13. 2023 11 14 IA action points follow up Q2
North Ayrshire Council · 14 November 2023
Back to Audit and Scrutiny Committee — 14 November 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 14 November 2023 Audit and Scrutiny Committee Title: Internal Audit and Corporate Fraud Action Plans: Quarter 2 update Purpose: To advise the Audit and Scrutiny Committee on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 30 September 2023. Recommendation: That the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 1. Executive Summary 1.1 The CIPFA document 'Audit Committee Principles in Local Authorities in Scotland' highlights that Audit Committees should monitor and review the progress made in implementing audit recommendations. 1.2 Service managers are responsible for ensuring that agreed actions arising from Internal Audit and Corporate Fraud reviews are implemented. This provides assurance that identified control weaknesses have been addressed and are being managed effectively. 1.3 All actions are monitored on the Pentana system and service managers are responsible for updating Pentana as they progress each action. This enables Internal Audit to monitor progress on a 'real-time' basis and address any delays in implementation. 1.4 This report details the position as at 30 September 2023. 2. Background 2.1 The last report to the Audit and Scrutiny Committee on 5 September 2023 highlighted that there were nine actions outstanding at the end of June 2023: one that had not been started or was only partially implemented and eight where the due date had not yet passed.
Page 2
2.2 In addition to these nine carried forward actions, there have been 26 new actions agreed, giving a total of 35 action points for review. 2.3 Services have completed 24 actions since the last report. All Council Services are required to retain evidence of work carried out in completing their actions and Internal Audit carries out 'spot-checks' on a sample of completed actions on an ongoing basis. 2.4 Of the remaining 11 actions, three were either not started or only partially complete at 30 September 2023 and the remaining eight actions were not due for completion until after that date. 2.5 Appendix 1 to this report provides the Committee with full details of the three actions that were not complete within the agreed timescales. 3. Proposals 3.1 It is proposed that the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The effective implementation of agreed Internal Audit and Corporate Fraud actions helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028.
Page 3
Community Wealth Building 4.7 None. 5. Consultation 5.1 Council Services are consulted during the completion of each Internal Audit and Corporate Fraud review and have also provided updates on progress made in implementing action points. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 4
4 Actions due by 30th September 2023 but not started or partially complete Code IA2023PA005a Description Action Description: Mandatory local guidance for Glow should be prepared and should incorporate the Information for Educators document provided on the Glow Connects website. The Glow guidance should be included in the email issued to all new Glow users. The Glow guidance should be incorporated into the mandatory e-learning module to provide evidence users have been made aware that personal and sensitive data should not be stored in Glow or sent via Glow email. Finding: A Glow Information document is issued to all probationers and reissued to existing staff annually. This guidance refers to the additional guidance provided on the Glow Connects website rather than incorporating it within the guidance. Although guidance is available to users, there is no mandatory local guidance that Glow users are asked to read and sign up to that ensures there is evidence users have been made aware that personal and sensitive data should not be stored in Glow or shared via Glow email. In addition, there is no guidance issued to a new Glow user when advised via email that a new account has been set up and the login details are provided to ensure they are advised of the rules before using the system. Risk: Without proper guidance, Glow users may use Glow to store or send personal or sensitive data which may result in a data breach and a potential fine from the Information Commissioner. Priority 2 Latest Note 2022/23 - Quarter Four Update: Update from S Lauder: The Sway information has been updated to incorporate the additional information from the Glow Connect website. New Glow users are not e-mailed as there is no automated system for this. This action can only be done if we instruct school offices to e-mail staff the Sway to new staff. We can implement this - to be actioned. Expected completion December 2023. Progress Bar Original Due Date 31-Aug-2023 Due Date 31-Aug-2023 Parent Code & Title IA2023PA005 Glow Managed By Andrew McClelland Assigned To Susan Lauder
Page 5
5 Code IA2023PA005b Description Action Description: Mandatory e-learning training that covers the type of data that can and cannot be stored and sent via Glow should be provided to all Glow users on an annual basis and should be provided to all new users as soon as possible. Finding: There is no mandatory training provided to Glow users which incorporates the types of data suitable to store and send via Glow. Risk: Without proper training, Glow users may use Glow to store or send personal or sensitive data which may result in a data breach and a potential fine from the Information Commissioner. Priority 2 Latest Note 2022/23 - Quarter Four Update: Update from S Lauder: OD have been contacted to ask them about putting a module on iLearn, and an email sent to them with a PPT constructed with the relevant information. Evidence that staff had completed the module would replace a signature to say they had read the guidance. In process. Expected completion August 2024. Progress Bar Original Due Date 31-Aug-2023 Due Date 31-Aug-2023 Parent Code & Title IA2023PA005 Glow Managed By Andrew McClelland Assigned To Susan Lauder
Page 6
6 Code IA2023PA026b Description Action Description: A reminder should be sent to all Psychologists and HSCP officers who deal with placements of the need to present all potential significant placement changes to the IG for consideration. Using the revised IG outcome minute proforma (as suggested in action a) will ensure detailed justification for the final placement decision, along with the Principal Psychologist’s approval is formally recorded. Finding: Audit identified only 1 significant change of placement during audit testing. The case was not brought to the IG for consideration, nor was it approved by the Principal Psychologist. Risk: The expertise of IG members is not being sought; the Council can’t evidence its decision making process when changing a pupil’s placement; no evidence of budget holder approving expenditure. Priority 1 Latest Note All Psychologists have been reminded of the need to bring placement changes to IG for consideration via email and Team meetings. Senior managers in HSCP have also been advised of this but no formal email has been issued. Revised target date end of November 2023. Progress Bar Original Due Date 31-Jul-2023 Due Date 31-Jul-2023 Parent Code & Title IA2023PA026 ASN Provision Managed By Andrew McClelland Assigned To Gail Nowek