12. 2024 05 30 IA annual report 2023-24
North Ayrshire Council · 30 May 2024
Back to Audit and Scrutiny Committee — 30 May 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 30 May 2024 Audit and Scrutiny Committee Title: Internal Audit Annual Report 2023/24 Purpose: To provide the Committee with an annual report on the work of Internal Audit during 2023/24 and provide an opinion on the governance, risk management and internal control environment of the Council. Recommendation: The Committee is asked to note the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 1. Executive Summary 1.1 The purpose of this report is to present the annual report on the internal audit activity during 2023/24, and to provide an independent opinion on the adequacy and effectiveness of the Council’s governance, risk management and internal control systems for the year ended 31 March 2024. 2. Background 2.1 The Public Sector Internal Audit Standards (PSIAS) require that the Chief Internal Auditor prepares an annual report on the activities of Internal Audit and that the report should contain a view on the adequacy of the Council’s governance, risk management and internal control frameworks. The annual report for 2023/24 is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the section during the year and the key audit findings. It also contains the annual internal audit opinion. 2.2 The required annual report for financial year 2023/24, together with the statement on internal controls, is included in Appendix 1. 2.3 The revised internal audit plan for 2023/24 (approved by the Audit and Scrutiny Committee in November 2023) has been substantially completed. Audit fieldwork remains in progress on eight assignments. One audit assignment is at draft report stage, meaning the assurance opinion can be included in the overall annual audit opinion. 2.4 All audit findings during the year support and inform the objective opinion of the Senior Manager (Audit, Fraud, Safety and Risk) on the adequacy of the Council’s
Page 2
governance, risk management and internal control environment. The assurance category given to each individual audit informs the overall level of assurance. 2.5 The annual internal audit opinion also contributes to the Annual Governance Statement which is published as part of the Council’s annual accounts and is included under separate cover to this Audit and Scrutiny Committee meeting for approval. 2.6 Based on the audit work carried out, the opinion of the Senior Manager (Audit, Fraud, Safety and Risk) is that reasonable assurance can be placed on the adequacy and effectiveness of the Council’s systems of governance, risk management and internal control. 3. Proposals 3.1 It is proposed that the Committee notes the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. 5. Consultation
Page 3
5.1 Council Services are consulted on the findings of Internal Audit throughout the year. No specific consultations have taken place in relation to this annual report. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 4
Appendix 1 INTERNAL AUDIT ANNUAL REPORT 2023/24 1. Introduction 1.1. The purpose of this report is to summarise the Internal Audit activity for 2023/24 and provide an opinion on the overall adequacy and effectiveness of the Council’s governance, risk management and internal control frameworks. 1.2. The Council’s Section 95 Officer has overall responsibility for Internal Audit in North Ayrshire Council. The Senior Manager (Audit, Fraud, Safety and Risk) reports to the Section 95 Officer, with the right of access to the Chief Executive and the Chair of the Audit and Scrutiny Committee on any audit matter. These rights of access help ensure the organisational independence of Internal Audit. 1.3. The presence of an effective internal audit function contributes towards, but is not a substitute for, effective control. It is the responsibility of management to have adequate controls in place and to ensure these controls are operating effectively. A sound control system will help safeguard assets, ensure records are reliable, promote operational efficiency and ensure adherence to Council policy and procedure. Such systems of internal control can provide only reasonable and not absolute assurance against loss. 2. Reporting requirements of the Public Sector Internal Audit Standards (PSIAS) 2.1. Internal Audit operates in accordance with the PSIAS requirements and is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. 2.2. Internal Audit operates within the Internal Audit Charter, most recently approved by the Audit and Scrutiny Committee in March 2023. 2.3. The PSIAS places a number of reporting obligations on the Chief Internal Auditor in respect of the annual report. These obligations are summarised below: PSIAS Ref Requirement Evidence 1110 The chief audit executive must confirm to the board, at least annually, the organisational independence of the internal audit activity. The Senior Manager reports directly to the Audit and Scrutiny Committee, and unfettered access is available to the Chief Executive as required. 1320 The results of the quality and assurance programme and progress against any improvement plans must be reported in the annual report. The results of the external quality assessment, carried out in 2022, were reported to the Audit and Scrutiny Committee in September 2022. All actions are complete.
Page 5
PSIAS Ref Requirement Evidence 2450 The chief audit executive must deliver an annual internal audit opinion and report that can be used by the organisation to inform its governance statement. This report to Audit and Scrutiny Committee provides the annual report and statement of assurance on internal controls. 2450 The annual internal audit opinion must conclude on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control. This report to Audit and Scrutiny Committee provides the annual statement of assurance at Annex B. 2450 The annual report must also include a statement on conformance with the Public Sector Internal Audit Standards and the results of the quality assurance and improvement programme. This report to Audit and Scrutiny Committee provides a statement on the conformance with the PSIAS at Section 5 below. 3. Planned and Actual Activity during 2023/24 3.1. The internal audit plan was approved by the Audit and Scrutiny Committee in March 2023 with a mid-year change to the plan approved in November 2023. Productive time is allocated in the plan to the delivery of audit assignments with a balance of time retained within the service for non-productive activities which includes management and strategy, attendance at meetings, administration and staff training and development. 3.2. The mid-year revised plan included 26 assignments where an audit output was anticipated. Eleven of these have been completed, one is at draft report stage, eight are at various stages of work in progress, one is not started, and five are deferred. The results of the draft reports and work in progress assignments will be reported to a future meeting of the Audit and Scrutiny Committee. 3.3. In line with the Council’s defalcation procedures, all instances of suspected fraud and irregularity should be reported to Internal Audit. These are investigated by the specialist Corporate Fraud Team and are not included within this annual report. 3.4. All audit reports finalised during 2023/24 were reported to meetings of the Audit and Scrutiny Committee. A summary of outputs achieved are included in Annex A. 3.5. The outcomes from the audit work during the year have primarily been positive, with mostly substantial and reasonable assurance opinions. Two audit reports have been finalised during the year where elements of the scope have resulted in a limited assurance opinion. These are as follows: • An HR/Payroll system review was carried out covering the CHRIS21 HR and Payroll system used by the Council. From that review, reasonable assurance was obtained with regard to administration of payroll processes. However there was
Page 6
limited assurance obtained on the timely administration by services to provide accurate and timeous information to ensure the effectiveness and accuracy of payroll runs. The HR/Payroll Team are continuing to liaise with services to ensure these matters are promptly rectified. This includes reminders to services, but also the development of reporting around absence and overpayments which will allow all Heads of Service to reiterate the importance of these matters with their managers. • A substantial cross-service review of Cyber Resilience Business Continuity was carried out, as Internal Audit continues to work through the categories and domains contained within the Scottish Government’s Cyber Resilience Framework. Again this review concluded with a split opinion. Reasonable assurance was obtained for most areas within the scope of the review, however there was limited assurance obtained with regards to the Data Protection Impact Assessment (DPIA) section of the audit due to all systems sample tested as part of the audit either having no DPIA in place or no DPIA signed off by the Data Protection Officer. The services are working with the Information Governance Team to ensure the prompt sign off of all outstanding DPIAs. The DPIA tracker held by Information Governance has also been further developed to reflect the various stages of the outstanding DPIAs. 3.6. It is important to also highlight some of the most positive outcomes arising from the audit work concluded during the year. This includes reviews of Financial Resilience and Viability, and Workforce Planning, both of which are significant priorities for the Council and both concluded with substantial audit opinions. This provides evidence that these most significant risks for the Council are being effectively managed in line with best practice. 3.7. These findings, together with those from other audits carried out and the individual assurance levels, contribute to the annual internal audit opinion in Annex B of this report. 4. Audit Resources 4.1. The Internal Audit section is directly managed by the Team Manager (Internal Audit), who reports to the Senior Manager (Audit, Fraud, Safety and Risk). The Senior Manager is responsible for Internal Audit, as well as Corporate Fraud, Risk and Insurance and Corporate Health and Safety. 4.2. As well as the Team Manager, the Internal Audit team consisted of two part-time Internal Auditors as well as a part-time Computer Auditor. 4.3. All staff within the section hold a relevant qualification, either through an institute which is part of the Consultative Committee of Accountancy Bodies (CCAB) or the Institute of Internal Auditors (IIA). 4.4. The Internal Audit Charter requires the Senior Manager to report to the Section 95 Officer and the Audit and Scrutiny Committee if resources available fall below an acceptable level for the audit work required. No instances of resource limitation have occurred during 2023/24. 5. Performance
Page 7
5.1. During 2023/24, Internal Audit provided regular updates to the Audit and Scrutiny Committee on the activities of the service. Elected Members had the opportunity to discuss all Internal Audit reports and question either the Senior Manager or relevant officers from Council services. The Senior Manager carried out Elected Member training to the Committee in May 2022, individual training for new members joining the Committee during the year, and further training is planned for 2024. 5.2. The Council’s performance management system, Pentana, is used to follow-up on audit action points. Officers with responsibility for implementing audit actions are required to update the system and updates are provided to the Audit and Scrutiny Committee on a quarterly basis. Where actions are overdue, officers are required to attend the Committee to update Elected Members on plans to ensure that actions are implemented. 5.3. The Senior Manager is required to confirm annually internal audit’s compliance with the Public Sector Internal Audit Standards (PSIAS). A significant achievement during 2022/23 was the successful completion of the External Quality Assessment. Under the terms of the PSIAS, each organisation’s Internal Audit team is required to undertake an External Quality Assessment (EQA) at least once in each five-year period. This helps to ensure compliance with the standards. 5.4. A peer to peer review network of the Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) is in place. The review of the Council's Internal Audit team was completed by West Dunbartonshire Council and was reported to the Audit and Scrutiny Committee in September 2022. The review assessed the compliance of the Council's Internal Audit team with the 14 sections of the PSIAS and noted that the team fully conforms with 13 of the standards and generally conforms with the remaining one. Overall the assessor was able to provide substantial assurance that the Council's Internal Audit team complies with the requirements of the PSIAS. There were four minor routine recommendations for improvement to further improve compliance, and these have all been completed. In summary, the Internal Audit service continues to conform with the PSIAS. 5.5. Internal Audit has a strong working relationship with all Council services and is frequently asked for audit advice on an ad-hoc basis. The volume of these requests is outwith the control of Internal Audit however it is important that Internal Audit responds to these requests when asked, as it ensures advice is provided at the right time to ensure organisational value is maximised. In 2023/24, there were 36 requests for service advice. Added to this, Internal Audit is included on the project board of a number of Corporate working groups, and these are listed in Annex A. 6. Other Responsibilities 6.1. The Senior Manager is also the Chief Internal Auditor for the North Ayrshire Integration Joint Board (NAIJB). In the interests of information sharing, the results of the NAIJB audit work are shared with the Audit and Scrutiny Committee. 7. Opinion 7.1. There is a formal requirement for the Chief Internal Auditor to prepare an assurance statement on the adequacy of internal control systems within the Council. The internal audit annual statement on the adequacy of internal controls is included in Annex B.
Page 8
8. Conclusion 8.1. The 2023/24 internal audit plan has been substantially completed. There are no limitations of scope to the issued audit opinion.
Page 9
Summary of Internal Audit Work 2023/24 Annex A Type Audit Opinion Reported to A&S Committee Actions Arising Priority 1 Priority 2 Priority 3 Total COMPLETED WORK Assurance Glow Reasonable 05/09/2023 0 4 0 4 Investigation Transport Substantial 05/09/2023 0 0 0 0 Assurance Payroll Transaction Testing* Reasonable 05/09/2023 1 3 0 4 Assurance ASN Provision* Reasonable 05/09/2023 2 1 0 3 Assurance Income Collection* Reasonable 05/09/2023 1 1 0 2 Assurance Accounts Payable Transaction Testing Q2 Reasonable 14/11/2023 2 1 0 3 Assurance Carers (Scotland) Act 2016 Substantial 14/11/2023 0 1 0 1 Assurance Early Years Provision* Substantial 14/11/2023 0 0 1 1 Assurance Financial Resilience and Viability Substantial 14/11/2023 0 0 0 0 Assurance Employee Services HR/Payroll System and Processes* Reasonable/Limited 25/01/2024 3 1 0 4 Assurance ICT Supplier Management* Reasonable 25/01/2024 0 3 0 3 Assurance Workforce Planning Substantial 21/03/2024 0 0 0 0 Assurance Standalone Early Years Centres Reasonable 21/03/2024 0 1 0 1 Assurance Community Resources Keyholding Substantial 21/03/2024 0 0 0 0 Assurance Procurement Cards Substantial 30/05/2024 0 0 0 0 Assurance Ayrshire Growth Deal – Revenue Projects Substantial 30/05/2024 0 1 0 1 Assurance Cyber Resilience Business Continuity Reasonable/Limited 30/05/2024 5 8 0 13 Annual Accounts Community Councils n/a n/a n/a n/a n/a n/a Annual Accounts Tenants and Residents Associations n/a n/a n/a n/a n/a n/a REPORTING PHASE** Assurance Supply Teachers Substantial 0 0 0 0 0 WORK IN PROGRESS
Page 10
Summary of Internal Audit Work 2023/24 Annex A Type Audit Opinion Reported to A&S Committee Actions Arising Priority 1 Priority 2 Priority 3 Total Assurance Movers/Leavers Education tbc tbc tbc tbc tbc tbc Assurance Property Asset Management tbc tbc tbc tbc tbc tbc Assurance Payroll Transaction Testing tbc tbc tbc tbc tbc tbc Assurance Community Based Support – Adults tbc tbc tbc tbc tbc tbc Assurance iPayImpact tbc tbc tbc tbc tbc tbc Assurance Housing Rental Income and Arrears tbc tbc tbc tbc tbc tbc Assurance Regeneration Delivery Plan and Funding tbc tbc tbc tbc tbc tbc Assurance Code of Corporate Governance tbc tbc tbc tbc tbc tbc NOT STARTED Assurance Community Funding tbc tbc tbc tbc tbc tbc OTHER/ONGOING Consultancy O365/Information and Collaboration Project Board n/a n/a n/a n/a n/a n/a Consultancy Sustainability and Climate Change n/a n/a n/a n/a n/a n/a Consultancy Municipalisation Project Board n/a n/a n/a n/a n/a n/a Consultancy Education Maintenance Allowance (EMA) n/a n/a n/a n/a n/a n/a Consultancy Waste review n/a n/a n/a n/a n/a n/a Consultancy Education processes for employees n/a n/a n/a n/a n/a n/a Small Advisory 36 various requests n/a n/a n/a n/a n/a n/a * 2022/23 audit but not sufficiently concluded at the time of the 2022/23 annual report, therefore opinion included 2023/24. ** Audits not yet finalised but sufficiently in draft to conclude on the level of assurance.
Page 11
Annex B Internal Audit Annual Statement on the Adequacy of Internal Controls To the Members and Chief Executive of North Ayrshire Council As Chief Internal Auditor for North Ayrshire Council, I am pleased to present my annual statement on the overall adequacy and effectiveness of the framework of governance, risk management and control of the Council for the year ended 31 March 2024. Respective responsibilities of management and internal auditors in relation to governance, risk management and control It is the responsibility of the Council’s senior management to determine, establish and maintain sound systems of governance, risk management and control to ensure that the organisation’s resources are properly applied in a manner and on the activities intended and that these arrangements are sufficient to address the risks facing their services. This includes responsibility for the prevention and detection of fraud. Management is also charged with monitoring the continuing effectiveness of these arrangements and taking action as appropriate. It is the responsibility of the Chief Internal Auditor to provide an annual assessment of the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control. Sound internal controls The main objectives of the Council’s internal control systems are to: • ensure adherence to management policies and directives in order to achieve the organisation’s objectives; • safeguard assets; • ensure the relevance, reliability and integrity of information, so ensuring as far as possible the completeness and accuracy of records; and • ensure compliance with statutory requirements. Any system of control can only ever provide reasonable and not absolute assurance that control weaknesses or irregularities do not exist or that there is no risk of material errors, losses, fraud, or breaches of laws or regulations. Accordingly, the Council is continually seeking to improve the effectiveness of its systems of internal control. The work of internal audit Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. The Internal Audit section operates in accordance with United Kingdom Public Sector Internal Audit Standards (PSIAS) which came into force with effect from 1 April 2013 (updated in March 2017). The requirements under PSIAS represent best practice and are mandatory.
Page 12
Annex B The Chief Internal Auditor prepares an annual internal audit plan which outlines the programme of work to be undertaken. The plan is developed utilising a risk-based methodology and takes into account the requirement placed upon the Chief Internal Auditor to deliver an annual internal audit opinion. The plan needs to be flexible to reflect the changing risks and priorities of the organisation. The plan, and any material changes to the plan during the year, are approved by the Audit and Scrutiny Committee. All internal audit reports are brought to the attention of management, including system weaknesses and/or non-compliance with expected controls, together with agreed action plans. It is management’s responsibility to ensure that due consideration is given to internal audit reports and that appropriate action is taken on audit recommendations. This includes management taking remedial action where appropriate or accepting that there may be a level of risk exposure if the weaknesses identified are not addressed for operational reasons. Internal Audit is required to ensure that appropriate arrangements are made to determine whether action has been taken on internal audit recommendations or that management has understood and assumed the risk of not taking action. Matters arising from internal audit work are also reported to the Chief Executive, Head of Finance (as Section 95 Officer), Members of the Audit and Scrutiny Committee, and external audit. Summary of Internal Audit Activity 2023/24 A total of 17 internal audit reports have been issued during 2023/24. Eight audit opinions give substantial assurance and seven reasonable assurance. Two reports with a wider scope have combined audit opinions of Limited/Reasonable. A further audit report is in draft and anticipated to have a Substantial assurance opinion. A diverse range of audit areas have been covered during the year. As well as planned assignments, Internal Audit also offers advice and guidance on the Council’s control environment as and when required and will carry out non-fraud investigations which are brought to our attention. A range of recommendations have been raised in the areas covered by the 2023/24 internal audit plan. Many expected key controls have been in place and operating effectively, however Internal Audit has also identified scope for improvement in some systems. All 40 action points raised in the year have been accepted by management and will result in continued improvement of the Council’s governance, risk management and control environment. Basis of Opinion The evaluation of the control environment is informed by a number of sources: • the audit work undertaken by Internal Audit during the year to 31 March 2024; • the audit work undertaken by Internal Audit in previous years and knowledge of any significant audit findings after the year end; • the assessment of risk completed during the preparation of the annual audit plan; • reports issued by the Council’s external auditors and other review and inspection agencies; • knowledge of the Council’s governance, risk management and performance monitoring arrangements; and
Page 13
Annex B • any other items brought to the attention of internal audit by whatever means which may warrant further investigation. Opinion On the above basis, Internal Audit can provide reasonable assurance over the framework of governance, risk management and control and that adequate controls were in place and were operating throughout the Council in 2023/24. Laura Miller FCCA Senior Manager (Audit, Fraud, Safety & Risk) 30 May 2024