Internal Audit Reports Issued
North Ayrshire Council · 4 June 2026
Back to Audit and Scrutiny Committee — 4 June 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 4 June 2026 Audit and Scrutiny Committee Title: Internal Audit Reports Issued Purpose: To inform the Committee of the findings of Internal Audit work completed since March 2026. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed since March 2026. Internal control reviews have been completed in respect of the areas detailed in Appendix A to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix A includes the report and action plan from each audit. 2.3 The findings from 3 separate audit assignments are detailed at Appendix A to this report and the levels of assurance for each are noted in the table below: Audit Title Assurance Level Capital Monitoring Substantial Payroll Transaction Testing Reasonable Building & Estates Management Reasonable
Page 2
3. Proposals 3.1 It is proposed that the Committee notes the outcomes from the Internal Audit work completed since March 2026. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. Islands Communities Impact Assessment (ICIA) 4.8 None. United Nations Rights of the Child (UNCRC) 4.9 None. Consumer Duty 4.10 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact Paul Brown, Senior Manager (Internal Audit), on paulbrown1@north-ayrshire.gov.uk. Background Papers None.
Page 4
Capital Monitoring 1 Background 1.1 Capital expenditure within NAC is split into 2 programmes:- • General Fund • Housing Revenue Account (HRA) 1.2 Council approved the refreshed 10-year capital programmes for both the General Capital Investment Fund and HRA in February 2025. This resulted in 2025/26 capital budgets of £95,806,924 for the General Investment Fund and £46,002,890 for HRA. 1.3 As per the Council’s Code of Financial Practice, this approval gives Heads of Service the authority to spend on projects so long as the nature of the project and the total spend remains in line with what has been approved. 1.4 The Head of Finance is responsible for providing Cabinet with regular and timeous updates on the actual spend as compared to budget. 2 Objectives and Scope 2.1 The objective of this audit was to confirm that capital monitoring is being carried out regularly and in sufficient detail to allow early identification and reporting of emerging issues. 3 Findings 3.1 Capital monitoring arrangements differ for the General Fund and HRA. Audit reviewed the systems in place for both areas. General Fund Monthly 3.2 Financial Management issues a monthly spreadsheet to budget holders showing current Integra spend and requesting project updates. 3.3 Audit reviewed the spreadsheet and found it to include detailed information for each project, including:- • Completion date • Project stage information (e.g. planning, feasibility, in development, tender, on site, complete) • Delivery status – Financial - which is an assessment of the financial performance against budget (e.g. on target, slightly off target, significantly off target, complete or on hold). • Delivery status – Physical – which is an assessment of the delivery as compared to the original timescale (e.g. on target, slightly off target, significantly off target, complete). 3.4 Audit confirmed monthly updates have occurred throughout 2025/26. (Approximately) every 2 months
Page 5
3.5 Place and Education have Project Boards that meet regularly to oversee project management for their services. 3.6 Audit reviewed the papers and minutes for both Boards and found these to be very detailed. Both Boards use standard templates that budget holders complete to provide updates on their projects. 3.7 The Place template includes:- • Project update • Project funding information – including budget and actual spend information over the life of the project. An overall RAG status is also included to show if the project is expected to be on budget • Forthcoming milestones • Risk management – outstanding risk and risk mitigation information Completion date. 3.8 The Education template includes:- • Project update • Project funding - information on budget on a year-by-year basis and an overall RAG status • Forthcoming milestones • Explanation of budget changes • New risks and mitigations • Actions/requests for Board • Original and current completion date. 3.9 The papers for both Boards also include a copy of the most recent monthly monitoring spreadsheet. 3.10 Audit confirmed that both Boards have met regularly during 2025/26. 4 times per year 3.11 The Capital Programme and Assets Group (CPAG) is chaired by the Head of Finance and meets 4 times per year. 3.12 As per the Council’s Code of Financial Practice, CPAG is responsible for:- • Overseeing the delivery of the capital programme, • Considering requests for reprofiling, • Considering requests to advance projects, • Considering new projects. 3.13 Audit reviewed the papers presented to CPAG and found them to include (as standing items):- • A capital finance briefing and budget movement report, • A capital expenditure detailed report (in the format of the appendix to be included in the cabinet capital monitoring report), • Minutes and action logs from Service Project Boards. 3.14 Audit confirmed the budget virements and reprofiles agreed by CPAG were reflected in the following Cabinet paper and in Integra. Pre-Cabinet Review
Page 6
3.15 The Executive Leadership Team (ELT) review all reports (including the Capital Monitoring Report) before they are presented to Cabinet. A copy of the approved CPAG minutes is included in the ELT papers that accompany the Cabinet papers. HRA 3.16 There is currently no reference to HRA capital within the Council’s Code of Financial Practice. Financial Management has agreed to rectify this during the next document update. (action point a) 3.17 HRA capital is split into:- • Improvements to existing stock and other projects, • Council house building. Improvements to existing stock and other projects 3.18 Whilst Housing is the budget holder for these projects, Property Management & Investment (PMI) and Building Services play a significant role in their delivery. Monthly 3.19 A rolling spreadsheet is used to monitor projects on a monthly basis. 3.20 Each month, PMI and Building Services use the spreadsheet to provide information on the ongoing delivery of projects, update annual spend projections and explain any movements from the previous period. 3.21 A joint monthly meeting is held with Housing, PMI, Building Services and Financial Management to discuss the spreadsheet, and implications of the projections on actual delivery. 3.22 A review of the spreadsheet and the minutes of these meetings confirmed that monthly monitoring has been undertaken during 25/26. Council Housing Building 3.23 As per the Council’s Strategic Housing Investment Plan (SHIP), the SHIP Board is responsible for monitoring the progress of the programme. 3.24 This is done via a monthly meeting of the SHIP Budget Monitoring Group with findings from this feeding into a 6-weekly full Board meeting. 3.25 Whilst Housing is the budget holder for these projects, PMI plays a significant role in their delivery. Monthly 3.26 A monthly rolling spreadsheet is used to track project delivery. The spreadsheet includes information on:- • Progress status • How many units are being built • Delivery status (re physical build) information including original construction completion date, current construction completion forecast, % delay • Financial status including total project budget, project projection, variance calculations (actual in £ and in %) • Previous Year spend info
Page 7
• Current Year budgets – updated on a monthly basis • Current Year forecast - updated on a monthly basis • Current Year variance • Current Year actual spend – on a month by month basis • Future year forecasts • Funding profile information eg prudential borrowing, Capital Financed from Current Revenue (CFCR), Scottish Government grant etc • Comments on current year forecasts. 3.27 A joint monthly meeting is held with Housing, PMI and Financial Management to discuss the projects and projections in the spreadsheet. 3.28 A review of the rolling spreadsheet and the minutes of the meetings confirmed that monthly monitoring has been undertaken during 25/26. 6-weekly 3.29 Audit reviewed the Board papers and found them to be very detailed. A template is used to report on projects, which includes the following information:- • Budget, timeline and overall RAG status of project • Main contractor • Funding streams • Project milestones • Utilities tracker • Narrative update • Key risks and mitigations • Financial summary • Timeline movement tracker • Unit tracker 3.30 In addition, the papers include a financial summary, based on the information in the monthly monitoring file. 3.31 Audit reviewed the minutes and papers for all SHIP Board meetings in 25/26 and confirmed that these have been held regularly. Pre-Cabinet Review Process (for all HRA capital) 3.32 Before HRA project updates and projections are included in the Capital Monitoring Cabinet paper, the proposed appendix goes through the following review process:- 3.33 • Financial Management meet with Housing to agree the contents of the appendix. • Once agreed, Financial Management meet with the Head of Service (Housing & Public Protection) to agree the contents of the appendix. • Once agreed, Financial Management meet with the Executive Director (Communities & Housing) to agree the contents of the appendix. • Head of Service (Finance) holds a meeting with Senior Officers to discuss all Communities & Housing financial monitoring papers due to be presented to Cabinet. 3.34 Audit obtained evidence of the above meetings being held prior to all Capital Monitoring papers being presented to Cabinet during 25/26. 3.35 In addition, the Executive Leadership Team (ELT) review all reports (including the Capital Monitoring Report) before they are presented to Cabinet.
Page 8
4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard the monitoring of capital expenditure. 4.2 Monthly monitoring is well established across all capital streams. 4.3 In addition, regular oversight of the findings of the monthly monitoring is undertaken both within Services and at a corporate level. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 9
KEY FINDINGS AND ACTION PLAN CAPITAL MONITORING Action a Finding The Council’s Code of Financial Practice does not define the process for budgeting and monitoring HRA capital expenditure. Action Description Processes relating to HRA capital should be incorporated into the Council’s Code of Financial Practice during the next scheduled update. Risk Lack of clarity surrounding the setting and monitoring of HRA capital budgets. Priority (1, 2, 3) 2 Paragraph Reference 3.16 Managed by Head of Service (Finance) Assigned to Team Manager (Business Partner) Due Date 31 March 2026 Management Comment The update will be incorporated into the Council’s Code of Financial Practice. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 10
Payroll Transaction Testing 1 Background 1.1 This audit was conducted as part of the approved 2025/26 Internal Audit Plan and Power BI was used to analyse the Payroll data and examine any anomalies which arose. 1.2 The HR Payroll system is called CHRIS. The Employee Account is used to access and complete internal online forms for contract amendments and terminations. Verint is the system used to submit approved contract amendments and terminations to allow Payroll and Resourcing to action the forms. 1.3 HR21 is the self-service module of CHRIS which allows mileage and travel & subsistence expenses to be claimed and approved. 1.4 The audit covered the following areas: • Overtime • Working time regulations • Last payment for leavers • Salary amendment • Pay Adjustments • High mileage claims • High travel and subsistence claims • Employee details • Allowances 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • High overtime payments are valid, properly authorised and no duplicate overtime payments have been made. • Employees working an average of 48+ hours per week have complied with the working time directive regulations. • Employees’ last pay is correct, properly authorised and any overpayments have been identified and rectified. • Salary amendments are valid and authorised. • Pay adjustments are valid, properly authorised and no duplicate pay adjustments have been made. • High mileage claims are in line with the Terms and Conditions of Employment, are valid and properly authorised. • Travel and subsistence expenses are in line with the Terms and Conditions of Employment, are valid and properly authorised. • Employee details are valid and complete. • Allowances are in line with the Terms and Conditions of Employment, are valid and properly authorised. 2.2 The audit covered the period 1st October 2024 to 30th September 2025.
Page 11
3 Findings Overtime Testing 3.1 The auditor selected a sample of 10 high overtime payments based on overtime of 50% more than base pay. The overtime paperwork used to key to CHRIS varies across the services. In 2 cases, no reason was noted on HSCP overtime paperwork, but this has been raised in a recent HSCP Overtime Controls audit. In 3 cases, no reason was noted on overtime paperwork for Neighbourhood Services employees, and this will be covered in an upcoming Neighbourhood Services overtime audit. 3.2 The auditor identified 15 potential duplicate payments of payments more than £100, 12 of which had been checked and reported as part of the HSCP overtime controls audit that was issued in September 2025. The remaining 3 were checked but no duplicate payments were found. 3.3 The auditor tested a sample of 10 employees with a casual status that were paid overtime. There were no findings to note as the employees carried out the overtime before their position was changed to a casual status. Working Time Regulations 3.4 The auditor calculated the average weekly working hours during the 6-month period dated 1st January to 30th June 2025. There were 42 employees working an average of more than 48 hours per week and 26 of them have completed a working time directive opt out form in line with the guidance. There are 15 employees that have not followed the guidance. The results were passed to the relevant Senior Managers who took the necessary action. 3.5 Internal Audit included working time regulations testing from 2021 onwards and to improve the management of this process, HR advised they would incorporate a report into a Workforce Information Power BI Tool to share with managers to identify multi- post employees. This would allow managers to liaise with employees to determine whether the opt-out process is appropriate. Every audit since has identified employees that are working 48+ hours per week that have not completed the opt out form. IT Services advised this tool has been rolled out to some services and there is a plan to roll out to the remaining services during 2026, including engagement and training provided to the services. 3.6 The CHRIS system did not show an opt out form for one employee. However, the Senior Manager confirmed the form was recorded under a different multi-post employee number. HR confirmed the opt out form should cover all posts and agreed to update the form to state that it covers all positions held by an employee and will instruct service admin teams to record the form under the employees primary contract number in CHRIS. The auditor also noted the current form has no date or version control. (action a) 3.7 The auditor testing for employees paid more than once on the same date and there were no findings to note from this testing. Leavers Last Pay 3.8 The auditor selected a sample of 10 leavers to check their final pays were correct and properly approved. There was an overpayment of £493.95 (gross) for a leaver’s last pay and this had not been picked up and rectified by Payroll. Payroll confirmed they
Page 12
will process a correction on the Payroll system and raise an invoice to correct this. In addition, there were 2 overpayments totalling £10,585.77 that had already been identified and corrected by Payroll. (action b) 3.9 There were 13 employees that left within 21 days of starting and the pays were checked to ensure they were only paid for the hours worked. There was 1 overpayment of £97.42 that had already been identified and corrected by Payroll. 3.10 The auditor carried out additional tests on leavers to identify potential overpayments. This resulted in 2 leavers being paid their requested pay arrears twice in error due to duplicate cases being added to the Verint queue resulting in both being actioned. The duplicate payments totalled £796.68, and Payroll agreed to take action to recover this money. Payroll has since confirmed their leavers request procedure has been updated to include a check to establish if the employee has already been paid for the arrears. In addition, there were 27 overpayments totalling just over £45k that had already been identified and corrected by Payroll. (action b) Salary Amendments 3.11 The auditor selected a sample of 10 salary amendments where the increase was more than 50%. There were no findings to report from this testing. Pay Adjustments 3.12 The auditor selected a sample of 5 responsibility allowance payments and there were no findings to note. 3.13 The auditor selected a sample of 5 payments coded to pay adjustments – sup and 1 had no reason recorded on the comments field in the CHRIS system. (action c) 3.14 The auditor selected a sample of 5 payments for independent chair fees. There were no findings to note. 3.15 The auditor checked a payment type called recover manual advance. There were no findings to note from this testing. Mileage Claims 3.16 The auditor tested a sample of 10 mileage claim forms for more than 700 miles. There were 2 claim forms not submitted within the 3-month period in line with the Terms and Conditions of Employment. The claim forms were submitted on HR21. The Lead Advisor (Workforce Systems) advised there is a notes facility which could be used by managers to provide a reason for such a delay, in line with the Terms and Conditions of Employment. The Senior Advisor (Payroll) has asked for the HR21 guidance to be updated to reflect the 3-month rule and advised the relevant section of the Terms and Conditions of Employment has been added to the Company News home page on HR21. (action d) 3.17 A potential duplicate mileage claim was identified on the HR21 system, one of which had been approved and paid, the other was awaiting approval. After confirmation with the employee, the Lead Advisor (Workforce Systems) removed the claim before it could be approved and paid again. Travel and Subsistence Claims
Page 13
3.18 Tested a sample of 10 travel and subsistence claim forms with a payment value over £200. One of the claim forms was not submitted within the 3-month period in line with the Terms and Conditions of Employment. The claim form was submitted on HR21. In addition, an employee claimed £273 travel expenses instead of 273 miles which resulted in an overpayment. The employee notified Payroll when they realised the error which was quickly corrected. (action d) 3.19 Tested for duplicate claim forms. There were 16 potential duplicates payments relating to 7 employees. The auditor checked the payments made to a sample of 4 employees and no duplicate payments were found. Employee Data Checks 3.20 The auditor tested for duplicate national insurance numbers, blank national insurance numbers, invalid national insurance format, blank date of birth, duplicate bank details and blank bank details. There were no findings to note from this testing. Allowances and Deductions 3.21 The auditor testing a sample of 10 allowances for the following 3 allowances - unsocial hours (direct amount payment), rotating shift and unsocial hours 15%. There were no findings to note from this testing. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to transactions on the Payroll system. There were overpayments relating to leavers, most of which had already been identified and rectified by the Payroll team. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 14
KEY FINDINGS AND ACTION PLAN PAYROLL TRANSACTION TESTING Action a Finding The CHRIS system did not show an opt out form for one employee. However, the Senior Manager confirmed the form was recorded under a different multi-post employee number. HR confirmed the opt out form should cover all posts and agreed to update the form to state that it covers all positions held by an employee and will instruct service admin teams to record the form under the employee’s primary contract number in CHRIS. Action Description The working time regulations opt out form should be updated to clarify the form covers all posts, the form should be recorded against the primary contract number on CHRIS and the form should be dated and version controlled. In addition, a communication should be issued advising the form has been updated and all service admin teams should start using the new form and follow the new guidance. Risk Form not recorded properly on CHRIS; users completing outdated versions of form. Priority (1, 2, 3) 3 Paragraph Reference 3.6 Managed by Head of Service (People & ICT) Assigned to Senior Manager (People Services) Due Date Complete Management Comment Form has been updated on Connects to reflect that this covers all posts held by an employee. The form has also been dated and the version control updates. Communications have been issued to advise accordingly. Action b Finding A leaver was overpaid £493.95 (gross) and 2 leavers were paid their requested pay arrears twice in error. The duplicate payments totalled £796.68. Action Description Payroll should take action to recover the 1 overpayment and 2 duplicate payments identified during the audit. Risk The Council has paid the same Payroll payment twice or made an overpayment and the money has not been recovered. Priority (1, 2, 3) 3 Paragraph Reference 3.8, 3.10 Managed by Head of Service (People & ICT) Assigned to Senior Manager (People Services) Due Date Complete Management Comment The Leavers Pay Award Procedure has been updated to include additional checks that are required to ensure this error does not occur in future. Overpayments have been addressed and accounts raised.
Page 15
Action c Finding The auditor selected a sample of 5 payments coded to pay adjustments – sup and 1 had no reason recorded on the comments field in the CHRIS system. Action Description Payroll should be reminded to complete the comments section on the Payment Adjustment screen. Risk Lack of a complete audit trail. Priority (1, 2, 3) 3 Paragraph Reference 3.13 Managed by Head of Service (People & ICT) Assigned to Senior Manager (People Services) Due Date Complete Management Comment The comments section isn’t a mandatory field, however Payroll acknowledge that this being completed would be useful. It has been noted that this would be helpful to detail what the adjustment is for to more easily identify this for both the payroll team and audit. The threshold for completion of the comments field will be £1500. Payroll procedure updated and the team made aware. Action d Finding There were 3 mileage, travel and subsistence claim forms keyed on HR21 that were not submitted within the 3-month period as per the Terms and Conditions of Employment. The Lead Advisor (Workforce Systems) advised there is a notes facility which could be used by managers to provide a reason for such a delay, in line with the Terms and Conditions of Employment. Action Description Payroll should issue a reminder that mileage, travel and subsistence expenses should be claimed on an ongoing monthly basis and submitted accurately and timeously in line with the Terms and Conditions of Employment. In exceptional circumstances, for claims submitted after the 3-month period, the manager should use the notes functionality on HR21 to provide a reason for the delay. Risk Poor compliance with policy. Increased risk of error if claims are delayed. Priority (1, 2, 3) 3 Paragraph Reference 3.16, 3.18 Managed by Head of Service (People & ICT) Assigned to Senior Manager (People Services) Due Date Complete Management Comment The HR21 homepage has now been updated to reflect that expenses should be claimed on a regular basis and that any expenses claimed beyond the 3-month period include a comment from the manager in terms of the reason for this. HR guide has been updated. Communications have also been issued as a reminder of the 3-month period and providing information in relation to the updated guide and HR21 homepage.
Page 16
Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 17
BUILDINGS AND ESTATE MAINTENANCE 1 Background 1.1 The audit related to non-Housing properties such as schools, office buildings, depots and social work establishments, and focussed on the “Property Asset Risk” in the Council’s Strategic Risk Register 2025/26. This included the relevant control measures and actions, relating to the risk. 1.2 It was reported in the monitoring reports on the Strategic Risk Register 2025/26 that a long-term impact of restricted budget availability for investment in the Council’s property assets means these assets are in declining condition and have greater long term investment needs. There have been a number of near misses or critical failures of aging heating plant and equipment, which the Council is unable to replace on a programmed basis. 1.3 Consequently, condition survey information will inform both investment planning and business continuity arrangements, given the declining condition of the Council’s property assets and increasing long-term investment requirements. 1.4 The review focussed on the arrangements in place for assessing risks, prioritising maintenance activities and determining whether this is reflected in the asset management plans. 2 Objectives and Scope 2.1 The main objective of the audit was to obtain assurance over the management of the “Property Asset Risk” in the Council’s Strategic Risk Register 2025/26 by reviewing the associated control measures and actions. Specifically, to: • Ensure documented procedures are in place to cover the processes of Buildings and Estate Maintenance. • Ensure an appropriate buildings and estate maintenance strategy are in place, supported by a risk-based approach and reflected in the asset management plans. • Ensure that previous action points from the last audit report are adequately implemented.
Page 18
3 Findings Procedures for gathering, storing and responding to building conditions 3.1 We noted that key elements of PMI approach are articulated in the Property Asset Management Plan (PAMP). However, there is a need to sufficiently outline the detailed operational approach to these key areas such as building maintenance processes, oversight controls, building conditions survey exercise, funding gaps, how work/activities are prioritised and reporting. (action a) 3.2 The review of the PMI Business Continuity Plan (BCP) document revealed the following: • The document was last reviewed on 18/02/2022, contrary to the requirement for six- monthly updates set out in the BCP. • No evidence was provided that BCP was tested for areas/activities relating to Building and Estates Maintenance, as indicated in the BCP document. BCP testing reports were not provided for review. (action b) Buildings and Estate Maintenance – Asset Management Plans 3.3 In line with section 8 of the Property Asset Management Plan (PAMP), Property Management and Investment (PMI) is expected to undertake condition surveys across the corporate estate, and this information is used to inform property lifecycle investment decisions. Alongside this data, there is a structured process in place to understand client’s priorities and where property issues are, or have the potential to, impact on service delivery. So far, a condition survey has only been conducted for the Education Estate. 3.4 However, strategic documents such as condition survey information and backlog maintenance to determine investment plans/funding gaps and business continuity plans for non-Education assets are still work in progress. Early work has already begun on a similar document for Connected Communities, where libraries and community centres have been listed, though this is still under development. (action c). 3.5 Condition survey data across the Education Estate alone indicates five-year investment requirements of £36.940m, however, the Property Lifecycle Investment (PLI) funding for next 5-year period, covering all operational assets, is only £5.658m, highlighting a significant funding gap. 3.6 Section 6 of the (PAMP) stipulates that a full condition survey on all operational properties should be conducted every five years, to provide a baseline for assessing building element lifecycle replacement requirements across the corporate estate exist. 3.7 Evidence was provided that the Education Estate has been reviewed in its entirety. The Education Estate remains the Council’s priority in terms of ensuring business continuity and directing investment to maintain the operational integrity of these buildings. Meanwhile, we noted that condition survey of some Education Estate properties is currently overdue with the last surveys performed in March and April 2019 for 3 schools: Dreghorn Primary School, Elderbank Primary School and Kilmory Primary School. (action d). 3.8 The Council’s Transformation Programme includes a workstream which focuses on property rationalisation as a means of reducing the financial burden of the Council estates through reducing overall area occupied. Tracking reports on this on-going
Page 19
workstream were reviewed and it was noted that some key milestones have been completed, “Localities Review ongoing – Phase 1” is nearing completion (mid 2026), and the Phase 2 exercise is ongoing. 3.9 The actions from the previous audit were followed up and found that they had been completed. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the Buildings and Estate Maintenance. PMI should improve on policy documentation detailing the building maintenance procedures, updating and testing of PMI Business Continuity Plan (BCP) as stipulated by BCP documents and conducting of condition surveys on all operational assets in compliance with the Property Asset Management Plan (PAMP). Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 20
KEY FINDINGS AND ACTION PLAN BUILDINGS AND ESTATE MAINTENANCE Action a Finding We noted that key elements of PMI approach are articulated in the Property Asset Management Plan (PAMP). However, there is a need to sufficiently outline the detailed operational approach to these key areas such as building maintenance processes, oversight controls, building conditions survey exercise, funding gaps, how work/activities are prioritised and reporting. Action Description Operating procedures should be developed to incorporate all activities of Buildings and Estate Maintenance to aid better understanding of the processes for gathering, storing and responding to building conditions. Risk Inconsistent approach by staff, possible key tasks not being carried out and lack of business continuity if staff familiar with the process are not available. Priority (1, 2, 3) 2 Paragraph Reference 3.1 Managed by Head of Service (Sustainability, Transport & Corporate Property) Assigned to Senior Manager (Property, Maintenance and Investment) Team Manager (Contracts, Compliance and Maintenance) Team Manager (Property Assets & Rationalisation) Due Date 31 May 2027 Management Comment While there are currently no standalone procedural documents covering Buildings and Estate Maintenance operations, key elements of the approach are set out within the Property Asset Management Plan (PAMP). We recognise that this does not fully address the scope of activity undertaken by PMI. In parallel, work is ongoing to implement a new electronic Integrated Workplace Management System (IWMS) which will capture corporate asset data and support more effective management and maintenance of the estate. Accordingly, we will undertake a review and develop appropriate procedural documentation within the next 12 months. In the period following the audit, ELT have also received a separate report in respect of specific challenges in the property estate including prioritisation and reporting. Action b Finding The review of the PMI Business Continuity Plan (BCP) document revealed the following: • The document was last reviewed on 18/02/2022, contrary to the requirement for six-monthly updates set out in the BCP. • No evidence was provided that BCP was tested for areas/activities relating to Building and Estates Maintenance as indicated in the BCP document. BCP testing reports were not provided for review. Action Description The Team Manager (Property Assets & Rationalisation) should ensure that the BCP document is updated 6 monthly to
Page 21
incorporate learnings from workshops as well as testing the plan as required for continuity in meeting service needs. Risk Business failure or disruptions if BCP is not updated and tested. Priority (1, 2, 3) 1 Paragraph Reference 3.2 Managed by Head of Service (Sustainability, Transport & Corporate Property) Assigned to Senior Manager (Property, Maintenance and Investment) Team Manager (Property Assets & Rationalisation) Due Date Completed Management Comment This action is now complete. The PMI Business Continuity Plans have been reviewed and updated to reflect current arrangements, and the documents are now current. Action c Finding Strategic documents such as condition survey information and backlog maintenance to determine investment plans/funding gaps and business continuity plans for non-Education assets are still work in progress. Early work has already begun on a similar document for Connected Communities, where libraries and community centres have been listed, though this is still under development. Action Description The Team Manager (Property Assets & Rationalisation) should continue to extend a full set of condition surveys on all operational properties, to obtain assurance that a baseline to measure building element lifecycle replacement requirements across the corporate estate exist in line with section 6 of The Property Asset Management Plan (PAMP). Risk Comprehensive information to support strategic decision making may not be available thereby impacting on business continuity and leading to sub-optimal use of resources. Without completed and up to date condition surveys across the Council’s entire estate, the Council cannot make fully informed decisions on investments and funding allocations. Priority (1, 2, 3) 2 Paragraph Reference 3.4 Managed by Head of Service (Sustainability, Transport & Corporate Property) Assigned to Senior Manager (Property, Maintenance and Investment) Team Manager (Property Assets & Rationalisation) Due Date 30 April 2027 Management Comment We acknowledge the need to extend the approach currently applied to the Education Estate and to develop a working document that consolidates relevant building information in a single, accessible location. There is a statutory requirement to report on the condition of school buildings to the Scottish Government and, as such, the priority to date has been to focus resources on the Learning Estate. Condition surveys are being undertaken out with Education, however there is currently a gap in bringing this information together into one document to support consistent analysis and investment planning. We will replicate the asset list used for Education across the other key service areas to support a consistent approach.
Page 22
Action d Finding We noted that condition surveys of some Education Estate properties are overdue with the last surveys performed in March and April 2019 for 3 schools: Dreghorn Primary School, Elderbank Primary School and Kilmory Primary School. The surveyor is currently working through the three schools on the list and expects to finish these by April 2026. Action Description The Team Manager (Property Assets & Rationalisation) should continue to track the completion of the overdue condition surveys for resolution in line with section 6 of the Property Asset Management Plan (PAMP). Risk Adequate information to support strategic decision making may not be available thereby impacting on business continuity. Priority (1, 2, 3) 2 Paragraph Reference 3.7 Managed by Head of Service (Sustainability, Transport & Corporate Property) Assigned to Senior Manager (Property, Maintenance and Investment) Team Manager (Property Assets & Rationalisation) Due Date 31 May 2026 Management Comment Progress with the condition survey programme has been impacted by ferry disruption to Arran. Notwithstanding this, surveys are progressing well and only one school, Elderbank Primary School, remains outstanding. The survey for Elderbank is currently underway and is expected to be completed by the end of May. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.