most current documents. Communications will be issued across the HSCP to make staff aware of this new resource. Revised target date 6 May 2026. Progress Bar Original Due Date 22-Dec-2025 Due Date 22-Dec-2025 Parent Code & Title IA2025PA012 Governance of Child Protection Managed By Elizabeth Stewart Assigned To Elizabeth Stewart