8. 2022 05 31 IA reports issued
North Ayrshire Council · 31 May 2022
Back to Audit and Scrutiny Committee — 31 May 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 31 May 2022 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed between March and April 2022. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission and consideration of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed between March and April 2022. Internal control reviews have been completed in respect of the areas detailed in Appendix 1 to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix 1 includes the report and action plan from each audit. 2.3 The findings from four separate audit assignments are detailed at Appendix 1 to this report and the levels of assurance for each are noted in the table below:
Page 2
Audit Title Assurance Level General Ledger System Reasonable Health and Social Care Partnership Procurement Substantial Ayrshire Growth Deal Governance Reasonable Secondary Schools Substantial 3. Proposals 3.1 It is proposed that the Committee considers the outcomes from the Internal Audit work completed between March and April 2022. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None.
Page 4
GENERAL LEDGER SYSTEM 1 Background 1.1 An audit of the general ledger in 2018/19 focussed on feeder systems, suspense/holding accounts and bank reconciliations. A number of action points were raised, and these have been followed up as part of this audit. 1.2 In addition, a review of current Integra log-ins has been undertaken. 2 Objectives and Scope 2.1 The objective of this audit was to ensure:- • All management actions raised during the 2018/19 Audit have been completed to a satisfactory level • Risks associated with the migration of Integra to the Cloud have been identified and addressed • Integra is being timeously updated to remove access rights from leavers. 3 Findings Follow-up of previous Audit actions 3.1 The action descriptions from the 2018/19 audit were as follows:- 3.2 Action Action Description from 2018/19 report a IT Services System Admin should contact Capita to request a solution to either prevent the same feeder file being processed or, at the very least, give a warning to the user that this file has already been processed. b An overarching procedure note for the suspense reconciliation checklist spreadsheet should be produced. Relevant staff should familiarise themselves with such procedure notes, to ensure the spreadsheet is properly completed. The checklist should be reviewed on a regular basis and any issues escalated promptly. c There should be evidence that reconciliations have been independently reviewed in a timely manner. d Consideration should be given to closing the Creditors Grants bank account if it is determined that it is no longer required and the balance is suitably transferred. e The Housing Advances bank account should be reviewed and the reconciliations should recommence if this account is still being used. f A decision should be made on the historical unreconciled Payroll transactions as per the Payroll bank reconciliation to ensure they are not continually carried forward. g Outstanding cheques from Masterpiece should be cancelled and a process put in place for cancelling outstanding cheques since Integra went live. 3.3 ICT and Financial Management were able to demonstrate that all the above issues have been addressed, therefore no further action is required.
Page 5
Migration of Integra to the Cloud 3.4 Capita hosts Integra on behalf of the Council. 3.5 In November 2021 Capita migrated Integra from their own datacentre to a Microsoft Azure cloud datacentre. Microsoft Azure has been used by the Council for several years to host Office 365 and its Active Directory. 3.6 In order to confirm that Capita is taking sufficient steps to ensure the security of the Council’s data, Audit obtained a copy of Capita’s Integra Security Management Plan. 3.7 This plan confirms that it should be read in conjunction with:- • National Cyber Security Centre (NCSC) Cloud Security Guidance • General Data Protection Regulation (GDPR) • UK Government Documentation, namely Information Security Standards and Security Policy Framework (including ISO 27001 & ISO 9001 cross reference) The above indicates that the principles set by the NCSC have been imbedded in Capita’s security approach. Review of Integra users 3.8 Audit obtained a list of all general ledger users from the Integra Systems Access Team. 3.9 This showed that whilst there are 2,685 general ledger users on Integra, 1,932 of these have never logged on. 3.10 The Systems Access Team confirmed that they were asked by eProcurement to ensure all employees with a corporate AD (active directory) account were set up in Integra. This resulted in a high number of new accounts having to be created. 3.11 To date, the new Integra function that required the additional users to be set up hasn’t been implemented. (action point a) 3.12 The Integra Systems Access Team receive a monthly leavers report from the CHRIS payroll system. Detailed audit testing identified 140 general ledger user accounts that relate to employees who have left the Council. This list has been passed to the Systems Access Team for action. (action point b) 3.13 Integra can only be accessed from within the Council’s system. There is a separate internal audit of leavers’ and movers’ IT access currently ongoing. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained in the areas of the general ledger covered by this Audit.
Page 6
Definitions of Assurance Levels: Substantial The framework of governance, risk management and control is adequate and effective. Reasonable Some improvements are required to enhance the adequacy and effectiveness of the framework of governance, risk management and control. Limited There are significant weaknesses in the framework of governance, risk management and control such that it could be or could become inadequate and ineffective. None There are fundamental weaknesses in the framework of governance, risk management and control such that it is inadequate and ineffective or is likely to fail. NB The level of assurance given is at the discretion of Internal Audit.
Page 7
KEY FINDINGS AND ACTION PLAN GENERAL LEDGER SYSTEM Action a Finding A high number of general ledger users have never logged into the system. Action Description The Integra System Access Team should liaise with the eProcurement Team to confirm if, and when, the new function is being added to Integra. If it is not going ahead, the System Access Team should stop automatically adding new corporate employees on to Integra and deactivate all users who have had a log-in for more than a defined number of days but have never used it. Risk Resources are being used setting up Integra accounts that aren’t needed or used; system access is not limited to those who need it. Priority (1, 2, 3) 2 Paragraph Reference 3.11 Managed by Fiona Walker, Head of Service (People & ICT) & Mark Boyd, Head of Service (Finance) Assigned to Brendan Quigley (Senior Manager, ICT); Suzanne Quinn (Senior Manager, Procurement) Due Date 31 July 2022 Management Comment Agreement has been reached with Finance/Procurement that the process of adding new corporate employees to Integra will cease and the unused accounts will be removed. Action b Finding Not all leavers’ accounts have been deactivated on Integra. Action Description Integra System Administration should review the list of leavers identified during the Audit and deactivate the relevant accounts on Integra. Monthly leavers reports should be actioned timeously. Risk Unauthorised individuals have access to Integra. Priority (1, 2, 3) 1 Paragraph Reference 3.12 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Brendan Quigley (Senior Manager, ICT) Due Date Complete Management Comment As a consequence of this Audit, this highlighted a bug in the system that resulted in notifications of reports not being received by system admin. This has now been resolved and report notifications are being received, and reports are dealt with on a regular basis. All accounts highlighted by this audit have been deactivated.
Page 8
Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 9
HSCP PROCUREMENT 1 Background 1.1 This audit was undertaken in line with the 2021/22 Audit Plan. 2 Objectives and Scope 2.1 The objective of this audit was to ensure:- • Employees with a personal interest in a Council contract are being identified and excluded from the contract award process • Contractual arrangements are in line with the Council’s ‘Standing Orders Relating to Contracts’ • Spend processed via Carefirst is being approved prior to its transfer to Integra • Procurement card spend is appropriate 3 Findings Employees with a personal Interest in contracts 3.1 As per the Council’s Employee Code of Conduct:- “Any employee, or employees, involved in the decision making process must notify their Head of Service by submitting a Declaration of Interests Form if it comes to their knowledge that a contract in which they have a personal or financial interest, whether direct or indirect, has been or is about to be entered into by the Council.” 3.2 Reliance is placed on employees highlighting a personal interest, however there is a reminder of the need to confirm any conflicts included within the Request for Procurement Action (RPA) form, which is completed for all procurements over £10k. 3.3 Audit asked to review the declaration of interest forms that have been submitted. The Service has confirmed that no forms have been lodged to date. Standing Orders relating to Contracts 3.4 The Council’s Standing Orders relating to Contracts sets out the process for awarding a contract, depending on the anticipated level of spend. 3.5 Audit selected a sample of 15 suppliers with varying levels of actual spend and reviewed the contract in place to ensure if complied with Standing Orders. 3.6 Only 1 contract was not available for inspection during the Audit. HSCP Contracts & Commissioning were already aware of this issue and were working on correcting it. No other issues were identified from this testing. Spending approved via Carefirst 3.7 Approximately half of HSCP spend is imported into Integra via Carefirst feeders.
Page 10
3.8 An initial review highlighted that processing and authorising methods within Carefirst vary depending upon the service area, as does the supporting information transferred into Integra. 3.9 A detailed review of the processes within Carefirst was not feasible within the budget of this audit, however it has been noted as an area for consideration within future audit plans. Procurement card spend 3.10 Approximately £740k has been spent by HSCP staff on procurement cards between 1 April 21 and 3 March 22. £135k of this total was cash withdrawals. 3.11 Audit reviewed a sample of transactions looking for evidence of:- • Disaggregation of expenditure to avoid card transaction limits, or Standing Orders • Inappropriate purchases being made via the card eg computer equipment being bought via cards rather than through the Council’s IT team • Cash being used for transactions that should be paid for by either invoice or procurement card 3.12 1 instance of cash being withdrawn to pay an invoice was noted during testing. Audit has highlighted this error with the cardholder and management. No other issues were noted. 3.13 Audit also reviewed the level of cash withdrawn, but not yet spent - to ensure that excessive amounts aren’t being held in Council premises. Cash to the value of approximately 1 months’ cash expenditure is being held, which seems reasonable. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the areas covered by this Audit.
Page 11
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 12
AYRSHIRE GROWTH DEAL 1 Background 1.1 The Ayrshire Growth Deal consists of a programme of 19 high-profile major development projects across Ayrshire involving public, private and 3rd sector partners and attracting funding from both Scottish and UK governments. East Ayrshire Council acts as the lead partner for the deal overall and hosts the Project Management Office (PMO). North Ayrshire Council is the lead partner for 9 of the 19 projects (6 capital, 3 revenue). 1.2 The 6 capital projects are managed by the Growth and Investment Directorate. The 3 revenue projects are managed by the Economic Development and Regeneration Service within the Place Directorate. The revenue projects are Ayrshire-wide projects where North Ayrshire Council is the lead partner. 1.3 Audit Scotland published a report on Scotland’s City Region and Growth Deals in January 2020, making recommendations for improvements to governance arrangements for these deals. 2 Objectives and Scope 2.1 The scope of this audit was limited to North Ayrshire Council’s role in the projects. It focused on the governance structures across the Council’s participation in the deal rather than individual projects. 2.2 The main objectives of the audit were to ensure that: • governance structures and roles and responsibilities of officers and elected members within North Ayrshire Council, in relation to the Ayrshire Growth Deal are clearly defined and communicated in order to enable good governance and strong accountability • North Ayrshire Council has adequate risk management arrangements in place in relation to the Ayrshire Growth Deal • suitable arrangements are in place to monitor the progress of the Ayrshire Growth Deal programmes within North Ayrshire, including appropriate reporting and scrutiny arrangements • there are adequate arrangements in place to ensure that North Ayrshire Council is fulfilling the requirements of the Project Management Office and external funding providers. 3 Findings Governance Structures, Roles and Responsibilities 3.1 Governance structures for decision-making and monitoring, both for individual projects and the overall Ayrshire Growth Deal programme within North Ayrshire Council, have been established and roles and responsibilities have been defined.
Page 13
3.2 A Governance Framework for the capital projects managed by Growth and Investment lays out the roles and responsibilities of the parties involved in these projects. Two of the revenue projects, Community Wealth Building and Working for a Healthy Economy, have also documented the roles and responsibilities. The third revenue project, Ayrshire Skills Investment Fund, was at an early stage of development at the time of audit work and these have not yet been fully developed. Risk Management 3.3 Risk Registers for all 9 projects have been prepared and input to Pentana. They are reviewed quarterly and presented to Programme Boards, Project Boards and the Council’s Executive Leadership Team as well as being included in quarterly submissions to the Scottish Government. 3.4 All the risks aside from 3 (out of 190) have at least one mitigating action identified under the heading “Internal Control” in Pentana. It was also noted that a few of the items listed under this heading were possible consequences of the risk occurring (e.g. “reputational damage”) rather than mitigating actions to prevent or reduce the impact of the risk. All the risks with missing or unsuitable mitigating actions related to capital projects. (Action a) Accountability, Scrutiny and Monitoring 3.5 All the projects must report progress monthly to the PMO. The PMO collates the monitoring information each month and distributes a monitoring report to officers across the 3 Ayrshire councils, including the Chief Executives, Section 95 Officers and Chief Auditors. The Pentana performance management system is being used across the 3 councils to monitor progress against key milestones for all the projects. 3.6 The Growth and Investment projects report regularly to the Council’s Executive Leadership Team. Reports have also been taken to Cabinet at key stages of some projects and reports on both the overall AGD programme and some individual projects have been presented to the Ayrshire Economic Joint Committee, which includes elected members from all the Ayrshire Councils. 3.7 All the projects have regular monitoring meetings of their own steering groups, other than the Ayrshire Skills Investment Fund, which is still at an early stage of development. 3.8 The projects are required to comply with HM Treasury Green Book project management methodology. The Green Book requirements include stakeholder engagement and consultation. 6/9 of the projects have undertaken or are planning to undertake some stakeholder engagement and consultation activities, but some of them have not yet reached the stage where this is appropriate. 3.9 The PMO has recently developed a Benefits Realisation Plan, which identifies the outcomes, outputs and targets the projects want to achieve. This plan stipulates the data needed to monitor them, the method of data collection and the regularity
Page 14
of monitoring and reporting which will have to be incorporated into the projects’ monitoring and reported arrangements. Requirements of PMO and Funding Organisations 3.10 The Ayrshire Growth Deal Agreement with the UK and Scottish Governments imposes a number of conditions of grant upon the Councils. Furthermore, the 3 Councils have signed a Memorandum of Understanding which places conditions on the parties. 3.11 The Council was found to have suitable arrangements in place to meet all the requirements of the UK and Scottish Governments. For the revenue projects where North Ayrshire is the lead partner, clarification is required regarding the responsibilities of each partner and Internal Audit will be working with Economic Development and Regeneration to obtain this clarification. 3.12 Overall, North Ayrshire Council was found to have arrangements in place to meet the requirements of the Memorandum of Understanding. However, this document requires a specific process for dealing with Freedom of Information requests whereby relevant requests would be brought to the attention of the Ayrshire Growth Deal Strategic Manager at the PMO. Only the 2 Employability projects stated that they had suitable arrangements in place to meet these requirements. (Action b) 3.13 Hitherto, none of the other funding bodies or partners have imposed any additional conditions on the projects. The projects gave assurance that if any future funding body or partner does impose additional conditions, they will develop arrangements to comply with these conditions. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the governance arrangements for the Ayrshire Growth Deal within North Ayrshire Council. Overall good governance arrangements are in place, but some of the projects are still at an early stage of development and therefore it has not been appropriate to fully develop the governance arrangements yet.
Page 15
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 16
KEY FINDINGS AND ACTION PLAN AYRSHIRE GROWTH DEAL Action a Finding All the risks aside from 3 (out of 190) have at least one mitigating action identified under the heading “Internal Control” in Pentana. It was also noted that a few of the items listed under this heading were possible consequences of the risk occurring (e.g. “reputational damage”) rather than mitigating actions to prevent or reduce the impact of the risk. All the risks with missing or inappropriate mitigating actions related to capital projects. Action Description Project Managers should be reminded to ensure that they complete the “Internal Control” field when adding risks to the risk register in Pentana. They should be reminded of the type of information to be included in this field i.e. mitigating actions to reduce the likelihood or impact of the risk. Risk Actions to mitigate the risk are not identified and undertaken, or it is not possible to monitor whether they are being undertaken because they haven’t been recorded. Priority (1, 2, 3) 2 Paragraph Reference 3.4 Managed by Karen Yeomans, Director (Growth and Investment) Assigned to Lisa Jamieson, Strategy and Programme Manager Due Date 30th April 2022 Management Comment Currently working on Risk Registers as part of the Implementation Plan review (due to AGD PMO 07/04/2022). These will be reconciled to ensure Pentana is up to date and mitigating factors identified by IA (3 missing and few with inappropriate mitigation factors) will be checked to have been updated. An email will then be circulated, following on from email issued on 29 Nov 2021 regarding importance of Risk Registers, to remind Project Leads to ensure Internal Control field is completed with suitable narrative. Action b(1) Finding The Memorandum of Understanding with East and South Ayrshire Councils requires a specific process for dealing with Freedom of Information (FoI) requests whereby relevant requests would be brought to the attention of the Ayrshire Growth Deal Strategic Manager at the PMO. Only the 2 Employability projects stated that they had suitable arrangements in place to meet these requirements Action Description Projects should ensure that they have suitable arrangements to identify relevant FoI requests and bring them to the attention of the AGD Strategic Manager. Risk Failure to comply with the conditions of the Memorandum of Understanding. Priority (1, 2, 3) 2 Paragraph Reference 3.12 Managed by Karen Yeomans, Director (Growth and Investment)
Page 17
Assigned to Lisa Jamieson, Strategy and Programme Manager Due Date 30th June 2022 Management Comment Currently follow NAC FoI procedures but have not documented how we will report to the PMO regarding and FoI for AGD projects. The G&I Governance Document is currently under review (yearly requirement) and will be updated to include a FoI section aligning with MoU agreement for FoI requests. The Governance Document will be circulated to all officers to ensure compliance with the MoU between all three Ayrshire Councils. Action b(2) Finding The Memorandum of Understanding with East and South Ayrshire Councils requires a specific process for dealing with Freedom of Information (FoI) requests whereby relevant requests would be brought to the attention of the Ayrshire Growth Deal Strategic Manager at the PMO. Only the 2 Employability projects stated that they had suitable arrangements in place to meet these requirements Action Description Projects should ensure that they have suitable arrangements to identify relevant FoI requests and bring them to the attention of the AGD Strategic Manager. Risk Failure to comply with the conditions of the Memorandum of Understanding. Priority (1, 2, 3) 2 Paragraph Reference 3.12 Managed by Caitriona McAuley, Head of Service (Economic Development & Regeneration) Assigned to Jude King, CWB Project Manager Due Date Complete Management Comment In the event that an FOI relating to the delivery of the AGD CWB project is received by any of the project delivery teams in North, East or South Ayrshire, this will be brought to the attention of the CWB Programme Manager at North Ayrshire Council. This will subsequently be brought to the attention of the PMO for discussion on a response to the FOI. This was raised on the agenda at the Steering Group meeting for the project (20th April 2022) and responsibilities noted in the action points of the meeting minutes which are circulated to all attendees. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 18
SECONDARY SCHOOLS 1 Background 1.1 Secondary schools were last audited in 2017/18. 1.2 The ongoing risk of coronavirus has meant that this audit has been undertaken remotely – no schools have been physically visited. However, schools have been asked to complete a detailed questionnaire, return various documents and engage in further discussions with Audit where necessary. 2 Objectives and Scope 2.1 The objective of this audit was to ensure:- • Staff are aware of all relevant Council governance procedures. • All cash is being held securely. • Cash withdrawals made via the Procurement Card are being used for appropriate types of expenditure, and all transactions are being properly recorded. • school fund income and expenditure is being monitored and reconciled. • Accurate inventory records are being kept. • Pupil Equity Funding (PEF) spend is being maximised. 3 Findings Governance 3.1 Headteachers were asked to confirm they were aware of the following procedures: Procedures • Financial Regulations • Code of Financial Practice • Standing Orders relating to Contracts • Defalcation Procedure • Acceptable Computer Use Policy • Procurement card policies and have completed the following training courses:- Training courses • Financial Regulations • Standing Orders relating to Contracts • Cyber Security Essentials • GDPR 3.2 Not all Headteachers were aware of all of the above. Audit has contacted each Headteacher who has yet to familiarise themselves with procedures, or complete training courses to request these are completed as soon as possible. All Headteachers have agreed to this request.
Page 19
3.3 Schools were also asked to confirm that all relevant staff have completed cash handling training. All schools have confirmed that staff have completed training, with a few members of staff awaiting slots on the training course. Cash Holding 3.4 The level of cash being held in schools had decreased over the last few years. 3.5 A cashless catering system operates within schools. Schools can also use this system to allow for cashless payment of school trips, uniform purchases etc. 3.6 All schools were asked to detail how cash is stored both during the school day and overnight. They were also asked to provide copies of keyholder registers. 3.7 No issues were noted in the responses. Based on the information supplied, all cash is being stored securely. GPC Cash Withdrawals 3.8 All schools withdraw cash via their procurement cards to pay for small incidental items. Cash should only be used when there is no alternative method of payment available, such as invoice or credit card. GPC cash use within schools was found to be low. 3.9 Cardholders complete cash spreadsheets detailing how cash has been spent. These spreadsheets should be loaded onto SDOL. Audit found that not all spreadsheets had been uploaded, although they were available directly from the cardholder. A review of these spreadsheets highlighted no inappropriate cash expenditure. 3.10 During the course of the Audit, Education HQ agreed to email all cardholders reminding them of their responsibility to upload cash spreadsheets onto SDOL. School Fund 3.11 Schools were asked a number of questions surrounding their management of school fund income and expenditure in order to confirm that:- • School funds are being kept separate from core school funds • An audit trail of all income and expenditure is being maintained via receipts • All funds are being accounted for via frequent reconciliations of cash and bank balances 3.12 All schools confirmed they are carrying out monthly reconciliations of school fund balances. Schools are normally required to submit copies of independently audited school fund accounts to Education HQ annually – however a number of schools highlighted issues with achieving the submission deadline in 20/21 due to coronavirus. All schools have confirmed that 21/22 accounts will be audited and submitted timeously. 3.13 No other issues were noted during testing.
Page 20
Inventory records 3.14 Coronavirus related legislation (such as the need for distancing, keeping pupils in ‘bubbles’) is likely to have resulted in the realignment of classrooms, resources and equipment. 3.15 Whilst some schools have highlighted issues in undertaking detailed inventory checks in 20/21 due to coronavirus, all have confirmed that records will be updated for 21/22. Pupil Equity Fund (PEF) 3.16 All schools were anticipating an underspend of PEF funding as at 31st March 22. The impact of coronavirus on the availability of staff, and lead times on resources (particularly IT items) have contributed to this underspend. 3.17 Underspends can be rolled forward and used up to the end of the school term (end of June 22). 3.18 Audit requested details on how PEF spend is monitored during the year. 3.19 Education HQ confirmed that all schools submit a forecast spend at the start of the financial year. Education HQ sends out monthly spend information comparing this forecast to:- • actual spend to date • payroll projections based on staff currently in post, adjusted to reflect any known new starts and/or leavers. 3.20 The above monitoring should allow early identification of any over or underspends, thereby allowing schools to adjust their spending plans. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard the areas covered by this audit.
Page 21
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.