7. (03) 2025 03 13 Internal Audit and Corporate Fraud Action Plans - Q3 Update
North Ayrshire Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 13 March 2025 Audit and Scrutiny Committee Title: Internal Audit and Corporate Fraud Action Plans: Quarter 3 update Purpose: To advise the Audit and Scrutiny Committee on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 31 December 2024. Recommendation: That the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 1. Executive Summary 1.1 The CIPFA document 'Audit Committee Principles in Local Authorities in Scotland' highlights that Audit Committees should monitor and review the progress made in implementing audit recommendations. 1.2 Service managers are responsible for ensuring that agreed actions arising from Internal Audit and Corporate Fraud reviews are implemented. This provides assurance that identified control weaknesses have been addressed and are being managed effectively. 1.3 All actions are monitored on the Pentana system and service managers are responsible for updating Pentana as they progress each action. This enables Internal Audit to monitor progress on a 'real-time' basis and address any delays in implementation. 1.4 This report details the position as at 31 December 2024. 2. Background 2.1 The last report to the Audit and Scrutiny Committee on 31 October 2024 highlighted that there were 12 actions outstanding at the end of September 2024: One action was overdue and the remaining 11 action had not yet passed their due date.
Page 2
2.2 In addition to these 12 carried forward actions, there have been 22 new actions agreed, giving a total of 34 action points for review. 2.3 Services have completed 22 actions since the last report. All Council Services are required to retain evidence of work carried out in completing their actions and Internal Audit carries out 'spot-checks' on a sample of completed actions on an ongoing basis. 2.4 Of the remaining 12 actions, three had either not started or were only partially complete at 31 December 2024 and the remaining nine actions were not due for completion until after that date. 2.5 Appendix 1 to this report provides the Committee with full details of the three actions that were not completed within the agreed timescales. 3. Proposals 3.1 It is proposed that the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The effective implementation of agreed Internal Audit and Corporate Fraud actions helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028.
Page 3
Community Wealth Building 4.7 None. 5. Consultation 5.1 Council Services are consulted during the completion of each Internal Audit and Corporate Fraud review and have also provided updates on progress made in implementing action points. Mark Boyd Head of Service (Finance) For further information please contact John McCallum, Senior Manager (Audit, Fraud, Safety, Risk & Insurance), on 01294 324607. Background Papers None.
Page 4
4 Appendix 1 - Actions due by 31st December 2024 but not started or partially complete Code IA2022PA019b Description Audit Action: A minimum technical standard for CCTV systems should be set for the Council. A Council-wide audit of CCTV inventory should be carried out to assess compliance of CCTV assets against the standards, which will give an indication of the level of capital investment required to bring the Council’s CCTV systems up to an appropriate standard and form the basis of a bid for capital. An approval process should be introduced to ensure new CCTV purchases meet the requirements of the standards. Audit Finding: Audit were advised that there are various capital budgets in place covering vehicles and property lifecycle investment. However, there is no formal replacement programme for CCTV equipment. Risk: Substandard systems that aren’t fit for the intended purpose. CCTV footage is not available or not usable when required. Priority 2 Latest Note Work in relation to the assessment of non-public space CCTV assets continues. Procurement have now issued a Prior Information Notice to appoint an external contractor to capture the physical data which will commence at the end of April 2025 (Q1). Further timescales will be available once information starts being received from the appointed contractor. Protective Services also continue to advise on the operational requirements for new or replacement systems, thereby ensuring ongoing compliance for current projects. DPIAs for CCTV systems across the Council continue to be assessed as and when required and the I-Learn CCTV awareness course continues to be used. Estimated completion date 31st December 2025. Progress Bar Original Due Date 30-Jun-2022 Due Date 31-Dec-2024 Parent Code & Title IA2022PA019 CCTV in Council Buildings and Vehicles Managed By David Hammond Assigned To David Hammond; Scott McKenzie
Page 5
5 Code IA2024PA022a Description Action Description: IT Services in consultation with the Risk Manager should compile an IT Corporate Systems list and facilitate a discussion with ELT to enable a Corporate priority list for the recovery of locally stored IT systems not covered by the SRM or Unix disaster recovery process. Finding: The Council’s key IT systems have data recovery capability. There are a number of locally stored IT systems not covered by the SRM or Unix disaster recovery process and there is no priority list to decide which order these IT systems are recovered in the event of a major cyber security event. Risk: No clear prioritised order for recovery could result in a delay in the recovery of such systems. Priority 2 Latest Note Priority list has been updated to reflect the updates suggested by ELT on 18th December: • Add externally hosted systems to the Priority List for visibility. • Add the Service that owns them in brackets beside the application. • Add anticipated timescales of recovery for systems. Could there be an extension to the audit action timeline to allow IT to re-present the updated list to ELT for approval by March 31st. Progress Bar Original Due Date 31-Oct-2024 Due Date 31-Oct-2024 Parent Code & Title IA2024PA022 Cyber Resilience Business Continuity Managed By James McNeil; Fiona Walker Assigned To James McNeil
Page 6
6 Code IA2024PA022k Description Action Description: Once the updated Business Continuity Management Strategy has been agreed it should be reissued to ensure relevant staff are aware the strategy has been reviewed and updated. Finding: The Council has a Business Continuity Management (BCM) Strategy in place, however, this strategy was last updated in October 2015. The Team Manager (Risk) is aware of this, and the document is currently being updated. Risk: It is not in line with industry best practice; out of date or inaccurate information. Priority 2 Latest Note There have been some delays to the strategy drafting due to staff changes. The Strategy is now in final draft stage and undergoing a review for accessibility and aesthetics. This will be approved at the appropriate level in due course. Target completion date 31st July 2025 Progress Bar Original Due Date 29-Nov-2024 Due Date 29-Nov-2024 Parent Code & Title IA2024PA022 Cyber Resilience Business Continuity Managed By Mark Boyd Assigned To Alex Fitzharris