8 - 2022 09 13 Internal Audit Plan 2022-23 Mid-year Update
North Ayrshire Council · 27 September 2022
Back to Audit and Scrutiny Committee — 27 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Internal Audit Plan 2022/23: Mid-year Update Purpose: To provide an update on progress made in delivering the 2022/23 Internal Audit Plan. Recommendation: That the Committee (a) notes the current position, (b) approves the inclusion of two additional audit reviews in 2022/23, and (c) approves the deferral of five audits for consideration as part of the 2023/24 internal audit plan. 1. Executive Summary 1.1 The current Internal Audit Plan, covering the period April 2022 to March 2023, was approved by the Audit and Scrutiny Committee in March 2022. The plan sets out the areas of work which Internal Audit intends to cover during the year. 1.2 The Public Sector Internal Audit Standards recognise that it is good practice to regularly review and adjust the plan, as necessary, in response to changes in the organisation’s business, risks, operations, programmes, systems and controls. 1.3 Some amendments are proposed to the internal audit plan for 2022/23 and these are detailed within this report and Appendix 1. 2. Background 2.1 Appendix 1 to this report is the approved audit plan for 2022/2023. For each audit, additional information has been provided to show the actual activity to 30 June 2022 and for competed audits, dates when the final report was published and reported to the Audit and Scrutiny Committee. 2.2 Twelve reports have been published in 2022/2023 to date; 11 of these were from the 2021/22 plan and one completed from the current year plan. 2.3 In line with good practice, the plan should be reviewed during the year in light of experience gained from audit work carried out, emerging risks to the Council and the changing environment in which audit work is carried out. 2.4 In May 2022, CIPFA published their “internal audit: untapped potential” report highlighting the vital role that internal audit has to play in supporting public sector
Page 2
organisations to achieve their goals. The revisions to this audit plan, and the planning for 2023/24, will take into account this publication and its recommendations for coverage in the coming years, while also balancing this with the specific risks emerging for the Council. 2.5 A significant priority in the coming three years will be an increased audit coverage of cyber security arrangements. There is technical knowledge required to meet this need and the Council is fortunate to have that expertise in-house through a dedicated Computer Auditor. 2.6 With Committee approval, the following additional audits are proposed for inclusion in the 2022/23 plan: • ICT supplier management, with focus on the Scottish Government’s cyber resilience framework. Two existing ICT audits will remain in the audit plan as originally planned but will also focus on the cyber resilience framework for the scope of work – ICT assets and ICT network controls. • ASN provision – during the consultation process for the mid-year review, the service highlighted a risk around their budget monitoring arrangements for ASN provision which are highly complex and internal audit could add value by reviewing current processes and identifying potential areas for improvement. 2.7 With Committee approval, and in order to align audit days with available resources, the following audits will be deferred for consideration as part of the 2023/24 plan: • Transformation – due to the timing of the Recovery & Renewal Team disbanding and responsibilities transferring to Finance and Place, it is considered reasonable to allow for arrangements to be developed and working groups sufficiently established prior to an audit review commencing. Given the recent best value review carried out by external audit, this is considered to be a low risk decision. • Risk management – as above, due to the timing of the Recovery & Renewal Team disbanding and responsibility for risk management transferring to Finance, it is considered reasonable to allow time for all risk management processes to be brought up to date prior to an audit review. • Social care clients financial assessments – a recent audit assignment on care home admissions (which is currently at draft report stage) included a review of residential financial assessments and therefore there is no requirement to duplicate this work. • Locality Planning/CPP – the service is currently working on a number of areas within this category and audit work at this time may not be helpful. Further work will be required to map out risks and auditable areas to identify where internal audit can add the most value. • Residential Placements – while a previous audit review in this area identified some areas with limited assurance, it is acknowledged that this area was last reviewed in 2019/20 and due to resource constraints can be deferred while still being covered again in a reasonable timeframe. 2.8 Due to limited resource and capacity within the team to accommodate any additional reviews, further amendments will need to be considered within the context of available resources.
Page 3
3. Proposals 3.1 It is proposed that the Committee (a) notes the current position, (b) approves the inclusion of two additional audit reviews in 2022/23, and (b) approves the deferral of five audits for consideration as part of the 2023/24 internal audit plan. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment. Services have also been consulted on the proposed changes to the internal audit plan. Mark Boyd Head of Service (Finance)
Page 4
For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None.
Page 5
NORTH AYRSHIRE COUNCIL INTERNAL AUDIT PLAN 2022-23 PROGRESS REPORT at Quarter 1 PRODUCTIVE TIME - AUDIT PLAN Key Corporate Systems Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny Income collection Carry out a review of the controls within the new Civica Pay income collection system. 20 0 20 20 Scheduled Q4 Employee Services - HR/Payroll system and processes Review a range of controls relating to the CHRIS21 payroll system. 30 0 30 30 Scheduled Q3 TOTAL AUDIT DAYS 50 0 50 50 Other Systems Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny Museums and Heritage Review the effectiveness of a range of controls within the Museums and Heritage service. 15 0 15 15 Scheduled Q3 Early years provision Review the service arrangements for payments to private nurseries 15 0 15 15 Scheduled Q3 Glow Review the Council's compliance with Education Scotland Guidance on the use of Glow 15 0 15 15 Scheduled Q4 ASN provision Review the budget monitoring arrangements in place for managing the ASN provision 0 0 0 15 Proposed adding to the plan and schedule Q4 Agency staff and workers Examine the Council's use of agency staff and workers. 15 17 -2 17 Complete 02/08/2022 13/09/2022 Transformation Review the Council's approach to transformation and its progress with best value 20 0 20 0 Propose to defer for consideration in 23/24 Residential placements (HSCP/Education) Review the use of placements within other authorities, residential schools or private educational establishments. 15 0 15 0 Propose to defer for consideration in 23/24 Social Services Clients - financial assessments Consider the financial assessment process carried out for Health and Social Care Partnership clients by the Finance team. 15 0 15 0 Propose to defer for consideration in 24/25 Integration Joint Board audit days Carry out audit work as agreed by the Performance and Audit Committee of the Integration Joint Board. 15 0 15 15 Scheduled Q4 Roads - stores control Examine the controls within the Roads materials store. 15 0 15 15 Scheduled Q2 Transport - Journeys and Hires Review controls in the Transport Hub in relation to transportation, with a particular focus on the use of taxis. 15 4 11 15 Work in progress Building Services - procurement (inc. sub-conts and materials) Review controls around procurement within Building Services. 15 8 7 15 Work in progress Facilities Management - Procurement Review controls around procurement within Facilities Management. 15 0 15 15 Scheduled Q2 Scottish Housing Regulator Review the governance arrangements around the Annual Assurance Statement 15 1 14 15 Scheduled Q2 PMI - commercial and industrial rents Review the governance arrangements and processes around commercial and industrial property rentals. 20 0 20 20 Scheduled Q2 TOTAL AUDIT DAYS 220 30 190 187
Page 6
ICT Auditing Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny ICT network controls Review a range of controls within the corporate network 20 3 17 20 Work in progress ICT assets Review controls over a range of ICT assets. 20 0 20 20 Scheduled Q3 ICT supplier management Review controls over ICT supplier management 0 0 0 20 Proposed adding to the plan and schedule Q4 TOTAL AUDIT DAYS 40 3 37 60 Governance Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny Risk management Review the Council's approach to risk management and risk control 15 0 15 0 Propose to defer for consideration in 23/24 HR - Workforce Planning (inc. VER/VR schemes) Review the Council's workforce planning arrangements. 15 0 15 15 Scheduled Q4 Gifts and hospitality Examine compliance with the Council's guidance on Gifts and Hospitality within the Employee Code of Conduct. 10 0 10 10 Work in progress Locality Planning/CPP Review the Council's approach to locality planning 15 0 15 0 Propose to defer for consideration in 23/24 TOTAL AUDIT DAYS 55 0 55 25 Regularity Audits Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny Accounts Payable transaction testing Use data analysis software to interrogate the HR/Payroll system and examine any anomolies which arise. 15 1 14 15 Work in progress Payroll transaction testing Use data analysis software to interrogate the Accounts Payable system and examine any anomolies which arise. 15 5 10 15 Work in progress Primary Schools (incl ASN School) Review financial controls within the Council's primary and ASN schools using self-assessment audit questionnaires and investigate any concerns which arise. 30 0 30 30 Scheduled Q3 Social Care establishments Review financial and other controls within a range of operational establishments managed by the Health and Social Care Partnership. 20 0 20 20 Scheduled Q2 TOTAL AUDIT DAYS 80 6 74 80 Following the Public Pound Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Community Councils Annual audit of Community Councils accounts' to ensure Council funding is used in accordance with the Council's Scheme of Administration. 10 4 6 10 As required. Tenants and Residents Associations Annual audit of the accounts of various Tenants and Residents Associations. 2 0 2 2 As required. TOTAL AUDIT DAYS 12 4 8 12
Page 7
Other Work Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Prior year audit work Completing audits from the previous year's audit plan that were not fully complete by the end of March 2017 or starting audits early from the 2018/19 audit plan. 20 62 -42 62 As required. Audit consultancy: ad-hoc advice Providing advice to council services in response to ad-hoc queries 10 3 7 10 As required. Audit consultancy: project work Participating in project work to support developments in other council services. 25 3 22 25 As required. Follow-up Follow up of previous audit reports to ensure that appropriate action has been taken. 15 3 12 18 As required. Audit planning and monitoring Preparing audit plans and monitoring progress and performance against plans. 20 7 13 20 As required. Audit and Scrutiny Committee Supporting the Council's Audit and Scrutiny Committee by preparing reports, attending meetings and delivering training for elected members as required. 25 10 15 25 As required. Governance documents Review of governance documents 2 1 1 2 As required. Development of the Audit service Carry out developmental work to further enhance the efficiency of the audit section. 5 0 5 5 As required. Internal Audit self-assessment against PSIAS Undertake a quality assurance programme for Internal Audit in line with the requirements of the Public Sector Internal Audit Standards (PSIAS). 2 0 2 0 As required. Internal Audit EQA (assess or being assessed) Participate in the Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) review network for the external quality assessment programme. 10 0 10 10 As required. Grant claims Certification of expenditure funded by specific grants from external funding bodies 2 0 2 2 As required. Annual Accounts Work in relation to the Council's annual accounts, including stock counts, reviewing imprests and preparing the Annual Governance Statement. 2 1 1 2 As required. TOTAL AUDIT DAYS 138 90 48 181 TOTAL PRODUCTIVE TIME - AUDIT PLAN 595 133 462 595 PRODUCTIVE TIME - CONTINGENCIES AND INVESTIGATIONS Contingencies & Investigations Audit Objective Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Non-Fraud Investigations 20 10 10 20 As required. TOTAL AUDIT PLAN 2022-23 615 143 472 615