3. 2022 05 31 IA annual report 2021-22
North Ayrshire Council · 31 May 2022
Back to Audit and Scrutiny Committee — 31 May 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 31 May 2022 Audit and Scrutiny Committee Title: Internal Audit Annual Report 2021/22 Purpose: To provide the Committee with an annual report on the work of Internal Audit during 2021/22 and provide an opinion on the governance, risk management and internal control environment of the Council. Recommendation: The Committee is asked to note the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 1. Executive Summary 1.1 The Internal Audit Annual Report attached at Appendix 1 provides information on the work carried out during the period of the 2021/22 audit plan. The plan covered a 14- month period from 1 February 2021 – 31 March 2022. 1.2 It is the opinion of the Senior Manager (Audit, Fraud, Safety and Insurance) that reasonable assurance can continue to be placed on the adequacy and effectiveness of the Council’s systems of governance, risk management and internal control. 2. Background 2.1 The Public Sector Internal Audit Standards (PSIAS) require that the Chief Internal Auditor prepares an annual report on the activities of Internal Audit and that the report should contain a view on the adequacy of the Council’s governance, risk management and internal control frameworks. The annual report for 2021/22 is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the section during the year and the key audit findings. It also contains the annual internal audit opinion. 2.2 The report gives information on the actual performance against the agreed plan. Overall, 752 days of audit work took place, which was 63 days less than budgeted. Section 2 of the annual report provides more information on the reasons for the shortfall and the corrective action which was taken to amend the audit plan. 2.3 Section 3 of the report provides information on the assurance level given for each audit and some of the most significant findings. All audit reports published were reported to the Audit and Scrutiny Committee.
Page 2
2.4 All audit findings during the year support and inform the objective opinion of the Senior Manager (Audit, Fraud, Safety and Insurance) on the adequacy of the Council’s governance, risk management and internal control environment. The assurance category given to each individual audit informs the overall level of assurance. The annual audit opinion required by PSIAS is included in the attached annual report. 2.5 The annual internal audit opinion also contributes to the Annual Governance Statement which is published as part of the Council’s annual accounts and is included under separate cover in this Audit and Scrutiny Committee agenda for approval. 2.6 Based on the audit work carried out, the opinion of the Senior Manager (Audit, Fraud, Safety and Insurance) is that reasonable assurance can continue to be placed on the adequacy and effectiveness of the Council’s systems of governance, risk management and internal control. 3. Proposals 3.1 It is proposed that the Committee notes the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building
Page 3
4.7 None. 5. Consultation 5.1 Council Services are consulted on the findings of Internal Audit throughout the year. No specific consultations have taken place in relation to this annual report. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None.
Page 4
INTERNAL AUDIT ANNUAL REPORT 2021/22
Page 5
INTERNAL AUDIT ANNUAL REPORT 2021/22 1 Introduction 1.1 The Council’s Section 95 Officer has overall responsibility for Internal Audit in North Ayrshire Council. The Senior Manager (Audit, Fraud, Safety and Insurance) reports to the Section 95 Officer, with the right of access to the Chief Executive and the Chair of the Audit and Scrutiny Committee on any audit matter. These rights of access help ensure the organisational independence of Internal Audit. 1.2 During 2021/22, the section operated in conformance with the ‘Public Sector Internal Audit Standards (PSIAS)’. The standards define the way in which the Internal Audit section should be established and undertake its functions. The section complied with the PSIAS requirement for an external assessment every five-years; this was last undertaken by Falkirk Council in 2017 through the peer-to-peer review network of the Scottish Local Authorities Chief Internal Auditors Group (SLACIAG). The current external assessment is being carried out by West Dunbartonshire Council and is a work in progress at the time of writing. The outcome from that review, and any associated quality assurance and improvement programme, will be reported at a future meeting of the Audit and Scrutiny Committee. 1.3 The Internal Audit section also operated under an ‘Internal Audit Charter’ which was most recently approved by the Audit and Scrutiny Committee in September 2020. 1.4 One of the requirements of the PSIAS is the publication of an annual report. The aim of this annual report is to give an overview of the work carried out during 2021/22. Some information is provided on the resources available to Internal Audit and the performance of the section. 1.5 Finally, the report provides an opinion on the overall adequacy and effectiveness of the Council’s governance, risk management and internal control frameworks. 2 Planned and Actual Activity during 2021/22 2.1 The internal audit plan approved by the Audit and Scrutiny Committee in January 2021 and covering a 14-month period from 1 February 2021 – 31 March 2022, included a plan for 815 audit days. 710 days (87%) were budgeted as ‘productive’ and allocated for carrying out audit work. A further 105 days (13%) were budgeted for ‘non-productive’ time: management and strategy, attendance at meetings, administration and staff training and development. Time is determined as ‘productive’ or ‘non-productive’ in line with definitions produced by CIPFA. 2.2 A mid-year review of the internal audit plan was approved by the Audit and Scrutiny Committee in November 2021. The revised plan included a total of 780 planned audit days. 644 days (83%) were budgeted as ‘productive’ and a further 136 days (17%) were budgeted as ‘non-productive’. The following audits were removed from the plan and deferred to the 2022/23 internal audit plan which was approved by the Audit and Scrutiny Committee in March 2022: • Museums and Heritage
Page 6
• Agency staff and workers • Transport Journeys and Hires • Building Services Procurement • Facilities Management Procurement • Workforce Planning • Social Care establishments. 2.3 During 2021/22, 752 workdays took place; this was 63 days below the original audit plan target and 28 days below the revised mid-year target. There are three main reasons for the reduction: • The former Senior Manager (Audit, Fraud, Safety and Insurance) was promoted to another post within the Council on 7 June 2021. The newly appointed Senior Manager came into post on 19 August 2021. In the interim, the Audit Manager took on the role of Acting Senior Manager for Internal Audit and Corporate Fraud. This had an impact on the audit days available. • An extension to the temporary change in the Council structure meant that additional time was spent on directly line managing the Insurance Team. This remained the case until March 2022 when the Risk and Insurance Manager returned from secondment. • Higher than anticipated sickness absence levels were experienced by the Internal Audit Team in February and March 2022. 2.3 There were 615 actual ‘productive’ days during 2021/22 and 138 ‘non-productive’ days. At 82% of total actual days, this meant productive days were around 5% below the original percentage target but consistent with the revised mid-year estimate. 2.4 In line with the Council’s defalcation procedures, all instances of suspected fraud and irregularity should be reported to Internal Audit. These are investigated by the specialist Corporate Fraud Team and are not included within this annual report. 3 Audit Findings 3.1 All audit reports which were finalised during 2021/22 were reported to meetings of the Audit and Scrutiny Committee in September and November 2021, and January, March and May 2022. 3.2 The assurance levels from each of the audits were as follows: September 2021 Committee Audit Title Assurance Level IJB Governance Substantial Supply Teachers Reasonable Sustainability Substantial Temporary Posts and Contracts Substantial/Limited Waste Management Substantial Sustainability Payments to Care Providers Substantial Aids and Adaptations Limited Procurement Cards Limited
Page 7
November 2021 Committee Audit Title Assurance Level Community Alarms Substantial January 2022 Committee Audit Title Assurance Level Payroll Transaction Testing Reasonable Procurement of Educational Supplies Reasonable/Limited Benefits Substantial CCTV in Council Buildings and Vehicles Limited Accounts Payable Transaction Testing Reasonable March 2022 Committee Audit Title Assurance Level Facilities Management Overtime Controls Limited Procurement Card Follow Up Reasonable Performance Indicators Substantial/Reasonable/Limited May 2022 Committee Audit Title Assurance Level General Ledger System Reasonable Health and Social Care Partnership Procurement Substantial Ayrshire Growth Deal Governance Reasonable Secondary Schools Substantial 3.3 The definitions of the assurance levels used by Internal Audit are as follows: Substantial The framework of governance, risk management and control is adequate and effective. Reasonable Some improvements are required to enhance the adequacy and effectiveness of the framework of governance, risk management and control. Limited There are significant weaknesses in the framework of governance, risk management and control such that it could be or could become inadequate and ineffective. None There are fundamental weaknesses in the framework of governance, risk management and control such that it is inadequate and ineffective or is likely to fail. 3.4 Detailed below are the most significant findings from the audit work finalised during 2021/22: 3.6 In respect of the audit of Aids and Adaptations, nine actions points were raised in the report with the key audit concern relating to the delay in follow-ups being carried out and the lack of evidence that follow-ups had been carried out. Eight of the nine audit
Page 8
actions have now been completed with the final action due for completion in June 2022. 3.7 In respect of the audit of Procurement Cards, four action points were raised with a view to improving general controls around the use of procurement cards. This included training, analysis of spend, and review and approval of transactions. The findings from this audit assignment were followed up by Internal Audit during the year. All actions were found to be implemented, or in the process of being implemented. No further actions were raised by Internal Audit and the revised assurance level was concluded as Reasonable. 3.8 Regarding CCTV in Council Buildings and Vehicles, there is a general recognition across the Council that CCTV images are personal data that require protection, however there is a requirement to harmonise practices across the Council to ensure a consistent approach to recording, storing and accessing CCTV images. Work has already commenced in the form of a cross service working group to take forward issues relating to CCTV, including the three actions arising from the internal audit. 3.9 Finally, for Overtime Controls in Facilities Management, a number of keying errors were identified as a result of changed notification processes due to COVID-19. It has been recommended that a longer-term solution to overtime is explored to ensure it is claimed, authorised and paid correctly. The service has now commenced this work in the form of a short life working group. 3.9 These findings, together with those from other audits carried out and the individual assurance levels detailed above, contribute to the annual internal audit opinion in section 6 of this report. 4 Audit Resources 4.1 The Internal Audit section is directly managed by the Team Manager (Internal Audit), who reports to the Senior Manager (Audit, Fraud, Safety and Insurance). The Senior Manager is responsible for Internal Audit, as well as the Corporate Fraud Team, the Risk and Insurance Team and the Corporate Health and Safety Team. 4.2 As well as the Team Manager, the Internal Audit team consisted of two part-time Internal Auditors as well as a part-time Computer Auditor. 4.3 All staff within the section hold a relevant qualification, either through an institute which is part of the CCAB (Consultative Committee of Accountancy Bodies) or the IIA (Institute of Internal Auditors). 5 Performance 5.1 During 2021/22, Internal Audit provided regular updates on work carried out to the Council’s Audit and Scrutiny Committee. Elected Members had the opportunity to discuss all Internal Audit reports and question either the Senior Manager or relevant officers from Council services.
Page 9
5.2 The Council’s performance management system, Pentana, is utilised to follow-up on audit recommendations. Officers with responsibility for implementing recommendations are required to update the Pentana system and updates are provided to the Audit and Scrutiny Committee on a quarterly basis. Where actions are overdue, officers may be required to attend the Committee to update Elected Members on plans to ensure that actions are implemented. 5.3 A range of performance indicators are used to monitor performance within the section, and these are detailed in the table below, along with the two previous years’ actual figures. These are tracked by the Team Manager on a quarterly basis and are discussed with audit staff to review performance and identify opportunities for development. 2019/20 Actual 2020/21 Actual 2021/22 Target 2021/22 Actual % of auditor time spent productively 87% 82% 87% 82% Training days per auditor 3.5 days 4.2 days 3.6 days 5.8 days Final reports issued 27 22 n/a 22 Audits completed within budgeted days 46% 24% 75% 23% Draft reports issued within 21 days of fieldwork completion 85% 83% 100% 81% Final reports issued within 14 days of return of action plan 100% 95% 100% 100% Actions implemented on time by Council services 80% 68% 80% 83% Ad-hoc requests for advice from Council services 47 requests 63 requests n/a 27 requests 5.4 The ‘percentage of auditor time spent productively’ remains below the annual target but consisted with the position last year. Due to ongoing COVID-19 restrictions during 2021/22, this position is as expected. The 82% actual remains close to the revised expectations set out in the mid-year review, which estimated a revised actual of 83%. 5.5 ‘Training days per auditor’ is higher than target. While 18 days of training was budgeted for the year, the actual number of days training was 29. This was across all members of the Internal Audit team. The reason for the difference was due to staff development in the use of Power BI. 5.6 Actual performance against the ‘audits complete in budgeted days’ indicator remains significantly below target and not yet back to pre-pandemic levels. This reflects the completion of individual audit assignments rather than the audit plan as a whole. Most audits which were over budget only exceeded the target by one or two days; those audits which were more considerably over target was due to wider scope than anticipated (Aids and Adaptations, Procurement Cards, CCTV, and Procurement of Educational Supplies). 5.7 Ad-hoc requests for advice are outwith the control of Internal Audit however are noted to be lower than in previous years. The previous year of 2020/21 was significantly higher as a result of more advice arising around changed processes and procedures relating to covid arrangements in light of new working practices. In May 2022,
Page 10
International Internal Audit Awareness Month, communications have been utilised to further remind services of the availability of Internal Audit for advice and consultancy. 5.8 The Internal Audit section also calculates 2 annual performance indicators which are required by the CIPFA Directors of Finance group. These are as follows: 2019/20 2020/21 2021/22 Productive days achieved per audit plan 96.72% 86.47% 85.36% Cost of Internal Audit per £1m of net expenditure £510.97 £529.51 £tbc 5.9 It should be noted that the figures in the table at 5.8 are for the financial year 2021/22. This differs from the audit plan year which covered a 14-month period. The figures at table 5.6 are therefore pro-rated to bring them into line with the financial year for the CIPFA return. 5.10 The ‘productive days achieved per audit plan’ remain considerably lower than pre-covid levels; the reasons for this are outlined at 2.3 above. It should be noted that this indicator reflects back to the original internal audit plan as the base point. If the productive days were compared with the mid-year plan, the percentage of productive days achieved per the audit plan is 94.71%. 5.11 The ‘cost of Internal Audit per £1m of Council net expenditure’ was £529.51 in 2020/21, a slight increase from £510.97 in 2019/20 but still well below the target of £850. The 2021/22 figure cannot be calculated until the closure of the Council’s draft annual accounts and will be reported at a later date. 6 Opinion 6.1 This statement on the adequacy and effectiveness of the framework of governance, risk management and internal control is based on the audit work performed during 2021/22 as reported above. It also draws on the experience of audit work carried out in earlier years as well as assurances received from management and external audit findings. 6.2 Internal Audit staff have carried out work, both on a corporate basis and within each of the Service groups and, subject to the comments in section 3 above, the conclusion drawn from that work was that most of the anticipated governance, risk management and internal control frameworks were in place and operating effectively. 6.3 Where Internal Audit identified opportunities for improvement, the responses received from managers continued to be positive and there was commitment to implementing Internal Audit's recommendations. 6.4 On this basis, it is my opinion that reasonable assurance can be placed on the adequacy and effectiveness of the Council’s systems of governance, risk management and internal control. Laura Miller Senior Manager (Audit, Fraud, Safety and Insurance) 31 May 2022