13 - (05) 2024 10 31 IA reports issued
North Ayrshire Council · 31 October 2024
Back to Audit and Scrutiny Committee — 31 October 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
PUBLIC INFORMATION PUBLIC INFORMATION NORTH AYRSHIRE COUNCIL 31 October 2024 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed between August and September 2024. Recommendation: That the Committee notes the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed between August and September 2024. Internal control reviews have been completed in respect of the areas detailed in Appendix 1 to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix 1 includes the report and action plan from each audit. 2.3 The findings from 3 separate audit assignments are detailed at Appendix 1 to this report and the levels of assurance for each are noted in the table below:
Page 2
PUBLIC INFORMATION PUBLIC INFORMATION Audit Title Assurance Level Leavers and Movers Limited Property Asset Management Reasonable Housing Rent Arrears Substantial 3. Proposals 3.1 It is proposed that the Committee notes the outcomes from the Internal Audit work completed between August and September 2024. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
PUBLIC INFORMATION PUBLIC INFORMATION Mark Boyd Head of Service (Finance) For further information please contact John McCallum, Senior Manager (Audit, Fraud, Safety, Risk & Insurance), on 01294 324607. Background Papers None.
Page 4
PUBLIC INFORMATION PUBLIC INFORMATION INTERNAL AUDIT REPORT LEAVERS AND MOVERS PROCESS IN EDUCATION Assurance Level: Limited Version: Final Date: 21st August 2024 Author: Yvonne Trundle File Ref: 2024-PA-003 Classification: Public
Page 5
PUBLIC INFORMATION PUBLIC INFORMATION 1 1.1 1.2 1.3 1.4 1.5 1.6 1.7 2 2.1 LEAVERS AND MOVERS PROCESS IN EDUCATION Background The audit reviewed the controls around employees in Education who move jobs within the Council as well as employees who leave the Council, with a particular focus on access to personal and sensitive information. The audit focussed on the IT process but it incorporated the HR process to ensure the process is clear for Head Teachers. A similar audit was carried out on the Corporate network and the final report was issued in June 2022. This audit was restricted to the 9 secondary schools as each secondary school has an ICT Technician who is responsible for the new start and leaver process in active directory which allows users access to the resources on the Education network drives. Primary schools and Lockhart are supported via corporate ICT Technicians. There are a number of different types of users that need network access and potentially need access to the IT systems used in the schools. There are employees with permanent, temporary or casual contracts. Employees with casual contracts are supply staff that could be in a school for a varied length of time (e.g. a day, a week, a month, up to a maximum of 12 weeks) and often no prior notice is given for such employees starting. There are employees that work in a school, but as per the position details on the Payroll system are located to a central location rather than a specific school. Examples of such employees are Active Schools Coordinators, Library staff, School Counsellors, Music Instructors etc. There are users that are not employees, for example, Campus Police Officers, Careers Officers, School Nurses and Student Teachers. There are a number of IT systems used in the schools. This audit included a review of users with access to SEEMIS which is an Education Management Information System offering a range of modules to support pupil and staff record management and an app called Xpressions which is used to send communication to parents. In addition, key staff in each school have an Outlook account for sending personal and sensitive data. All employees have a work record within SEEMIS and if they need access to the SEEMIS system, they are also given a user profile. When an employee leaves the school, the work record is closed, and the access is removed. If an employee moves within the school, the access may need to be amended. The Service advised that a census exercise was carried out just prior to the audit which resulted in the SEEMIS users being reviewed and updated in line with current staff. This exercise highlighted issues with SEEMIS not being timeously updated when a user leaves. The findings carried out on SEEMIS users as part of this audit reflects this exercise. Objectives and Scope The main objectives of this audit were to ensure that: • Appropriate policies and procedures are in place covering the process for removing IT access for leavers and amending IT access for movers. • Network access has been deactivated or amended in a timely manner for leavers and movers.
Page 6
PUBLIC INFORMATION PUBLIC INFORMATION • System access has been deactivated or amended in a timely manner for leavers and movers. • Processes are in place to remove or amend access to Corporate Office 365 for leavers and movers and there are proper controls in place over shared mailboxes. 2.2 The scope of the audit covered the controls in relation to the Education network only. The audit focussed on secondary school staff only and excluded pupils. 3 Findings Leavers and Movers Process for Network Access 3.1 Each of the ICT Technicians were contacted to ask how they are notified that a staff member is leaving. This highlighted that there is an informal process in place with some being notified by email or word of mouth. Most are notified by the Education Business Officer (EBO). There is no documented formal process of how the ICT Technicians should be informed a member of staff is leaving to allow the Active Directory (AD) account to be deleted. (action a) 3.2 The auditor tested the ICT Guidance Leavers Procedure that was implemented as part of a previous internal audit. This test highlighted that 6 out of 9 ICT Technicians provided the sample of leavers forms. However, in 2 cases the leavers forms were either completed and/or approved by the Head Teacher retrospectively. In another case the leavers forms did not record the leaving date or record when the AD account was deleted. One of the ICT Technicians had not previously completed the leavers form but will now start using them. The other 2 ICT Technicians did not reply or provide the requested information due to being on sick leave. (action b) 3.3 IT Services are planning to replicate the Corporate automated movers and leavers process in Education. If the ICT Technician is not notified of a leaver or mover, the automated process will ensure the AD account is deleted when an employee leaves or amended if an employee moves. In order for this to work, the new start process needs to capture mandatory information including employee number and email address. IT Services carried out a cleansing exercise to ensure missing employee numbers for historic users was captured. IT services developed an AD user creation tool to be used by the ICT Technicians when adding a new start to AD. In January 2024 and after discussions with the ICT Technicians, the Technology Officer requested the ICT Technicians use this tool to ensure the employee number is captured at the AD account creation stage. In June 2024, the Technology Officer advised not all ICT Technicians are using the new user creation tool resulting in accounts being created manually that are missing the employee number. IT Services have drafted an email that will be issued by the Senior Manager to advise the ICT Technicians that it is mandatory to use this app. The ICT Technicians advised one of the issues with using the new app is that they are not always notified in advance of a new start and are not always provided with the employee number and email address. This was discussed with the Service as there is no formal process in place to ensure the ICT Technician is notified of a new start in advance and to ensure the mandatory information is provided to allow the AD user creation tool to be used. (action c)
Page 7
PUBLIC INFORMATION PUBLIC INFORMATION 3.4 There were 1,114 active AD users on a report provided by IT Services which were matched to the Payroll system. This test identified 34 leavers. IT Services were contacting the ICT Technicians to clean up AD at the time of writing. 3.5 The data match identified 28 generic AD accounts that should be reviewed and removed if no longer needed. (action d) 3.6 The data match identified 24 AD accounts that were passed to IT Services as the employee number on AD has been recorded incorrectly, to allow the correct employee number to be recorded. 3.7 There were 49 leavers from secondary schools as per the Payroll system report from April 2023 to November 2024 and 4 of them were overpaid by 2 weeks but this has been identified and rectified by the Payroll team. 3.8 There were 20 secondary school staff members that moved within Education between March and September 2023 as per the IT movers and leavers report. A sample of 5 were selected to check the movers AD access had been amended and there were no findings to report. 3.9 There were 3 secondary school staff members that moved from Education to Corporate between March and September 2023, as per the IT movers and leavers report, and 1 of them still had AD access in the school they previously worked in but this has been deleted by the relevant ICT Technician. 3.10 There have been discussions with IT and Education regarding how the AD access for supply staff should be controlled. Further discussion is required to agree the best approach for removing this access, giving consideration to time spent adding and removing such users as well as ensuring access is not retained for longer than necessary. Leavers and Movers Process for System Access 3.11 Each of the EBOs were contacted about the leavers process for the SEEMIS system and all of them confirmed they will close the work records and remove the access for leavers. The majority are informed by the Head Teacher but some did not specify who informs them. Some also receive the resignation letters and are involved in the recruitment process for the leaver’s replacement. Some advised the leavers are confirmed via email or verbally. There is no formal documented process in place for the leavers process to ensure work records are closed and access is removed. (action e) 3.12 Each of the EBOs were contacted about the movers process for the SEEMIS system and all confirmed once they are informed of a change in post, they would amend the SEEMIS access, where necessary. Only four of the schools advised they are involved in the recruitment process, which is how they are informed of movers and 1 advised they are usually informed via email or in person. There is no formal documented process in place for the movers process to ensure access is appropriate for the new job role, particularly when a promoted post ends and additional access should be removed. (action f) 3.13 Each of the EBOs were contacted to ask if they carry out periodic reviews of SEEMIS users. Only 1 school confirmed they did not carry out such a review and the other responses varied from once a year to every 8 weeks. The new formal documented
Page 8
PUBLIC INFORMATION PUBLIC INFORMATION process should advise that a full review should be carried out at least twice per year. (action g) 3.14 There were 1,089 SEEMIS users and a data match was carried out to the Payroll system. This data match resulted in 146 queries being passed to the EBOs to investigate and included users that could not be traced to the Payroll system, users that had left, and users with a different school location as per the Payroll system. The EBOs reviewed the queries and took appropriate action. Action taken included removing access to 21 leavers, removing access to 5 movers and changing the access profile for 9 users. This data match also identified 2 external users. 3.15 The data match identified that non-teaching staff such as Active Schools Coordinators, Library staff, School Counsellors, Music Instructors have access to SEEMIS. The data match also identified non-council employees such as Campus Cops, Careers Officers and School Nurses have access to SEEMIS. Education should review such users to decide whether these users should have access to this system or whether relevant information should be sought from pastoral/guidance staff. 3.16 The data match identified 50 duplicate usernames at the same school and 12 duplicate usernames at different schools. The EBOs reviewed the duplicate usernames and 22 work records were closed as a result of this check. There are genuine reasons why a user would need more than 1 work record including a teacher that works at different schools or have more than 1 post at the same school. 3.17 The auditor summarised the users per user profile which determines the level of access they have. There are 43 user profiles being used. The auditor selected a sample of user profiles selected to test – Counsellor, Pastoral, Principal Teacher, Office and Security. There were 307 users with the selected user profiles that were reviewed by the EBOs which resulted in action being taken to amend 21 user access profiles and to remove access for 14 users. In addition, Auchenharvie and Greenwood Academies have a high number of users with the Security and/or Office-Security user profiles. (action h) 3.18 The auditor carried out testing on Groupcall Xpressions which is used to communicate with parents and 8 out of the 9 secondary schools use this application. This testing highlighted that the number of users varies per school and ranges from 11 to 32 users. Testing identified 1 leaver and 4 movers that still had access and the relevant EBO has since removed this access. 3.19 The Groupcall Xpressions testing also identified 7 users with personal email addresses set up and 1 user with a generic school email address set up. The relevant EBOs agreed to amend the email addresses to their Glow email account. Shared Mailboxes 3.20 The auditor discussed the use of shared mailboxes and in the school they are set up via Glow. Each school has a general shared school email account that parents can use to contact the school. Access to these accounts is via a shared login and password. (action i) 3.21 The schools have other shared mailboxes set up via Glow that are controlled via distribution lists so if a user is added to the distribution list, they will receive that email via their own email login and password so shared logins and passwords are not being used.
Page 9
PUBLIC INFORMATION PUBLIC INFORMATION 4 Internal Audit Opinion 4.1 Overall, limited assurance was obtained with regard to the leavers and movers process in Education. There are no formal documented processes in place for the removal of leavers from the IT systems reviewed as part of this audit or for the amendment of IT access for movers. Although there is a documented leavers process for AD, this was not always being followed by all ICT Technicians. 4.2 It is vital that the new start application developed by IT Services is used by the ICT Technicians when a new start needs to be set up with AD access and that the relevant information is provided to the ICT Technicians, preferably in advance of the start date. This will allow the automated leavers and movers process to be implemented to capture any leavers and movers not dealt with via the school leavers and movers process. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 10
PUBLIC INFORMATION PUBLIC INFORMATION KEY FINDINGS AND ACTION PLAN LEAVERS AND MOVERS PROCESS IN EDUCATION Action a Finding Each of the ICT Technicians were contacted to ask how they are notified that a staff member is leaving. This highlighted that there is an informal process in place with some being notified by email or word of mouth. Most are notified by the Education Business Officer (EBO). There is no documented formal process of how the ICT Technicians should be informed a member of staff is leaving to allow the Active Directory (AD) account to be deleted. Action Description A formal procedure document should be prepared documenting how the ICT Technicians are notified of leavers to allow the AD account to be deleted on a timely basis and all relevant staff should be notified of the new process to ensure it is followed. Risk Leavers continue to have IT access. Priority (1, 2, 3) 1 Paragraph Reference 3.1 Managed by Andrew McClelland, Head of Service (Education) Assigned to Lynn Taylor, Senior Manager (Resources & Infrastructure) Due Date 31 August 2024 Management Comment EBOs have been instructed to develop a procedure that will be consistent across all secondary schools to be implemented for the new session. Action b Finding The auditor tested the ICT Guidance Leavers Procedure that was implemented as part of a previous internal audit. This test highlighted that 6 out of 9 ICT Technicians provided the sample of leavers forms. However, in 2 cases the leavers forms were either completed and/or approved by the Head Teacher retrospectively. In another case the leavers forms do not record the leaving date or record when the AD account was deleted. One of ICT technicians has not previously completed the leavers form but will now start using them. The other 2 ICT Technicians did not reply or provide the requested information due to being off sick. Action Description The ICT Technicians should be reminded to follow the ICT Guidance Leavers Procedure and to ensure all relevant information is captured and recorded. Risk Leavers continue to have IT access. IT access is withdrawn at the wrong date or from the wrong person causing operational issues and additional work. Priority (1, 2, 3) 2 Paragraph Reference 3.2 Managed by Andrew McClelland, Head of Service (Education) Assigned to Stewart Reid, ICT Coordinator Due Date 31 August 2024 Management Comment A communication will be issued reminding ICT Technicians to follow the ICT Guidance Leavers Procedure and to ensure all relevant information is captured and recorded.
Page 11
PUBLIC INFORMATION PUBLIC INFORMATION Action c Finding There is no formal process in place to ensure the ICT Technician is notified of a new start in advance and to ensure the mandatory information is provided to allow the AD user creation tool to be used. Action Description A formal process should be introduced to ensure the ICT Technicians are notified on a timely basis of all new starts to allow the AD user creation tool to be used which will ensure the mandatory information is captured at onboarding stage. Risk The AD user creation tool cannot be used to set up a new user, therefore the automated movers and leavers process cannot be used for that user. Priority (1, 2, 3) 2 Paragraph Reference 3.3 Managed by Andrew McClelland, Head of Service (Education) Assigned to Lynn Taylor, Senior Manager (Resources & Infrastructure) Due Date 31 August 2024 Management Comment EBOs have been instructed to develop a procedure that will be consistent across all secondary schools to be implemented for the new session. Action d Finding The data match identified 28 generic AD accounts. Action Description The generic AD accounts should be reviewed and deleted where appropriate. Risk Unnecessary generic accounts could be used for unauthorised access; there is lack of accountability for user actions; there is an inability to detect who has carried out fraudulent actions. Priority (1, 2, 3) 2 Paragraph Reference 3.5 Managed by Andrew McClelland, Head of Service (Education) Assigned to Lynn Taylor, Senior Manager (Resources & Infrastructure) Due Date 31 August 2024 Management Comment EBOs will be instructed to review and delete, where appropriate, all generic AD accounts for the new session. Action e Finding Each of the EBOs were contacted about the leavers process for the SEEMIS system and all of them confirmed they will close the work records and remove the access for leavers. The majority are informed by the Head Teacher and a couple did not specify who informs them. Some also receive the resignation letters and are involved in the recruitment process for the leavers replacement. Some advised the leavers are confirmed via email or verbally. Action Description A formal documented procedure should be introduced for the leavers process to cover how EBOs are notified of leavers to ensure the work record is closed and access is removed in a timely manner. Risk User access and work records are not updated promptly. Priority (1, 2, 3) 1
Page 12
PUBLIC INFORMATION PUBLIC INFORMATION Paragraph Reference 3.11 Managed by Andrew McClelland, Head of Service (Education) Assigned to Lynn Taylor, Senior Manager (Resources & Infrastructure) Due Date 31 August 2024 Management Comment EBOs have been instructed to develop a procedure that will be consistent across all secondary schools to be implemented for the new session. Action f Finding Each of the EBOs were contacted about the movers process for the SEEMIS system and all confirmed once they are informed of a change in post, they would amend the SEEMIS access, where necessary. Only four of the schools advised they are involved in the recruitment process which is how they are informed of movers and 1 advised they are usually informed via email or in person. Action Description A formal documented procedure should be introduced for the movers process to cover how EBOs are notified of movers to ensure access is amended in a timely manner, particularly when a promoted post ends and additional access should be removed. Risk Access is not appropriate for the new job role; user retains additional access no longer required. Priority (1, 2, 3) 1 Paragraph Reference 3.12 Managed by Andrew McClelland, Head of Service (Education) Assigned to Lynn Taylor, Senior Manager (Resources & Infrastructure) Due Date 31 August 2024 Management Comment EBOs have been instructed to develop a procedure that will be consistent across all secondary schools to be implemented for the new session. Action g Finding Each of the EBOs were contacted to ask if they carry out periodic reviews of SEEMIS users. Only 1 school confirmed they did not carry out such a review and the other responses varied from once a year to every 8 weeks. Action Description The new formal documented process should advise that a full review should be carried out at least twice per year. Risk Movers or leavers have inappropriate access to SEEMIS. Priority (1, 2, 3) 2 Paragraph Reference 3.13 Managed by Andrew McClelland, Head of Service (Education) Assigned to Lynn Taylor, Senior Manager (Resources & Infrastructure) Due Date 31 August 2024 Management Comment EBOs have been instructed to develop a procedure that will be consistent across all secondary schools to be implemented for the new session.
Page 13
PUBLIC INFORMATION PUBLIC INFORMATION Action h Finding Auchenharvie and Greenwood Academies have a high number of users with the Security and/or Office-Security user profiles. Action Description Auchenharvie and Greenwood Academies should review the number of users with Security and/or Office-Security user profiles to ensure this is restricted to a small number of key staff. Risk Users have inappropriate access to sensitive data or to make changes. Priority (1, 2, 3) 2 Paragraph Reference 3.16 Managed by Andrew McClelland, Head of Service (Education) Assigned to Carlyn Jamison (Education Business Officer, Auchenharvie and Lynne Murdoch (Education Business Officer, Greenwood) Due Date 31 August 2024 Management Comment The EBOs at Auchenharvie and Greenwood Academies have been instructed to review the number of users with Security and/or Office-Security user profiles to ensure this is restricted to a small number of key staff. Action i Finding The auditor discussed the use of shared mailboxes and in the school they are set up via Glow. Each school has a general shared school email account that parents can use to contact the school. Access to these accounts is via a shared login and password. Action Description Education should investigate amending access to the schools’ shared mailboxes so that users are not sharing a login and password. Individual logins and passwords should be used. Risk Leavers or movers continue to have access to shared mailboxes Priority (1, 2, 3) 2 Paragraph Reference 3.19 Managed by Andrew McClelland, Head of Service (Education) Assigned to Lynn Taylor, Senior Manager (Resources & Infrastructure) Due Date 31 August 2024 Management Comment EBOs have been asked to investigate amending access to the schools’ shared mailboxes so that users are not sharing a login and password. Individual logins and passwords should be used. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 14
PUBLIC INFORMATION PUBLIC INFORMATION INTERNAL AUDIT REPORT PROPERTY ASSET MANAGEMENT Assurance Level: Reasonable Version: Final Date: 10th September 2024 Author: Gordon Swinburne File Ref: 2024-PA-016 Classification: Public
Page 15
PUBLIC INFORMATION PUBLIC INFORMATION PROPERTY ASSET MANAGEMENT 1 Background 1.1 Property Management and Investment (PMI) manage the Council’s asset portfolio. 1.2 Scottish councils are required to maintain transparency regarding their assets. The Community Empowerment (Scotland) Act 2015 mandates that local authorities must provide information about their land and buildings upon request. Additionally, following the 2007 Asset Management Review, all Scottish Government organisations are required to lodge an Asset Management Plan (AMP) with Facilities and Estates Services (FES). These plans should outline the organisation’s office requirements and aspirations over a 10-year period. 1.3 The Scottish Public Finance Manual, published by the Scottish Government, stipulates that asset registers are a crucial part of financial management systems and must meet the accounting requirements of the HM Treasury Government Financial Reporting Manual. This ensures that there is a clear record of all assets, which is accessible for audit and public scrutiny. 2 Objectives and Scope 2.1 The objective of this audit was to assess the process surrounding the management of property assets to ensure: • an appropriate control strategy is clearly defined by the Council which is approved and supported by appropriate staffing and budgets • that all assets are recorded and maintenance planning is centrally recorded and monitored • maintenance of properties maximises lifespan of property assets • asset disposal achieves maximum value of property 3 Findings CONTROLS 3.1 Asset management policy documents are current. The Property Asset Management Plan (PAMP) 2023 to 2028 is the key public policy document relating to assets. 3.2 The Computer Aided Facility Management Tribal K2 system records assets. This system is currently being replaced. 3.3 The Service risk register identifies several risks including maintenance compliance, staffing capability, failure to rationalise assets creating a drain on budgets and lack of investment in asset management. To support the management in mitigating these risks, the service uses a monthly budgeting report, using real time financial information to measure all related property running costs. 3.4 The service reports that it hasn’t had a high turnover of staff which supports a more efficient and consistent approach to maintenance and management of assets.
Page 16
PUBLIC INFORMATION PUBLIC INFORMATION ASSET RECORDS 3.5 Complementing the PAMP property list, 3 other asset lists were obtained during the course of the audit. Property services provided a Property Inspection Schedule/Asset list. Another copy of the Asset Register was obtained online, and the risk management team provided their asset insurance spreadsheet. Cross referencing the data between all 4 was difficult due to different referencing to index the assets. (Action a) 3.6 The PAMP identified 523 property assets by their Uniclass categorisation. These categories including historic buildings, offices, educational resources, care, cemeteries, commercial sports and traveller sites, public conveniences, 7 of which are Common Good assets. Housing assets are not included in this list. 3.7 Cross referencing the Insurance Assets Uniclass categorisation index there was a considerable difference in assets listed on both registers. A further 8 assets were identified on the Insurance index that were not listed on the PAMP, 1 of which was a Common Good asset. (Action b) 3.8 The property maintenance asset register identified 1,121 properties not including housing stock. 3.9 The insurance register is more comprehensive and in addition to the maintenance register and the PAMP also covers 13,347 housing properties. Cross referencing the information, gaps were identified. 3.10 Each property on the register should be referenced with a variety of unique identifiers. The Unique Property Reference Number (UPRN) is assigned to every address in Scotland was missing from the registers reviewed. Additional information including geographical northing and eastings settings was incomplete. The service maintenance and asset register had incomplete property index references assigned to assets. MAINTENANCE PLANNING 3.11 Maintenance is tracked on an Excel spreadsheet. Following the COVID period, there is a backlog on completing property inspection schedules. Last inspection dates on the register were incomplete for 861 properties, therefore maintenance compliance cannot be determined from the information provided. (Action c) 3.12 The service manages a range of property performance management risks, including environmental challenges, upgrading and replacing current building stock and plant, and identifying the need to use external consultants. ASSET DISPOSAL 3.13 Properties for sale are advertised on the internet. At the time of the audit, 2 properties were for sale and a further 3 development sites were advertised of which 2 were under offer. 3.14 There were 78 properties identified as surplus. These did not include properties identified in the recent office rationalisation review undertaken by the Council.
Page 17
PUBLIC INFORMATION PUBLIC INFORMATION 3.15 Independent third-party overview relating to the disposal of assets is provided by Legal Services. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to property asset management with improvements required to the administration supporting maintenance planning. 4.2 Prior to moving to the replacement IT system, all existing records are required to be updated in order for the service to obtain maximum value and usage of the assets and identify cost effective mitigation of older and failing equipment rendering the asset unusable. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 18
PUBLIC INFORMATION PUBLIC INFORMATION KEY FINDINGS AND ACTION PLAN PROPERTY ASSET MANAGEMENT Action a Finding Inconsistent refencing of data is used within different registers. Action Description A consistent referencing format be adopted which allows the service to provide accurate information to all reports that it and other users require. This will also support further extension of the real time information currently provided by the PMI budget monitoring report. Risk The services using the data are unable to get accurate information which may have operational and financial impact on their budgets. Priority (1, 2, 3) 2 Paragraph Reference 3.5 Managed by Laurence Cree, Head of Service (Sustainability, Transport & Corporate Property) Assigned to David Oliver, Team Manager (Assets & Property Rationalisation) Due Date 31st March 2025 Management Comment A review of all property asset lists currently in circulation will be undertaken, which will cross-reference the data and update as required to ensure all asset registers are correct and consistent. Action b Finding Inconsistent register of assets across different reports. Action Description Prior to migration of asset data to the new IT system a data cleansing exercise should be undertaken. If resources are not available to achieve this prior to migration, a planned audit of assets should be timetabled to ensure accuracy of asset register. Risk Gaps in information will lead to inconsistent use of the data over different areas of the Council. Use of data for business information systems will be inaccurate and lead to poor decision planning. Priority (1, 2, 3) 2 Paragraph Reference 3.7, 3.10 Managed by Laurence Cree, Head of Service (Sustainability, Transport & Corporate Property) Assigned to David Oliver, Team Manager (Assets & Property Rationalisation) Due Date 31st March 2025 Management Comment As noted above in Action (a), a review of all asset registers will be completed which will include a full data cleanse exercise to ensure the information held is correct and consistent.
Page 19
PUBLIC INFORMATION PUBLIC INFORMATION Action c Finding Maintenance spreadsheet highlights a high number of outstanding property inspections. Action Description Ensure if maintenance inspections have been completed, that they are recorded on the spreadsheet, if gaps remain then a prioritised regime is introduced to manage the inspection backlog. Risk Failure to maintain a regular inspection regime will impact in the identification of property issues, preventative maintenance and possible long-term loss of the use of the property. Priority (1, 2, 3) 1 Paragraph Reference 3.11 Managed by Laurence Cree, Head of Service (Sustainability, Transport & Corporate Property) Assigned to David Oliver, Team Manager (Assets & Property Rationalisation) Due Date 31st January 2025 Management Comment The Property Inspection Schedule is an in-service document which had been used to monitor all property-related maintenance activities when the document was first introduced. The processes have now evolved, including the creation of a new condition survey programme and so a lot of the information held in the document is no longer relevant or required. As part of the asset register review and data cleanse, the Property Inspection Schedule will be revised to reflect current practices and avoid reporting inaccurate information. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 20
PUBLIC INFORMATION PUBLIC INFORMATION INTERNAL AUDIT REPORT HOUSING RENTAL ARREARS Assurance Level: Substantial Version: Final Date: 18th September 2024 Author: Gordon Swinburne File Ref: 2024-PA-015 Classification: Public
Page 21
PUBLIC INFORMATION PUBLIC INFORMATION HOUSING RENTAL ARREARS 1 Background 1.1 North Ayrshire Council had 13,329 rental properties at 31st March 2024. 1.2 Failure to pay rent on a property can result in eviction from the property. During the COVID pandemic there was a moratorium on evictions, and with other cost of living increases creating cashflow issues, some clients failed to keep up with their rent payments, creating a rental backlog debt to the Council. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • changes in the legal and operational environment are managed. • financial risks to the council are identified. • recovery processes are managed. • legal processes are timely. 3 Findings HOUSING ENVIRONMENT 3.1 An updated version of guidance documents relating to housing rent arrears are currently being worked on, reflecting current changes in procedure and updated screens in the Northgate system. (Action a) ACTUAL AND TRENDS 3.2 Sample testing on rent arrears was carried out for the financial year periods 2021 through to 2024. No issues were identified. 3.3 The average 2023/24 weekly rent for North Ayrshire is £82.78 compared to the Scottish average of £84.31. 3.4 Arrears in many cases had increased due to a suspension of evictions during the COVID period, aligned with cost-of-living increases; many chose to avoid paying rent to meet other costs. ARREARS RECOVERY 3.5 Rent is collected on a fortnightly basis which allows at-risk accounts to be identified early and interventions to be made. A wide range of guidance regarding rent arrears and support available is provided in various media both printed and online. 3.6 Housing officers report that contacting clients is, at times, difficult and they are currently trialing the use of texts in the Three Towns Housing Office.
Page 22
PUBLIC INFORMATION PUBLIC INFORMATION LEGAL INTERVENTIONS 3.7 Legal Services are instructed by Housing Services, if no repayment plan can be agreed or adhered to, to process evictions through the Sheriff Court. Tracking information is shared between both services using a dedicated Teams group and SharePoint site. 3.8 Considerable changes in the court processes since COVID mean that these processes are now more time consuming. Cases are now submitted to the court on an individual basis whereas prior practice was paper based and allowed multiple applications to be submitted at the same time. The submitting of cases and all subsequent correspondence with the court is via email. 3.9 Value for money of the recovery process requires some cut off limits to be set. The maximum amount that a social landlord can recover through the Summary Cause Recovery of Heritable Property process is £5,000 plus expenses/outlays (if granted by the Sheriff) and any arrears under 4 weeks are not submitted for recovery via the Sheriff Court. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to management of rent arrears. 4.2 Cost of living costs will continue to impact on renters and early interventions to support them to maintain their homes will be important. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 23
PUBLIC INFORMATION PUBLIC INFORMATION KEY FINDINGS AND ACTION PLAN HOUSING RENTAL ARREARS Action a Finding Guidance procedure documents are out of date and currently being updated. Action Description The service should ensure that updates to guidance procedure documents are completed timeously. Risk Localised practices can be established and used to train new starts thereby correct procedural processes are not followed and mitigating remedial action is delayed. Priority (1, 2, 3) 2 Paragraph Reference 3.1 Managed by Yvonne Baulk, Head of Service (Housing and Public Protection) Assigned to Craig Leitch, Area Housing Manager Due Date 31st October 2024 Management Comment The updates to the guidance procedure are in progress and will be completed by 31 October 2024. The guidance procedure will be monitored and reviewed regularly through the rent arrears working group. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.