9 - 2022 09 13 Internal Audit Reports Issued
North Ayrshire Council · 27 September 2022
Back to Audit and Scrutiny Committee — 27 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed between May and August 2022. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission and consideration of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed between March and April 2022. Internal control reviews have been completed in respect of the areas detailed in Appendix 1 to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix 1 includes the report and action plan from each audit. 2.3 The findings from eight separate audit assignments are detailed at Appendix 1 to this report and the levels of assurance for each are noted in the table below:
Page 2
Audit Title Assurance Level IJB Compliance with the CIPFA Financial Management Code Substantial Accounts Payable Transaction Testing Q4 Reasonable Leavers & Movers Processes Reasonable Social Media Substantial VAT Reasonable Off-Payroll Working (IR35) Substantial/Limited CM2000 Substantial Funding Support to Businesses Reasonable 2.4 The key findings are as follows: • In respect of off-payroll working (IR35), substantial assurance was obtained around the Employee Services’ provision of procedures and guidance to Council Services. Information and support is available to Services and reliance is placed on Services making use of these resources. Limited assurance was obtained with regard to the application of IR35 within Services. It is noted that Building Services were able to demonstrate some consideration and application of IR35 in 2021/22. 3. Proposals 3.1 It is proposed that the Committee considers the outcomes from the Internal Audit work completed between May and August 2022. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities
Page 3
4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None.
Page 4
IJB COMPLIANCE WITH CIPFA FINANCIAL MANAGEMENT CODE 1 Background 1.1 The CIPFA Financial Management Code (the FM Code) was published in October 2019. It applies to IJBs in Scotland as well as Local Government Bodies in Scotland, England, Wales and Northern Ireland. The purpose of the FM Code is to “support good practice in financial management and to assist local authorities [including IJBs] in demonstrating their financial sustainability.” The FM Code consists of 17 standards presented across 7 thematic sections. 1.2 Lasts year’s IJB audit related to Governance and is taken to largely cover sections 2 (Governance and Financial Management Style) and 5 (Stakeholder Engagement and Business Cases) of the Code. It is expected that the work of the IJB’s External Auditor will cover section 7 (External Financial Reporting) of the Code. The IJB does not have a capital programme, so Standard H is not relevant to the organisation. 1.3 The FM Code states that the “Leadership Team includes Executive Committees…and other Key Committees of the Authority and Senior Officers”, therefore in applying it to North Ayrshire IJB, it is taken to mean the IJB and senior officers. 2 Objectives and Scope 2.1 The audit tested the IJB’s compliance with the following sections of the FM Code: • Section 1 The Responsibilities of the Chief Finance Officer and Leadership Team • Section 3 Medium to Long-Term Financial Management (excluding Standard H) • Section 4 The Annual Budget • Section 6 Performance Monitoring 2.2 The main objectives of the audit were to ensure that: • the Chief Finance Officer and Leadership Team are fulfilling their Financial Management responsibilities. • the IJB has adequate arrangements in place to plan its finances in the medium to long term. • the IJB has adequate arrangements in place to set a sustainable and robust annual budget. • the IJB has adequate arrangements in place to monitor its financial performance. 3 Findings Responsibilities of the Chief Finance Officer and Leadership Team 3.1 The IJB ensures it is obtaining value for money through its budget setting and budget monitoring processes. North Ayrshire Council and NHS Ayrshire and Arran both have procurement strategies to ensure that they are obtaining value for money. The IJB also receives assurance on value for money from the work of internal and external audit.
Page 5
3.2 The Chief Finance Officer was found to comply with the CIPFA Statement on the Role of the Chief Financial Officer in Local Government. This statement covers: • role in the Leadership Team • involvement in business decisions • promotion of good financial management • finance function • qualifications and experience Medium to Long-Term Financial Management 3.3 The Annual Budget 2022-23 and Medium Term Financial Outlook 2022-25 (MTFO) were approved by the IJB in March 2022. They consider financial risks to the IJB and the MTFO considers a variety of funding and cost pressures and risks, with different possible scenarios and sensitivity analysis. 3.4 The Budget and MTFO consider the IJB’s prospects for financial sustainability and although they focus on the next 3 years, they consider factors affecting the IJB’s financial position further into the future, such as government proposals covering the term of the Scottish Parliament and demographic changes. 3.5 The MTFO constitutes a rolling multi-year medium-term financial plan. The Budget gives more detail for the 1st year of this 3-year period, where funding is known with more certainty. The MTFO links into the IJB’s 10-year Strategy to ensure that the resources are targeted towards strategic priorities. The Annual Budget 3.6 The IJB’s Integration Scheme is approved by Scottish Ministers and lays out how the IJB will set an annual budget for the resources provided by the partner organisations. The IJB has set a balanced budget for 2022-23 to fulfil this requirement. 3.7 In the Budget papers, the Chief Finance Officer states that “The estimates are based on a robust understanding of the additional resources available, the risks and challenges faced by the Partnership and the anticipated budget pressures.” The resources, risks, challenges and budget pressures are described in more detail throughout the report. 3.8 With regard to the adequacy of reserves, the paper states that the optimum value of reserves held uncommitted in contingency is 2-4% of net expenditure, and that the estimated value is 2.2%, therefore at the lower end of the target. Furthermore, one of the anticipated outcomes of the budget is listed as “The level of free general fund reserves and earmarked resources for service investment provides confidence re the financial sustainability of the IJB.” Monitoring Financial Performance 3.9 The IJB receives regular budget monitoring reports which highlight key risks and actions being taken to monitor and mitigate them. The Strategic Risk Register identifies Financial Sustainability as a strategic risk for the IJB, and several other strategic risks which have the potential to impact the IJB’s budget strategy and
Page 6
financial sustainability. The most recent review of the Strategic Risk Register was approved by the IJB in March and identifies existing and new mitigating actions for these risks. The Strategic Risk Register is reviewed annually as a minimum. 3.10 As at the Annual Accounts 2020/21, the only balance sheet items for the IJB were short term debtors, long term creditors and Usable Reserve: General Fund. The debtor balances represent the value of reserves held by partners supporting the earmarked element of the General Fund balance. The creditor relates to an outstanding debt to North Ayrshire Council which the IJB has been paying back in stages over a number of years. The budget monitoring reports include consideration of the position in relation to reserves, including the debt to North Ayrshire Council. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the IJB’s compliance with the CIPFA Financial Management Code. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 7
ACCOUNTS PAYABLE TRANSACTION TESTING Q4 1 Background 1.1 This audit used computer audit software called IDEA (Interactive Data Extraction and Analysis) to interrogate the Accounts Payable (AP) System and examined any anomalies which arose. 1.2 There were 45,241 invoices paid to trade and sundry suppliers during the period of the audit totalling just under £160 million. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • duplicate invoices have not gone undetected. • invoices paid to employees are bona fide. 2.2 The audit period was 1st July 2021 to 31st December 2021. 3 Findings Invoice Tests 3.1 The auditor tested for duplicate invoices for payments to suppliers and identified 176 possible duplicates that were investigated further. This confirmed that 79 were duplicates but had already been identified and action taken by the AP team. This testing eventually identified 13 potential duplicate invoices totalling £9,441.24, and 2 potential credit notes totalling £943.98 which have not already been identified by the AP team. The potential duplicates have been passed to the AP team to check and arrange recovery. (action a) Payments Made to Employees Tests 3.2 The auditor tested for employees who have been paid via Integra. This highlighted 44 supplier bank details matching an employee’s bank details which received payments via Integra. All invoices to these suppliers were checked and the majority were in relation to kinship/fostering/ adoption payments. There were 3 purchases with a value between £4,000 and £7,000 that were investigated further, and assurance was obtained that proper procurement processes were followed. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the controls around the processing of invoices, in particular to preventing duplicate invoices being processed as the number of potential duplicates identified is relatively low.
Page 8
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 9
KEY FINDINGS AND ACTION PLAN ACCOUNTS PAYABLE TRANSACTION TESTING Q4 Action a Finding Testing identified 13 potential duplicate invoices totalling £9,441.24 and 2 potential credit notes totalling £943.98, which have not already been identified by the AP team. Action Description AP should review the potential duplicate invoices and, where necessary, arrange for recovery of monies paid twice. Risk The Council has paid the same invoice twice and the money has not been recovered. Priority (1, 2, 3) 1 Paragraph Reference 3.1 Managed by Mark Boyd, Head of Service (Finance) Assigned to Suzanne Quinn, Senior Manager (Corporate Procurement) Due Date 31/05/22 Management Comment The Accounts Payable Team will investigate the 13 potential duplicate invoices by 31/05/22 and recover where appropriate or notify Internal Audit, why duplicate payment is legitimate. Recovery of funds can take several months. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 10
LEAVERS AND MOVERS PROCESSES 1 Background 1.1 The audit reviewed the controls around employees who move jobs within the Council as well as employees who leave the Council, with a particular focus on access to personal and sensitive information. The audit focused on the IT process but it incorporated the HR process to ensure the process is clear for managers. The scope of the audit covered the controls in relation to the Corporate network only. The Education network was not included. 1.2 A movers process audit report was issued in January 2019 and this audit incorporated a follow-up of the actions identified in this audit. A leavers process audit was issued in March 2017. 1.3 As a result of the previous movers audit, IT Services introduced an Active Directory (AD) Chris movers process which involved a script being developed which links to the Payroll system and removes all bar default network groups on the employee’s moving day. The new line manager will have to request the correct network access via the IT Portal. This is to ensure the previous job’s network access is not retained if the new line manager does not request new access in advance of the move. If the manager does request new access, IT Services developed an app which logs all such requests. This ensures any changes requested via the IT portal and actioned by IT are not removed when the IT script runs otherwise the new access will be wiped and access returned to default network groups only. 1.4 IT Services also introduced a monthly leavers and movers report which is generated from the Payroll system and emailed to key system administrators to take action to remove access to IT systems. 1.5 The Council uses Office 365 which includes access to Teams sites and SharePoint sites. There is an ongoing project to move network files/folders to SharePoint sites. 1.6 The auditor was advised during the audit that IT Services are replacing the current IT Portal for logging jobs with IT. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • Appropriate procedures are in place to advise managers of their responsibilities for employees leaving the Council or moving posts. • Network access has been deactivated or amended in a timely manner for employees who have left the Council or moved jobs within the Council. • System access has been deactivated or amended in a timely manner for employees who have left the Council or moved jobs within the Council. • Processes are in place to remove or amend access to SharePoint and Team sites for employees who have left the Council or moved jobs within the Council. • Leavers and movers processes are operating as expected and access has been deactivated or amended correctly.
Page 11
3 Findings Leavers Process for Network Access 3.1 There is clear HR guidance for managers to follow when an employee leaves the Council, particularly with the employee journey and managers checklist. This process also refers to the IT process. However, the managers checklist does not request a review of SharePoint or Teams sites to ensure the leaver is removed. The IT leavers process will remove IT access and prevent access to SharePoint and Teams sites, however, the Senior Manager (HR&OD) was advised to update the checklist as a housekeeping issue for site owners and this has been done. 3.2 It should also be noted that the HR/Payroll leavers process and the IT leavers process requires a manager to complete 2 separate forms resulting in 2 separate processes that are not linked in any way. 3.3 There is clear guidance on the IT portal for an employee leaving the Council. Movers Process for Network Access 3.4 There is no separate process in the employee journey for employees moving posts and there is no managers’ checklist for this process linking to the IT movers process. The employee journey for leavers does advise the termination/transfer form should be completed and the termination reason should be recorded as ‘Transfer within NAC’. This will notify Payroll that the employee is not leaving NAC and a contract amendment form is to follow from the new service. (action a) 3.5 There is no clear guidance on the IT portal for an employee that is moving. The IT leavers form advises this form should only be completed if the employee is completely leaving NAC and refers to an employee moving role or department within the Council form that should be completed for movers. However, this form was deactivated in 2021. The ‘Announcements’ section on the IT portal advises movers should complete the ‘Access to files or folder’ request form to request new network access. There is an option to select ‘Yes’ if this access is required because the user has just moved or is moving post within the next month. However, this form does not ask for the new post start date to ensure existing access is retained until this date when the new access should be set up. (action a) Leavers and Movers Process for System Access 3.6 IT email a list of movers and leavers from the Payroll system on a monthly basis to a number of key system administrators asking for the lists to be reviewed against the users for their System and update as appropriate. Internal Audit recommended the wording of this email should be amended specifically state the action that should be taken for leavers and movers. The wording of the email was amended during the audit. 3.7 The auditor requested a list of all current users for the Payroll system, the EM Pro customer relationship management system (formerly Lagan) and the Housing system to carry out user testing. There were no findings to report on the current users for the Payroll system.
Page 12
3.8 The following findings were noted for the EM Pro system and were discussed with IT staff who are administrators for this system and action has been taken to rectify the findings: • There were 8 users that could not be traced to the Payroll system or the email system. System admin confirmed all users were identified as duplicates or past SPS Doorguard users and all were removed. • There were 9 usernames that related to test or train accounts. System admin confirmed all test and train accounts have been removed and all testing will be carried out on the training environment. • There were no duplicate user IDs but there were 2 users with more than 1 username. System admin confirmed all duplicate accounts have been removed. • There were 16 generic user IDs which were last logged on in 2021. System admin provided explanations for the purpose of each account. • There were 33 external usernames identified, including 30 users that work for SPS Doorguard. System admin confirmed all SPS Doorguard users were removed and the other accounts are required for system purposes. • There were 31 leavers that still had access. System admin confirmed all leavers have been removed. 3.9 The following findings were noted for the Housing system and were discussed with the Team Manager/Housing Strategy & Dev and action has been taken to rectify the findings: • there were no duplicate user IDs but there were 12 users with more than 1 username. The Team Manager advised that all have been contacted to find out if both are required and will disable any that are not required. • There were 3 generic usernames or user IDs. The Team Manager advised one has been disabled and the other 2 are required for system purposes. • There were 119 leavers that still has access. The Team Manager advised that all leavers accounts have been locked. 3.10 The auditor advised the Team Manager that the Housing system was not in receipt of the IT monthly movers and leavers report and were not one of the IT systems listed on the HR/Payroll Termination form. The auditor requested via IT Services that the Housing system and the Housing Abritas system are added to both processes to ensure they are notified of movers and leavers to ensure leavers’ and movers’ access is promptly removed. This was rectified during the audit. Leavers and Movers Process for Office 365 3.11 With the move to Office 365, employees may have access to SharePoint or Teams sites as well as Outlook. IT have amended the script in the AD Chris movers process to link to O365 groups so the group owner will automatically be emailed asking if the employee still needs access to groups they belong to. No detailed testing of this process was carried out due to budget constraints, however it has been noted as an area for consideration within future audit plans. Sample Testing 3.12 The auditor selected a sample of 10 leavers and all had completed the HR/Payroll Termination forms before the leaving date. However, only 3 out of 10 had
Page 13
completed the IT leavers form. It should be noted that 1 of the IT leavers form was completed after the leaving date. 3.13 The auditor selected a sample of 10 movers and found the following: • 5 previous managers completed the HR/Payroll Termination form with the termination reason noted as transfer within NAC, 1 of which was completed after the moving date • All new managers completed the amendment form although 1 of these was completed after the moving date. • 1 of the amendment forms was not approved by an authorised signatory. • There was 1 mover that could not be traced to a job on the IT portal requesting new network access • 5 of the movers had logged a job correctly via the folder access request form. The others were logged under employee starters, employee leaving, new start and advised to update Chris record. • There was 1 mover who had completed a folder access request form on 27/10/21, the employee moved on 08/11/21 and the employee advised IT on 11/11/21 their new network access had been removed so it had to be set up again. • There was one mover who completed the correct form but when IT queried the specific folder access required, the line manager asked for the mover to be cloned with another employee in the team. Cloning of access is not recommended due to the risk of including unnecessary additional access. • There were 3 movers for whom the auditor queried the current network access with the current line manager and in 2 cases they advised the mover should not have access to all network groups listed. Therefore, the auditor advised they contact IT to arrange for this access to be removed. (action a) 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the leavers and movers processes. There is clear guidance from HR and IT on the leavers process although testing showed that managers are not completing the IT leavers form. There is no clear guidance from HR and IT on the movers process. The AD Chris movers process implemented as a result of a previous movers audit has improved this process by ensuring network access removes all bar default network access for movers who have not requested new network access via the IT Portal.
Page 14
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 15
KEY FINDINGS AND ACTION PLAN MOVERS AND LEAVERS PROCESSES Action a Finding There is no clear guidance on the IT portal for an employee that is moving. The IT leavers form advises this form should only be completed in the employee is completely leaving NAC and refers to an employee moving role or department within the Council form that should be completed for movers. However, this form was deactivated in 2021. The ‘Announcements’ section on the IT portal advises movers should complete the ‘Access to files or folder’ request form to request new network access. There is an option to select yes if this access is required because the user has just moved or is moving post within the next month. However, this form does not ask for the new post start date to ensure existing access is retained until this date when the new access should be set up. Action Description IT Services should introduce a clear movers process for managers to follow and should notify HR to allow the employee journey to be updated accordingly. Risk It is unclear what action managers should take and may result in no action being taken. Inappropriate access may not be removed or access may be removed while it is still required. Priority (1, 2, 3) 1 Paragraph Reference 3.4, 3.5, 3.13 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Damien Lynn, Senior Customer Officer (ICT) Due Date 31 October 2022 Management Comment IT Services will introduce new movers process on Hornbill ITSM. IT Services will also work with HR to allow the employee journey to be updated accordingly. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 16
SOCIAL MEDIA 1 Background 1.1 This area was last audited in the 2017/18 audit year. The action plan resulted in the formation of a short-life working group to complete several of the actions. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • previous audit actions have been fully implemented. • social media sites are set up in line with corporate policies and procedures and adequate training is provided. • there are appropriate controls in place to manage the Council’s Twitter & Facebook accounts and access is restricted. • adequate access controls are in place for other social media sites and relevant information is available on the site. • employees’ access to social media is restricted, training has been given for investigation purposes and GDPR requirements regarding consent are being adhered to. • adequate advice has been issued to employees for personal use of social media. 3 Findings Implementation of Previous Audit Actions 3.1 The 10 actions from the previous audit of Social Media in 2017/18 were followed up. All were found to have been implemented as agreed by the relevant services. As part of this implementation, an HR Social Media Guide was circulated to all employees in June 2019. Compliance with Social Media Policies 3.2 The Council has a Social Media Implementation Strategy which was updated in February 2021 and is available on the Intranet, Connects. The Council also has Social Media Guidelines for customers which are published on the external website together with a Digital Engagement Register which lists the Council’s Facebook and Twitter pages. There is employee guidance for setting up and managing social media accounts and an e-learning module that supports this guidance. 3.3 A sample of social media pages set up in the last 2 years were tested to ensure that they had been set up according to the set procedure and all had followed the procedure. 3.4 During the audit 1 Instagram account for an HSCP service and 9 Twitter accounts for schools were identified that had not been authorised, as well as a further school Twitter account which had been set up despite the Head of Service declining to authorise it. Corporate Communications are liaising with the HSCP service to ensure that the Instagram account meets the Council’s requirements and arrange
Page 17
retrospective authorisation. Education were already aware that there was an issue with schools setting up unauthorised Twitter accounts and details of the accounts identified were passed to management for action. Education are in the process of preparing their own Digital Strategy which includes social media and have set up a working party on social media. Controls around the Corporate Facebook and Twitter Accounts 3.5 The Corporate Communications team provided information regarding the controls over the corporate social media accounts. No issues were identified. Social Media Use by the Council 3.6 The sample of social media pages at 3.3 above were asked about user access controls and the content of the pages. No issues were identified concerning access controls. 3 accounts had not included the Council’s Social Media Guidelines and 3 did not include their monitoring hours, but all committed to adding this information. No other issues were identified. 3.7 A sample of school Twitter accounts was reviewed and the schools were asked to complete a questionnaire. One school had used a Gmail account in the school’s name to set up the Twitter account. They were advised to change this to a North Ayrshire Council or Glow account and to close the Gmail account. No other issues were identified. Social Media Use by Employees for Work Purposes 3.8 All IT users have read-only access to social media. Read-write access needs to be requested via the IT helpdesk with approval from the employee’s line manager. This access controls whether users can post from within the Council’s network, but they can still access the social media sites outwith the Council’s network if they know the credentials and therefore make posts. Therefore the usefulness of this control is very limited. 3.9 IT provided a list of users with read-write access to social media. This listed 432 users. These were matched to current employees in the CHRIS payroll system. 281 current employees were identified from this match and subsequent investigation. 2 leavers were identified, although 1 was very recent. IT arranged to remove this access. 140 accounts belonged to NHS users. 5 accounts which were never or no longer used were disabled, 1 account was required for election software and 3 accounts were left with IT for further investigation. 3.10 The data match exercise highlighted the large number of accounts allocated to NHS users. There is not a reliable mechanism for IT to be notified when NHS users leave their posts. This is a risk that has been highlighted in this test but it is not appropriate to explore in further detail in the scope and budget of this audit. Therefore it will be explored in a future separate audit exercise. 3.11 A sample of employees from the data match were sent a survey about how they use the access. None of the users surveyed used their access for investigation activities which would be subject to Regulation of Investigatory Powers (Scotland) Act (RIPSA) requirements.
Page 18
3.12 The Council has arrangements in place to ensure that any officers using social media for investigation purposes comply with RIPSA requirements. 3.13 The Council has arrangements in place to ensure that GDPR requirements relating to posting photos on social media are complied with. All of the sample of social media pages at 3.3 and the sample of schools at 3.7 confirmed that they obtain consent before posting any photographs of individuals. Social Media Use by Employees for Personal Use 3.14 Guidance has been issued to all employees regarding use of social media, as well as specific guidance for Education and HSCP employees. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to social media use throughout the Council. Several unauthorised school social media accounts were identified. Education have already established a working group to review schools’ use of social media. 4.2 140 NHS users with read-write access to social media were identified. There is not a reliable mechanism for IT to be notified when NHS users leave their posts. It was not appropriate to explore this issue in further detail within the scope and budget of this audit. Therefore it will be explored in a future separate audit exercise. Definitions of Assurance Levels: Substantial The framework of governance, risk management and control is adequate and effective. Reasonable Some improvements are required to enhance the adequacy and effectiveness of the framework of governance, risk management and control. Limited There are significant weaknesses in the framework of governance, risk management and control such that it could be or could become inadequate and ineffective. None There are fundamental weaknesses in the framework of governance, risk management and control such that it is inadequate and ineffective or is likely to fail. NB The level of assurance given is at the discretion of Internal Audit.
Page 19
VAT 1 Background 1.1 The Council incurs more input VAT (VAT on purchases) than it collects via output VAT (VAT on charges for services) and is therefore in a net position of having paid out tax that it is able to recover from HMRC. 1.2 Monthly VAT returns allows the Council to recoup this cash timeously. 1.3 HMRC can impose significant penalties on the Council if they believe any inaccuracies in these returns are the result of carelessness, are deliberate or are deliberate and concealed. 2 Objectives and Scope 2.1 The objective of this audit is to ensure:- • Training and procedures are available to ensure staff understand the Council’s VAT position • VAT returns are being submitted accurately and timeously • The Council’s de minimis calculation is being reviewed regularly • Input VAT in being correctly recorded within Integra 3 Findings Training 3.1 In order to ensure the correct classification and treatment of VAT on transactions, it is important that officers understand the Council’s VAT status and what that means, in addition to knowing how to process transactions within Integra. 3.2 Audit reviewed the resources available to Officers and found those noted in paragraphs 3.3 – 3.6 below. 3.3 The Council has a VAT manual which covers general information such as:- • VAT classifications, • how to calculate VAT, • what constitutes a VAT invoice • Tax points • Accounting for VAT errors • The importance of VAT planning but also looks at the specific transactions being undertaken by services and the VAT treatment and implications of these. 3.4 Supplementary information is circulated as necessary eg guidance notes on how to deal with VAT charged by EU suppliers and VAT Planning for Land and Property Transactions have been provided to staff. 3.5 An online VAT awareness training course has recently been added to ILearn.
Page 20
3.6 The mechanics of recording VAT is covered within system specific procedures. VAT returns 3.7 Audit confirmed that all monthly VAT returns in 2021/22 were submitted timeously. 3.8 The Council must make a voluntary disclosure to HMRC of any VAT correction required that is greater than £50,000. Financial Management have confirmed that no such disclosures have been made during 2021/22. 3.9 Minor VAT corrections can be made via monthly returns. Audit reviewed all returns in 2021/21 and only found 2 instances of minor adjustments having been made. These adjustments totalled £2,736 net. 3.10 Audit also confirmed that the Council’s VAT suspense account is being reconciled monthly. De Minimis Calculation 3.11 The Council provides a number of services that are VAT exempt. Normally no VAT is chargeable on an exempt supply, and input VAT cannot be recovered. 3.12 However, section 33 of the VAT Act 1994 allows the Council to recover this input VAT so long as its value is deemed insignificant as compared to the Council’s overall input VAT value. 3.13 The de minimis calculation sets the maximum value of input tax relating to exempt supplies that can be incurred (and reclaimed) whilst staying within the parameter of ‘insignificant’. 3.14 Should the Council exceed this maximum value then it would lose the ability to reclaim all VAT incurred providing exempt services – not just the element that exceeds the threshold. 3.15 It is therefore important that the Council plans and monitors its exempt activities. 3.16 The Council’s main exempt supply relates to the lease of properties and hall lets. Any significant transactions relating to such properties - such as purchases, refurbishment or sales could have a significant impact on the total value of exempt transactions. 3.17 Financial Management have issued a document to all senior managers highlighting the impact of land and property transactions on the Council’s overall VAT position. They have requested to be notified of all potential transactions and have issued a ‘VAT consideration form’ for completion. 3.18 Financial Management have confirmed that the de minimis calculation is revisited annually – with the latest recalculation being undertaken in September 21. Input VAT 3.19 VAT can only be recovered if a valid VAT invoice is received and retained.
Page 21
3.20 Audit selected a sample of 24 invoices and 6 procurement card transactions to verify that:- • A valid VAT invoice is available in all instances where VAT has been reclaimed • Any VAT on invoices has been accurately reflected in Integra or SDOL 3.21 No issues were noted during testing of the 24 invoices. 3.22 Of the 6 procurement card transactions tested:- • 2 transactions were found to have appropriate invoices, and had been correctly coded in SDOL • 1 transaction was found to have a VAT invoice, but the VAT hadn’t been recorded in SDOL. This means VAT of £132.47 has not been reclaimed by the Council. • The card surcharge on one invoice had been incorrectly treated as VATable by the cardholder. As a result, the Council has incorrectly reclaimed £6.79 of VAT. • 1 transaction was found to have no VAT invoice. At the request of Audit, the cardholder obtained a VAT invoice from the company which confirmed the VAT on the transaction had been correctly recorded in SDOL. • 1 transaction was found to have no VAT invoice. At the request of Audit, the cardholder was able to obtain a VAT invoice from the company. This invoice included VAT, however the VAT element had not been recorded in SDOL. This means VAT of £36.66 has not been reclaimed by the Council. (action point a) 3.23 Audit has also raised the above errors with relevant cardholders and their line managers. 3.24 Audit has liaised with Financial Management to ensure the above errors are corrected via the Council’s next VAT return. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regards the Council’s treatment of VAT transactions. 4.2 Invoices being processed via Integra are being recorded properly, however some issues with the identification and processing of VAT on procurement card transactions is evident from Audit testing.
Page 22
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 23
KEY FINDINGS AND ACTION PLAN VAT Action a Finding VAT invoices are not always being obtained and/or recorded correctly in SDOL for procurement card purchases. Action Description Procurement card holders to be reminded of the importance of obtaining VAT invoices for all purchases, and then reflecting these accurately in SDOL. Risk The Council is missing the opportunity to reclaim VAT that it is entitled to. Evidence required by HMRC to support VAT being reclaimed has not been retained. Priority (1, 2, 3) 1 Paragraph Reference 3.22 Managed by Mark Boyd, Head of Service (Finance) Assigned to Suzanne Quinn, Senior Manager (Corporate Procurement) Due Date Completed Management Comment An email was sent to all card holders from the Head of Finance, stressing the importance of the treatment of VAT in Pcard transactions and reminding all users to obtain a VAT invoice and to upload the VAT invoice and complete the relevant VAT information on the SDOL system. The email also stressed that any continued incorrect recording of VAT in Pcard transactions could result in removal of this facility. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 24
OFF PAYROLL WORKING (IR35) 1 Background 1.1 IR35 (Off payroll working) was introduced by HMRC to tackle the issue of individuals providing ‘employee type’ services to a company but doing so via a Personal Service Company (PSC) so as to avoid having to pay PAYE and NI. 1.2 Updates to the legislation in 2021 made it clear that the company receiving the service is responsible for assessing whether an engagement lies within the scope of IR35 and deducting the correct PAYE and NI if necessary. 1.3 Fines and penalties can be imposed by HMRC if assessments are not carried out or a lack of care and/or negligence results in incorrect assessments being made. 2 Objectives and Scope 2.1 The objective of this audit was to ensure council officers are aware of IR35 rules and are taking steps to identify off payroll working. 3 Findings 3.1 Payroll maintains a separate payrun through which any tax deducted from PSCs is processed. Payroll have confirmed that no transactions have been processed through this payrun in 2021/22. Procedures and processes 3.2 HMRC looks for evidence of ‘reasonable care’ when assessing whether the Council has fulfilled its responsibilities surrounding off payroll working. 3.3 ‘Reasonable care’ can be evidenced, in part, by having robust procedures and processes in place to support Council Officers. 3.4 Audit reviewed the procedures and processes available to Officers and found:- • The Council’s ‘Codes of Financial Practice’ document has been updated to reference IR35. • HR has a procedure called ‘Engaging Agency Workers and Personal Service Companies’ which sets out Service roles and responsibilities, explains how to assess engagements and gives worked examples and flowcharts to support Officers. • An online training course on off payroll working is available on ILearn. Senior Managers have been instructed to ensure all relevant staff have completed this course. • From December 2021, Corporate Procurement has added prompts to its processes to remind Services to consider IR35 when procuring new contracts. Engaging workers via Agencies 3.5 When engaging workers via agencies, it is important to establish if the worker is a direct employee of the agency (in which case the agency is responsible for dealing
Page 25
with PAYE and NI) or if the agency is simply acting as an intermediary to match up independent workers with those seeking their services (in which case the Council needs to consider if IR35 is applicable). 3.6 The HR procedure sets out 6 questions to help assess whether each engagement is within the scope of IR35. It also directs officers to the HMRC assessment tool if the 6 questions do not give a conclusive answer. 3.7 IR35 requires the Council to send out a Status Determination Statement (SDS) to the agency and worker to confirm the outcome of the assessment. (action point a) 3.8 Audit analysed all expenditure coded to ‘Agency costs’ in 2021/22 and found that the following services had used agency staff:- • HSCP – Children, Families & Justice • HSCP – Mental Health • Building Services • Waste 3.9 Audit asked the above services to confirm that they had completed all the requirements of IR35 prior to engaging agency staff. 3.10 HSCP – Children, Families & Justice were unable to confirm whether or not IR35 had been considered prior to engaging staff. (action point b) 3.11 HSCP – Mental Health team did not consider IR35 prior to engaging staff. (action point b) 3.12 HSCP – Learning Disabilities team were unable to confirm whether or not IR35 had been considered prior to engaging staff. (action point b) 3.13 Building Services – have a process in place where all agency appointments are managed by a single officer. A review of this process highlighted that whilst elements of IR35 have been applied, not all requirements have been met. (action point b) 3.14 Waste – did not consider IR35 prior to engaging staff. (action point b) 3.15 The above findings prompted Audit to review who has completed the online IR35 training. This highlighted that not all officers who are dealing with potential IR35 transactions have completed the training. (action point c) Direct Engagement of PSC 3.16 Services could also have contracted directly with a PSC i.e. not via an agency. 3.17 Audit looked for evidence of such transactions by:- • Reviewing a sample of 10 invoices coded to consultants fees • Reviewing transactions with 5 local suppliers whose contract type and company name might indicate a PSC. 3.18 No issues were noted during testing.
Page 26
4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard Employee Services’ provision of procedures and guidance to Council Services. Information and support is available to Services and reliance is placed on Services making use of these resources. 4.2 Overall, limited assurance was obtained with regard to the application of IR35 within Services. 4.3 Building Services were the only Service using agency workers who could demonstrate some consideration and application of IR35 in 21/22. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 27
KEY FINDINGS AND ACTION PLAN OFF PAYROLL WOKING (IR35) Action a Finding The Council does not have its own Status Determination Statement (SDS) template at present (although there is one available on the HMRC website). Action Description Employee Services to add a Status Determination Statement (SDS) template to the HR ‘Engaging Agency Workers and Personal Service Companies’ procedure Risk Inconsistent communication with agencies/PSCs Priority (1, 2, 3) 3 Paragraph Reference 3.7 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Jackie Hamilton, Senior Manager (Employee Services) Due Date 31 August 2022 Management Comment HMRC’s template will be added to the HR ‘Engaging Agency Workers and Personal Service Companies’ procedure Action b(1) Finding IR35 is not being considered, evidenced, and applied consistently throughout the Council. Action Description Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.10 Managed by Alison Sutherland, Head of Service (Children, Families & Justice) Assigned to Alison Sutherland, Head of Service (Children, Families & Justice) Due Date 31 October 2022 Management Comment Children, Families & Justice (CFJ) accept the findings in the report. The Head of Service will contact Internal Audit to identify individuals/companies this audit refers to in order to revisit the transactions from last year and assess against IR35 criteria to ensure the process is applied consistently and evidenced. CFJ senior managers will complete the training module and HoS will make IR35 an agenda item at an extended team manager meeting to raise awareness.
Page 28
HSCP will review our processes and change procedures to identify one person in the partnership who will be responsible for the IR35 checklist to make sure this does not happen again. Action b(2) Finding IR35 is not being considered, evidenced, and applied consistently throughout the Council. Action Description Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.11, 3.12 Managed by Thelma Bowers, Head of Service (Mental Health) Assigned to Thelma Bowers, Head of Service (Mental Health) Due Date 31 October 2022 Management Comment A review of practice has been undertaken within the service which has identified a gap in knowledge regarding these standing financial requirements. A programme of training will be implemented to ensure compliance in this area of financial management and all staff with this area of financial responsibility have been made aware of the audit outcome. Action b(3) Finding IR35 is not being considered, evidenced, and applied consistently throughout the Council. Action Description Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.13 Managed by Yvonne Baulk, Head of Service (Housing & Public Protection) Assigned to Leigh-Ann Mitchell (Senior Manager, Building Services Governance) Due Date 30 September 2022 Management Comment When recruiting agency workers Building Services have been asking the 6 questions as set out by the HR procedure. The one requirement still outstanding relates to completion of the Status Determination Statement, which is currently being developed by HR. Once this is made available Building Services will complete this retrospectively for all agency appointments from 2021/22.
Page 29
Action b(4) Finding IR35 is not being considered, evidenced, and applied consistently throughout the Council. Action Description Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.14 Managed by Thomas Reaney, Head of Service (Commercial) Assigned to Wallace Turpie (Senior Manager Waste & Streetscene) Due Date Complete Management Comment Waste Services employed one agency driver for one period for holiday cover. The agency has been contacted and confirmed that they paid tax for this worker. Head of Service can confirm that agency labour will no longer be used in this service area. Action c Finding IR35 training hasn’t been completed by all relevant Officers. Action Description Employee Services to remind all Heads of Service of the importance of ensuring relevant staff have completed the online IR35 training. A list of all staff who have completed the training course to be circulated alongside the above communication. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.15 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Jackie Hamilton, Senior Manager (Employee Services) Due Date 31 August 2022 Management Comment Communications are scheduled on a 6 monthly cycle to remind Services of the importance of adhering to IR35 regulations, sign posting to the guide and training module. The next update will be brought forward and will also include details of those who have undertaken the training. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 30
CM2000 SYSTEM 1 Background 1.1 The CM2000 system is a care management system used by HSCP. It is a scheduling and monitoring system which allows visits to service users to be scheduled, recorded and monitored. 1.2 The Care at Home team use this system to schedule, record and manage care at home visits that have been assessed and approved. There are also 2 external providers that use the CM2000 system for this purpose. It is also used for Community Alarms but this is a reactive service rather than a planned service. 1.3 When a new service user is set up on CM2000 system, a CM2000 disc is set up which links to mobile phones which have been allocated to Care at Home staff. A CM2000 tag is set up in the service user’s home. This allows the rota to be provided to Care at Home staff via the mobile device and will allow them to clock in and out of the service user’s home to allow the time spent at each visit to be recorded on the system. 1.4 The Adult Services team do not key to the CM2000 system, but they have access to the system to allow reports to be run for the external providers that carry out approved visits to adults. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • There is a robust process in place for users that move post or leave the Council and appropriate password controls are in place. • Access permissions are appropriate to the job role ensuring segregation of duties and high-risk areas are adequately restricted to key staff. • Adequate controls are in place for interfaces to and from the CM2000 system and accurate reports are produced. • Adequate access controls are in place to protect personal/sensitive data on mobile devices and the allocation and return of mobile devices is controlled. 3 Findings System Access Controls 3.1 The Business Support Officer advised that password security settings were set by NAC but were passed to the provider to set up. Password controls did not enforce the need for an uppercase character and a special character; however, this was rectified during the audit. 3.2 The CM2000 system admin team do not receive the monthly leavers and movers report emailed by IT. This was rectified during the audit. System Users Controls
Page 31
3.3 The auditor carried out testing on users of the system. There were no leavers identified, all were current employees with relevant permissions to the system. 3.4 The user roles called ‘Super User’ and ‘Team Manager’ have very similar permissions and system administrator duties should be restricted to Super Users only. There are 4 Super Users and 7 Team Managers that can reset passwords, access system administration, and set up and maintain user accounts. (action a) Interfaces and Reports 3.5 The auditor reviewed the invoice checking process for Adult Services and tested a sample of 5 invoices. Although there were no findings to report from this testing, it should be noted that the current invoice reconciliation process is manual and resource intensive. The provider invoice is manually reconciled to the CSV file which is a file generated from the CM2000 system. The CSV file is then checked against the projections spreadsheet which details the service level agreements in place as per the CareFirst system to ensure the correct charge has been invoiced. The team will investigate any overcharges. (action b) 3.6 The auditor reviewed the invoice checking process for Care at Home and tested a sample of 5 invoices. There were no findings to report from the invoice testing process for the Care at Home team. Use of Mobile Devices 3.7 Mobile phones are allocated to Care at Home Assistants to allow them to access their daily rota and to clock in and out of each service users home. There is a record of who has been allocated a mobile phone and the mobile phones are secured with a pin number to access the device, a password to access the NAC company portal and an additional password to access the CM2000 app. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the system controls for the CM2000 system.
Page 32
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 33
KEY FINDINGS AND ACTION PLAN CM2000 SYSTEM Action a Finding The user roles called ‘Super User’ and ‘Team Manager’ have very similar permissions and system administrator duties should be restricted to Super Users only. Both groups can reset passwords, access system administration, and set up and maintain user accounts. Action Description System administrator functions should be restricted to ‘Super User’ roles only. Risk A user with too much access can manipulate the system to their own benefit and avoid detection. Priority (1, 2, 3) 2 Paragraph Reference 3.4 Managed by David Thomson, Head of Service (Health and Community Care) Assigned to Kerry Logan, Senior Manager (HSCP) Due Date Complete Management Comment The Team Manager user role has been amended to remove access to system administrator permissions. Action b Finding The current reconciliation process is manual and resource intensive. The provider invoice is manually reconciled to the CSV file which is a file generated from the CM2000 system. The CSV file is then checked against the projections spreadsheet which details the service level agreements in place as per the CareFirst system to ensure the correct charge has been invoiced and investigate any overcharges. Action Description Consideration should be given to investigating the use of a more automated invoice checking process that would allow overcharges to be highlighted and investigated. Risk Manual checking process is more prone to human error which could result in an overpayment. Inefficient use of staff time. Priority (1, 2, 3) 3 Paragraph Reference 3.5 Managed by Paul Doak, Head of Service (HSCP Finance and Transform) Assigned to Eleanor Currie, Principal Manager - Finance Due Date 31st August 2022 Management Comment A new process has been drafted and is being tested using the July data. Following testing, the adult finance team will be trained and the process applied to the August data onwards. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 34
FUNDING SUPPORT TO BUSINESSES 1 Background 1.1 On 16 March 2020, Health Secretary Matt Hancock announced to the House of Commons all unnecessary social contact should cease. On 23 March 2020, the first lockdown was announced, the Chancellor announced the Coronavirus Job Retention Scheme for furloughed workers and a programme of funding support to businesses was announced at various stages during the pandemic. This scheme was devolved to the Scottish Parliament and local councils managed the distribution. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • guidance issued by the Scottish Government is accurately relayed to staff issuing grants • systems were in place to distribute grant and that guidance was complied with • grants were issued to clients in a timeous and secure manner • lessons learned from this experience are being built into future plans including Business Continuity Plans (BCP) 3 Findings Guidance 3.1 The Scottish Government issued guidance relating to the grant funding schemes announced on 18th March 2020. This guidance was continuously updated via the Strategic Framework Funds Issues Log; by January, there were 114 responses to requests made by local Authorities. 3.2 In March 2020, small business grant fund and retail, hospitality and leisure grant fund guidance were issued relating to two grants funding schemes: • A one-off £10,000 small business grant to the ratepayers of properties with specified uses in receipt of the Small Business Bonus Scheme (SBBS) or Rural Relief, or eligible for SBBS but in receipt of Nursery Relief, Disabled Relief, the Business Growth Accelerator Relief or Fresh Start. Certain property uses are excluded. • A one-off £25,000 grant to the ratepayers of properties in the retail, hospitality and leisure sectors. Certain property uses are excluded. 3.3 In total there were 20 different schemes administered by 4 different teams who were best placed to access the relevant information to make decisions on grants. Distribution teams had to be set up quickly. Revenues, who administrate rates for the council, and Business Support, who had developed relationships with local Businesses, administered the main tranches of grants. Growth and Development administered hospitality grants, and Legal Services manage an administration team for all the taxi applications to the council. 3.4 Support process guidance to staff was clearly mapped on a flowchart.
Page 35
3.5 NAC used social media and its website to provide public advice. Staff were available to provide guidance and support via the phone, using social media accounts Twitter, Facebook, Linked in and YouTube. Publicity was maximised using the Council’s website and social media. Applications were to be completed online and grant specific links were created which all fed to unique mail boxes. Compliance 3.6 In the 2020-21 financial year, the Scottish Government issued £1,806,663,060 in support. North Ayrshire Council received £74,780,641 (2.3%). The distribution process was negotiated by the Scottish Government and COSLA with local authorities being deemed best placed to facilitate grant applications. 3.7 Applications were to be made online and submitted via email. Each application was submitted to a dedicated email address, allowing the application to be identified and handled by the correct team. This also allows, in the event of one of the team members becoming ill, access to the applications by the rest of the team. 3.8 Internal audit examined two of the email accounts: Business Grants and Taxi and Private Hire Driver Grants (TPHD). 3.9 The Business Grants account was the most sought-after support grant. In the period March 2021 to December 2021 there were 3,098 emails posted on this account. 3.10 Taxi drivers were approached by NAC directly. 3.11 A four-step escalation plan was put in place to resolve enquiries and any appeals. Email evidence indicates that many enquiries were resolved at stage one with a few at stage two. Payments 3.12 Internal audit identified 2,222 applications for Business grant support and the instruction to pay £2,287,500 for the period 1st April 2020 to 27th October 2020. Taxi payments for 344 claims were paid with a value of £88,400. A sample of 25 business and 10 taxi grants were randomly selected and tested for completeness of information. 3.13 Business grant applicants submitted their application by email. 3.14 The application form comprised of seven sections:- 1. Applications for grant of £10,000 2. Applications for grant of £25,000 3. About your business 4. Business details 5. Bank details 6. State Aid 7. Term and conditions
Page 36
From the responses sampled some of the applicants had difficulty completing sections 1 and 2 - from 3 questions, four didn’t provide a response and one provided a response that made their application ineligible. Section 3 responses, to five questions posed, were also incomplete – the lowest level of compliance related to providing the business rates reference number and purpose of business at 79%. In general, the other sections were complete. 3.15 Taxi application responses were almost 100% complete with only a couple of questions not responded to, for example two applicants did not provide postcode. 3.16 Testing identified 78 potential duplicate payments, however further investigation identified that these were either applications by the same company in different locations, or by individuals with the same name. The reason they were highlighted was the twelve-digit reference used for Integra postings were the first details of the applicant’s name. Other checks into potential fraudulent claims are being investigated independently through the Scottish Local Authority Investigators Group. 3.17 All the sample tested received appropriate grant payments. Future Planning 3.17 Business Continuity Plans (BCP) reviewed included scenarios faced during the pandemic. 3.18 Audit Scotland issued a report “Principals for community empowerment” in July 2019, which identified what councils would need to achieve following the pandemic. On 28th October 2021, an update report was issued, which identified the disproportional effect of the pandemic on parts of the population and the role that third party organisations had to play at this time. The report included a case study for the Three Towns Hub, which has identified a concrete strategy for community empowerment moving forward. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained regarding administration and allocation of support grants during the COVID period.
Page 37
Definitions of Assurance Levels: Substantial The framework of governance, risk management and control is adequate and effective. Reasonable Some improvements are required to enhance the adequacy and effectiveness of the framework of governance, risk management and control. Limited There are significant weaknesses in the framework of governance, risk management and control such that it could be or could become inadequate and ineffective. None There are fundamental weaknesses in the framework of governance, risk management and control such that it is inadequate and ineffective or is likely to fail. NB The level of assurance given is at the discretion of Internal Audit.