7 - 2022 09 13 IA action points follow up Q1
North Ayrshire Council · 27 September 2022
Back to Audit and Scrutiny Committee — 27 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Internal Audit and Corporate Fraud Action Plans: Quarter 1 update Purpose: To advise the Audit and Scrutiny Committee on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 30 June 2022. Recommendation: That the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 1. Executive Summary 1.1 The CIPFA document 'Audit Committee Principles in Local Authorities in Scotland' highlights that Audit Committees should monitor and review the progress made in implementing audit recommendations. 1.2 Service managers are responsible for ensuring that agreed actions arising from Internal Audit and Corporate Fraud reviews are implemented. This provides assurance that identified control weaknesses have been addressed and are being managed effectively. 1.3 All actions are monitored on the Pentana system and service managers are responsible for updating Pentana as they progress each action. This enables Internal Audit to monitor progress on a 'real-time' basis and address any delays in implementation. 1.4 This report details the position at 30 June 2022. 2. Background 2.1 The last report to the Audit and Scrutiny Committee on 31 May 2022 highlighted that there were 18 actions outstanding at the end of March 2022: five that had not been started or were only partially implemented and 13 where the due date had not yet passed.
Page 2
2.2 In addition to these 18 carried forward actions, there have been 22 new actions agreed, giving a total of 40 action points for review. 2.3 Services have completed 12 actions since the last report. All Council Services are required to retain evidence of work carried out in completing their actions and Internal Audit carries out 'spot-checks' on a sample of completed actions on an ongoing basis. 2.4 Of the remaining 28 actions, nine were either not started or only partially complete at 30 June 2022 and the remaining 19 were not due for completion until after that date. 2.5 Appendix 1 to this report provides the Committee with full details of seven of the actions that were not complete within the agreed timescales. In terms of Section 50 (A) 4 of the Local Government (Scotland) Act 1973, two of the outstanding action points are exempted from public inspection, on the grounds indicated in terms of Paragraph 1 of Part 1 of Schedule 7A of the Act. 3. Proposals 3.1 It is proposed that the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The effective implementation of agreed Internal Audit and Corporate Fraud actions helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024.
Page 3
Community Wealth Building 4.7 None. 5. Consultation 5.1 Council Services are consulted during the completion of each Internal Audit and Corporate Fraud review and have also provided updates on progress made in implementing action points. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None.
Page 4
Actions due by 30th June but not started or partially complete Code IA2017PA020b Description Data protection information awareness for schools training should be agreed and implemented as soon as possible. Priority 1 Latest Note A data protection talk for Garnock Academy has been arranged for 22nd November so the action will be complete then, as all other schools have completed this training. Progress Bar Original Due Date 01-Jun-2018 Due Date 30-Apr-2022 Parent Code & Title IA2017PA020 Email Controls In Education Managed By Andrew McClelland Assigned To Rosslyn Lee Code IA2021PA009a Description Audit Action: The admin team should ensure that all areas of this process are documented in standard operating procedures and issued to all relevant members of the team. Audit Finding: The admin team are currently working on standard operating procedures to cover the full process for Council tenants and those completed during the audit were provided to the auditor for review. Risk: Inconsistent approach by staff, possible key tasks not being carried out and lack of business continuity if staff familiar with the process are not available. Priority 2 Latest Note The team are continually working with the Transformation team to streamline our processes and use systems to produce reports for information rather than spreadsheets. Our standing operating procedures will continually be updated to reflect any changes that are made. Proposed new end date 30th September 2022. Progress Bar Original Due Date 31-Dec-2021 Due Date 30-Jun-2022 Parent Code & Title IA2021PA009 Aids and Adaptations Managed By David Thomson
Page 5
Assigned To Lynn Kirkland Code IA2021PA009b Description Audit Action: The team should liaise with the Transformation team to streamline this part of the process and reduce the number of times the same information must be keyed. Audit Finding: The admin team are required to update the budget monitoring spreadsheet, an operational access database and the CareFirst system at each stage of this process for all council tenant jobs. In addition, the access database is not supported by IT Services. Risk: Inefficient use of staff time and increased risk of keying errors. Priority 2 Latest Note This is currently ongoing with the Transformation team and also with the work that is being done at the moment with the new Eclipse system we are hoping that when developing the system for Comm OT and adaptations that we will be capture the data on this system to produce scheduled Business Object Reports. This will be ongoing with the transformation team until the end of the year. Progress Bar Original Due Date 31-Dec-2021 Due Date 06-Jun-2022 Parent Code & Title IA2021PA009 Aids and Adaptations Managed By David Thomson Assigned To Lynn Kirkland
Page 6
Code IA2021PA013b Description Audit Action Building Services should progress with the interface between the URM system and Integra to prevent double keying. Audit Finding There has been no progress made in an invoice interface between the URM system and Integra. As a result, Building Services staff are having to double key invoices. Risk Increased risk of keying errors and inefficient use of staff time. Priority 3 Latest Note In order to implement the Creditors interface some work had to be undertaken on the general ledger. This work was complete in December 2021 and involved a mapping exercise to ensure ROCC’s financial coding was in line with the Councils Integra system, this involved removing the translation table that changed the old financial codes to the current codes that are in use. Following this there was some discussions re the best route to take to remove any duplicate keying and the options reviewed were a creditors interface, e-invoicing or both. It has been decided that introducing the creditors interface would be the preferred option initially. IT suppliers have been contacted and a cross service working group has been set up to progress this action, with supplier forms received and a mapping exercise across systems to match suppliers due to commence. The new date for this action is January 2023 and is reliant on external suppliers meeting our deadlines. Progress Bar Original Due Date 31-Dec-2021 Due Date 31-Dec-2021 Parent Code & Title IA2021PA013 Building Services Systems Managed By Yvonne Baulk Assigned To Leigh-Ann Mitchell; Jim Smith
Page 7
Code IA2022PA019b Description Audit Action: A minimum technical standard for CCTV systems should be set for the Council. A Council-wide audit of CCTV inventory should be carried out to assess compliance of CCTV assets against the standards, which will give an indication of the level of capital investment required to bring the Council’s CCTV systems up to an appropriate standard and form the basis of a bid for capital. An approval process should be introduced to ensure new CCTV purchases meet the requirements of the standards. Audit Finding: Audit were advised that there are various capital budgets in place covering vehicles and property lifecycle investment. However, there is no formal replacement programme for CCTV equipment. Risk: Substandard systems that aren’t fit for the intended purpose. CCTV footage is not available or not usable when required. Priority 2 Latest Note The CCTV Asset Register is in the process of finalisation and all CCTV assets have been identified. A process is being undertaken to review these assets including undertaking Data Protection Impact Assessments. These will come for review and services have been advised to get those to the Information Governance team by 31st August. This will help to inform whether the CCTV asset is still required, its age and condition and whether it meets acceptable technical standards. If the asset is no longer required, it will be decommissioned in accordance with identified processes. If upgrading is required, a process has been embedded into the corporate CCTV policy for agreeing upgrades. The anticipated completion date is 31st December 2022. Progress Bar Original Due Date 30-Jun-2022 Due Date 30-Jun-2022 Parent Code & Title IA2022PA019 CCTV in Council Buildings and Vehicles Managed By Aileen Craig Assigned To Lorraine Barr; Mark Boyd; Russell McCutcheon
Page 8
Code IA2022PA027a(1) Description Audit Action: Written procedures on the calculation of PIs should be produced. Audit Finding: There are no written procedures detailing the methodology for the calculation of PI CP_12. Risk: Inaccurate and/or inconsistent PI figures being published due to errors in calculations; business continuity implications Priority 1 Latest Note We have identified an alternative means of collecting information to support this PI which would be relevant to service activity and meet requirements as regards accuracy/consistency of reporting. There is still some work to be done to confirm this as the best route forward, and create relevant written procedures to support it, which we hope to have complete by end of September 2022. Progress Bar Original Due Date 30-Jun-2022 Due Date 30-Jun-2022 Parent Code & Title IA2022PA027 Performance Indicators Managed By Thelma Bowers Assigned To Dominic Jarrett
Page 9
Code IA2022PA027b Description Audit Action: HSCP to identify more useful PIs to be considered for inclusion in the upcoming Council Plan update. Audit Finding: The current PI [PI CP_12] might not provide the most useful information to the public and Council Officers. Risk: The public and managers are missing out on more useful information due to the current PIs. Priority 2 Latest Note The Learning Disability Service has been exploring a range of possible indicators as part of its ongoing development of Trindlemoss and other aspects of the service, as well as considering other developments due to come on-stream later this year (primarily the establishment of a new Intensive Support Team). Our consideration of Performance Indicators is being informed by our ongoing involvement in a learning collaborative with Healthcare Improvement Scotland; we have also linked with Healthcare Improvement Scotland around their promotion of Human Learning Systems, and the new perspectives on measuring outcomes/performance which this encourages. We hope to have established a relevant range of indicators by end October 2022. Progress Bar Original Due Date 30-Jun-2022 Due Date 30-Jun-2022 Parent Code & Title IA2022PA027 Performance Indicators Managed By Thelma Bowers Assigned To Dominic Jarrett