Agenda Document Pack - Audit and Scrutiny Committee - 27/09/2022
North Ayrshire Council · 27 September 2022
Back to Audit and Scrutiny Committee — 27 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Ayrshire Council, Cunninghame House, Irvine KA12 8EE Audit and Scrutiny Committee A Special Meeting of the Audit and Scrutiny Committee of North Ayrshire Council will be held in the Council Chambers, Ground Floor, Cunninghame House, Irvine, KA12 8EE on Tuesday, 27 September 2022 at 10:00 to consider the undernoted business. Meeting Arrangements - Hybrid Meetings This meeting will be held on a predominantly physical basis but with provision, by prior notification, for remote attendance by Elected Members in accordance with the provisions of the Local Government (Scotland) Act 2003. Where possible, the meeting will be live-streamed and available to view at https://north-ayrshire.public- i.tv/core/portal/home. 1 Declarations of Interest Members are requested to give notice of any declarations of interest in respect of items of business on the Agenda. 2 Minutes The accuracy of the Minutes of (i) the Ordinary Meeting of the Audit and Scrutiny Committee held on 31 May 2022; and (ii) the Special Meeting held on 30 June 2022 will be confirmed and the Minutes signed in accordance with Paragraph 7 (1) of Schedule 7 of the Local Government (Scotland) Act 1973 (copy enclosed). 3 External Quality Assessment of Internal Audit by West Dunbartonshire Council Submit report by the Head of Service (Finance) on the findings of the recent external review of Internal Audit carried out by West Dunbartonshire Council (copy enclosed). 1
Page 2
North Ayrshire Council, Cunninghame House, Irvine KA12 8EE 4 Accounts Commission’s Report: Local Government in Scotland: Overview 2022 Submit a report by the Head of Service (Finance) on the findings of the Local Government in Scotland Overview 2022 report by the Accounts Commission (copy enclosed). 5 Internal Audit Annual Update Report: North Ayrshire Integration Joint Board (IJB) Submit report by the Head of Service (Finance) on the IJBs Annual Report for 2021/22 and the approved internal audit plan for 2022/23 (copy enclosed). 6 Strategic Risk Register 2022/23 Submit report by the Head of Service (Finance) on the Council’s agreed Strategic Risk Register for 2022/23 (copy enclosed). 7 Internal Audit and Corporate Fraud Action Plans: Quarter 1 Update Submit report by the Head of Service (Finance) on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 30 June 2022 (copy enclosed). 8 Internal Audit Plan 2022/23: Mid-Year Update Submit report by Head of Service (Finance) on progress made in delivering the 2022/23 Internal Audit Plan (copy enclosed). 9 Internal Audit Reports Issued Submit report by the Head of Service (Finance) on the findings of Internal Audit work completed between May and August 2022 (copy enclosed). 10 Counter Fraud and Corruption Strategy Submit report by the Head of Service (Finance) on the refresh of the Council’s Counter Fraud and Corruption Strategy (copy enclosed). 11 Annual Assurance Statement to the Scottish Housing Regulator 2021/22 Submit report by the Executive Director (Place) on the Council’s Annual Return on the Charter 2021/22 submission and on endorsement of the Annual Assurance Statement for submission to the Scottish Housing Regulator (copy enclosed). 12 Urgent Items Any other items which the Chair considers to be urgent. 2
Page 3
North Ayrshire Council, Cunninghame House, Irvine KA12 8EE 13 Exclusion of the Public - Para 1 Resolve in terms of Section 50(A)4 of the Local Government (Scotland) Act 1973, to exclude from the Meeting the press and the public for the following item of business on the grounds indicated in terms of Paragraph 1 of Part 1 of Schedule 7A of the Act. Non Disclosure of Information In terms of Standing Order 21 (Disclosure of Information), the information contained within the following report is confidential information within the meaning of Section 50A of the 1973 Act and shall not be disclosed to any person by any Member or Officer. 14 Investigation Reports Issued Submit report by the Head of Service (Finance) on investigation reports finalised since the last meeting (copy enclosed). 15 Internal Audit and Corporate Fraud Action Plans: Quarter 1 Update (exempted items) Submit report by the Head of Service (Finance) on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 30 June 2022 (copy enclosed). Webcasting Please note: this meeting may be filmed/recorded/live-streamed to the Council's internet site and available to view at https://north-ayrshire.public- i.tv/core/portal/home, where it will be capable of repeated viewing. At the start of the meeting, the Provost/Chair will confirm if all or part of the meeting is being filmed/recorded/live-streamed. You should be aware that the Council is a Data Controller under the Data Protection Act 2018. Data collected during the webcast will be retained in accordance with the Council’s published policy, including, but not limited to, for the purpose of keeping historical records and making those records available via the Council’s internet site. Generally, the press and public seating areas will not be filmed. However, by entering the Council Chambers, using the press or public seating area or (by invitation) participating remotely in this meeting, you are consenting to being filmed and consenting to the use and storage of those images and sound recordings and any information pertaining to you contained in them for webcasting or training purposes and for the purpose of keeping historical records and making those records available to the public. If you do not wish to participate in a recording, you should leave the meeting. This will constitute your revocation of consent. If you have any queries regarding this and, in particular, if you believe that use and/or storage of any particular information would cause, or be likely to cause, substantial damage or distress to any individual, please contact dataprotectionofficer@north-ayrshire.gov.uk. 3
Page 4
North Ayrshire Council, Cunninghame House, Irvine KA12 8EE Audit and Scrutiny Committee Sederunt John Bell (Chair) Donald Reid (Vice Chair) Eleanor Collier Cameron Inglis Tom Marshall Matthew McLean Davina McTiernan Ian Murdoch John Sweeney Chair: Apologies: Attending: 4
Page 5
Audit and Scrutiny Committee 31 May 2022 At a Meeting of the Audit and Scrutiny Committee of North Ayrshire Council at 10.00 a.m. involving participation by remote electronic means and physical attendance within the Council Chambers, Irvine. Present (Physical Participation) John Bell, Donald Reid, Eleanor Collier, Cameron Inglis, Tom Marshall and Matthew McLean. In Attendance (Physical Participation) A. Sutton, Executive Director and A. McClelland, Head of Service (Education) (Communities and Education); M. Boyd, Head of Service, D. Forbes, Senior Manager (Strategic Business Partner), L. Miller, Senior Manager (Audit, Fraud Safety and Insurance) (Finance), A. Craig, Head of Service (Democratic), H. Clancy and D. McCaw, Committee Services Officers (Chief Executive’s Service). In Attendance (Remote Electronic Participation) C. Cameron, Director (Health and Social Care Partnership); R. Arthur, Head of Service (Connected Communities) (Communities and Education); M. Anderson, Senior Manager, Committee and Member Services and A. Little, Committee Services Officer (Chief Executive’s Service). Also in Attendance (Physical Participation) Beth Griffin and Lynn Kirkland (NHS Ayrshire and Arran). Also in Attendance (Remote Electronic Participation) P. Kenny (Deloitte). Chair Councillor Bell in the Chair. Apologies Davina McTiernan, Ian Murdoch and John Sweeney. 1. Chair’s Remarks The Chair agreed, in terms of Standing Order 10.5, to vary the order of business to allow consideration of Agenda Item 3: External Audit Report on Audit Dimensions and Best Value for the year ended 31 March 2022, immediately following Agenda Item 10: Participatory Budgeting, to allow remote attendance by the External Auditor. 2. Declarations of Interest There were no declarations of interest by Members in terms of Standing Order 11 and Section 5 of the Code of Conduct for Councillors. Agenda Item 2 5
Page 6
3. Accounts Commission’s Report: Local Government in Scotland: Financial Overview 2020/21 Submitted report by the Head of Service (Finance) on the findings of the recently published Accounts Commission report on the Financial Overview 2020/21 of Local Government in Scotland. The report analysed the annual accounts produced by Local Authorities together with the reports of each body’s external auditors, to identify relative performance, highlight challenges faced and assess responses to those challenges. The relevant feedback on each of the key messages, across 3 main categories identified, was detailed in Appendix 1 to the report. Members asked questions and were provided with further information in relation to: • Covid-19 related funding which could not be spent in the last financial year and which was, therefore, identified as earmarked reserves in the current financial year for the specified set-aside purpose; and • section 2.3 of the report being relative to the national position across Scotland with Section 2.5 specific to North Ayrshire. The Committee agreed to note (i) the findings of the recent Accounts Commission report; and (ii) the current position regarding North Ayrshire in relation to the findings. 4. Internal Audit Annual Report 2021/22 Submitted report by the Head of Service (Finance) on the work of Internal Audit during 2021/22, covering the 14-month period from 1 February 2021 – 31 March 2022, and detailing an opinion on the governance, risk management and internal control environment of the Council. The full report was attached at Appendix 1 to the report. Members asked questions and were provided with further information in relation to: • the potential to reduce the number of procurement cards in operation throughout North Ayrshire in order to mitigate misuse; • the rationale for the allocation of Procurement Cards to more than one person within a service; • the retrospective procurement card transaction authorisation process by a designated approver; • delays between the purchase of goods/services and approval of transactions; and • spending level analysis information which could be provided to the Committee. The Head of Finance undertook to confirm the current number of Procurement Cards in operation across North Ayrshire, together with options for rationalising the number being utilised, and to provide spending level analysis information to the Committee. The Committee agreed to note (i) the content of the annual report detailed at Appendix 1 to the report and (ii) the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 6
Page 7
5. Annual Governance Statement 2021-22 Submitted report by the Head of Service (Finance) on the Council’s Annual Governance Statement for 2021-22 for inclusion within the draft Annual Accounts. The Annual Governance Statement, detailed at Appendix 1 to the report, outlined the governance framework in place and changes which had been made to strengthen the framework during 2021-22. The Committee agreed to approve the draft Annual Governance Statement as detailed at Appendix 1 to the report. 6. Accounting Policies 2021/22 Submitted report by the Head of Service (Finance) on the accounting policies which would be adopted in the preparation of the Council’s Annual Accounts for the year to 31 March 2022. The draft Accounting Policies proposed for adoption were detailed at Appendix 1 to the report. Members asked questions and were provided with further information in relation to: • the number of leases currently held by North Ayrshire Council; • the benefit of utilising loans to buy assets outright as opposed to leasing in the current financial climate; and • termination benefit information being provided to the Committee on a service basis. The Senior Manager (Strategic Business Partner) undertook to provide termination benefit information to the Committee on a service basis. The Committee agreed to approve the Accounting Policies as detailed in Appendix 1 to the report. 7. Corporate Fraud Team Annual Report 2021/22 Submitted report by the Head of Service (Finance) on the work of the Corporate Fraud Team during 2021/22, where 280 referrals for investigation had been received. The Senior Manager (Internal Audit, Risk and Fraud) highlighted investigations which had been carried out across a range of areas including employee-related matters as well as Council Tax, Discretionary Housing Payments, Scottish Welfare Fund, Blue Badges and Housing tenancy issues. The Committee was advised that joint working with the DWP Single Fraud Investigation Service (SFIS) in cases where there were suspected frauds relating to both DWP Benefits and Council Tax Reduction, had been suspended during the Pandemic, but the DWP had intimated that this work would recommence. It was further highlighted that the increase in referrals was not yet back to pre Covid-19 levels. Members asked questions and were provided with further information in relation to: • whether ‘scammers’ were still an issue across North Ayrshire; and 7
Page 8
• the slight reduction in the number of blue badge misuse warning letters issued given that the Corporate Fraud Team investigated 100% of the referrals made to the Team. Noted. 8. Internal Audit and Corporate Fraud Action Plans: Quarter 4 Update Submitted report by the Head of Service (Finance) on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 31 March 2022. Appendix 1 to the report provided full details of the actions which were not completed within the agreed timescale, including the most recent update information. Members asked questions and were provided with further information in relation to: • progress with the first 2 HSCP actions on page 96 of the report Appendix, with delays being attributed jointly to the 3 Ayrshire Councils and the NHS Board; and • the establishment of a short-life working group to progress both HSCP actions with estimated completion by December 2022 The Committee agreed to note (i) the current position with the implementation of Internal Audit and Corporate Fraud actions; and (ii) that those Services which had not implemented actions within the previously agreed timescales would be challenged. 9. Internal Audit Reports Issued Submitted report by the Head of Service (Finance) on the findings of Internal Audit work completed between March and April 2022. The findings from four audit assignments were detailed at Appendix 1 to the report, together with the respective executive summaries and action plans. Members asked questions and were provided with further information in relation to: Secondary Schools • self-assessments carried out by secondary schools due to the Covid-19 pandemic; • the audit planning process focussing primarily on Primary Schools in the current year; and • the use of any surplus time gained once planned audit work had been completed, to allow a focus on Secondary Schools. Noted. 10. Participatory Budgeting Submitted report by the Executive Director (Communities and Education) providing an update on engagement methods used in Participatory Budgeting events and on future engagement approaches following the easing of restrictions in terms of Covid-19. 8
Page 9
The Committee agreed to approve the recommended engagement methods for use in future Participatory Budgeting events, as set out in the report. 11. External Audit Report on Audit Dimensions and Best Value for the year ended 31 March 2022 Submitted report by Head of Service (Finance), and received a verbal report by the External Auditor, on the findings from the External Audit report on Audit Dimensions and Best Value for 2021/22 which summarised the external auditor’s conclusions across four audit dimensions within the scope of the 2021/22 audit work, and the review of arrangements made by the Council for securing Best Value. The full External Audit Report was attached at Appendix 1 to the report. The Committee agreed (a) to note (i) the findings contained in the External Auditor’s very positive Audit Dimensions and Best Value report detailed at Appendix 1 to the report; and (ii) the sector developments as outlined in the report; and (b) to receive the External Auditor’s Annual Report on the accounts to the meeting to be held on 27 September 2022. 12. Exclusion of the Public – Para 1 The Committee resolved in terms of Section 50(A)4 of the Local Government (Scotland) Act 1973, to exclude from the Meeting the press and the public for the following item of business on the grounds indicated in terms of Paragraph 1 of Part 1 of Schedule 7A of the Act. 13. Investigation Reports Issued Submitted report by the Head of Service (Finance) on investigation reports finalised since the last meeting. Noted. The meeting ended at 11.05 a.m. 9
Page 10
Audit and Scrutiny Committee 30 June 2022 At a Special Meeting of the Audit and Scrutiny Committee of North Ayrshire Council at 10.00 a.m. involving participation by remote electronic means, Present John Bell, Eleanor Collier, Cameron Inglis, Tom Marshall, Matthew McLean, Ian Murdoch and John Sweeney. Also Present Joe Cullinane, Scott Davidson, Todd Ferguson, Robert Foster, Tony Gurney, Alan Hill, Christina Larsen and Nairn McDonald. In Attendance A. Sutton, Executive Director (Communities and Education); C. McAuley, Head of Service (Economic Development and Regeneration) and L. Kirk, Senior Manager (Regeneration) (Place); M. Boyd, Head of Service (Finance), A. Craig, Head of Service (Democratic), C. Stewart and H. Clancy, Committee Services Officers (Chief Executive’s Service). Chair Councillor Bell in the Chair. Apologies Davina McTiernan and Donald Reid. 1. Declarations of Interest There were no declarations of interest by Members in terms of Standing Order 11 and Section 5 of the Code of Conduct for Councillors. 2. Call-In: Revenue Budget 2021/22: Financial Performance to 31 March 2022 Submitted report by the Chief Executive on a call-in request received in respect of a decision taken by Cabinet on 7 June 2022 on the financial performance of the Council at 31 March 2022. The report to Cabinet, with various appendices, attached at Appendix 1 to the report, contained detailed explanations of the significant variances in service expenditure compared to the approved budgets, together with information on funding to be carried forward to support expenditure during 2022/23, a full list of the proposed carry forward of earmarked funds and information in respect of the Housing Revenue Account (HRA). An updated briefing note had been provided by the Head of Service (Finance) and was attached at Appendix 2 to the report. The Cabinet agreed (a) to note (i) the information and financial performance outlined in the report and its associated appendices, (ii) the transfer of the net in-year underspend of £3.073m to supplement the Investment Fund, (iii) the financial performance of the Health and Social Care Partnership at paragraph 2.7 of the report and (iv) the IJB cumulative deficit position of £2.320m at 31 March 2022; and 10
Page 11
(b) to approve the additional earmarking of £11.833m identified at section 2.5 of the report to meet future year commitments. Subsequently, a call-in request was received from Councillors Foster, McDonald and Cullinane in the following terms:- Reason for Call-In “To provide more support to residents struggling with the cost-of-living crisis.” Desired Outcome “• Remove Contribution to the Loans Fund • Remove Provision for additional non-contractual inflationary pressures (with it to be met by existing unearmarked reserves Reallocate to: • £500,000 pre-payment meter fund to support low-income families on pre-payment meters • £750,000 to reinstate £4 per eligible child per day voucher scheme during the school holidays for the remainder of 2022/23. • Additional £1,000,000 the Community Based Energy Support (check name) for energy- efficiency grants • £300,000 to provide a £50 winter top-up to the school clothing grant in 2022/23 • Additional £200,000 for Cost of the School Day activity win 2022/23 to address the rising cost of living • £641,000 to widen access to the Better Off financial inclusion service.” Prior to consideration of this matter, the Head of Democratic Services summarised the procedure for considering the call-in requests in terms of Standing Orders and referred to the Cabinet decision. Thereafter, the Members who had requested the call-in were invited to speak. Councillor McDonald advised that he would speak to this call - in request along with the two others on the agenda, with Councillors Cullinane and Foster being available to answer any questions, if required. He then addressed the Committee in support of the call-in request. The Chair then invited Councillor Larsen, as the Cabinet Member for Finance, to address the meeting. She explained the reasoning for the Cabinet decision and referred to an updated briefing note from the Head of Service (Finance) provided at Appendix 2 to the report. The Head of Service (Finance) was also heard in relation to the report presented to Cabinet and on issues raised by the call-in, reference being made to the briefing note at Appendix 2. Members asked questions of Councillors McDonald, Larsen and the Head of Service (Finance) and were provided with further information in relation to: • Anticipated inflationary increases, since the Council had set its budget for the current financial year; • Inflation and the cost of living; and 11
Page 12
• The position on Reserves, in view of the anticipated inflationary increase, and potential pressure on budgets. Councillor Marshall, seconded by Councillor Inglis, moved that the Committee agree not to support the call-in request and that the previous decision of Cabinet should stand. As an amendment, Councillor Sweeney, seconded by Councillor Bell, moved to accept the terms of the call-in request. Thereafter, on a division and a roll call vote, there voted for the amendment, Councillors Bell and Sweeney (2) and for the motion, Councillors Collier, Inglis, Marshall, McLean and Murdoch (5), and the motion was declared carried. Accordingly, the Committee agreed not to support the call-in request. 3. Call In: Regeneration Delivery Plan Funding Proposals 2022/23 Submitted report by the Chief Executive on a call-in request received in respect of a decision taken by Cabinet on 7 June 2022 on the Regeneration Delivery Plan Funding Proposals for 2022/23. The report to Cabinet, attached as an Appendix to the report, sought approval for the 2022/23 Regeneration Delivery Plan funding proposals. An updated briefing note had been provided by the Executive Director (Place) and was attached at Appendix 2 to the report. The Cabinet agreed (a) to approve the Regeneration Delivery Plan funding proposals for 2022/23 provided at Appendix 1 to the report; (b) that delegated authority be granted to the Executive Director (Place) to agree changes to the funding allocations in consultation with the Portfolio Lead, as required; and (c) to note the update on the previously agreed Levelling Up Fund (LUF) bid for the ‘Gateway to the West Coast and Clyde Islands strategic regeneration package’ and that this LUF bid would now be solely based on the development of Lochshore. Subsequently, a Call In request was received from Councillors Foster, McDonald and Cullinane in the following terms:- Reason for Call In “To tackle privately owned vacant and derelict sites in North Ayrshire with a fund to bring the sites into council or community ownership.” Desired Outcome “Remove the following from the Placed based projects: Saltcoats Place Framework £70,000 Largs Place Framework £70,000 Kilwinning Place Framework £70,000 Future Years Project Development £40,000 Reduce the following in the VDLF: Development work to £160,000 12
Page 13
Replace with: £410,000 (£250,000 Placed Based and £160,000 VDLF) to create a new High Street Buyout Fund to deliver a Community Wealth Building approach to town centre regeneration, aimed at bringing privately owned derelict sites into Council or community ownership to be repurposed for the benefit of the community. This fund would act as a delivery arm of the Place Frameworks and build on the projects supported through the Repurposing Property Grant with further funding in future years.” Thereafter, the Members who had requested the call-in were invited to speak. Councillor McDonald advised that he would speak to this call-in request, with Councillors Cullinane and Foster being available to answer any questions, if required. He then addressed the Committee in support of the call-in request. The Chair then invited Councillor Gurney, as the Cabinet Member for Economy & Climate Change, to address the meeting. He explained the reasoning for the Cabinet decision and addressed matters raised by the call-in. The Senior Manager (Regeneration) referred to an updated briefing note from the Executive Director (Place), provided at Appendix 2 to the report. Members asked questions of Councillors McDonald, Gurney and the Senior Manager (Regeneration) and were provided with further information in relation to: • The reasons for seeking the change since the budget was agreed in March; • Mechanisms for achieving owners to sell properties; • The number of Compulsory Purchase Orders (CPOs) that had been carried out in North Ayrshire during the last 10-year period; • The strict parameters and requirements that required to be met regarding CPOs to allow them to be progressed in appropriate and specific circumstances • Delivery proposals; and • The qualifying criteria for Vacant and Derelict Land Funding. Councillor Marshall, seconded by Councillor Collier, moved that the Committee agree not to support the call-in request and that the previous decision of Cabinet should stand. As an amendment, Councillor Sweeney, seconded by Councillor Bell, moved to accept the terms of the call-in request. Thereafter, on a division and a roll call vote, there voted for the amendment, Councillors Bell and Sweeney (2) and for the motion, Councillors Collier, Inglis, Marshall, McLean and Murdoch (5), and the motion was declared carried. Accordingly, the Committee agreed not to support the call-in request. 4. Call-In: North Ayrshire Covid Recovery Fund Submitted report by the Chief Executive on a call-in request received in respect of a decision taken by Cabinet on 7 June 2022 on the North Ayrshire Covid Recovery 13
Page 14
Fund. The report to Cabinet, attached at Appendix 1 to the report, sought agreement for the proposed North Ayrshire Economic COVID Recovery Fund Investment Plan. An updated briefing note had been provided by the Executive Director (Place) and was attached at Appendix 2 to the report. The Cabinet agreed to (a) note the Scottish Government’s recently announced Economic Covid Recovery Fund, which would see an allocation of £2.154m for North Ayrshire; and (b) approve the proposed North Ayrshire Economic COVID Recovery Fund Investment Plan Subsequently, a call-in request was received from Councillors Foster, McDonald and Cullinane in the following terms:- Reason for Call In “Given their dominance of the local bus market, the “Public Transport Travel Scheme” is effectively a public subsidy for Stagecoach at a time when they are cutting local services.” Desired Outcome “That we send a very strong public message to Stagecoach that the Council will not accept their cuts to local bus services and therefore the £20,000 for the “Public Transport Travel Scheme” be reallocated to support the North Ayrshire Fairer Food Network.” Thereafter, the Members who had requested the call-in were invited to speak. Councillor McDonald advised that he would speak to this call-in request, with Councillors Cullinane and Foster being available to answer any questions, if required. He then addressed the Committee in support of the call-in request. The Chair then invited Councillor Gurney, as the Cabinet Member for Economy & Climate Change, to address the meeting. He explained the reasoning for the Cabinet decision and addressed matters raised by the call-in. The Head of Service (Economic Development and Regeneration) referred to an updated briefing note from the Executive Director (Place), provided at Appendix 2 to the report. Members asked questions of Councillors McDonald, Gurney and the Head of Service (Economic Development and Regeneration) and were provided with further information in relation to: • The operation of the proposed scheme including identification of recipients and providers; • Other types of support available from third sector organisations including assistance with travel; and • Availability of supplies for foodbanks. Councillor McLean, seconded by Councillor Collier, moved that the Committee agree not to support the call-in request and that the previous decision of Cabinet should stand. 14
Page 15
As an amendment, Councillor Sweeney, seconded by Councillor Bell, moved to accept the terms of the call-in request. Thereafter, on a division and a roll call vote, there voted for the amendment, Councillors Bell and Sweeney (2) and for the motion, Councillors Collier, Marshall, McLean and Murdoch (4), and the motion was declared carried. Due to a technical issue, Councillor Inglis left the meeting prior to the roll call vote taking place. Accordingly, the Committee agreed not to support the call-in request. The meeting ended at 11.25 a.m. 15
Page 16
16
Page 17
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: External Quality Assessment of Internal Audit by West Dunbartonshire Council Purpose: To inform the Committee of the findings of the recent external review of Internal Audit carried out by West Dunbartonshire Council. Recommendation: It is proposed that the Committee: (a) notes the findings and action plan from the review of Internal Audit; (b) notes the positive nature of the assessment; and (c) records its thanks to West Dunbartonshire Council Internal Audit for carrying out the review. 1. Executive Summary 1.1 Internal Audit operates in accordance with the requirements of the 'Public Sector Internal Audit Standards (PSIAS)'. The standards are designed to ensure that common standards and practices are followed across all public sector bodies. 1.2 One requirement of the PSIAS is that the Internal Audit service should undergo an external quality assessment, at least every 5 years. The first assessment was undertaken by Falkirk Council in 2017. 1.3 The second assessment has recently been undertaken by West Dunbartonshire Council Internal Audit and this report presents the key findings and action plan. 2. Background 2.1 The PSIAS was introduced in April 2013 and requires all Internal Audit teams to undergo an external quality assessment at least every 5 years; this can be either a full external assessment or a self-assessment with independent validation. 2.2 The Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) has developed an external review network, where each participating Council Internal Audit team will carry out a review of another authority, and will in turn be reviewed by another, different Council. Agenda Item 3 17
Page 18
2.3 The benefits of joining this network are the opportunity to share good operational practice from elsewhere, both through being reviewed by another Council and by carrying out a review elsewhere, and the absence of any financial cost. 2.4 A review of the Council's Internal Audit team has recently been completed by the Shared Service Manager (Audit & Fraud) from West Dunbartonshire Council and her report is attached in full at Appendix 1. 2.5 The review assessed the compliance of the Council's Internal Audit team with the 14 sections of the PSIAS and notes that the team fully conforms with 13 of the standards and generally conforms with one. Overall the assessor has been able to provide assurance that the Council's Internal Audit team complies with the requirements of the PSIAS. 2.6 The assessment is a very positive one. There are four low priority ‘routine’ actions for implementation which will further improve compliance. The action plan is included within Appendix 1. One action has already been completed. 2.7 The Shared Service Manager (Audit & Fraud) will attend the Audit and Scrutiny Committee to report on her findings. 3. Proposals 3.1 It is proposed that the Audit and Scrutiny Committee: (a) notes the findings and action plan from the review of Internal Audit, (b) notes the positive nature of the assessment, and (c) records its thanks to West Dunbartonshire Council Internal Audit for carrying out the review. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. 18
Page 19
Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 No consultation was required as part of this review. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None. 19
Page 20
June 2022 Page 1 EXTERNAL QUALITY ASSESSMENT 2 OF NORTH AYRSHIRE COUNCIL’S INTERNAL AUDIT JULY 2022 Final Report Recipients: Laura Miller, Senior Manager Audit, Fraud, Safety and Insurance (Chief Audit Executive) 20
Page 21
EXECUTIVE SUMMARY 2 1. INTRODUCTION 1.1 The mandatory Public Sector Internal Audit Standards (PSIAS), published initially in April 2013 and updated most recently in March 2017, apply to all internal audit service providers in the UK public sector, whether in-house, provided via a shared service arrangement or outsourced. To supplement the PSIAS, and provide specific guidance surrounding its application within a local government setting, the Chartered Institute of Public Finance and Accountancy (CIPFA) compiled a Local Government Application Note, which was last updated in 2019. 1.2 The objectives of the PSIAS are to define the nature of internal auditing within the UK public sector; set out basic principles for carrying out internal audit; establish a framework for providing internal audit services, which add value to the organisation, leading to improved organisational processes and operations; establish the basis for the evaluation of internal audit performance and drive improvement planning. 1.3 The PSIAS require the Chief Audit Executive (the Senior Manager, Audit, Fraud, Safety and Insurance in North Ayrshire Council) to develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outwith the organisation, and enable evaluation of the internal audit activity’s (Internal Audit service in North Ayrshire Council) conformance with the PSIAS, including the Mission of Internal Audit, Definition of Internal Auditing and Code of Ethics. In addition, the QAIP should also assess the efficiency and effectiveness of the internal audit activity and identify opportunities for improvement. 1.4 To assist its members to meet the five-yearly external assessment requirement, the Scottish Local Authorities Chief Internal Auditors’ Group (SLACIAG) established a collaborative system of formal peer reviews. This approach not only assists with ensuring that independent assessors, and their teams, have appropriate knowledge and experience of the local government internal audit environment but also removes the financial burden from councils, associated with procuring these services externally. The allocation of assessors / assessment teams to councils participating in the peer review process was undertaken autonomously, ensuring that, amongst other governing principles, local authorities with perceived / known conflicts of interest could not review one another. At the outset, assessors were required to formally declare any interests so that these could be appropriately addressed during the allocation process. West Dunbartonshire Council was selected to carry out the external assessment for North Ayrshire Council. 1.5 To support the peer review process, SLACIAG developed a comprehensive External Quality Assessment (EQA) framework, including an EQA Checklist for Assessing Conformance with the PSIAS and the Local Government Application Note (EQA Checklist) and a key Stakeholder Questionnaire proforma. The external assessment of North Ayrshire Council’s Internal Audit service has been carried out by West Dunbartonshire Council’s Shared Service Manager – Audit & Fraud utilising this framework. 1.6 This report provides a high level summary of requirements for each standard per the PSIAS and CIPFA Local Government Application Note and sets out the findings, conclusions and recommendations from the external assessment, which involved discussions with key members of staff, including the Chief Audit Executive, review of the most recent self-assessment carried out utilising the EQA Checklist and consideration of other relevant supporting documentation / information (Evidence Pack) including working paper files and completed stakeholder questionnaires. A comprehensive list of supporting documentation / information and completed stakeholder questionnaires considered as part of the assessment can be found at appendices B and C respectively. 21
Page 22
June 2022 Page 1 2. OVERALL CONCLUSION 2.1 The overall conclusion of the external assessment is that North Ayrshire Council’s Internal Audit service fully conforms with 13 areas of the Public Sector Internal Audit Standards and generally conforms in relation to one area. There were no areas assessed as partial or non-conformance. A summary of totals is set out in the undernoted table and a full summary of assessment, by assessment area can be found at Appendix A: Fully Conforms Generally Conforms Partially Conforms Does Not Conform TOTALS 13 1 0 0 2.2 The main areas for improvement highlighted in the report are as follows: • The Internal Audit Charter could be enhanced to provide specific reference to the Mission of Internal Audit. • The Chief Audit Executive has recognised the need to improve the documentation of the audit risk assessment process and the overall assurance process. Consideration should also be given to inclusion of the risk factors which have influenced the audit plan in relation to the risk-based audit assurance work in the covering report. • The Chief Audit Executive has recognised the need for referencing audit work to the strategic and service risk registers within the audit programme. • The Chief Audit Executive has recognised the need to include a specific section on exclusions within the audit programme. Consideration should also be given to including exclusions where identified within the draft and final reports to management. 2.3 Full details of the assessment recommendations and management responses can be found in the Action Plan at Appendix D. 3. SECTION A – MISSION OF INTERNAL AUDIT AND CORE PRINCIPLES The PSIAS state that the Mission of Internal Audit articulates what internal audit aspires to accomplish within an organisation, which is ‘to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight’. Taken as a whole, the Core Principles for the Professional Practice of Internal Auditing, as set out in the PSIAS, articulate internal audit effectiveness. For an internal audit function to be considered effective, all Core Principles should be present and operating effectively. Failure to achieve any of the Core Principles would imply that an internal audit activity was not as effective as it could be in achieving the Mission of Internal Audit. 3.1 Evidence obtained from assessing conformance with other standards in the PSIAS has been used, along with specific consideration surrounding the achievement of the Core Principles, to conclude that the Internal Audit service at North Ayrshire Council fully conforms with accomplishing the Mission of Internal Audit as detailed above. 4. SECTION B – DEFINITION OF INTERNAL AUDITING The PSIAS state that internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. 22
Page 23
4 4.1 Evidence obtained from assessing conformance with other standards in the PSIAS has been used to conclude that the Internal Audit service at North Ayrshire Council fully conforms with the definition of Internal Auditing as detailed above. 5. SECTION C – CODE OF ETHICS The PSIAS state that the purpose of the Institute of Internal Auditor’s Code of Ethics is to promote an ethical culture in the profession of internal auditing. A code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about risk management, control and governance. Internal auditors in UK public sector organisations must conform to the Code of Ethics as set out in the PSIAS. If individual internal auditors have membership of another professional body then he or she must also comply with the relevant requirements of that organisation. 5.1 Evidence obtained from assessing conformance with other standards in the PSIAS, in particular the Attribute Standards 1000 – Purpose Authority and Responsibility, 1100 – Independence and Objectivity, 1200 – Proficiency and Due Professional Care and Professional Standards 2000 – Managing the Internal Audit Activity and 2300 – Performing the Engagement, has been used to conclude that North Ayrshire Council’s Internal Audit service fully conforms with the requirement to comply with the Code of Ethics. 6. SECTION D – ATTRIBUTE STANDARDS Attribute Standards apply to organisations and individual internal auditors providing the internal audit services in a local authority. 6.1 1000 - Purpose, Authority, and Responsibility The PSIAS state that the purpose, authority and responsibility of the internal audit activity must be formally defined in an Internal Audit Charter, consistent with the Mission of Internal Audit and the mandatory elements of the International Professional Practices Framework. The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval. The internal audit charter must also: • define the terms ‘board’ and ‘senior management’ for the purposes of internal audit activity; • cover the arrangements for appropriate resourcing; • define the role of internal audit in any fraud-related work; and • describe safeguards to limit impairments of independence or objectivity if internal audit or the chief audit executive undertakes non-audit activities. 6.1.1 North Ayrshire Council’s Internal Audit Charter is periodically reviewed with the most recent review taking place in September 2020. The Internal Audit Charter was approved by the Audit & Scrutiny Committee on 29 September 2020. 6.1.2 The internal self-assessment by the Chief Audit Executive at North Ayrshire Council recognised that the current Internal Audit Charter does not specifically reference the Mission of Internal Audit “To enhance and protect organisational value by providing risk- based and objective assurance, advice and insight”. However, this external assessment considers that this is covered by the detail included at section 2 Responsibilities of Internal Audit of the Internal Audit Charter. 6.1.3 The Chief Audit Executive has already considered, as an enhancement, the inclusion of specific reference to the Mission of Internal Audit when the Internal Audit Charter is next reviewed. 23
Page 24
5 6.1.4 Having considered the findings above, it has been concluded that the Internal Audit service at North Ayrshire Council fully conforms with Standard 1000 on Purpose, Authority and Responsibility. 6.2 1100 - Independence and Objectivity The internal audit activity must be independent and internal auditors must be objective in performing their work. Various aspects of independence and objectivity are covered in this standard as well as 1200, including reporting functional lines of the CAE, the relationship between the CAE and the board and any impairment to individual internal auditors’ objectivity or independence. Reporting and management arrangements must be put in place that preserve the CAE’s independence and objectivity, in particular with regard to the principle that the CAE must be independent of the audited activities. 6.2.1 The Chief Audit Executive reports functionally to the Audit & Scrutiny Committee and administratively to the Head of Finance, who is a member of the Council’s Executive Leadership Team. The Chief Audit Executive has direct and unrestricted access to the Chief Executive and the Chair of the Audit & Scrutiny Committee and this has been confirmed through the Terms of Reference for the Audit & Scrutiny Committee. These reporting/access arrangements are clearly defined in the Internal Audit Charter as are safeguards to limit impairment of independence or objectivity. 6.2.2 In support of organisational independence, the Chief Audit Executive attends Audit & Scrutiny Committee meetings to present all internal audit reports (including, for example, the Internal Audit Charter, Annual Report, Internal Audit Plan and reports / executive summaries from the planned audits) to Elected Members. The reports are all submitted in the Head of Service’s name with the Chief Audit Executive’s information listed as a contact for further information. Through observation of Audit & Scrutiny Committee meetings held via webcast during 2021/22 it was noted that the Chief Audit Executive attends each Audit & Scrutiny Committee and presented all internal audit reports at the meeting. 6.2.3 The Chief Audit Executive has operational responsibility for some activities subject to audit and this is communicated to stakeholders via the Internal Audit Charter which sets out the procedure whereby the Chief Audit Executive is the client and the Team Manager is responsible for the oversight and reporting of the audit work to mitigate any impairments. 6.2.4 All staff within the Internal Audit service are required to complete a register of interests form on an annual basis. 6.2.5 North Ayrshire Council’s Internal Audit service fully conforms with Standard 1100 on Independence and Objectivity. 6.3 1200 - Proficiency and Due Professional Care The CAE must be professionally qualified, suitably experienced and responsible, in accordance with the organisation’s human resources processes, for recruiting appropriate staff. He or she is responsible for ensuring that up-to-date job descriptions exist, reflecting roles and responsibilities, and that person specifications define the required qualifications, competencies, skills, experience and personal attributes. The CAE should periodically assess individual auditors’ skills and competencies against those set out in the relevant job descriptions and person specifications. Any training or development needs identified should be included in an appropriate ongoing development programme that is recorded and regularly reviewed and monitored. In addition, all internal auditors have a personal responsibility to undertake a programme of continuing professional development (CPD) to maintain and develop their competence. This may be fulfilled through requirements set by professional bodies or 24
Page 25
6 through the organisation’s own appraisal and development programme. Auditors should maintain a record of such professional training and development activities. The internal audit activity should be appropriately resourced to meet its objectives. It should have appropriate numbers of staff in terms of grades, qualifications, personal attributes and experience or have access to appropriate resources in order to meet its objectives and to comply with these standards. The PSIAS states that the CAE must obtain competent advice and assistance if the activity is unable to perform all or part of an engagement. 6.3.1 The Chief Audit Executive holds a relevant professional qualification (ACCA) and is suitably experienced, with 14 years internal audit experience within a Scottish local government environment. The Chief Audit Executive is a member of SLACIAG (or otherwise) and regularly attends and contributes to meetings. In relation to the two SLACIAG Sub-groups, the Computer Audit Sub-Group (CASG) and the Scottish Local Authorities Investigators Group (SLAIG), North Ayrshire Council’s Internal Audit service is represented on both. 6.3.2 To support the Chief Audit Executive in North Ayrshire Council’s Internal Audit service, a Team Manager is in place for Internal Audit, a Team Supervisor for Fraud, a Team Manager for Safety, and a Team Manager for Risk & Insurance. There are a total of 18 members of staff in the Internal Audit service, including the Chief Audit Executive, Team Managers/Supervisors. The Internal Audit service delivers internal audit services to North Ayrshire Council and North Ayrshire Integration Joint Board. The team has dedicated IT audit and fraud resources. 6.3.3 The Internal Audit service has an appraisal process “Our Time to Talk” which is a corporate process. This is carried out on an annual basis and in in place for Internal audit staff. 6.3.4 The Internal Audit service is represented on a number of corporate groups, including the Municipalisation Working Group, Chris21 HR/Payroll System Project Board, and the O365 Information and Collaboration Project Board. 6.3.5 The Chief Audit Executive and all members of the Internal Audit service have specific CPD requirements to adhere to. Staff training records are maintained on the corporate HR system. 6.3.6 Throughout 2021-22, Audit & Scrutiny meetings were subject to live webcasting. These webcasts are also available as archive webcasts which were reviewed as part of the external quality assessment where it was observed that the Chief Audit Executive demonstrated sufficient knowledge and experience and that all members of the Internal Audit service had exercised due professional care. 6.3.7 North Ayrshire Council’s Internal Audit service fully conforms with standard 1200 on Proficiency and Due Professional Care. 6.4 1300 - Quality Assurance and Improvement Programme The PSIAS state that the Chief Audit Executive must develop and maintain a quality assurance and improvement programme (QAIP) that covers all aspects of the internal audit activity. The QAIP must include both periodic internal self-assessments and five-yearly external assessments, carried out by a qualified, independent assessor from outside the organisation, and enable evaluation of the internal audit activity’s conformance with the PSIAS, including the Definition of Internal Auditing and Code of Ethics. In addition, the QAIP should also assess the efficiency and effectiveness of the internal audit activity and identify opportunities for improvement. 25
Page 26
7 The public sector requirement in the PSIAS states that results of the QAIP and progress against any improvement plans must be reported in the annual report. 6.4.1 Internal audit reports are reviewed by the Chief Audit Executive prior to issue and working papers are, in general, reviewed by the Chief Audit Executive or Audit Manager. Where the assignment is carried out by the Audit Manager, the Chief Audit Executive will review the working paper file. 6.4.2 Client feedback is actively pursued by the Internal Audit service for assignments carried out within North Ayrshire Council. 6.4.3 A range of performance measures are in place for the Internal Audit service which aligns to balanced scorecard reporting of performance by the Institute of Internal Auditors. These are formally reported to the Audit & Scrutiny Committee on an annual basis as part of the Internal Audit Annual Report. 6.4.4 A formal self-assessment of conformance with the PSIAS was carried out in September 2021, using the EQA Checklist. This was used by West Dunbartonshire Council as the baseline for the external quality assessment in 2022. 6.4.5 North Ayrshire Council’s Internal Audit service fully conforms with Standard 1300 on Quality Assurance and Improvement Programme. 7. SECTION E – PERFORMANCE STANDARDS Performance Standards describe the nature of the internal audit services being provided and provide criteria against which the performance of an internal audit function can be measured. 7.1 2000 - Managing the Internal Audit Activity The chief audit executive must effectively manage the internal audit activity to ensure it adds value to the organisation. The internal audit activity is effectively managed when it achieves the purpose and responsibility included in the internal audit charter, it conforms with the PSIAS, its individual members conform with the Code of Ethics and the PSIAS and it considers trends and emerging issues that could impact the organisation. The internal audit activity adds value to the organisation and its stakeholders when it considers strategies, objectives and risks; strives to offer ways to enhance governance, risk management, and control processes; and objectively provides relevant assurance. 7.1.1 An annual Internal Audit Plan is compiled by the Chief Audit Executive outlining the planned programme of work to be undertaken. The planning process includes consultation with members of the Executive Leadership Team on planned audit areas, a review of strategic and service risk registers, discussions with external audit to minimise duplication and maximise audit coverage for the Council and review of other local authority internal audit plans through wider discussion groups. 7.1.2 The annual Internal Audit Plan is presented to the Audit and Scrutiny Committee for approval. 7.1.3 Progress towards completion of the Internal Audit Plan, and the individual audits contained within it is reported to Audit & Scrutiny Committee as an update to each meeting of the Committee. 7.1.4 The Internal Audit Plan for 2021-22 was presented to the January 2021 meeting of the Audit & Scrutiny Committee and good engagement was observed by the Committee Members in discharging their scrutiny role of the proposed audit coverage. 26
Page 27
8 7.1.5 Through review of the Internal Audit Plan for 2021-22 an area for improvement was identified in relation to including the risk factors which have influenced the scope of the areas subject to risk-based audit assurance work within the covering report. The Chief Audit Executive also recognised that the documentation of audit risk assessment and overall assurance mapping process could be improved. 7.1.6 It is recommended that consideration is given to include the risk factors which have influenced the scope of the risk-based plan within the covering report relating to the Annual Audit Plan. It is also recognised that the Chief Audit Executive plans to improve the documented audit risk assessment and assurance mapping process. 7.1.7 North Ayrshire Council’s Internal Audit service generally conforms with Standard 2000 on Managing the Internal Audit Activity. 7.2 2100 - Nature of Work The internal audit activity must evaluate and contribute to the improvement of the organisation’s governance, risk management, and control processes using a systematic, disciplined, and risk-based approach. Internal audit credibility and value are enhanced when auditors are proactive and their evaluations offer new insights and consider future impact. More specifically, the internal audit activity must assess and make appropriate recommendations to improve the organisation’s governance processes, evaluate the effectiveness and contribute to the improvement of risk management processes and assist the organisation in maintaining effective controls by evaluating their efficiency and effectiveness and promoting continuous improvement. 7.2.1 It was recognised that the Chief Audit Executive plans to enhance the audit planning process by specifically referencing audit work to strategic and service risk registers. 7.2.2 North Ayrshire Council’s Internal Audit fully conforms with Standard 2100 on Nature of Work. 7.3 2200 - Engagement Planning Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing and resource allocations. The plan must consider the organisation’s strategies, objectives and risks relevant to the engagement. The CIPFA Local Government Application note states that for each engagement, a brief should be prepared, discussed and agreed with relevant managers. The brief should establish the objectives, scope and timing for the assignment and its resource and reporting requirements. Audit work should be undertaken using a risk-based audit approach. 7.3.1 A standard methodology is in place for Internal Audit engagement planning which includes an audit programme which sets out the background to the area being audited, the risks, the timing of the audit, the audit resource, the report distribution, the audit test objectives and conclusions reached. 7.3.2 North Ayrshire Council’s Internal Audit service fully conforms with Standard 2200 on Engagement Planning. 7.4 2300 - Performing the Engagement Internal auditors must identify, analyse, evaluate and document sufficient information to achieve the engagement’s objectives. At each stage of the audit, auditors should consider what specific work needs to be conducted and evidence needs to be gathered to achieve the engagement objectives and support an independent and objective audit opinion. Systems should be in place to 27
Page 28
9 ensure that auditors obtain and record, within the working papers, sufficient evidence to support their conclusions, professional judgements and recommendations. Working papers should always be sufficiently complete and detailed to enable an experienced internal auditor with no previous connection with the audit to ascertain what work was performed, re-perform it if necessary and support the conclusions reached. The CAE should also specify how long all audit documentation should be retained, whether held on paper or electronically. All audit work should be subject to an appropriate internal quality review process. Internal auditors must be alert to the possibility of intentional wrongdoing, errors and omissions, poor value for money, failure to comply with management policy and conflicts of interest when performing their individual audits. They must also have sufficient knowledge to identify indicators that fraud or corruption may have been committed. 7.4.1 Internal Audit Manual sets out the procedure in relation to undertaking a planned audit, including preparing working papers and setting up working paper files. In addition, the manual also includes standard procedures in place for dealing with other types of work e.g. advice and consultancy and investigating fraud and irregularity. 7.4.2 Standard working papers are used at each stage of the audit. Templates are referenced within the Internal Audit Manual. 7.4.3 During the course of each audit, regular discussions take place between the team carrying out the assignment and the Chief Audit Executive or Team Manager. This ensures that any significant issues are escalated appropriately and that the audit is on track to be delivered on time and within budget. 7.4.4 All working papers are subject to review by either the Chief Audit Executive or the Audit Manager. This quality control process ensures that the risks and objectives of the assignment have been met and that conclusions are suitably evidenced. 7.4.5 A records retention and disposal schedule is in place for Internal Audit files which sets out the legal basis for retention and the timescales. 7.4.6 North Ayrshire Council’s Internal Audit service fully conforms with Standard 2300 on Performing the Engagement. 7.5 2400 - Communicating Results The basic aims of every internal audit report should be to: • give an opinion on the risk and controls of the area under review, building up to the annual opinion on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control; • prompt management to implement the agreed actions for change leading to improvement in the control environment and performance; and • provide a formal record of points arising from the audit and, where appropriate, of agreements reached with management, together with appropriate timescales. Each report should include the scope and purpose of the audit to help the reader to understand the extent, or limitations, of the assurance(s) provided by the report. During the course of the audit, key issues should be brought to the attention of the relevant manager to enable them to take corrective action and to avoid surprises at the closure stage. Before issuing the final report, the internal auditor should normally discuss the contents with the appropriate levels of management to confirm the factual accuracy, to seek comments and to confirm the agreed management actions. A draft report is useful for this purpose. Recommendations should be prioritised according to risk. The recommendations and the resultant management action plans should be agreed prior to the issue of the final report. Any areas of disagreement between the internal auditor and management that cannot be resolved by discussion should be recorded in the action 28
Page 29
10 plan and the residual risk highlighted. Those weaknesses giving rise to significant risks that are not agreed should be brought to the attention of a more senior level of management and the board. As set out in the PSIAS, the CAE must deliver an annual internal audit opinion and report that can be used by the organisation to inform its annual governance statement. This must include the annual internal audit opinion concluding on the overall adequacy and effectiveness of the organisation’s governance, risk and control framework, a summary of the audit work from which the opinion is derived (including reliance placed on work by other assurance bodies); and a statement of conformance with the PSIAS and the results of the internal audit QAIP. 7.5.1 A standard report template is used for all audit assignments. The report includes background to the area being audited, the objectives and scope of the audit, the findings and agreed actions together with responsible owners and implementation dates. The audit report also sets out the overall opinion on the level of assurance that is being provided. 7.5.2 Draft reports are discussed with the client service to agree factual accuracy as well as allow the client to respond to recommendations with implementation dates and details of responsible officers. 7.5.3 The overall level of assurance for the audit area is included in the overall Internal Audit Annual Report which allows the Chief Audit Executive to provide an overall opinion on the adequacy and effectiveness of the Council’s governance, risk management and control processes for that year. 7.5.4 The Chief Audit Executive through the self-assessment exercise identified that exclusions to the scope of the audit assignment could be more explicit within the audit programme. We would also recommend that any exclusions are also included in the draft and final reports to management. 7.5.5 Through observation of Audit & Scrutiny Committee meetings held via webcasting it was demonstrated that senior management value the work of Internal Audit and are committed to improving the control environment through the implementation of internal audit actions. 7.5.6 North Ayrshire Council’s Internal Audit fully conforms with Standard 2400 on Communicating Results. 7.6 2500 - Monitoring Progress The PSIAS place responsibility for monitoring progress with the CAE to ensure that management actions have been effectively implemented or, if not, that senior management have accepted the risk of not taking action. The CAE must, therefore, implement a follow-up process for ensuring the effective implementation of audit results or ensuring senior management are aware of the consequences of not implementing an action point and are prepared to accept the risk of such consequences occurring. The results of this process should be communicated to the board. The CAE should develop escalation procedures for cases where agreed actions have not been effectively implemented by the date agreed. These procedures should ensure that the risks of not taking action have been understood and accepted at a sufficiently senior management level. The effective involvement of the board in the follow-up process is critical to ensuring that it works. The CAE should consider revising the internal audit opinion in light of findings from the follow-up process. The findings of follow-up reviews should inform the planning of future audit work. 7.6.1 The Internal Audit Manual sets out the process for audit follow up. The completed action plan for each audit is monitored for completion through the Council’s performance 29
Page 30
11 management system Pentana. As part of the quarterly reporting to the Audit & Scrutiny Committee, information is provided on actions which have not been completed within the agreed timescales. Evidence obtained by Internal Audit in relation to audit follow up is retained on the shared drive in accordance with relevant retention and disposal timescales. 7.6.2 Through observation of Audit & Scrutiny Committee meetings held via webcasting, it was demonstrated that there is effective challenge and scrutiny by Elected Members in relation to progress in implementing Internal Audit action plans. 7.6.3 North Ayrshire Council’s Internal Audit service fully conforms with Standard 2500 on Monitoring Progress. 7.7 2600 - Communicating the Acceptance of Risks When the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organisation, they must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, they must communicate the matter to the board. It is not the responsibility of the chief audit executive to resolve the risk. 7.7.1 Management comments are added to each finding and where no action is proposed this is included within the action plan. 7.7.2 Where the Chief Audit Executive determines any risk to be significant, this would be raised with the Chief Executive, S95 Officer and the Chair of the Audit & Scrutiny Committee. 7.7.3 The Internal Audit Annual Report for 2021-22 fully sets out the scope of internal audit responsibilities to provide an opinion on the Council’s governance, risk management and control procedures. The report did not highlight any concerns regarding management’s acceptance of risk which required to be brought to the attention of the Committee. 7.7.4 North Ayrshire Council’s Internal Audit service fully conforms to the Standard on Communicating the Acceptance of Risk. Andi Priestman Shared Service Manager – Audit & Fraud West Dunbartonshire Council July 2022 30
Page 31
12 APPENDIX A – SUMMARY OF ASSESSMENT REF PAGE No. ASSESSMENT AREA Fully Conforms Generally Conforms Partially Conforms Does Not Conform Section A Mission of Internal Audit and Core Principles Section B Definition of Internal Auditing Section C Code of Ethics Section D ATTRIBUTE STANDARDS 1000 Purpose, Authority and Responsibility 1100 Independence and Objectivity 1200 Proficiency and Due Professional Care 1300 Quality Assurance and Improvement Programme Section E PERFORMANCE STANDARDS 2000 Managing the internal Audit Activity 2100 Nature of Work 2200 Engagement Planning 2300 Performing the Engagement 2400 Communicating Results 2500 Monitoring Progress 2600 Communicating the Acceptance of Risks TOTALS 13 1 31
Page 32
13 APPENDIX B – EVIDENCE PACK • North Ayrshire Council PSIAS Self-Assessment 2021-22 • Internal Audit Charter 2020-22 • Financial Regulations December 2020 • Minutes of Audit & Scrutiny Committee September 2020 • Minutes of Audit & Scrutiny Committee • Scheme of Administration June 2021 • Internal Audit Structure Chart • Internal Audit Job Descriptions • Internal Audit Professional Qualifications • Internal Audit Training Records • Internal Audit Annual Reports 2020-21 and 2021-22 • NAC Recruitment Policy • NAC Disciplinary Policy • NAC Performance Appraisal Process • NAC Code of Conduct for Employees • Staff Register of Interests • NAC Information Security Policy • NAC Data Protection Policy • NAC Whistleblowing Policy • NAC Defalcation Procedures • NAC Counter Fraud and Corruption Strategy • Internal Audit Manual 2021/22 • Internal Audit Annual Audit Plan 2021/22 • Mid-Year review of Internal Audit Annual Audit Plan 2021/22 • Budget Monitoring Report example • 6-monthly survey process • EQA 1 • Annual Governance Statement 2020-21 • IJB PAC Minutes June 2021 • Audit Universe • Audit File Checklist • Audit Programme Template • Draft Report Template • File Review Template • Retention Schedule • Audit Actions Follow Up Report 32
Page 33
14 APPENDIX C – STAKEHOLDER QUESTIONNAIRES Due to the ongoing Coronavirus restrictions, stakeholder engagement was considered through reviewing archived webcasting of Audit & Scrutiny Committees meetings held during 2021 to 2022 where it was observed that there is good engagement and challenge and also recognition of the support and value that is added to the organisation by the Internal Audit service by both Elected Members and senior management. 33
Page 34
15 APPENDIX D – ACTION PLAN No. Para Recommendation Management Response Responsible Officer / Agreed Completion Date 1 6.1.3 The Internal Audit Charter should be enhanced to provide specific reference to the “Mission of Internal Audit” at its next review. This will be incorporated into the next iteration of the Internal Audit Charter, which is due for review at the next audit planning round for 2023/24. Laura Miller, CAE 31 March 2023 2 7.1.5 The Chief Audit Executive has recognised the need to improve the documentation of the audit risk assessment process and the overall assurance process. Consideration should also be given to the inclusion of the risk factors which have influenced the audit plan in relation to the risk-based audit assurance work in the covering report. Work commenced to improve the documentation of the risk assessment at the 2022/23 audit planning process. In addition, the overall assurance process was also more fully documented at the time the annual internal audit report and opinion for 2021/22 was produced. Further action will also be taken during the 2023/24 internal audit planning process to document the risk factors which have influenced the audit plan and ensuring these are referenced within the covering report. Laura Miller, CAE 31 March 2023 3 7.2.1 The Chief Audit Executive has recognised the need for referencing audit work to the strategic and service risk registers within the audit planning process. The audit universe was amended for the 2022/23 audit planning process to include reference to the strategic and service risk registers. Laura Miller, CAE Complete 4 7.5.4 The Chief Audit Executive has recognised the need to include a specific section on exclusions within the audit programme. It is recommended that where exclusions are identified that these are also included in the draft and final reports issued to management. Standard templates relating to the audit engagement (the audit programme and the audit report) will be amended to capture the need to document exclusions from the scope of the audit. This will also be reflected in the Audit Manual. Laura Miller, CAE 30 September 2022 Critical Significant Routine 34
Page 35
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Accounts Commission’s Report: Local Government in Scotland: Overview 2022 Purpose: To inform the Audit and Scrutiny Committee of the findings of the recently published report. Recommendation: That the Committee (i) notes the findings of the Accounts Commission report, (ii) notes the recommendation contained therein; and (iii) notes North Ayrshire Council’s current approach in relation to each. 1. Executive Summary 1.1 The Accounts Commission recently published its national report ‘Local Government in Scotland: Overview 2022’. This report reflects on the evolving and long-term nature of the impact of the Covid-19 pandemic, considers the second year of the pandemic, building on last year’s review of the initial response of Councils to the challenges, and assesses the ongoing impact of Covid-19 and Councils’ progress towards recovery and renewal. A link to the full report is attached as follows: Local Government in Scotland 2022 1.2 Throughout the report, the Accounts Commissions has identified a number of key messages in relation to Councils’ response to the pandemic and made recommendations on future actions for Council leadership in relation to “Organising the Council” and “Meeting local needs”. 2. Background 2.1 The Accounts Commission has published a national report, ‘Local Government in Scotland: Overview 2022’, which reflects on the impact of the Covid-19 pandemic and assesses Councils’ progress towards recovery and renewal. 2.2 The Local Government in Scotland: Overview 2022 is based on evidence gathered from a range of local and national audit work carried out throughout the year and includes data and information to the end of February 2022. Agenda Item 4 35
Page 36
2.3 The report identifies a number of key messages in relation to Councils’ response to the pandemic, including: • Councils have had a very difficult year: Alongside the ongoing response to the pandemic, councils have faced challenges in recovering services, dealing with increased demand and backlogs, and meeting community needs and expectations. This has taken place against a backdrop of long-standing pressures such as increased demand from an ageing population and rising poverty. • The challenging context means collaborative leadership is more important than ever: Councils are operating in a difficult and uncertain strategic context and face longer- term financial pressures, a lack of certainty and flexibility over long-term funding, and the prospect of major service reforms. This challenging context needs local government leaders skilled in effective strategic thinking, decision-making and collaborative working, and able to learn lessons from new ways of working. Collaborative leadership is more important than ever as councils work with partners, communities, and citizens to support recovery and improve outcomes. • Pressures on the local government workforce continues: Councils are continuing to experience high absence levels. Impacts on staff wellbeing and skills shortages, particularly in front-line workers, have also been noted. A resilient workforce is critical to the ongoing response to Covid-19 and the recovery of services. Workforce plans will need to be updated, considering lessons learned from new ways of working. Wellbeing support for the workforce must also continue. • The impact of the pandemic and service disruption have been felt most strongly by those already experiencing inequality: Councils have worked hard and adapted to maintain service delivery but not all services are back at pre-pandemic levels so those most in need of support are still being affected. Councils must evaluate these impacts so that recovery and renewal supports those most affected and addresses inequalities. Recovery and renewal should also reflect the wider ambitions of the public service reform agenda. • The early response showed what could be achieved by working closely with communities and the voluntary sector: This momentum may be lost if communities and the voluntary sector are not involved in shaping recovery. Flexible governance and decision-making structures will be needed, as will opportunities for more local participation. • Improvements are needed in data availability, tools and skills to support performance monitoring, strategic decision-making and planning service improvements: Data has been important in guiding the response to the pandemic but there are key areas where a lack of data could hamper recovery, such as unmet needs, service demands and backlogs. Data is a key tool in tackling inequality but there are gaps in equality data, particularly at a local level. 36
Page 37
2.4 The report makes a number of recommendations in relation to Council organisation, including: Recommendation North Ayrshire Council Response Councils together with their partners and communities should revise their strategic plans, including Local Outcomes Improvement Plans to realign priorities and provide a roadmap for recovery and renewal. They should also consider how this contributes to the national recovery strategy set out by the Scottish Government. The 2019-24 Council Plan was approved in June 2019. The Plan describes our vision, mission and priorities and sets out a strategic approach which is focused on making North Ayrshire a fairer and more equal society. Regular Council Plan progress reports are considered by members and include detailed updates on Covid-19 recovery and renewal support activity. The Council Plan aligns with the Local Outcomes Improvement Plan, which sets out how we will work with other public, private and voluntary organisations and groups to achieve our key priorities. Work on the new Council Plan has already started and will include extensive consultation with communities and agencies. The Council’s Administration has identified initial key priorities across Poverty and cost of living, Communities and climate change. Elected members and senior managers need to work together to drive change, make decisions and deliver recovery and renewal. The Council’s strong leadership, which was demonstrated in the collaborative response to Covid-19, has been recognised by our external auditors in their annual audit reports and the Best Value Assurance Report. Recovery and Renewal Investment of £14.744m was approved in June 2021. Councils should consider the leadership skills needed for now and in future. This includes clear succession planning arrangements and a structured programme of induction for new elected members. Our workforce planning approach utilises a variety of tools and techniques, including succession planning and strategic leadership development programmes. A development programme is in place for all Elected Members and a full Member’s induction programme took place during May 2022 for all recently elected Members. 37
Page 38
Councils’ governance arrangements should ensure that their elected members have sufficient information to support the scrutiny and decision-making needed for recovery and renewal. The Council’s Scheme of Administration, Standing Orders Relating to Meetings, Scheme of Delegation and Other Key Governance documents were reviewed and approved by Council in May 2022. The Council also undertakes self- evaluation through toolkits and this has been evidenced through the Audit and Scrutiny Committee. Councils need to clearly set out how they are evaluating new service models and learning lessons from the response to Covid-19. We have developed our Sustainable Change Programme, aligned to the Council priorities and the Council Transformation themes and set within the context of the Council Plan and Community Wealth Building Strategy, with the objective of developing a pipeline of projects that will deliver improved outcomes, meet the Council’s environmental ambitions, and deliver financial efficiencies. Councils should have a clear plan for developing the use of data in their councils, this includes data skills, data standards and data tools. The Council’s Performance Management Strategy 2021-24 outlines how the Council’s performance management supports a culture of continuous improvement in order to achieve the best outcomes for the people of North Ayrshire. Our Annual Performance Reports detail progress against our Council Plan Performance Framework and Delivery Plan. Councils must ensure that financial plans and overarching recovery strategies and actions are clearly aligned, including funding to deliver on their duty to address inequalities. Our Recovery & Renewal Strategy sets out a series of key principles and themes to enable North Ayrshire Council to recover and renew its services in a prioritised way, ensuring they meet resident needs. As part of our Financial Recovery Plan, our Recovery and Renewal Fund identified £14.744m to address economic recovery, environmental initiatives, support for vulnerable families, citizens and communities, sustainable investment on infrastructure and open spaces and investment in mental health and wellbeing. This included a £3m contribution to our Community Investment Fund to support 38
Page 39
recovery and renewal across our communities. Our Economic Recovery and Renewal Approach was agreed in September 2020 to support businesses and social enterprises to rebuild, diversify and become more resilient, green and inclusive. Councils must have clear plans for management of reserves. Our utilisation of reserves, both earmarked and unearmarked are reported to elected members throughout the financial year with an annual review of appropriate reserves levels reported to members as part of the annual budget setting and annual accounts processes. Councils should update their workforce plans to build on lessons learned, address skills gaps and build a resilient workforce for the future. This will include monitoring the wellbeing of the workforce, and the effectiveness of health and wellbeing initiatives. Our workforce planning approach utilises a variety of tools and techniques to ensure our workforce requirements for the future, in terms of skills and capabilities, are planned. Each Head of Service has a workforce plan, and these are monitored six-monthly with continued HR support and guidance to ensure service review and redesign of the workforce is on track. 2.5 The Accounts Commission report also makes several recommendations in relation to “Meeting local needs”, including: Recommendation North Ayrshire Council Response While some progress has been made in improving the use of data in decision- making, councils need to have a clear sense of where increased demand and service backlogs exist so that they can identify areas of high risk and direct resources accordingly. This information also needs to be more transparent and publicly available. Our Annual Performance Reports detail progress against our Council Plan which is supported by 34 performance indicators and 41 actions. More detailed information is provided through half yearly Council Pan Progress reports and our North Ayrshire Performance Dashboard, which is publicly available on our website and includes details of our nationally comparable LGBF indicators. A key priority for councils’ recovery and renewal is assessing the impact of the pandemic and service disruption on the most vulnerable and learning from this to inform how they support those most affected and address inequalities. This Community engagement sessions, carried out to support the development of our annual budget programme, have been used to help shape our Transformation and Renewal programme and will continue to 39
Page 40
will need better local data to improve understanding. influence the structure of current and future service delivery. The North Ayrshire Community Engagement Toolkit/ Hub has been developed to support and promote effective community engagement practice carried out across North Ayrshire by the Community Planning Partnership (CPP), the Health and Social Care Partnership (HSCP), and their respective Locality Partnerships and Locality Forums. Where councils plan to continue with the changes made to services during the pandemic, they need to conduct impact assessments and consult the community. With the expansion of digital services, councils need to assess and mitigate the impacts of digital exclusion. Our Community Learning and Development Plan for 2021-24 was approved in September 2021 and sets out how we will support each of our localities by providing digital learning and career support, address poverty including food insecurity and, by doing so, improve the life chances of our residents. This has been further supported by the allocation of £0.250m of investment to support the recruitment of a Digital Officer to support the digital strategy review following the pandemic. Councils need to ensure that partnership working forged in the pandemic with their communities, partners and the voluntary sector remains in place. They also need to learn what made it work and harness this to transform future engagement. The momentum and energy from communities may be lost if public bodies don’t capitalise on what has been achieved. Throughout our Recovery & Renewal Strategy is the key theme that communities need to be at the heart of what we do. This is an opportunity to build on the strong partnership working already in place with our communities and to continue to actively involve them in the design of new service delivery models. This will be achieved through an increase in the use of participatory approaches, including Participatory Budgeting, and through Design Experiments. Key to the ongoing success in community engagement is through maintaining the locality based community hub support model of approach which has been key in supporting communities. 40
Page 41
3. Proposals 3.1 It is proposed that the Committee (i) notes the findings of the Accounts Commission report, (ii) notes the recommendation contained therein; and (iii) notes North Ayrshire Council’s current approach in relation to each. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 None. Community Wealth Building 4.7 None. 5. Consultation 5.1 No consultation has been required in the preparation of this report Mark Boyd Head of Service (Finance) For further information please contact David Forbes, Senior Manager (Strategic Business Partner), on 01294 324551 or DavidForbes@north-ayrshire.gov.uk. Background Papers Accounts Commission’s Report: Local Government in Scotland: Overview 2021, Audit and Scrutiny Committee, 16 November 2021 41
Page 42
42
Page 43
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Internal Audit Annual Update Report – North Ayrshire Integration Joint Board (IJB) Purpose: To inform the Committee of the IJB’s annual report for 2021/22 and the approved internal audit plan for 2022/23. Recommendation: That the Committee notes the IJB annual report and approved internal audit plan. 1. Executive Summary 1.1 Section 21.7 of the North Ayrshire Integration Joint Board’s Financial Regulations states: “The Integration Joint Board Chief Internal Auditor will submit an annual audit report of the Internal Audit function to the Chief Officer and the Performance and Audit Committee indicating the extent of audit cover achieved and providing a summary of audit activity during the year. As a minimum the annual audit report and Chief Internal Auditor’s opinion will also be reported to the Audit Committees of the NHS Ayrshire & Arran Board and North Ayrshire Council”. 1.2 The remit of the IJB’s Performance and Audit Committee (PAC) includes the review of the overall internal control arrangements of NAIJB. The IJB annual report for 2021/22 and the proposed internal audit plan for 2022/23 were provided to the PAC on 24 June 2022. 1.3 The annual report and audit plan will also be provided for information to the Audit and Risk Committee of NHS Ayrshire and Arran on 23 November 2022. 2. Background Annual Report 2021/22 2.1 The 2021/22 IJB internal audit plan was approved by the PAC in September 2021 and included a review of compliance with the CIPFA financial management code. This audit has been finalised and the findings are reported elsewhere on the agenda for this meeting. Substantial assurance was provided over the arrangements in place, and no areas for improvement were identified during the review. 2.2 The opinion on the control environment of the IJB is also influenced by the audit findings relating to the key systems of North Ayrshire Council and NHS Ayrshire and Agenda Item 5 43
Page 44
Arran and by relevant audit work within service areas that are part of the Health and Social Care Partnership. The annual report on audit work within North Ayrshire Council was presented to the Audit and Scrutiny Committee of the Council on 31 May 2022. The annual report for NHS Ayrshire and Arran was presented to the Audit and Risk Committee of the NHS on 27 June 2022. 2.3 Based on the audit work carried out in the IJB and relevant work carried out in the parent bodies, my opinion is that reasonable assurance can continue to be placed on the adequacy and effectiveness of the IJB’s systems of governance, risk and internal control. Internal Audit Plan 2022/23 2.4 The internal audit plan for 2022/23 was approved by the PAC on 24 June 2022. The IJB has its own audit plan which includes 25 days drawn from the Internal Audit service of North Ayrshire Council and 10 days from NHS Ayrshire and Arran. 2.6 Within the 25 days allocated by North Ayrshire Council, 10 days have been set aside to fulfil the IJB Chief Internal Auditor role; this will include preparing reports for the IJB, attending meetings and providing training and support to members of the IJB Performance and Audit Committee. 2.7 The remaining 15 days were left unallocated, for the approval of the PAC. It was agreed that the 15 days will focus on the IJB’s arrangements towards community engagement. 3. Proposals 3.1 It is proposed that the Committee notes the North Ayrshire Integration Joint Board annual report for 2021/22 and the approved internal audit plan for 2022/23. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 44
Page 45
4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the IJB’s strategic priorities. Community Wealth Building 4.7 None. 5. Consultation 5.1 In preparing the draft IJB audit plan, consultation has taken place with the Director and the Chief Finance and Transformation Officer of the North Ayrshire IJB and with the internal auditors of the East and South Ayrshire Integration Joint Boards. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None. 45
Page 46
46
Page 47
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Strategic Risk Register 2022/23 Purpose: To inform the Committee of the Council’s agreed Strategic Risk Register for 2022/23. Recommendation: That Committee notes the Strategic Risk Register. 1. Executive Summary 1.1 The Strategic Risk Register has been reviewed and updated for 2022/23. 1.2 Six of the eight previous risks remain on the Strategic Risk Register at their existing risk scores and titles – Financial Environment, Inequalities, Cyber Security, Transformation, Climate Change and Community Capacity Building & Empowerment. 1.3 Financial Sustainability of the Health and Social Care Partnership has reduced in risk score from 16 to 12 as a result of further positive corrective actions improving the partnerships financial position. 1.4 A risk relating to the impact of Covid-19 was tabled at Cabinet in March 2020 as the pandemic emerged. This risk has been renamed ‘Operating Environment’ and updated to take account of the challenges of recovery and the uncertain operating environment. 1.5 The Strategic Risk Register was agreed by Cabinet on 7 June 2022. 1.6 It is noted that there are emerging risks associated with the creation of a National Care Service and officers are currently working to incorporate this into the next update to the Strategic Risk Register. 2. Background 2.1 North Ayrshire Council is committed to ensuring that it is proactive in identifying and managing the risks impacting on the authority. The Council recognises that a certain amount of risk is inevitable if the organisation is to achieve its objectives. 2.2 The aim of risk management is to reduce the likelihood and/or impact of risk by identifying and controlling risks to the Council. If risk is to be managed appropriately, and Services are aware of these risks, risk management can contribute positively Agenda Item 6 47
Page 48
towards the organisation's decision-making processes, making the Council more innovative and effective in its approach to service delivery. 2.3 The most significant risks are identified through the Council's Strategic Risk Register (SRR), recognising the challenges facing the Council and demonstrating the arrangements in place to manage these risks. 2.4 The Strategic Risk Register has been reviewed and updated for 2022/23 and is attached at Appendix 1 to this report. For each of the risks detailed within the register a number of components are identified: • Risk proximity factors. • Risk score. • Potential effect on the Council's priorities. • Internal controls currently in place. • Assessment of controls, and • Additional actions identified. 2.5 To assist in the assessment of each risk, the Council’s agreed risk matrix was used to ensure consistency. This is used to assess the likelihood of occurrence (on a scale from 1 to 5) and the significance of the impact of the risk should it occur (on a scale from 1 to 5). The risk score is the product of likelihood multiplied by impact. Only those risks rated as high or very high (10 or above) will feature on the SRR to ensure a focus on managing the most significant risks. 2.6 Six risks remain on the Strategic Risk Register at their existing risk scores – Financial Environment, Inequalities, Cyber Security, Transformation, Climate Change and Community Capacity Building and Empowerment. 2.7 Financial Sustainability of the Health and Social Care Partnership has reduced risk score from 16 to 12 which is a continuous line of improvement following a reduction from 20 to 16 in 2021/22. 2.8 A risk relating to the impact of Covid-19 was tabled at Cabinet in March 2020 as the pandemic emerged and wording subsequently formulated. This risk has now been renamed ‘Operating Environment’ and updated to consider the challenging emerging risks. This considers a number of proximate and relevant risks such as recovery, living with covid, Inflation impacts - cost of living and supply chain/construction inflation. 2.9 Very High Risks • Financial Environment - this risk reflects the ongoing financial challenge faced by the Council. (risk score 20) • Inequalities - this highlights the socio-economic inequalities faced in North Ayrshire. (risk score 20) • Emergent Operating Environment – this risk reflects the challenges the Council and its partners are facing as we move out of a covid control environment requiring agile strategy. (risk score 20) High Risks 48
Page 49
• Cyber Security – this reflects the ongoing risk from external cyber-attack which is being faced by all organisations. (risk score 16) • Transformation - this reflects the wider risks associated with delivering the current Transformation Programme and developing a pipeline of future initiatives. (risk score 16) • Climate Change – this risk has been on the Strategic Risk Register following the declaration by the Council of a Climate Change Emergency during 2019 (risk score 16). • Financial Sustainability of the Health and Social Care Partnership - this reflects the ongoing financial challenges faced by the Partnership and the risk these present to the Council. (risk score 12 – reduced from 16) • Community Capacity Building and Empowerment - this highlights the challenges associated with community empowerment (risk score 12). 2.10 Council Services have identified high level strategic actions within their planning for 2022/23 to help the Council mitigate against its strategic risks. These actions are detailed in summary format in the Risk Management Action Plans following each Risk within Appendix 1. These actions will assist with performance monitoring and reporting on the strategic risks. 2.11 The Council’s Internal Audit Plan 2022/23 was approved at the Audit and Scrutiny Committee on 8 March 2022 and is risk-based with clear links in place between the audit plan and key risks the Council faces. 3. Proposals 3.1 Committee is requested to note the Strategic Risk Register 2022/23. 4. Implications/Socio-economic Duty Financial 4.1 The Council continues to have a robust long- and medium-term financial planning framework. Key strands include development of key transformation themes and the establishment of an Investment Fund that will generate future savings alongside delivery of a number of key Council priorities. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 The risk to the Council is that North Ayrshire residents, and in particular certain groups, will experience increasing levels of poverty and its effects. Current control measures fall into two categories - measures to address the root causes of socio- 49
Page 50
economic inequalities - income through employment or benefits – and mitigation measures to minimise the impacts of poverty. Climate Change and Carbon 4.5 The Council has declared a climate change emergency and has in place an Environmental Sustainability and Climate Change Strategy. Significant work to help mitigate the risk of flooding is included within the Capital Plan. The Council is undertaking an ambitious renewable energy programme. Key Priorities 4.6 A successful risk management framework helps to underpin the delivery of the Council’s strategic priorities in the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 The Strategic Risk Register has been reviewed and updated in consultation with the Executive Leadership Team and the Corporate Risk Management Group and approved by Cabinet. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294-324524. Background Papers None. 50
Page 51
Appendix 1 - Strategic Risk Report 2022/23 Risk Code SRR2223_R01 Risk Title Financial Environment Latest Note Date 20-Feb-2022 Risk Owner Mark Boyd Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact The risk is that the level of funding from Scottish Government to local government will require the Council to take increasingly difficult and challenging decisions, potentially operating with increased levels of risk to ensure service delivery and investment in assets align with available resources. Although the 2022/23 local government settlement represents an increase of 0.90% in core grant funding, this has to continue to be looked at within the context of financial pressures facing the council including pay, contractual and demographic pressures over the short, medium and long term and more recently through the significant inflationary pressures faced by the council. The continuation of single year settlements makes effective medium and long term financial planning challenging. It is recommended that following the settlement and within the wider financial pressure context, the risk score remains unchanged at this time. Any consideration to change this will only occur following a sustained period of annual growth in core revenue funding. The Council is exposed to financial risk as a result of underlying cost pressures within the IJB; more detail on this is set out at risk SRR03. Funding not keeping pace with demand and cost means that there will be a reduction in some service areas potentially resulting in higher risks for service users. Robust monitoring of the Council’s revenue and capital budgets is in place as well as regular reporting of financial performance of the IJB to Cabinet and Audit and Scrutiny. To assist financial planning The Long Term Financial Outlook (LTFO) to 2030/31 was approved at Council on 16 December 2020 - this is the cornerstone of the Council's financial planning in the medium to long term. The Council approved a balanced budget for 2022/23 on 2 March 2022. Further funding of £3.209m was announced by SG on 27 January 2022, taking the settlement to a 0.90% increase from last year. A range of additional finance pressures have been identified including additional national insurance contributions, energy cost inflation, contractual commitments as well as significant construction inflation coming through the capital programme. Based on the outturn position in 2021/22 for the IJB, the annual debt repayment to the Council of £1.497m will again be achieved and it anticipated the debt will reduce from £3.807m to £2.310m at 31 March 2022. This position is further supported by the creation of an unearmarked reserve currently sitting at over £4m. 4 5 Status Risk Score Heat Map Change in Score Approach No change Treat Stable 20 51
Page 52
Strategic Risk Action Plan Date Updated 20-Feb-2022 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Regular financial monitoring of Revenue and Capital Budgets 20 February 2022: Bi-monthly monitoring 31-Mar-2024 Mark Boyd Deliver balanced Budget for 2022/23 20 February 2022: Budget delivered for 2022 02-Mar-2022 Mark Boyd Maintain Financial Governance Arrangements for IJB 20 February 2022: Bi-monthly monitoring. 31-Mar-2024 Mark Boyd Progress dialogue via COSLA with Scottish Government on a range of areas including fair funding, multi-year settlements, reduction in levels of ring-fenced resources, true costs of SG policy areas and financial flexibilities 20 February 2022: Regular engagement through Directors of finance group 31-Mar-2024 Mark Boyd 52
Page 53
Risk Code SRR2223_R02 Risk Title Inequalities Latest Note Date 16-Feb-2022 Risk Owner Audrey Sutton/Caroline Amos Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact North Ayrshire residents, and in particular certain excluded groups, will experience increasing levels of poverty and its effects, as a result both of the economic situation and Covid-19. Health inequality is closely linked to poverty, employment and people's earliest experiences as children, and will increase. The population of North Ayrshire is projected to fall over the next 10 years but there will also be a larger proportion of the population considered dependent (not economically active). The impact on specific risk groups is greatest for our children, young people and families, unemployed people and those in in-work poverty and people exposed to the risks of drug and alcohol addiction. Demand for HSCP and Council Services will increase. As reductions in resources increase, early intervention and prevention activities are at risk, thus increasing the potential for an increase in costly crisis interventions. The local economy will be impacted by reduced spending power by economically inactive residents. Tackling inequalities is a strategic priority of the Community Planning Partnership (CPP), the Council and the HSCP. Current poverty-related controls fall into two categories: measures to address the root causes of socio-economic inequalities – income through employment or benefits – and mitigation measures to minimise the impacts of poverty. A range of strategies are in place: Fair for All, Children’s Services Plan, the Child Poverty Action Plan, Economic Renewal Strategy, Community Wealth Building, the Ayrshire Growth Deal. The HSCP tackles inequalities in areas of economy, health and community. Through the HSCP strategic plan, the Partnership sets out actions to tackle inequality through its Partnership Pledge and across its strategic priorities. The Alcohol and Drug Partnership has a focus on drug and alcohol misuse, with a focus on reducing the numbers of drug related deaths. The ‘Housing First’ programme provides tenancies for the most vulnerable homeless people in North Ayrshire, initially targeting households with addiction and mental health issues on discharge from prison. Through Covid-19 responses a whole system approach is being developed to support residents through a place based model of locality hubs and multi-agency locality working. We continue to progress work to fulfil our commitment in equality of opportunity in employment for all our employees. The Council’s pioneering Community Wealth Building Strategy focuses on five pillars to reduce inequalities and work is well underway on procurement, land and assets and fair employment. 5 4 Status Risk Score Heat Map Change in Score Approach No Change Treat Increasing 20 53
Page 54
Strategic Risk Action Plan Date Updated 11-Feb-2022 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Many of the current controls are in early to medium stages of implementation: Fair for All (ongoing) Children’s Services Plan (new plan) Child Poverty Action Plan (new annual plan) HSCP Strategic Plan (new plan) Economic Renewal Strategy (new strategy) Community Wealth Building (in delivery) Ayrshire Growth Deal (launched and underway) New Ayrshire Regional Economic Strategy under development underpinned by a CWB approach to create an inclusive economy Recovery & Renewal Strategy 11 February 2022: Each of these strategies, taken together, and further developed and implemented, should make a significant contribution to inequalities. Actions are being progressed and remain within the Target date for completion. Commissioning commenced in Feb 22. 31-Mar-2024 Audrey Sutton/Caroline Amos; Caroline Cameron 54
Page 55
Risk Code SRR2223_R03 Risk Title Financial Sustainability of the Health and Social Care Partnership Latest Note Date 08-Feb-2022 Risk Owner Caroline Cameron Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact Uncertainty of future funding against growing demand and demographic pressures. Resources have not kept pace with the demand for and cost of social care services. There remains uncertainty around Covid- related costs and how these ongoing costs will be funded in the longer-term. In earlier years, the HSCP did not manage to contain spend within the delegated budget, but surpluses were achieved in 20- 21 and 21-22. Outstanding debt to the Council is currently £2.321m following repayments 20/21 and 21/22. A further repayment of £1.486m will be made at the end of 22/23. Current Scottish Government proposals to introduce a National Care Service (NCS) by 2026 will significantly impact on the IJB. A consultation on the NCS closed in November 2021 and legislation will be developed by Summer 2022. Significant inflationary pressures across employee pay and contractual costs will increase the financial challenges for the Partnership. Funding levels could result in savings being made that are not in alignment with the strategic plan. This could impact on the future demand levels e.g. reduction in early intervention and prevention means that future demand is increased. Funding levels increase the requirement to transform services at scale and pace. In 2020-21 and 2021-22, the Partnership was in an underspend position. The impact of the National Care Service will become clearer as legislation is progressed. The IJB actively monitors the financial position with regular detailed reporting. Directors of Finance of the Council and Health Board have oversight and regular updates are provided to the Council's Cabinet. There is an integrated approach to managing the totality of NHS and Council resources delegated to the IJB. The Medium-Term Financial Plan for 2022-25 has been presented to the March 2022 IJB. Previous financial settlements have seen both partners meet the Scottish Government settlement conditions with any additional resources passed to the IJB. The IJB had uncommitted reserves of £4.151m (at 01/04/21) and this position is expected to improve at the end of 21/22. It is anticipated that uncommitted reserves will be towards the lower end of the good practice target of 2%-4%. Significant funding has been provided to IJBs for the Covid-19 response, supported by regular financial returns to the Scottish Government. Costs were fully funded in 20/21 and 21/22 and funding was received late in 21/22 which has been carried forward into 22/23 to support ongoing Covid-related costs. The Scottish Government recently announced additional funding for the areas below which support the sustainability of the HSCP: : Enhanced Care at Home capacity : Interim Care : Multi-Disciplinary Teams; and : Mental Health Recovery and Renewal The Partnership has a Transformation Board overseeing the programme of service re-design. 3 4 Status Risk Score Heat Map Change in Score Approach Reduced from 16 to 12 Tolerate Reducing 12 55
Page 56
Strategic Risk Action Plan Date Updated 08-Feb-2022 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Budget Monitoring - Regular budget monitoring reports to IJB are effective. 8 February 2022: No additional actions planned at this time but will keep under review 31-Mar-2024 Caroline Cameron; Paul Doak Corrective Action – Transformation Board is effective 8 February 2022: No additional actions planned at this time but will keep under review. 31-Mar-2024 Caroline Cameron; Paul Doak 56
Page 57
Risk Code SRR2223_R04 Risk Title Cyber Security Latest Note Date 03-Feb-2022 Risk Owner Fiona Walker Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact The potential compromise of business operations or a data breach orchestrated via either digital channels or the IT infrastructure. This can include targeting of the user base. Risk derives from both Council operations and those of its supply chain. The increasing importance of delivering services through digital channels and maximising efficiency through effective and secure use of technology. This includes a growing adoption of cloud-based computing resources which extend processing capabilities, and associated risks, beyond the Council’s network. The ongoing response to the Covid-19 pandemic has resulted in the remote and mobile working by staff as effectively being the normal working practice. This is likely to continue as a hybrid approach becomes the new normal. Such a distributed work force increases the complexity of protecting against cyber and data protection risks. Failure by Services to adopt and comply with strategies, policies and procedures may result in a failure to adequately ensure the desired levels of cyber-security required to maintain and protect council systems and data. There may be a significant impact on the authority through the release of personal and/or sensitive information resulting in a loss of public confidence and significant financial loss incurred through fines and service disruption. A successful cyber-attack (malicious external or internal action) on the Council’s IT environments could also result in significant service disruption, loss of income streams and possible data loss/exposure. Impacts of a cyber-attack could include economic (i.e. inability to collect online payments), societal disruption (i.e. loss of diaries and client appointments), and reputational damage (i.e. loss of public confidence in digital services). It is recognised that it is not possible for any organisation to expect to be completely protected against continually evolving cyber threats. A threat actor with sufficient motivation, resource and capability will be able to compromise the most secure system. The Council takes a sociotechnical approach to reducing risk by continually developing protective measures through technical, organisational and people-focused controls. Technical controls are implemented in areas such as network defences, secure configuration of systems, user authentication, malware protection, and vulnerability management. These are based on best practice and independently tested on an annual basis to confirm their effectiveness in accordance with compliance schemes. The Council maintains a comprehensive set of policies, standards, guidelines, metrics and reporting mechanisms as part of its information security governance structure. A comprehensive training and awareness programme is delivered to nurture a cyber- aware workforce and culture. 4 4 Status Risk Score Heat Map Change in Score Approach No change Treat Stable 16 57
Page 58
Strategic Risk Action Plan Date Updated 03-Feb-2022 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Incident Detection and Response – Recent cyber-attacks on public sector organisations highlight the need for robust incident detection and response procedures and technologies. The current response procedures been shown to be effective based on incidents experienced so far, however detection capabilities will need to be reviewed and improved. 3 February 2022: In progress – Documenting and embedding of specific response procedures has still to be completed. Revised target date of 31st December 2022 taking cognisance of ongoing recruitment process for a replacement cyber security lead. 31-Dec-2022 Fiona Walker 3 February 2022: In progress – A joint procurement of a Managed Security Operations Centre (SOC) service with other local authorities is being taken forward by the Digital Office. The intention is to have this agreed by April 2022 and implemented by the end of 2022. 31-Dec-2022 Fiona Walker 3 February 2022: In progress – The investigation of potential options and quotes is still underway with Aon. The risk assessment is complete and will now be used in discussions to establish whether it is possible to broker for quotes. Revised target date of 31st December 2022 taking cognisance of ongoing recruitment process for a replacement cyber security lead. 31-Dec-2022 Fiona Walker Training and Awareness – The pandemic has impacted on the cyber training programme with the long-term cancellation of all classroom-based training. However, a new online course was launched to compensate for this. 3 February 2022: In progress – Review of effectiveness still to be undertaken. Revised target date of 31st December 2022 taking cognisance of ongoing recruitment process for a replacement cyber security lead. 31-Dec-2022 Fiona Walker 58
Page 59
Risk Code SRR2223_R05 Risk Title Transformation Latest Note Date 20-Feb-2022 Risk Owner Mark Boyd Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact There is an overarching risk that transformation and change management activities, which are core to the future delivery models and long-term financial sustainability of both the Council and Health and Social Care Partnership, fail to deliver. Failure to deliver transformational change will impact on the Council’s financial sustainability, effectiveness of service delivery and delivery of the outcomes set out in the Council Plan 2019-24 and the Local Outcome Improvement Plan (LOIP). Failure to deliver the HSCP Transformation programmes across the Partnership, involving North Ayrshire Council (NAC) and NHS Ayrshire & Arran (NHSAA) services may lead to the identified outcomes not being delivered; resulting in financial instability, reduced performance, deteriorating patient outcomes, and reputational damage within North Ayrshire Health and Social Care Partnership (NAHSCP). Failure to embed cultural transformation activities may lead to difficulties in building future workforce capacity and in ensuring we have an engaged, skilled and knowledgeable workforce to meet service demand. The transformation programme aligns to the Council Plan and is monitored via the Executive Leadership Team (ELT) and the Transformation Board. Workstreams have been developed across Transport and Travel, Accessing our Council, Land and Property, Our Future Working Environment and Sustainable energy. A Benefits Tracking monitoring tool is being developed to ensure financial and wider outcomes, aligned to our Transformation plan, are captured. HSCP have an established Transformation Board to closely monitor progress with plans, regular updates on programme to the IJB and regular meetings with the Chief Executive and S95 Officer to review progress and mitigation plans. IJB will approve budget and Strategic Plan for 2022-23 which will align financial plans with transformational strategic change ambitions. Cultural transformation activities continue to evolve to support the Council’s transformation and improve effectiveness and capability. This includes sharing learning and skills, engagement, design experiments and a whole systems approach to transformation and change. Our workforce planning approach utilises a variety of tools and techniques, such as career development, succession planning, vacancy management, redeployment and early release schemes to ensure our workforce requirements for the future, in terms of skills and capabilities, are planned. Each Head of Service has a workforce plan, and these are monitored six-monthly with continued HR support and guidance to ensure service review and redesign of the workforce is on track. 4 4 Status Risk Score Heat Map Change in Score Approach No change Treat Stable 16 59
Page 60
Strategic Risk Action Plan Date Updated 20-Feb-2022 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Existing project level governance and controls remain effective and are constantly reviewed. 20 February 2022: Transformation has recently moved to the Finance Service and continues to progress existing plans as well as integrating into the service and associated workstreams. Mark Boyd 60
Page 61
Risk Code SRR2122_R06 Risk Title Climate Change Latest Note Date 22-Feb-2022 Risk Owner David Hammond Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact Climate change is expected to continue and worsen in the future if no action is taken, with increases to mean global temperatures, sea level rise and the increasing frequency and severity of weather events such as floods, heatwaves, droughts and storms. More frequent and intense heavy rainfall events increase the risk of soil erosion and flooding. Rises in mean sea level increases risks of coastal erosion, flooding, saltwater intrusion and soil salinisation (risk to agricultural land and freshwater habitats). Severe weather is already affecting public services across Scotland, with operational, reputational, financial and legal consequences. There is also an ongoing impact of severe winter weather including snowfall and freezing temperatures which impact service delivery and the integrity of our roads open space and buildings infrastructure. This shift in weather patterns caused by climate change is also affecting biodiversity across Scotland. Increased frequency of severe weather conditions and flooding events may lead to more instances of damage to Council infrastructure and property, interruptions to service delivery and increased demands on services, often with little notice. Risk to life, transport disruption and pollution to the local environment, as well as impact adversely on the local economy if businesses are unable to operate. Council requirement to provide immediate response and manage the adverse effects of more frequent and severe weather emergency situations, including support to local communities and businesses. The Council is required to comply with the ‘Public Bodies Climate Change Duties’ under the Climate Change (Scotland) Act 2009. These duties require the Council to assess the risks, threats and opportunities associated with climate change and identify actions to increase resilience to climate change. North Ayrshire Council declared a Climate Emergency in June 2019, committing to act on climate change and reduce carbon emissions. In January 2020 the Council approved the target to become net-zero carbon by 2030. The third iteration of the Environmental Sustainability & Climate Change Strategy was approved by Cabinet in May 2021, providing a road map to achieve the net zero carbon emissions by 2030 target. Climate Change Adaptation has been included as a workstream within the new strategy, utilising Adaptation Scotland’s Capability Framework to ensure North Ayrshire takes a strong, proactive approach to adapting to climate change. Officers are participating in the Sustainable Scotland Network’s ‘Adaptation Scotland Benchmarking Group’ to learn and share best practice with other local authorities. The Flood Risk Management Strategy has been developed into a 6-year plan which began in 2016. A second plan, which will follow on, is in development. In addition, actions to mitigate Climate Change risk are held within strategies such as the Core Paths Plan, Outdoor Access Strategy, Local Biodiversity Action Plan, and Weather and Winter Emergencies Plan. Asset management plans are in place which are regularly reviewed for our Roads, Fleet, Housing, Property and Open Spaces. Furthermore, through the Ayrshire Civil Contingencies Team there are emergency planning arrangements in place in the event of severe weather and flooding conditions causing major disruption and damage to the area or to individual communities within it. 4 4 Status Risk Score Heat Map Change in Score Approach No change Treat Stable 16 61
Page 62
Strategic Risk Action Plan Date Updated 22-Feb-2022 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Reducing Carbon Emissions: North Ayrshire Council declared a Climate Emergency in June 2019, committing to act on climate change and reduce carbon emissions. In January 2020 the Council approved the target to become net-zero carbon by 2030. We have seen a reduction in overall carbon emissions in the first half of 2021/2022 from 9,918tCO2 to 9,706 tCO2. Existing controls remain effective and are under review as our response to climate change develops and we progress towards achieving net zero by the 2030 target. 22 February 2022: Continuing the Implementation of the 3rd Environmental Sustainability & Climate Change Strategy, which Includes a Roadmap with actions towards achieving the target. The ESCCS 3 contains workstreams: • Affordable Warmth • Green Economy • Transport and Travel • Natural Environment • Sustainable Operations • Carbon Absorption • Climate Change Adaptation, which follows Adaptation Scotland’s Capability Framework, to build a climate resilient North Ayrshire. Significant progress has been made in 2021/22 and this will be built on in 2022/23. Actions are being progressed and remain within the Target date for completion. 31-Mar-2023 David Hammond The Flood Risk Management Strategy: This has been developed into a multi-year plan which began in 2016. The strategy involves taking a proactive approach to flood protection, using modelling to identify vulnerable assets. Assets will then be protected on a prioritised basis taking financial damages and other impacts such as danger to life and disruption into account. Existing controls remain effective and are under review as our response to climate change develops and we progress towards achieving net zero by 2030 target. 22 February 2022: We will continue the implementation of the flood risk management strategy and develop the next flood risk plans. Adaptation to the impacts of climate change can be seen in the Flood Protection Schemes being developed and delivered in the Upper Garnock Valley and Millport. This is a continuous risk based and cyclical process. 31-02-2024 David Hammond 62
Page 63
Risk Code SRR2122_R07 Risk Title Community Capacity Building and Empowerment Latest Note Date 20-Feb-2022 Risk Owner Rhona Arthur Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact Unrealistic timescales for implementation of aspects of legislation of the Community Empowerment Act (Scotland) 2015, such as Community Asset Transfer. Pressure to support community capacity building and the variation of needs within a reducing workforce. Duplication of effort across HSCP and Locality Partnerships to foster community participation and deliver engagement activities. Complying with the complex consultation legislation in service redesign. Where the risk is not managed effectively the potential benefits of community capacity building and empowerment may be lost. Widening inequality gap between those communities where levels of capacity and engagement with the empowerment agenda are high and those with less social capital where interest remains low, which constrains the ability to influence the planning and delivery service. Any disconnect between the Council’s aspirations, community appetite for increasing ownership of assets and what communities themselves feel able and prepared to commit to can result in community assets reverting back to Council. Accelerating asset transfer risks losing services and facilities. Over-engagement carries disengagement and engagement fatigue. Ongoing commitment to community empowerment and locality partnerships from CPP. Six locality partnerships and alignment with HSCP locality arrangements. Leadership of the CPP Senior Officers’ Group. Enabling approach with community partners and support with third sector interface to build capacity and identify opportunities for growth and sustainability. Reviewed guidance and processes relating to asset transfer, allotment and Community Councils. Participatory budgeting approach local grants, commitment to PB with partners and leading practice in mainstreaming participatory approaches External funding bid help for groups through regular meetings with third sector, funders and funding officers. Membership of The Consultation Institute. Additional investment of £1m for a Community Asset Transfer Start Up Fund, prioritising additional staffing capacity to support CAT in Connected Communities and TACT. 3 4 Status Risk Score Heat Map Change in Score Approach No change Tolerate Stable 12 63
Page 64
Strategic Risk Action Plan Date Updated 20-Feb-2022 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG Implementation of CEA: Existing controls remain effective and are keep under review to monitor the impact of Covid-19. 22 February 2022: Strategic CLD Plan 2021-2024 identifies priorities for capacity building and the programme of community support is addressing needs. New larders and Community Cafes are being supported by the NA Food System. All other actions are being progressed and remain within the Target date for completions. 31-Mar-2024 Rhona Arthur Implementation of CEA: Existing controls remain effective and are keep under review to monitor the impact of Covid-19. 20 February 2022: Action ongoing to test current community priorities with recent consultation on the Local Outcome Improvements Plan. 30-Mar-2022 Rhona Arthur Staff capacity: Existing controls remain effective and are keep under review to monitor the impact of Covid-19. 20 February 2022: Staffing capacity increased with CAT Start Up Fund June 2021. 31-Mar-2024 Rhona Arthur Alignment of engagement: Existing controls remain effective and are adapting to respond to the impact of Covid- 19. 20 February 2022: Actions are being progressed and remain within the Target date for completion. 31-Mar-2024 Rhona Arthur Consultation: Existing controls remain effective and are adapting to respond to the impact of Covid- 19. 20 February 2022: Actions are being progressed and remain within the Target date for completion. 31-Mar-2024 Rhona Arthur 64
Page 65
Risk Code SRR2223_R08 Risk Title Operating Environment Latest Note Date 24-Feb-2022 Risk Owner Mark Boyd Risk Proximity Factors Consequences / Impact Existing Risk Control Measures Likelihood Impact Residual societal impacts from ongoing ‘background’ waves of the pandemic and new strains emerging. As the population mixes again dormant infections such as norovirus outbreaks will rise. There are ongoing and interrelated strategic risks caused or exacerbated by the pandemic ranging from increased technology/cyber risk, financial (multiple impacts), supply chain – particularly ICT and specialist equipment, inequalities to how this affects our transformation ambitions. The war in Ukraine is having indirect costs and affecting market confidence. It is also causing supply chain issues. A significant risk is inflation which is affecting the cost of living and construction projects. Partly accelerated by factors including Brexit and Covid, as well as general inflationary pressures, there is a significant risk of construction cost inflation impacting on capital investment plans, including the Ayrshire Growth Deal. Other factors may increase constriction cost, such as low carbon development solutions. Concurrent’ resilience risks such as Cyber Security and ‘Blackstart’ power resilience risks add a layer of complexity. Delays to key plans, objectives and projects. Consequences from this period including financial loss, backlogs, socioeconomic, health and mental health impacts on our staff and communities. The disruption to proactive work in the community has been detrimental to inequalities, poverty, socio-economic and health workstreams. The impact of construction cost inflation is starting to materialise and project development is requiring to adapt and often descope to this. Largely the issue will be a future issue that will impact on construction projects that do not have a completed build tender process in place to restrict movement of material price. Strategic, tactical and operational response groups formed. Effective internal and external digital communication strategy in place. Established but developing hub model North Ayrshire and Anchor Community Partners. The ’North Ayrshire Food System’ has been developed to ensure enhanced resilience. Ongoing interpretation of guidance, involvement with national and local resilience partners and horizon scanning. Increased work on concurrent resilience risk planning. Refreshing the approach to Business Continuity Management. Redesigning project scope to reduce what can be delivered to meet inflated costs Identification of additional budget to support Business Continuity measures Negotiation with funders to seek either of the above, where applicable. Robust financial planning through the Medium term financial Plan and 10 Year Capital programme to recognise impact of inflation on budgets. 5 4 Status Risk Score Heat Map Change in Score Approach Revised risk Treat Uncertain 20 65
Page 66
Strategic Risk Action Plan Date Updated 24-Feb-2022 Analysis of Effectiveness of Controls Further Action Required Target Date for Completion Officers Responsible Current Status: RAG There is ongoing work to develop business continuity processes and ensure constant horizon scanning for emerging risks. The Capital Programme Asset Group and Ayrshire Growth Deal Governance board will continue to assess this emerging environment. 24 February 22: This risk will be monitored as the Council emerges from covid related controls through the period of increasing inflation and update on relevant actions at mid-year update. - - 66
Page 67
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Internal Audit and Corporate Fraud Action Plans: Quarter 1 update Purpose: To advise the Audit and Scrutiny Committee on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 30 June 2022. Recommendation: That the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 1. Executive Summary 1.1 The CIPFA document 'Audit Committee Principles in Local Authorities in Scotland' highlights that Audit Committees should monitor and review the progress made in implementing audit recommendations. 1.2 Service managers are responsible for ensuring that agreed actions arising from Internal Audit and Corporate Fraud reviews are implemented. This provides assurance that identified control weaknesses have been addressed and are being managed effectively. 1.3 All actions are monitored on the Pentana system and service managers are responsible for updating Pentana as they progress each action. This enables Internal Audit to monitor progress on a 'real-time' basis and address any delays in implementation. 1.4 This report details the position at 30 June 2022. 2. Background 2.1 The last report to the Audit and Scrutiny Committee on 31 May 2022 highlighted that there were 18 actions outstanding at the end of March 2022: five that had not been started or were only partially implemented and 13 where the due date had not yet passed. Agenda Item 7 67
Page 68
2.2 In addition to these 18 carried forward actions, there have been 22 new actions agreed, giving a total of 40 action points for review. 2.3 Services have completed 12 actions since the last report. All Council Services are required to retain evidence of work carried out in completing their actions and Internal Audit carries out 'spot-checks' on a sample of completed actions on an ongoing basis. 2.4 Of the remaining 28 actions, nine were either not started or only partially complete at 30 June 2022 and the remaining 19 were not due for completion until after that date. 2.5 Appendix 1 to this report provides the Committee with full details of seven of the actions that were not complete within the agreed timescales. In terms of Section 50 (A) 4 of the Local Government (Scotland) Act 1973, two of the outstanding action points are exempted from public inspection, on the grounds indicated in terms of Paragraph 1 of Part 1 of Schedule 7A of the Act. 3. Proposals 3.1 It is proposed that the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The effective implementation of agreed Internal Audit and Corporate Fraud actions helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. 68
Page 69
Community Wealth Building 4.7 None. 5. Consultation 5.1 Council Services are consulted during the completion of each Internal Audit and Corporate Fraud review and have also provided updates on progress made in implementing action points. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None. 69
Page 70
Actions due by 30th June but not started or partially complete Code IA2017PA020b Description Data protection information awareness for schools training should be agreed and implemented as soon as possible. Priority 1 Latest Note A data protection talk for Garnock Academy has been arranged for 22nd November so the action will be complete then, as all other schools have completed this training. Progress Bar Original Due Date 01-Jun-2018 Due Date 30-Apr-2022 Parent Code & Title IA2017PA020 Email Controls In Education Managed By Andrew McClelland Assigned To Rosslyn Lee Code IA2021PA009a Description Audit Action: The admin team should ensure that all areas of this process are documented in standard operating procedures and issued to all relevant members of the team. Audit Finding: The admin team are currently working on standard operating procedures to cover the full process for Council tenants and those completed during the audit were provided to the auditor for review. Risk: Inconsistent approach by staff, possible key tasks not being carried out and lack of business continuity if staff familiar with the process are not available. Priority 2 Latest Note The team are continually working with the Transformation team to streamline our processes and use systems to produce reports for information rather than spreadsheets. Our standing operating procedures will continually be updated to reflect any changes that are made. Proposed new end date 30th September 2022. Progress Bar Original Due Date 31-Dec-2021 Due Date 30-Jun-2022 Parent Code & Title IA2021PA009 Aids and Adaptations Managed By David Thomson 70
Page 71
Assigned To Lynn Kirkland Code IA2021PA009b Description Audit Action: The team should liaise with the Transformation team to streamline this part of the process and reduce the number of times the same information must be keyed. Audit Finding: The admin team are required to update the budget monitoring spreadsheet, an operational access database and the CareFirst system at each stage of this process for all council tenant jobs. In addition, the access database is not supported by IT Services. Risk: Inefficient use of staff time and increased risk of keying errors. Priority 2 Latest Note This is currently ongoing with the Transformation team and also with the work that is being done at the moment with the new Eclipse system we are hoping that when developing the system for Comm OT and adaptations that we will be capture the data on this system to produce scheduled Business Object Reports. This will be ongoing with the transformation team until the end of the year. Progress Bar Original Due Date 31-Dec-2021 Due Date 06-Jun-2022 Parent Code & Title IA2021PA009 Aids and Adaptations Managed By David Thomson Assigned To Lynn Kirkland 71
Page 72
Code IA2021PA013b Description Audit Action Building Services should progress with the interface between the URM system and Integra to prevent double keying. Audit Finding There has been no progress made in an invoice interface between the URM system and Integra. As a result, Building Services staff are having to double key invoices. Risk Increased risk of keying errors and inefficient use of staff time. Priority 3 Latest Note In order to implement the Creditors interface some work had to be undertaken on the general ledger. This work was complete in December 2021 and involved a mapping exercise to ensure ROCC’s financial coding was in line with the Councils Integra system, this involved removing the translation table that changed the old financial codes to the current codes that are in use. Following this there was some discussions re the best route to take to remove any duplicate keying and the options reviewed were a creditors interface, e-invoicing or both. It has been decided that introducing the creditors interface would be the preferred option initially. IT suppliers have been contacted and a cross service working group has been set up to progress this action, with supplier forms received and a mapping exercise across systems to match suppliers due to commence. The new date for this action is January 2023 and is reliant on external suppliers meeting our deadlines. Progress Bar Original Due Date 31-Dec-2021 Due Date 31-Dec-2021 Parent Code & Title IA2021PA013 Building Services Systems Managed By Yvonne Baulk Assigned To Leigh-Ann Mitchell; Jim Smith 72
Page 73
Code IA2022PA019b Description Audit Action: A minimum technical standard for CCTV systems should be set for the Council. A Council-wide audit of CCTV inventory should be carried out to assess compliance of CCTV assets against the standards, which will give an indication of the level of capital investment required to bring the Council’s CCTV systems up to an appropriate standard and form the basis of a bid for capital. An approval process should be introduced to ensure new CCTV purchases meet the requirements of the standards. Audit Finding: Audit were advised that there are various capital budgets in place covering vehicles and property lifecycle investment. However, there is no formal replacement programme for CCTV equipment. Risk: Substandard systems that aren’t fit for the intended purpose. CCTV footage is not available or not usable when required. Priority 2 Latest Note The CCTV Asset Register is in the process of finalisation and all CCTV assets have been identified. A process is being undertaken to review these assets including undertaking Data Protection Impact Assessments. These will come for review and services have been advised to get those to the Information Governance team by 31st August. This will help to inform whether the CCTV asset is still required, its age and condition and whether it meets acceptable technical standards. If the asset is no longer required, it will be decommissioned in accordance with identified processes. If upgrading is required, a process has been embedded into the corporate CCTV policy for agreeing upgrades. The anticipated completion date is 31st December 2022. Progress Bar Original Due Date 30-Jun-2022 Due Date 30-Jun-2022 Parent Code & Title IA2022PA019 CCTV in Council Buildings and Vehicles Managed By Aileen Craig Assigned To Lorraine Barr; Mark Boyd; Russell McCutcheon 73
Page 74
Code IA2022PA027a(1) Description Audit Action: Written procedures on the calculation of PIs should be produced. Audit Finding: There are no written procedures detailing the methodology for the calculation of PI CP_12. Risk: Inaccurate and/or inconsistent PI figures being published due to errors in calculations; business continuity implications Priority 1 Latest Note We have identified an alternative means of collecting information to support this PI which would be relevant to service activity and meet requirements as regards accuracy/consistency of reporting. There is still some work to be done to confirm this as the best route forward, and create relevant written procedures to support it, which we hope to have complete by end of September 2022. Progress Bar Original Due Date 30-Jun-2022 Due Date 30-Jun-2022 Parent Code & Title IA2022PA027 Performance Indicators Managed By Thelma Bowers Assigned To Dominic Jarrett 74
Page 75
Code IA2022PA027b Description Audit Action: HSCP to identify more useful PIs to be considered for inclusion in the upcoming Council Plan update. Audit Finding: The current PI [PI CP_12] might not provide the most useful information to the public and Council Officers. Risk: The public and managers are missing out on more useful information due to the current PIs. Priority 2 Latest Note The Learning Disability Service has been exploring a range of possible indicators as part of its ongoing development of Trindlemoss and other aspects of the service, as well as considering other developments due to come on-stream later this year (primarily the establishment of a new Intensive Support Team). Our consideration of Performance Indicators is being informed by our ongoing involvement in a learning collaborative with Healthcare Improvement Scotland; we have also linked with Healthcare Improvement Scotland around their promotion of Human Learning Systems, and the new perspectives on measuring outcomes/performance which this encourages. We hope to have established a relevant range of indicators by end October 2022. Progress Bar Original Due Date 30-Jun-2022 Due Date 30-Jun-2022 Parent Code & Title IA2022PA027 Performance Indicators Managed By Thelma Bowers Assigned To Dominic Jarrett 75
Page 76
76
Page 77
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Internal Audit Plan 2022/23: Mid-year Update Purpose: To provide an update on progress made in delivering the 2022/23 Internal Audit Plan. Recommendation: That the Committee (a) notes the current position, (b) approves the inclusion of two additional audit reviews in 2022/23, and (c) approves the deferral of five audits for consideration as part of the 2023/24 internal audit plan. 1. Executive Summary 1.1 The current Internal Audit Plan, covering the period April 2022 to March 2023, was approved by the Audit and Scrutiny Committee in March 2022. The plan sets out the areas of work which Internal Audit intends to cover during the year. 1.2 The Public Sector Internal Audit Standards recognise that it is good practice to regularly review and adjust the plan, as necessary, in response to changes in the organisation’s business, risks, operations, programmes, systems and controls. 1.3 Some amendments are proposed to the internal audit plan for 2022/23 and these are detailed within this report and Appendix 1. 2. Background 2.1 Appendix 1 to this report is the approved audit plan for 2022/2023. For each audit, additional information has been provided to show the actual activity to 30 June 2022 and for competed audits, dates when the final report was published and reported to the Audit and Scrutiny Committee. 2.2 Twelve reports have been published in 2022/2023 to date; 11 of these were from the 2021/22 plan and one completed from the current year plan. 2.3 In line with good practice, the plan should be reviewed during the year in light of experience gained from audit work carried out, emerging risks to the Council and the changing environment in which audit work is carried out. 2.4 In May 2022, CIPFA published their “internal audit: untapped potential” report highlighting the vital role that internal audit has to play in supporting public sector Agenda Item 8 77
Page 78
organisations to achieve their goals. The revisions to this audit plan, and the planning for 2023/24, will take into account this publication and its recommendations for coverage in the coming years, while also balancing this with the specific risks emerging for the Council. 2.5 A significant priority in the coming three years will be an increased audit coverage of cyber security arrangements. There is technical knowledge required to meet this need and the Council is fortunate to have that expertise in-house through a dedicated Computer Auditor. 2.6 With Committee approval, the following additional audits are proposed for inclusion in the 2022/23 plan: • ICT supplier management, with focus on the Scottish Government’s cyber resilience framework. Two existing ICT audits will remain in the audit plan as originally planned but will also focus on the cyber resilience framework for the scope of work – ICT assets and ICT network controls. • ASN provision – during the consultation process for the mid-year review, the service highlighted a risk around their budget monitoring arrangements for ASN provision which are highly complex and internal audit could add value by reviewing current processes and identifying potential areas for improvement. 2.7 With Committee approval, and in order to align audit days with available resources, the following audits will be deferred for consideration as part of the 2023/24 plan: • Transformation – due to the timing of the Recovery & Renewal Team disbanding and responsibilities transferring to Finance and Place, it is considered reasonable to allow for arrangements to be developed and working groups sufficiently established prior to an audit review commencing. Given the recent best value review carried out by external audit, this is considered to be a low risk decision. • Risk management – as above, due to the timing of the Recovery & Renewal Team disbanding and responsibility for risk management transferring to Finance, it is considered reasonable to allow time for all risk management processes to be brought up to date prior to an audit review. • Social care clients financial assessments – a recent audit assignment on care home admissions (which is currently at draft report stage) included a review of residential financial assessments and therefore there is no requirement to duplicate this work. • Locality Planning/CPP – the service is currently working on a number of areas within this category and audit work at this time may not be helpful. Further work will be required to map out risks and auditable areas to identify where internal audit can add the most value. • Residential Placements – while a previous audit review in this area identified some areas with limited assurance, it is acknowledged that this area was last reviewed in 2019/20 and due to resource constraints can be deferred while still being covered again in a reasonable timeframe. 2.8 Due to limited resource and capacity within the team to accommodate any additional reviews, further amendments will need to be considered within the context of available resources. 78
Page 79
3. Proposals 3.1 It is proposed that the Committee (a) notes the current position, (b) approves the inclusion of two additional audit reviews in 2022/23, and (b) approves the deferral of five audits for consideration as part of the 2023/24 internal audit plan. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment. Services have also been consulted on the proposed changes to the internal audit plan. Mark Boyd Head of Service (Finance) 79
Page 80
For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None. 80
Page 81
NORTH AYRSHIRE COUNCIL INTERNAL AUDIT PLAN 2022-23 PROGRESS REPORT at Quarter 1 PRODUCTIVE TIME - AUDIT PLAN Key Corporate Systems Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny Income collection Carry out a review of the controls within the new Civica Pay income collection system. 20 0 20 20 Scheduled Q4 Employee Services - HR/Payroll system and processes Review a range of controls relating to the CHRIS21 payroll system. 30 0 30 30 Scheduled Q3 TOTAL AUDIT DAYS 50 0 50 50 Other Systems Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny Museums and Heritage Review the effectiveness of a range of controls within the Museums and Heritage service. 15 0 15 15 Scheduled Q3 Early years provision Review the service arrangements for payments to private nurseries 15 0 15 15 Scheduled Q3 Glow Review the Council's compliance with Education Scotland Guidance on the use of Glow 15 0 15 15 Scheduled Q4 ASN provision Review the budget monitoring arrangements in place for managing the ASN provision 0 0 0 15 Proposed adding to the plan and schedule Q4 Agency staff and workers Examine the Council's use of agency staff and workers. 15 17 -2 17 Complete 02/08/2022 13/09/2022 Transformation Review the Council's approach to transformation and its progress with best value 20 0 20 0 Propose to defer for consideration in 23/24 Residential placements (HSCP/Education) Review the use of placements within other authorities, residential schools or private educational establishments. 15 0 15 0 Propose to defer for consideration in 23/24 Social Services Clients - financial assessments Consider the financial assessment process carried out for Health and Social Care Partnership clients by the Finance team. 15 0 15 0 Propose to defer for consideration in 24/25 Integration Joint Board audit days Carry out audit work as agreed by the Performance and Audit Committee of the Integration Joint Board. 15 0 15 15 Scheduled Q4 Roads - stores control Examine the controls within the Roads materials store. 15 0 15 15 Scheduled Q2 Transport - Journeys and Hires Review controls in the Transport Hub in relation to transportation, with a particular focus on the use of taxis. 15 4 11 15 Work in progress Building Services - procurement (inc. sub-conts and materials) Review controls around procurement within Building Services. 15 8 7 15 Work in progress Facilities Management - Procurement Review controls around procurement within Facilities Management. 15 0 15 15 Scheduled Q2 Scottish Housing Regulator Review the governance arrangements around the Annual Assurance Statement 15 1 14 15 Scheduled Q2 PMI - commercial and industrial rents Review the governance arrangements and processes around commercial and industrial property rentals. 20 0 20 20 Scheduled Q2 TOTAL AUDIT DAYS 220 30 190 187 81
Page 82
ICT Auditing Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny ICT network controls Review a range of controls within the corporate network 20 3 17 20 Work in progress ICT assets Review controls over a range of ICT assets. 20 0 20 20 Scheduled Q3 ICT supplier management Review controls over ICT supplier management 0 0 0 20 Proposed adding to the plan and schedule Q4 TOTAL AUDIT DAYS 40 3 37 60 Governance Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny Risk management Review the Council's approach to risk management and risk control 15 0 15 0 Propose to defer for consideration in 23/24 HR - Workforce Planning (inc. VER/VR schemes) Review the Council's workforce planning arrangements. 15 0 15 15 Scheduled Q4 Gifts and hospitality Examine compliance with the Council's guidance on Gifts and Hospitality within the Employee Code of Conduct. 10 0 10 10 Work in progress Locality Planning/CPP Review the Council's approach to locality planning 15 0 15 0 Propose to defer for consideration in 23/24 TOTAL AUDIT DAYS 55 0 55 25 Regularity Audits Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Final Report issued Report to Audit and Scrutiny Accounts Payable transaction testing Use data analysis software to interrogate the HR/Payroll system and examine any anomolies which arise. 15 1 14 15 Work in progress Payroll transaction testing Use data analysis software to interrogate the Accounts Payable system and examine any anomolies which arise. 15 5 10 15 Work in progress Primary Schools (incl ASN School) Review financial controls within the Council's primary and ASN schools using self-assessment audit questionnaires and investigate any concerns which arise. 30 0 30 30 Scheduled Q3 Social Care establishments Review financial and other controls within a range of operational establishments managed by the Health and Social Care Partnership. 20 0 20 20 Scheduled Q2 TOTAL AUDIT DAYS 80 6 74 80 Following the Public Pound Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Community Councils Annual audit of Community Councils accounts' to ensure Council funding is used in accordance with the Council's Scheme of Administration. 10 4 6 10 As required. Tenants and Residents Associations Annual audit of the accounts of various Tenants and Residents Associations. 2 0 2 2 As required. TOTAL AUDIT DAYS 12 4 8 12 82
Page 83
Other Work Audit Objective Planned Audit Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Prior year audit work Completing audits from the previous year's audit plan that were not fully complete by the end of March 2017 or starting audits early from the 2018/19 audit plan. 20 62 -42 62 As required. Audit consultancy: ad-hoc advice Providing advice to council services in response to ad-hoc queries 10 3 7 10 As required. Audit consultancy: project work Participating in project work to support developments in other council services. 25 3 22 25 As required. Follow-up Follow up of previous audit reports to ensure that appropriate action has been taken. 15 3 12 18 As required. Audit planning and monitoring Preparing audit plans and monitoring progress and performance against plans. 20 7 13 20 As required. Audit and Scrutiny Committee Supporting the Council's Audit and Scrutiny Committee by preparing reports, attending meetings and delivering training for elected members as required. 25 10 15 25 As required. Governance documents Review of governance documents 2 1 1 2 As required. Development of the Audit service Carry out developmental work to further enhance the efficiency of the audit section. 5 0 5 5 As required. Internal Audit self-assessment against PSIAS Undertake a quality assurance programme for Internal Audit in line with the requirements of the Public Sector Internal Audit Standards (PSIAS). 2 0 2 0 As required. Internal Audit EQA (assess or being assessed) Participate in the Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) review network for the external quality assessment programme. 10 0 10 10 As required. Grant claims Certification of expenditure funded by specific grants from external funding bodies 2 0 2 2 As required. Annual Accounts Work in relation to the Council's annual accounts, including stock counts, reviewing imprests and preparing the Annual Governance Statement. 2 1 1 2 As required. TOTAL AUDIT DAYS 138 90 48 181 TOTAL PRODUCTIVE TIME - AUDIT PLAN 595 133 462 595 PRODUCTIVE TIME - CONTINGENCIES AND INVESTIGATIONS Contingencies & Investigations Audit Objective Days Actual Days @ 30/06/22 Variance Fav / (Adv) Proposed revised plan Current Progress @ 30/06/22 Non-Fraud Investigations 20 10 10 20 As required. TOTAL AUDIT PLAN 2022-23 615 143 472 615 83
Page 84
84
Page 85
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed between May and August 2022. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission and consideration of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed between March and April 2022. Internal control reviews have been completed in respect of the areas detailed in Appendix 1 to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix 1 includes the report and action plan from each audit. 2.3 The findings from eight separate audit assignments are detailed at Appendix 1 to this report and the levels of assurance for each are noted in the table below: Agenda Item 9 85
Page 86
Audit Title Assurance Level IJB Compliance with the CIPFA Financial Management Code Substantial Accounts Payable Transaction Testing Q4 Reasonable Leavers & Movers Processes Reasonable Social Media Substantial VAT Reasonable Off-Payroll Working (IR35) Substantial/Limited CM2000 Substantial Funding Support to Businesses Reasonable 2.4 The key findings are as follows: • In respect of off-payroll working (IR35), substantial assurance was obtained around the Employee Services’ provision of procedures and guidance to Council Services. Information and support is available to Services and reliance is placed on Services making use of these resources. Limited assurance was obtained with regard to the application of IR35 within Services. It is noted that Building Services were able to demonstrate some consideration and application of IR35 in 2021/22. 3. Proposals 3.1 It is proposed that the Committee considers the outcomes from the Internal Audit work completed between May and August 2022. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 86
Page 87
4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None. 87
Page 88
IJB COMPLIANCE WITH CIPFA FINANCIAL MANAGEMENT CODE 1 Background 1.1 The CIPFA Financial Management Code (the FM Code) was published in October 2019. It applies to IJBs in Scotland as well as Local Government Bodies in Scotland, England, Wales and Northern Ireland. The purpose of the FM Code is to “support good practice in financial management and to assist local authorities [including IJBs] in demonstrating their financial sustainability.” The FM Code consists of 17 standards presented across 7 thematic sections. 1.2 Lasts year’s IJB audit related to Governance and is taken to largely cover sections 2 (Governance and Financial Management Style) and 5 (Stakeholder Engagement and Business Cases) of the Code. It is expected that the work of the IJB’s External Auditor will cover section 7 (External Financial Reporting) of the Code. The IJB does not have a capital programme, so Standard H is not relevant to the organisation. 1.3 The FM Code states that the “Leadership Team includes Executive Committees…and other Key Committees of the Authority and Senior Officers”, therefore in applying it to North Ayrshire IJB, it is taken to mean the IJB and senior officers. 2 Objectives and Scope 2.1 The audit tested the IJB’s compliance with the following sections of the FM Code: • Section 1 The Responsibilities of the Chief Finance Officer and Leadership Team • Section 3 Medium to Long-Term Financial Management (excluding Standard H) • Section 4 The Annual Budget • Section 6 Performance Monitoring 2.2 The main objectives of the audit were to ensure that: • the Chief Finance Officer and Leadership Team are fulfilling their Financial Management responsibilities. • the IJB has adequate arrangements in place to plan its finances in the medium to long term. • the IJB has adequate arrangements in place to set a sustainable and robust annual budget. • the IJB has adequate arrangements in place to monitor its financial performance. 3 Findings Responsibilities of the Chief Finance Officer and Leadership Team 3.1 The IJB ensures it is obtaining value for money through its budget setting and budget monitoring processes. North Ayrshire Council and NHS Ayrshire and Arran both have procurement strategies to ensure that they are obtaining value for money. The IJB also receives assurance on value for money from the work of internal and external audit. 88
Page 89
3.2 The Chief Finance Officer was found to comply with the CIPFA Statement on the Role of the Chief Financial Officer in Local Government. This statement covers: • role in the Leadership Team • involvement in business decisions • promotion of good financial management • finance function • qualifications and experience Medium to Long-Term Financial Management 3.3 The Annual Budget 2022-23 and Medium Term Financial Outlook 2022-25 (MTFO) were approved by the IJB in March 2022. They consider financial risks to the IJB and the MTFO considers a variety of funding and cost pressures and risks, with different possible scenarios and sensitivity analysis. 3.4 The Budget and MTFO consider the IJB’s prospects for financial sustainability and although they focus on the next 3 years, they consider factors affecting the IJB’s financial position further into the future, such as government proposals covering the term of the Scottish Parliament and demographic changes. 3.5 The MTFO constitutes a rolling multi-year medium-term financial plan. The Budget gives more detail for the 1st year of this 3-year period, where funding is known with more certainty. The MTFO links into the IJB’s 10-year Strategy to ensure that the resources are targeted towards strategic priorities. The Annual Budget 3.6 The IJB’s Integration Scheme is approved by Scottish Ministers and lays out how the IJB will set an annual budget for the resources provided by the partner organisations. The IJB has set a balanced budget for 2022-23 to fulfil this requirement. 3.7 In the Budget papers, the Chief Finance Officer states that “The estimates are based on a robust understanding of the additional resources available, the risks and challenges faced by the Partnership and the anticipated budget pressures.” The resources, risks, challenges and budget pressures are described in more detail throughout the report. 3.8 With regard to the adequacy of reserves, the paper states that the optimum value of reserves held uncommitted in contingency is 2-4% of net expenditure, and that the estimated value is 2.2%, therefore at the lower end of the target. Furthermore, one of the anticipated outcomes of the budget is listed as “The level of free general fund reserves and earmarked resources for service investment provides confidence re the financial sustainability of the IJB.” Monitoring Financial Performance 3.9 The IJB receives regular budget monitoring reports which highlight key risks and actions being taken to monitor and mitigate them. The Strategic Risk Register identifies Financial Sustainability as a strategic risk for the IJB, and several other strategic risks which have the potential to impact the IJB’s budget strategy and 89
Page 90
financial sustainability. The most recent review of the Strategic Risk Register was approved by the IJB in March and identifies existing and new mitigating actions for these risks. The Strategic Risk Register is reviewed annually as a minimum. 3.10 As at the Annual Accounts 2020/21, the only balance sheet items for the IJB were short term debtors, long term creditors and Usable Reserve: General Fund. The debtor balances represent the value of reserves held by partners supporting the earmarked element of the General Fund balance. The creditor relates to an outstanding debt to North Ayrshire Council which the IJB has been paying back in stages over a number of years. The budget monitoring reports include consideration of the position in relation to reserves, including the debt to North Ayrshire Council. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the IJB’s compliance with the CIPFA Financial Management Code. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. 90
Page 91
ACCOUNTS PAYABLE TRANSACTION TESTING Q4 1 Background 1.1 This audit used computer audit software called IDEA (Interactive Data Extraction and Analysis) to interrogate the Accounts Payable (AP) System and examined any anomalies which arose. 1.2 There were 45,241 invoices paid to trade and sundry suppliers during the period of the audit totalling just under £160 million. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • duplicate invoices have not gone undetected. • invoices paid to employees are bona fide. 2.2 The audit period was 1st July 2021 to 31st December 2021. 3 Findings Invoice Tests 3.1 The auditor tested for duplicate invoices for payments to suppliers and identified 176 possible duplicates that were investigated further. This confirmed that 79 were duplicates but had already been identified and action taken by the AP team. This testing eventually identified 13 potential duplicate invoices totalling £9,441.24, and 2 potential credit notes totalling £943.98 which have not already been identified by the AP team. The potential duplicates have been passed to the AP team to check and arrange recovery. (action a) Payments Made to Employees Tests 3.2 The auditor tested for employees who have been paid via Integra. This highlighted 44 supplier bank details matching an employee’s bank details which received payments via Integra. All invoices to these suppliers were checked and the majority were in relation to kinship/fostering/ adoption payments. There were 3 purchases with a value between £4,000 and £7,000 that were investigated further, and assurance was obtained that proper procurement processes were followed. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the controls around the processing of invoices, in particular to preventing duplicate invoices being processed as the number of potential duplicates identified is relatively low. 91
Page 92
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. 92
Page 93
KEY FINDINGS AND ACTION PLAN ACCOUNTS PAYABLE TRANSACTION TESTING Q4 Action a Finding Testing identified 13 potential duplicate invoices totalling £9,441.24 and 2 potential credit notes totalling £943.98, which have not already been identified by the AP team. Action Description AP should review the potential duplicate invoices and, where necessary, arrange for recovery of monies paid twice. Risk The Council has paid the same invoice twice and the money has not been recovered. Priority (1, 2, 3) 1 Paragraph Reference 3.1 Managed by Mark Boyd, Head of Service (Finance) Assigned to Suzanne Quinn, Senior Manager (Corporate Procurement) Due Date 31/05/22 Management Comment The Accounts Payable Team will investigate the 13 potential duplicate invoices by 31/05/22 and recover where appropriate or notify Internal Audit, why duplicate payment is legitimate. Recovery of funds can take several months. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. 93
Page 94
LEAVERS AND MOVERS PROCESSES 1 Background 1.1 The audit reviewed the controls around employees who move jobs within the Council as well as employees who leave the Council, with a particular focus on access to personal and sensitive information. The audit focused on the IT process but it incorporated the HR process to ensure the process is clear for managers. The scope of the audit covered the controls in relation to the Corporate network only. The Education network was not included. 1.2 A movers process audit report was issued in January 2019 and this audit incorporated a follow-up of the actions identified in this audit. A leavers process audit was issued in March 2017. 1.3 As a result of the previous movers audit, IT Services introduced an Active Directory (AD) Chris movers process which involved a script being developed which links to the Payroll system and removes all bar default network groups on the employee’s moving day. The new line manager will have to request the correct network access via the IT Portal. This is to ensure the previous job’s network access is not retained if the new line manager does not request new access in advance of the move. If the manager does request new access, IT Services developed an app which logs all such requests. This ensures any changes requested via the IT portal and actioned by IT are not removed when the IT script runs otherwise the new access will be wiped and access returned to default network groups only. 1.4 IT Services also introduced a monthly leavers and movers report which is generated from the Payroll system and emailed to key system administrators to take action to remove access to IT systems. 1.5 The Council uses Office 365 which includes access to Teams sites and SharePoint sites. There is an ongoing project to move network files/folders to SharePoint sites. 1.6 The auditor was advised during the audit that IT Services are replacing the current IT Portal for logging jobs with IT. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • Appropriate procedures are in place to advise managers of their responsibilities for employees leaving the Council or moving posts. • Network access has been deactivated or amended in a timely manner for employees who have left the Council or moved jobs within the Council. • System access has been deactivated or amended in a timely manner for employees who have left the Council or moved jobs within the Council. • Processes are in place to remove or amend access to SharePoint and Team sites for employees who have left the Council or moved jobs within the Council. • Leavers and movers processes are operating as expected and access has been deactivated or amended correctly. 94
Page 95
3 Findings Leavers Process for Network Access 3.1 There is clear HR guidance for managers to follow when an employee leaves the Council, particularly with the employee journey and managers checklist. This process also refers to the IT process. However, the managers checklist does not request a review of SharePoint or Teams sites to ensure the leaver is removed. The IT leavers process will remove IT access and prevent access to SharePoint and Teams sites, however, the Senior Manager (HR&OD) was advised to update the checklist as a housekeeping issue for site owners and this has been done. 3.2 It should also be noted that the HR/Payroll leavers process and the IT leavers process requires a manager to complete 2 separate forms resulting in 2 separate processes that are not linked in any way. 3.3 There is clear guidance on the IT portal for an employee leaving the Council. Movers Process for Network Access 3.4 There is no separate process in the employee journey for employees moving posts and there is no managers’ checklist for this process linking to the IT movers process. The employee journey for leavers does advise the termination/transfer form should be completed and the termination reason should be recorded as ‘Transfer within NAC’. This will notify Payroll that the employee is not leaving NAC and a contract amendment form is to follow from the new service. (action a) 3.5 There is no clear guidance on the IT portal for an employee that is moving. The IT leavers form advises this form should only be completed if the employee is completely leaving NAC and refers to an employee moving role or department within the Council form that should be completed for movers. However, this form was deactivated in 2021. The ‘Announcements’ section on the IT portal advises movers should complete the ‘Access to files or folder’ request form to request new network access. There is an option to select ‘Yes’ if this access is required because the user has just moved or is moving post within the next month. However, this form does not ask for the new post start date to ensure existing access is retained until this date when the new access should be set up. (action a) Leavers and Movers Process for System Access 3.6 IT email a list of movers and leavers from the Payroll system on a monthly basis to a number of key system administrators asking for the lists to be reviewed against the users for their System and update as appropriate. Internal Audit recommended the wording of this email should be amended specifically state the action that should be taken for leavers and movers. The wording of the email was amended during the audit. 3.7 The auditor requested a list of all current users for the Payroll system, the EM Pro customer relationship management system (formerly Lagan) and the Housing system to carry out user testing. There were no findings to report on the current users for the Payroll system. 95
Page 96
3.8 The following findings were noted for the EM Pro system and were discussed with IT staff who are administrators for this system and action has been taken to rectify the findings: • There were 8 users that could not be traced to the Payroll system or the email system. System admin confirmed all users were identified as duplicates or past SPS Doorguard users and all were removed. • There were 9 usernames that related to test or train accounts. System admin confirmed all test and train accounts have been removed and all testing will be carried out on the training environment. • There were no duplicate user IDs but there were 2 users with more than 1 username. System admin confirmed all duplicate accounts have been removed. • There were 16 generic user IDs which were last logged on in 2021. System admin provided explanations for the purpose of each account. • There were 33 external usernames identified, including 30 users that work for SPS Doorguard. System admin confirmed all SPS Doorguard users were removed and the other accounts are required for system purposes. • There were 31 leavers that still had access. System admin confirmed all leavers have been removed. 3.9 The following findings were noted for the Housing system and were discussed with the Team Manager/Housing Strategy & Dev and action has been taken to rectify the findings: • there were no duplicate user IDs but there were 12 users with more than 1 username. The Team Manager advised that all have been contacted to find out if both are required and will disable any that are not required. • There were 3 generic usernames or user IDs. The Team Manager advised one has been disabled and the other 2 are required for system purposes. • There were 119 leavers that still has access. The Team Manager advised that all leavers accounts have been locked. 3.10 The auditor advised the Team Manager that the Housing system was not in receipt of the IT monthly movers and leavers report and were not one of the IT systems listed on the HR/Payroll Termination form. The auditor requested via IT Services that the Housing system and the Housing Abritas system are added to both processes to ensure they are notified of movers and leavers to ensure leavers’ and movers’ access is promptly removed. This was rectified during the audit. Leavers and Movers Process for Office 365 3.11 With the move to Office 365, employees may have access to SharePoint or Teams sites as well as Outlook. IT have amended the script in the AD Chris movers process to link to O365 groups so the group owner will automatically be emailed asking if the employee still needs access to groups they belong to. No detailed testing of this process was carried out due to budget constraints, however it has been noted as an area for consideration within future audit plans. Sample Testing 3.12 The auditor selected a sample of 10 leavers and all had completed the HR/Payroll Termination forms before the leaving date. However, only 3 out of 10 had 96
Page 97
completed the IT leavers form. It should be noted that 1 of the IT leavers form was completed after the leaving date. 3.13 The auditor selected a sample of 10 movers and found the following: • 5 previous managers completed the HR/Payroll Termination form with the termination reason noted as transfer within NAC, 1 of which was completed after the moving date • All new managers completed the amendment form although 1 of these was completed after the moving date. • 1 of the amendment forms was not approved by an authorised signatory. • There was 1 mover that could not be traced to a job on the IT portal requesting new network access • 5 of the movers had logged a job correctly via the folder access request form. The others were logged under employee starters, employee leaving, new start and advised to update Chris record. • There was 1 mover who had completed a folder access request form on 27/10/21, the employee moved on 08/11/21 and the employee advised IT on 11/11/21 their new network access had been removed so it had to be set up again. • There was one mover who completed the correct form but when IT queried the specific folder access required, the line manager asked for the mover to be cloned with another employee in the team. Cloning of access is not recommended due to the risk of including unnecessary additional access. • There were 3 movers for whom the auditor queried the current network access with the current line manager and in 2 cases they advised the mover should not have access to all network groups listed. Therefore, the auditor advised they contact IT to arrange for this access to be removed. (action a) 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the leavers and movers processes. There is clear guidance from HR and IT on the leavers process although testing showed that managers are not completing the IT leavers form. There is no clear guidance from HR and IT on the movers process. The AD Chris movers process implemented as a result of a previous movers audit has improved this process by ensuring network access removes all bar default network access for movers who have not requested new network access via the IT Portal. 97
Page 98
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. 98
Page 99
KEY FINDINGS AND ACTION PLAN MOVERS AND LEAVERS PROCESSES Action a Finding There is no clear guidance on the IT portal for an employee that is moving. The IT leavers form advises this form should only be completed in the employee is completely leaving NAC and refers to an employee moving role or department within the Council form that should be completed for movers. However, this form was deactivated in 2021. The ‘Announcements’ section on the IT portal advises movers should complete the ‘Access to files or folder’ request form to request new network access. There is an option to select yes if this access is required because the user has just moved or is moving post within the next month. However, this form does not ask for the new post start date to ensure existing access is retained until this date when the new access should be set up. Action Description IT Services should introduce a clear movers process for managers to follow and should notify HR to allow the employee journey to be updated accordingly. Risk It is unclear what action managers should take and may result in no action being taken. Inappropriate access may not be removed or access may be removed while it is still required. Priority (1, 2, 3) 1 Paragraph Reference 3.4, 3.5, 3.13 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Damien Lynn, Senior Customer Officer (ICT) Due Date 31 October 2022 Management Comment IT Services will introduce new movers process on Hornbill ITSM. IT Services will also work with HR to allow the employee journey to be updated accordingly. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. 99
Page 100
SOCIAL MEDIA 1 Background 1.1 This area was last audited in the 2017/18 audit year. The action plan resulted in the formation of a short-life working group to complete several of the actions. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • previous audit actions have been fully implemented. • social media sites are set up in line with corporate policies and procedures and adequate training is provided. • there are appropriate controls in place to manage the Council’s Twitter & Facebook accounts and access is restricted. • adequate access controls are in place for other social media sites and relevant information is available on the site. • employees’ access to social media is restricted, training has been given for investigation purposes and GDPR requirements regarding consent are being adhered to. • adequate advice has been issued to employees for personal use of social media. 3 Findings Implementation of Previous Audit Actions 3.1 The 10 actions from the previous audit of Social Media in 2017/18 were followed up. All were found to have been implemented as agreed by the relevant services. As part of this implementation, an HR Social Media Guide was circulated to all employees in June 2019. Compliance with Social Media Policies 3.2 The Council has a Social Media Implementation Strategy which was updated in February 2021 and is available on the Intranet, Connects. The Council also has Social Media Guidelines for customers which are published on the external website together with a Digital Engagement Register which lists the Council’s Facebook and Twitter pages. There is employee guidance for setting up and managing social media accounts and an e-learning module that supports this guidance. 3.3 A sample of social media pages set up in the last 2 years were tested to ensure that they had been set up according to the set procedure and all had followed the procedure. 3.4 During the audit 1 Instagram account for an HSCP service and 9 Twitter accounts for schools were identified that had not been authorised, as well as a further school Twitter account which had been set up despite the Head of Service declining to authorise it. Corporate Communications are liaising with the HSCP service to ensure that the Instagram account meets the Council’s requirements and arrange 100
Page 101
retrospective authorisation. Education were already aware that there was an issue with schools setting up unauthorised Twitter accounts and details of the accounts identified were passed to management for action. Education are in the process of preparing their own Digital Strategy which includes social media and have set up a working party on social media. Controls around the Corporate Facebook and Twitter Accounts 3.5 The Corporate Communications team provided information regarding the controls over the corporate social media accounts. No issues were identified. Social Media Use by the Council 3.6 The sample of social media pages at 3.3 above were asked about user access controls and the content of the pages. No issues were identified concerning access controls. 3 accounts had not included the Council’s Social Media Guidelines and 3 did not include their monitoring hours, but all committed to adding this information. No other issues were identified. 3.7 A sample of school Twitter accounts was reviewed and the schools were asked to complete a questionnaire. One school had used a Gmail account in the school’s name to set up the Twitter account. They were advised to change this to a North Ayrshire Council or Glow account and to close the Gmail account. No other issues were identified. Social Media Use by Employees for Work Purposes 3.8 All IT users have read-only access to social media. Read-write access needs to be requested via the IT helpdesk with approval from the employee’s line manager. This access controls whether users can post from within the Council’s network, but they can still access the social media sites outwith the Council’s network if they know the credentials and therefore make posts. Therefore the usefulness of this control is very limited. 3.9 IT provided a list of users with read-write access to social media. This listed 432 users. These were matched to current employees in the CHRIS payroll system. 281 current employees were identified from this match and subsequent investigation. 2 leavers were identified, although 1 was very recent. IT arranged to remove this access. 140 accounts belonged to NHS users. 5 accounts which were never or no longer used were disabled, 1 account was required for election software and 3 accounts were left with IT for further investigation. 3.10 The data match exercise highlighted the large number of accounts allocated to NHS users. There is not a reliable mechanism for IT to be notified when NHS users leave their posts. This is a risk that has been highlighted in this test but it is not appropriate to explore in further detail in the scope and budget of this audit. Therefore it will be explored in a future separate audit exercise. 3.11 A sample of employees from the data match were sent a survey about how they use the access. None of the users surveyed used their access for investigation activities which would be subject to Regulation of Investigatory Powers (Scotland) Act (RIPSA) requirements. 101
Page 102
3.12 The Council has arrangements in place to ensure that any officers using social media for investigation purposes comply with RIPSA requirements. 3.13 The Council has arrangements in place to ensure that GDPR requirements relating to posting photos on social media are complied with. All of the sample of social media pages at 3.3 and the sample of schools at 3.7 confirmed that they obtain consent before posting any photographs of individuals. Social Media Use by Employees for Personal Use 3.14 Guidance has been issued to all employees regarding use of social media, as well as specific guidance for Education and HSCP employees. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to social media use throughout the Council. Several unauthorised school social media accounts were identified. Education have already established a working group to review schools’ use of social media. 4.2 140 NHS users with read-write access to social media were identified. There is not a reliable mechanism for IT to be notified when NHS users leave their posts. It was not appropriate to explore this issue in further detail within the scope and budget of this audit. Therefore it will be explored in a future separate audit exercise. Definitions of Assurance Levels: Substantial The framework of governance, risk management and control is adequate and effective. Reasonable Some improvements are required to enhance the adequacy and effectiveness of the framework of governance, risk management and control. Limited There are significant weaknesses in the framework of governance, risk management and control such that it could be or could become inadequate and ineffective. None There are fundamental weaknesses in the framework of governance, risk management and control such that it is inadequate and ineffective or is likely to fail. NB The level of assurance given is at the discretion of Internal Audit. 102
Page 103
VAT 1 Background 1.1 The Council incurs more input VAT (VAT on purchases) than it collects via output VAT (VAT on charges for services) and is therefore in a net position of having paid out tax that it is able to recover from HMRC. 1.2 Monthly VAT returns allows the Council to recoup this cash timeously. 1.3 HMRC can impose significant penalties on the Council if they believe any inaccuracies in these returns are the result of carelessness, are deliberate or are deliberate and concealed. 2 Objectives and Scope 2.1 The objective of this audit is to ensure:- • Training and procedures are available to ensure staff understand the Council’s VAT position • VAT returns are being submitted accurately and timeously • The Council’s de minimis calculation is being reviewed regularly • Input VAT in being correctly recorded within Integra 3 Findings Training 3.1 In order to ensure the correct classification and treatment of VAT on transactions, it is important that officers understand the Council’s VAT status and what that means, in addition to knowing how to process transactions within Integra. 3.2 Audit reviewed the resources available to Officers and found those noted in paragraphs 3.3 – 3.6 below. 3.3 The Council has a VAT manual which covers general information such as:- • VAT classifications, • how to calculate VAT, • what constitutes a VAT invoice • Tax points • Accounting for VAT errors • The importance of VAT planning but also looks at the specific transactions being undertaken by services and the VAT treatment and implications of these. 3.4 Supplementary information is circulated as necessary eg guidance notes on how to deal with VAT charged by EU suppliers and VAT Planning for Land and Property Transactions have been provided to staff. 3.5 An online VAT awareness training course has recently been added to ILearn. 103
Page 104
3.6 The mechanics of recording VAT is covered within system specific procedures. VAT returns 3.7 Audit confirmed that all monthly VAT returns in 2021/22 were submitted timeously. 3.8 The Council must make a voluntary disclosure to HMRC of any VAT correction required that is greater than £50,000. Financial Management have confirmed that no such disclosures have been made during 2021/22. 3.9 Minor VAT corrections can be made via monthly returns. Audit reviewed all returns in 2021/21 and only found 2 instances of minor adjustments having been made. These adjustments totalled £2,736 net. 3.10 Audit also confirmed that the Council’s VAT suspense account is being reconciled monthly. De Minimis Calculation 3.11 The Council provides a number of services that are VAT exempt. Normally no VAT is chargeable on an exempt supply, and input VAT cannot be recovered. 3.12 However, section 33 of the VAT Act 1994 allows the Council to recover this input VAT so long as its value is deemed insignificant as compared to the Council’s overall input VAT value. 3.13 The de minimis calculation sets the maximum value of input tax relating to exempt supplies that can be incurred (and reclaimed) whilst staying within the parameter of ‘insignificant’. 3.14 Should the Council exceed this maximum value then it would lose the ability to reclaim all VAT incurred providing exempt services – not just the element that exceeds the threshold. 3.15 It is therefore important that the Council plans and monitors its exempt activities. 3.16 The Council’s main exempt supply relates to the lease of properties and hall lets. Any significant transactions relating to such properties - such as purchases, refurbishment or sales could have a significant impact on the total value of exempt transactions. 3.17 Financial Management have issued a document to all senior managers highlighting the impact of land and property transactions on the Council’s overall VAT position. They have requested to be notified of all potential transactions and have issued a ‘VAT consideration form’ for completion. 3.18 Financial Management have confirmed that the de minimis calculation is revisited annually – with the latest recalculation being undertaken in September 21. Input VAT 3.19 VAT can only be recovered if a valid VAT invoice is received and retained. 104
Page 105
3.20 Audit selected a sample of 24 invoices and 6 procurement card transactions to verify that:- • A valid VAT invoice is available in all instances where VAT has been reclaimed • Any VAT on invoices has been accurately reflected in Integra or SDOL 3.21 No issues were noted during testing of the 24 invoices. 3.22 Of the 6 procurement card transactions tested:- • 2 transactions were found to have appropriate invoices, and had been correctly coded in SDOL • 1 transaction was found to have a VAT invoice, but the VAT hadn’t been recorded in SDOL. This means VAT of £132.47 has not been reclaimed by the Council. • The card surcharge on one invoice had been incorrectly treated as VATable by the cardholder. As a result, the Council has incorrectly reclaimed £6.79 of VAT. • 1 transaction was found to have no VAT invoice. At the request of Audit, the cardholder obtained a VAT invoice from the company which confirmed the VAT on the transaction had been correctly recorded in SDOL. • 1 transaction was found to have no VAT invoice. At the request of Audit, the cardholder was able to obtain a VAT invoice from the company. This invoice included VAT, however the VAT element had not been recorded in SDOL. This means VAT of £36.66 has not been reclaimed by the Council. (action point a) 3.23 Audit has also raised the above errors with relevant cardholders and their line managers. 3.24 Audit has liaised with Financial Management to ensure the above errors are corrected via the Council’s next VAT return. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regards the Council’s treatment of VAT transactions. 4.2 Invoices being processed via Integra are being recorded properly, however some issues with the identification and processing of VAT on procurement card transactions is evident from Audit testing. 105
Page 106
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. 106
Page 107
KEY FINDINGS AND ACTION PLAN VAT Action a Finding VAT invoices are not always being obtained and/or recorded correctly in SDOL for procurement card purchases. Action Description Procurement card holders to be reminded of the importance of obtaining VAT invoices for all purchases, and then reflecting these accurately in SDOL. Risk The Council is missing the opportunity to reclaim VAT that it is entitled to. Evidence required by HMRC to support VAT being reclaimed has not been retained. Priority (1, 2, 3) 1 Paragraph Reference 3.22 Managed by Mark Boyd, Head of Service (Finance) Assigned to Suzanne Quinn, Senior Manager (Corporate Procurement) Due Date Completed Management Comment An email was sent to all card holders from the Head of Finance, stressing the importance of the treatment of VAT in Pcard transactions and reminding all users to obtain a VAT invoice and to upload the VAT invoice and complete the relevant VAT information on the SDOL system. The email also stressed that any continued incorrect recording of VAT in Pcard transactions could result in removal of this facility. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. 107
Page 108
OFF PAYROLL WORKING (IR35) 1 Background 1.1 IR35 (Off payroll working) was introduced by HMRC to tackle the issue of individuals providing ‘employee type’ services to a company but doing so via a Personal Service Company (PSC) so as to avoid having to pay PAYE and NI. 1.2 Updates to the legislation in 2021 made it clear that the company receiving the service is responsible for assessing whether an engagement lies within the scope of IR35 and deducting the correct PAYE and NI if necessary. 1.3 Fines and penalties can be imposed by HMRC if assessments are not carried out or a lack of care and/or negligence results in incorrect assessments being made. 2 Objectives and Scope 2.1 The objective of this audit was to ensure council officers are aware of IR35 rules and are taking steps to identify off payroll working. 3 Findings 3.1 Payroll maintains a separate payrun through which any tax deducted from PSCs is processed. Payroll have confirmed that no transactions have been processed through this payrun in 2021/22. Procedures and processes 3.2 HMRC looks for evidence of ‘reasonable care’ when assessing whether the Council has fulfilled its responsibilities surrounding off payroll working. 3.3 ‘Reasonable care’ can be evidenced, in part, by having robust procedures and processes in place to support Council Officers. 3.4 Audit reviewed the procedures and processes available to Officers and found:- • The Council’s ‘Codes of Financial Practice’ document has been updated to reference IR35. • HR has a procedure called ‘Engaging Agency Workers and Personal Service Companies’ which sets out Service roles and responsibilities, explains how to assess engagements and gives worked examples and flowcharts to support Officers. • An online training course on off payroll working is available on ILearn. Senior Managers have been instructed to ensure all relevant staff have completed this course. • From December 2021, Corporate Procurement has added prompts to its processes to remind Services to consider IR35 when procuring new contracts. Engaging workers via Agencies 3.5 When engaging workers via agencies, it is important to establish if the worker is a direct employee of the agency (in which case the agency is responsible for dealing 108
Page 109
with PAYE and NI) or if the agency is simply acting as an intermediary to match up independent workers with those seeking their services (in which case the Council needs to consider if IR35 is applicable). 3.6 The HR procedure sets out 6 questions to help assess whether each engagement is within the scope of IR35. It also directs officers to the HMRC assessment tool if the 6 questions do not give a conclusive answer. 3.7 IR35 requires the Council to send out a Status Determination Statement (SDS) to the agency and worker to confirm the outcome of the assessment. (action point a) 3.8 Audit analysed all expenditure coded to ‘Agency costs’ in 2021/22 and found that the following services had used agency staff:- • HSCP – Children, Families & Justice • HSCP – Mental Health • Building Services • Waste 3.9 Audit asked the above services to confirm that they had completed all the requirements of IR35 prior to engaging agency staff. 3.10 HSCP – Children, Families & Justice were unable to confirm whether or not IR35 had been considered prior to engaging staff. (action point b) 3.11 HSCP – Mental Health team did not consider IR35 prior to engaging staff. (action point b) 3.12 HSCP – Learning Disabilities team were unable to confirm whether or not IR35 had been considered prior to engaging staff. (action point b) 3.13 Building Services – have a process in place where all agency appointments are managed by a single officer. A review of this process highlighted that whilst elements of IR35 have been applied, not all requirements have been met. (action point b) 3.14 Waste – did not consider IR35 prior to engaging staff. (action point b) 3.15 The above findings prompted Audit to review who has completed the online IR35 training. This highlighted that not all officers who are dealing with potential IR35 transactions have completed the training. (action point c) Direct Engagement of PSC 3.16 Services could also have contracted directly with a PSC i.e. not via an agency. 3.17 Audit looked for evidence of such transactions by:- • Reviewing a sample of 10 invoices coded to consultants fees • Reviewing transactions with 5 local suppliers whose contract type and company name might indicate a PSC. 3.18 No issues were noted during testing. 109
Page 110
4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard Employee Services’ provision of procedures and guidance to Council Services. Information and support is available to Services and reliance is placed on Services making use of these resources. 4.2 Overall, limited assurance was obtained with regard to the application of IR35 within Services. 4.3 Building Services were the only Service using agency workers who could demonstrate some consideration and application of IR35 in 21/22. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. 110
Page 111
KEY FINDINGS AND ACTION PLAN OFF PAYROLL WOKING (IR35) Action a Finding The Council does not have its own Status Determination Statement (SDS) template at present (although there is one available on the HMRC website). Action Description Employee Services to add a Status Determination Statement (SDS) template to the HR ‘Engaging Agency Workers and Personal Service Companies’ procedure Risk Inconsistent communication with agencies/PSCs Priority (1, 2, 3) 3 Paragraph Reference 3.7 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Jackie Hamilton, Senior Manager (Employee Services) Due Date 31 August 2022 Management Comment HMRC’s template will be added to the HR ‘Engaging Agency Workers and Personal Service Companies’ procedure Action b(1) Finding IR35 is not being considered, evidenced, and applied consistently throughout the Council. Action Description Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.10 Managed by Alison Sutherland, Head of Service (Children, Families & Justice) Assigned to Alison Sutherland, Head of Service (Children, Families & Justice) Due Date 31 October 2022 Management Comment Children, Families & Justice (CFJ) accept the findings in the report. The Head of Service will contact Internal Audit to identify individuals/companies this audit refers to in order to revisit the transactions from last year and assess against IR35 criteria to ensure the process is applied consistently and evidenced. CFJ senior managers will complete the training module and HoS will make IR35 an agenda item at an extended team manager meeting to raise awareness. 111
Page 112
HSCP will review our processes and change procedures to identify one person in the partnership who will be responsible for the IR35 checklist to make sure this does not happen again. Action b(2) Finding IR35 is not being considered, evidenced, and applied consistently throughout the Council. Action Description Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.11, 3.12 Managed by Thelma Bowers, Head of Service (Mental Health) Assigned to Thelma Bowers, Head of Service (Mental Health) Due Date 31 October 2022 Management Comment A review of practice has been undertaken within the service which has identified a gap in knowledge regarding these standing financial requirements. A programme of training will be implemented to ensure compliance in this area of financial management and all staff with this area of financial responsibility have been made aware of the audit outcome. Action b(3) Finding IR35 is not being considered, evidenced, and applied consistently throughout the Council. Action Description Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.13 Managed by Yvonne Baulk, Head of Service (Housing & Public Protection) Assigned to Leigh-Ann Mitchell (Senior Manager, Building Services Governance) Due Date 30 September 2022 Management Comment When recruiting agency workers Building Services have been asking the 6 questions as set out by the HR procedure. The one requirement still outstanding relates to completion of the Status Determination Statement, which is currently being developed by HR. Once this is made available Building Services will complete this retrospectively for all agency appointments from 2021/22. 112
Page 113
Action b(4) Finding IR35 is not being considered, evidenced, and applied consistently throughout the Council. Action Description Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.14 Managed by Thomas Reaney, Head of Service (Commercial) Assigned to Wallace Turpie (Senior Manager Waste & Streetscene) Due Date Complete Management Comment Waste Services employed one agency driver for one period for holiday cover. The agency has been contacted and confirmed that they paid tax for this worker. Head of Service can confirm that agency labour will no longer be used in this service area. Action c Finding IR35 training hasn’t been completed by all relevant Officers. Action Description Employee Services to remind all Heads of Service of the importance of ensuring relevant staff have completed the online IR35 training. A list of all staff who have completed the training course to be circulated alongside the above communication. Risk Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority (1, 2, 3) 1 Paragraph Reference 3.15 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Jackie Hamilton, Senior Manager (Employee Services) Due Date 31 August 2022 Management Comment Communications are scheduled on a 6 monthly cycle to remind Services of the importance of adhering to IR35 regulations, sign posting to the guide and training module. The next update will be brought forward and will also include details of those who have undertaken the training. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. 113
Page 114
CM2000 SYSTEM 1 Background 1.1 The CM2000 system is a care management system used by HSCP. It is a scheduling and monitoring system which allows visits to service users to be scheduled, recorded and monitored. 1.2 The Care at Home team use this system to schedule, record and manage care at home visits that have been assessed and approved. There are also 2 external providers that use the CM2000 system for this purpose. It is also used for Community Alarms but this is a reactive service rather than a planned service. 1.3 When a new service user is set up on CM2000 system, a CM2000 disc is set up which links to mobile phones which have been allocated to Care at Home staff. A CM2000 tag is set up in the service user’s home. This allows the rota to be provided to Care at Home staff via the mobile device and will allow them to clock in and out of the service user’s home to allow the time spent at each visit to be recorded on the system. 1.4 The Adult Services team do not key to the CM2000 system, but they have access to the system to allow reports to be run for the external providers that carry out approved visits to adults. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • There is a robust process in place for users that move post or leave the Council and appropriate password controls are in place. • Access permissions are appropriate to the job role ensuring segregation of duties and high-risk areas are adequately restricted to key staff. • Adequate controls are in place for interfaces to and from the CM2000 system and accurate reports are produced. • Adequate access controls are in place to protect personal/sensitive data on mobile devices and the allocation and return of mobile devices is controlled. 3 Findings System Access Controls 3.1 The Business Support Officer advised that password security settings were set by NAC but were passed to the provider to set up. Password controls did not enforce the need for an uppercase character and a special character; however, this was rectified during the audit. 3.2 The CM2000 system admin team do not receive the monthly leavers and movers report emailed by IT. This was rectified during the audit. System Users Controls 114
Page 115
3.3 The auditor carried out testing on users of the system. There were no leavers identified, all were current employees with relevant permissions to the system. 3.4 The user roles called ‘Super User’ and ‘Team Manager’ have very similar permissions and system administrator duties should be restricted to Super Users only. There are 4 Super Users and 7 Team Managers that can reset passwords, access system administration, and set up and maintain user accounts. (action a) Interfaces and Reports 3.5 The auditor reviewed the invoice checking process for Adult Services and tested a sample of 5 invoices. Although there were no findings to report from this testing, it should be noted that the current invoice reconciliation process is manual and resource intensive. The provider invoice is manually reconciled to the CSV file which is a file generated from the CM2000 system. The CSV file is then checked against the projections spreadsheet which details the service level agreements in place as per the CareFirst system to ensure the correct charge has been invoiced. The team will investigate any overcharges. (action b) 3.6 The auditor reviewed the invoice checking process for Care at Home and tested a sample of 5 invoices. There were no findings to report from the invoice testing process for the Care at Home team. Use of Mobile Devices 3.7 Mobile phones are allocated to Care at Home Assistants to allow them to access their daily rota and to clock in and out of each service users home. There is a record of who has been allocated a mobile phone and the mobile phones are secured with a pin number to access the device, a password to access the NAC company portal and an additional password to access the CM2000 app. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the system controls for the CM2000 system. 115
Page 116
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit. 116
Page 117
KEY FINDINGS AND ACTION PLAN CM2000 SYSTEM Action a Finding The user roles called ‘Super User’ and ‘Team Manager’ have very similar permissions and system administrator duties should be restricted to Super Users only. Both groups can reset passwords, access system administration, and set up and maintain user accounts. Action Description System administrator functions should be restricted to ‘Super User’ roles only. Risk A user with too much access can manipulate the system to their own benefit and avoid detection. Priority (1, 2, 3) 2 Paragraph Reference 3.4 Managed by David Thomson, Head of Service (Health and Community Care) Assigned to Kerry Logan, Senior Manager (HSCP) Due Date Complete Management Comment The Team Manager user role has been amended to remove access to system administrator permissions. Action b Finding The current reconciliation process is manual and resource intensive. The provider invoice is manually reconciled to the CSV file which is a file generated from the CM2000 system. The CSV file is then checked against the projections spreadsheet which details the service level agreements in place as per the CareFirst system to ensure the correct charge has been invoiced and investigate any overcharges. Action Description Consideration should be given to investigating the use of a more automated invoice checking process that would allow overcharges to be highlighted and investigated. Risk Manual checking process is more prone to human error which could result in an overpayment. Inefficient use of staff time. Priority (1, 2, 3) 3 Paragraph Reference 3.5 Managed by Paul Doak, Head of Service (HSCP Finance and Transform) Assigned to Eleanor Currie, Principal Manager - Finance Due Date 31st August 2022 Management Comment A new process has been drafted and is being tested using the July data. Following testing, the adult finance team will be trained and the process applied to the August data onwards. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement. 117
Page 118
FUNDING SUPPORT TO BUSINESSES 1 Background 1.1 On 16 March 2020, Health Secretary Matt Hancock announced to the House of Commons all unnecessary social contact should cease. On 23 March 2020, the first lockdown was announced, the Chancellor announced the Coronavirus Job Retention Scheme for furloughed workers and a programme of funding support to businesses was announced at various stages during the pandemic. This scheme was devolved to the Scottish Parliament and local councils managed the distribution. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • guidance issued by the Scottish Government is accurately relayed to staff issuing grants • systems were in place to distribute grant and that guidance was complied with • grants were issued to clients in a timeous and secure manner • lessons learned from this experience are being built into future plans including Business Continuity Plans (BCP) 3 Findings Guidance 3.1 The Scottish Government issued guidance relating to the grant funding schemes announced on 18th March 2020. This guidance was continuously updated via the Strategic Framework Funds Issues Log; by January, there were 114 responses to requests made by local Authorities. 3.2 In March 2020, small business grant fund and retail, hospitality and leisure grant fund guidance were issued relating to two grants funding schemes: • A one-off £10,000 small business grant to the ratepayers of properties with specified uses in receipt of the Small Business Bonus Scheme (SBBS) or Rural Relief, or eligible for SBBS but in receipt of Nursery Relief, Disabled Relief, the Business Growth Accelerator Relief or Fresh Start. Certain property uses are excluded. • A one-off £25,000 grant to the ratepayers of properties in the retail, hospitality and leisure sectors. Certain property uses are excluded. 3.3 In total there were 20 different schemes administered by 4 different teams who were best placed to access the relevant information to make decisions on grants. Distribution teams had to be set up quickly. Revenues, who administrate rates for the council, and Business Support, who had developed relationships with local Businesses, administered the main tranches of grants. Growth and Development administered hospitality grants, and Legal Services manage an administration team for all the taxi applications to the council. 3.4 Support process guidance to staff was clearly mapped on a flowchart. 118
Page 119
3.5 NAC used social media and its website to provide public advice. Staff were available to provide guidance and support via the phone, using social media accounts Twitter, Facebook, Linked in and YouTube. Publicity was maximised using the Council’s website and social media. Applications were to be completed online and grant specific links were created which all fed to unique mail boxes. Compliance 3.6 In the 2020-21 financial year, the Scottish Government issued £1,806,663,060 in support. North Ayrshire Council received £74,780,641 (2.3%). The distribution process was negotiated by the Scottish Government and COSLA with local authorities being deemed best placed to facilitate grant applications. 3.7 Applications were to be made online and submitted via email. Each application was submitted to a dedicated email address, allowing the application to be identified and handled by the correct team. This also allows, in the event of one of the team members becoming ill, access to the applications by the rest of the team. 3.8 Internal audit examined two of the email accounts: Business Grants and Taxi and Private Hire Driver Grants (TPHD). 3.9 The Business Grants account was the most sought-after support grant. In the period March 2021 to December 2021 there were 3,098 emails posted on this account. 3.10 Taxi drivers were approached by NAC directly. 3.11 A four-step escalation plan was put in place to resolve enquiries and any appeals. Email evidence indicates that many enquiries were resolved at stage one with a few at stage two. Payments 3.12 Internal audit identified 2,222 applications for Business grant support and the instruction to pay £2,287,500 for the period 1st April 2020 to 27th October 2020. Taxi payments for 344 claims were paid with a value of £88,400. A sample of 25 business and 10 taxi grants were randomly selected and tested for completeness of information. 3.13 Business grant applicants submitted their application by email. 3.14 The application form comprised of seven sections:- 1. Applications for grant of £10,000 2. Applications for grant of £25,000 3. About your business 4. Business details 5. Bank details 6. State Aid 7. Term and conditions 119
Page 120
From the responses sampled some of the applicants had difficulty completing sections 1 and 2 - from 3 questions, four didn’t provide a response and one provided a response that made their application ineligible. Section 3 responses, to five questions posed, were also incomplete – the lowest level of compliance related to providing the business rates reference number and purpose of business at 79%. In general, the other sections were complete. 3.15 Taxi application responses were almost 100% complete with only a couple of questions not responded to, for example two applicants did not provide postcode. 3.16 Testing identified 78 potential duplicate payments, however further investigation identified that these were either applications by the same company in different locations, or by individuals with the same name. The reason they were highlighted was the twelve-digit reference used for Integra postings were the first details of the applicant’s name. Other checks into potential fraudulent claims are being investigated independently through the Scottish Local Authority Investigators Group. 3.17 All the sample tested received appropriate grant payments. Future Planning 3.17 Business Continuity Plans (BCP) reviewed included scenarios faced during the pandemic. 3.18 Audit Scotland issued a report “Principals for community empowerment” in July 2019, which identified what councils would need to achieve following the pandemic. On 28th October 2021, an update report was issued, which identified the disproportional effect of the pandemic on parts of the population and the role that third party organisations had to play at this time. The report included a case study for the Three Towns Hub, which has identified a concrete strategy for community empowerment moving forward. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained regarding administration and allocation of support grants during the COVID period. 120
Page 121
Definitions of Assurance Levels: Substantial The framework of governance, risk management and control is adequate and effective. Reasonable Some improvements are required to enhance the adequacy and effectiveness of the framework of governance, risk management and control. Limited There are significant weaknesses in the framework of governance, risk management and control such that it could be or could become inadequate and ineffective. None There are fundamental weaknesses in the framework of governance, risk management and control such that it is inadequate and ineffective or is likely to fail. NB The level of assurance given is at the discretion of Internal Audit. 121
Page 122
122
Page 123
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit and Scrutiny Committee Title: Counter Fraud and Corruption Strategy Purpose: To advise the Audit and Scrutiny Committee of the Council’s Counter Fraud and Corruption Strategy, which has recently been refreshed to ensure it remains current. Recommendation: That the Committee notes the refreshed Counter Fraud and Corruption Strategy. 1. Executive Summary 1.1 In January 2015, Cabinet approved the Counter Fraud and Corruption Strategy, setting out the Council's zero-tolerance approach towards fraud and corruption. 1.2 The Strategy was refreshed in 2016, in particular to make reference to the role of the Corporate Fraud Team, which was not yet established when the Strategy was approved in 2015. 1.3 The Strategy has been further refreshed to ensure it remains current. The refreshed Counter Fraud and Corruption Strategy is attached at Appendix 1. Minor changes have been incorporated throughout the Strategy; the most notable change is the inclusion of Section 7 on Reporting. 2. Background 2.1 Those responsible for the conduct of public business and the handling of public money will be held fully accountable for their conduct in accordance with the law and proper standards. It is essential that public money is handled with absolute integrity, safeguarded and properly accounted for and used economically, efficiently and effectively. 2.2 To discharge its accountability to the local community, the Council has established and will maintain proper arrangements for the governance of its affairs and the public money at its disposal. The Council is committed to ensuring openness and transparency in the provision of all its services. 2.3 The Council recognises that its resources may be the target of fraudsters, either working outwith or inside the organisation. This Counter Fraud and Corruption Strategy sets out how the Council aims to address the fraud risk it faces. Agenda Item 10 123
Page 124
2.4 The Strategy highlights the areas of the Council's operations that are viewed as being at greatest risk of fraud and corruption. These include: • employees • information and cyber security • procurement and contracts • finance • physical security of assets • licensing • planning • housing tenancy • council tax. 2.5 The Strategy outlines a number of danger signs or 'red flags' to which the Council must be alert in order to maximise the opportunity to identify potential frauds. 2.6 The Council will follow 5 key steps in managing its approach to tackling fraud and corruption. The approach covers proactive steps, aiming to prevent fraud and corruption occurring, and reactive steps when suspected instances are identified. These are: • deter • prevent • detect • investigate • enforce. 2.7 In enforcing action, the Council will always pursue a triple-track response to any instances of fraud or corruption which are found to be proven: • Disciplinary action • Criminal proceedings • Recovery action. 2.8 In addition to this Strategy, the Council has a range of related policies and procedures which staff and elected members are required to adhere to; these include the financial regulations, codes of financial practice, standing orders relating to contracts, 'whistleblowing' policy and defalcation procedures. 2.9 The responsibility for creating a strong anti-fraud culture lies both with Elected Members, in particular the Cabinet and the Audit and Scrutiny Committee, and the Extended Leadership Team. All members of staff must remain vigilant to the threat of fraudulent activity and take the appropriate action if suspicions arise. 3. Proposals 3.1 It is proposed that the Committee notes the refreshed Counter Fraud and Corruption Strategy. 124
Page 125
4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 Counter fraud activity helps support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 No consultation was required in refreshing the Strategy. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None. 125
Page 126
North Ayrshire Council Counter Fraud and Corruption Strategy Version: Final Date: 13/09/2022 Author: Laura Miller Classification: Public 126
Page 127
29/08/2022 Page 2 of 8 [PUBLIC] COUNTER FRAUD AND CORRUPTION STRATEGY 1 Key Messages 1.1 North Ayrshire Council has a zero-tolerance approach to fraudulent or corrupt activity, whether perpetrated by employees, Elected Members, partner organisations, suppliers or service users. 1.2 All parties should remain vigilant to the threat of fraudulent or corrupt activity and should alert the Council when suspicions arise. 1.3 The Council will always investigate allegations of fraud by referring them to the Corporate Fraud Team and thereafter, where appropriate, to the Crown Office and Procurator Fiscal Service (COPFS). 1.4 The Council can pursue a triple-track response to any instances of fraud or corruption which are found to be proven: • Disciplinary action – any fraudulent or corrupt activity by employees will be regarded as ‘gross misconduct’ and appropriate action will be taken under the Council’s disciplinary procedures. • Criminal proceedings – following the conclusion of any Corporate Fraud Team investigation, fraudulent or corrupt activity may be referred on to Police Scotland or reported directly to COPFS for their consideration of criminal prosecution (with the approval of the Chief Executive). • Recovery action – the Council will seek to recover any financial loss it has suffered through fraudulent or corrupt activity, either through court proceedings or by pursuing civil action. 2 Introduction 2.1 Those responsible for the conduct of public business and the handling of public money will be held fully accountable for their conduct in accordance with the law and proper standards. It is essential that public money is handled with absolute integrity, safeguarded and properly accounted for and used economically, efficiently and effectively. 2.2 To discharge its accountability to the local community, the Council has established and will maintain proper arrangements for the governance of its affairs and the public money at its disposal. The Council is committed to ensuring openness and transparency in the provision of all its services. 2.3 The Council has adopted a zero-tolerance approach to fraud and corruption and will always refer any allegations for investigation through the Corporate Fraud Team. The Council may report findings to the COPFS where appropriate and will seek to recover any losses due to fraud or other corrupt practices. 2.4 The Council recognises that its resources may be the target of fraudsters, either working outwith or inside the organisation. This Counter Fraud and Corruption Strategy sets out how the Council aims to address the fraud risk it faces. 127
Page 128
29/08/2022 Page 3 of 8 [PUBLIC] 2.5 In addition to this strategy, the Council has a range of policies and procedures which staff and Elected Members are required to adhere to and these are referred to throughout this document. 2.6 The responsibility for creating a strong anti-fraud culture lies both with Elected Members, in particular the Cabinet and the Audit and Scrutiny Committee, and the Executive Leadership Team. All members of staff must remain vigilant to the threat of fraudulent activity and take the appropriate action if suspicions arise. 3 Definitions 3.1 A number of specialist terms are used throughout this strategy and general definitions (which are not exhaustive) are provided below: 3.2 Fraud – the provision of false or misleading information, the intentional distortion or attempted distortion of statements and records and/or the misappropriation of assets involving deception to obtain an unjust and illegal financial or other advantage. 3.3 Corruption – the offering, giving, soliciting or acceptance of an inducement or reward that may influence the actions taken by the Council, its Committees, Elected Members or officers. 3.4 Embezzlement – theft or misappropriation of funds placed in one’s trust or belonging to one’s employer. 3.5 Bribery – giving, soliciting, or receiving a financial or other advantage in connection with the "improper performance" of a position of trust, or a function that is expected to be performed impartially or in good faith. A bribe may be offered directly to an officer to influence their actions or it may be given to another officer to influence the actions of someone else. 3.6 Money Laundering – the process in which the proceeds of crime are transformed into what appears to be legitimate money or other assets. 3.7 Theft – the dishonest appropriation of property belonging to another (including the Council) with the intention of permanently depriving the other of it. 4 Awareness of Fraud and Corruption Challenge 4.1 The criminal threat presented by fraud is not a new one but the ways in which fraudsters operate has developed significantly and is becoming ever more sophisticated. 4.2 Criminals are more organised than ever and their activities rely on significant levels of planning and organising. Fraudsters share information online and build criminal organisations across the UK and overseas. Tactics are constantly changing as criminals respond to the intervention of organisations and take advantage of new opportunities. 128
Page 129
29/08/2022 Page 4 of 8 [PUBLIC] 4.3 In taking advantage of new opportunities, criminals exploit the latest technology. They steal personal and financial data, both from individuals and organisations. They use social networking to build trust with potential victims who either unwittingly or are coerced into providing information to fraudsters. 4.4 Fraud can be a primary activity for organised crime groups or it can provide funding for other serious crimes. The organisers of fraud networks are often violent criminals who are doing harm to communities, public services and businesses. 4.5 However, not all frauds are perpetrated by organised crime gangs. There are a variety of opportunistic frauds and those which require a degree of sophisticated planning – often coupled with insider knowledge and access. Opportunistic frauds are facilitated by dishonesty; a culture that tolerates fraudulent behaviour and does not always acknowledge it as criminal; weak procedures, systems and controls; and lack of information sharing between organisations. 4.6 Fraud can cause significant damage to those affected. The annual fraud indicator 2017, which provides the last set of government sanctioned estimates, indicates that identified and hidden fraud against the UK public sector amounts to an estimated £40.3 billion per year. An estimated £7.3 billion of this amount was in the local government sector1. 4.7 Losses on this scale have huge implications for already constrained budgets within public bodies and undermine the effective provision of public services. 4.8 Public sector bodies are an attractive target for fraudsters, who look to abuse the tax, benefits and grants systems for personal gain. Furthermore, the public sector, like all organisations, is subject to fraud risks against day-to-day business functions. A number of the main service areas which have been identified as being at significant risk of fraud are detailed below. 4.9 Employees – any employee can perpetrate fraud against their employer. Types of employee fraud are wide-ranging and can include misuse of time and resources, fraudulent claims for allowances and expenses, failure to declare conflicts of interest or the acceptance of gifts and hospitality, as well as the manipulation of finance and payroll systems. One of the strongest defences against employee fraud is ensuring that proper vetting takes place prior to employment. NAC has a range of relevant policies that must be adhered to, including the Recruitment and Selection Policy, Protection of Vulnerable Groups (PVG) Policy and Recruitment of Ex-Offenders Policy. All members of staff are required to comply with the Employee Code of Conduct. It is also essential that senior management ensures that clear internal controls and segregation of duties are in place across the Council. 4.10 Information and Cyber Security – this is an area of increasing public focus with a number of recent high-profile incidents and attacks across the public sector. Councils hold a range of personal and sensitive information about individuals and organisations which would be of interest to fraudsters. It is vitally important that the Council has robust arrangements in place to protect the integrity of its data and systems. Any loss brings the risk of reputational and financial damage to the Council plus the adverse personal impact on those individuals affected by the cyber-enabled fraud. 1 https://www.cipfa.org/-/media/files/services/ccfc/cipfa-fraud-and-corruption-tracker-national-report-2020.pdf 129
Page 130
29/08/2022 Page 5 of 8 [PUBLIC] North Ayrshire has a range of information and cyber security policies, procedures, and guidelines in place to help manage the risks related to data loss and cyber-attacks. These include an Acceptable Use of ICT Policy, which all staff are required to sign up to, Data Sharing Guidelines, Information Classification Guidelines, Cyber Incident Response Plans and Data Protection Policy. The Council has both an Information Governance Team and a Cyber Security Team to manage the information and cyber risks, implement controls which protect data and systems, and respond rapidly to any reported incidents or attacks. 4.11 Procurement and Contracts – procurement fraud covers the entire procure-to-pay lifecycle, including fraud in the bidder selection and contract award stages (such as illicit cartel activity or the bribery of an official to influence the tendering process) as well as fraud occurring during the life of the contract (for example, false or duplicate invoicing). The Council has a centralised procurement function for all non-social care procurement and a dedicated social care commissioning team within the Health and Social Care Partnership; both operate in accordance with the Council’s Standing Orders Relating to Contracts and the procurement manual. The Corporate Procurement Unit has a data-sharing protocol in place with Police Scotland and staff are required to declare any conflicts of interest they may have. 4.12 Finance – the Head of Service (Finance) has a responsibility to ensure that the Council’s financial resources are used in accordance with agreed policy. A range of monitoring and reporting processes are in place, in particular over the Council’s revenue and capital budgets. The Council has financial regulations and codes of financial practice, to which all staff are required to adhere, as well as approved treasury management practices. 4.13 Physical security of assets – Council assets (particularly buildings, cash, safes, stores and computer systems) may be at risk through weaknesses in physical security. Each Council building has a maintained alarm system, linked to an out-of-hours call centre. Should any alarm be activated, the stand-by security contractor will arrange to attend the property and undertake a security check. The police will be contacted if it is deemed necessary. 4.14 Licensing – many of the businesses that require licensing are those identified by Police Scotland as being most commonly associated with organised crime gangs. The Council operates a range of policies in relation to the various licences that are available; these policies are made available to the public through the Council website. A Licensing Board and Licensing Committee are in place to determine applications and will make decisions in accordance with appropriate legislation based on information provided by applicants and statutory consultees, including Police Scotland. 4.15 Planning – legislation requires the determination of applications to be made in accordance with the Development Plan, unless material considerations indicate otherwise. The Development Plan has to be submitted to the Scottish Government prior to adoption. The planning system has a series of checks for conformity with national and local plans, together with an open and transparent procedure, through the need for consultation and publicity at every stage of the decision-making process. Offers of community benefit are not a material planning consideration and it is important that decision makers are not induced to grant an otherwise unacceptable consent through the promise of community benefits. Within NAC, there is democratic 130
Page 131
29/08/2022 Page 6 of 8 [PUBLIC] accountability through the Committee structures in terms of the Local Development Plan Committee, Planning Committee and Local Review Body, and the full Council when required. Management structures within the service negate the possibility of influence over an individual officer. The Councillors’ Code of Conduct has been updated to clarify that community benefits are not a material consideration when determining Planning applications. Community benefits are not managed within the Planning Service and are dealt with entirely separately from and without reference to the planning process. 4.16 Housing tenancy – this can cover a wide range of fraud such as the provision of false information to obtain social housing, unlawful sub-letting, false homeless applications and false successions. Unlawful occupation of social housing results in reduced availability of housing stock to legitimate applicants. The Council carries out a range of identity checks on applicants for housing to help reduce the risk of tenancy fraud. 4.17 Council tax – Council tax is a target for fraudsters, particularly through false claiming of single person discount, vacant property relief or student occupancy or through the Council Tax Reduction scheme. The Council participates in data matching initiatives to identify potential fraud cases and these are investigated by the fraud team. 4.18 The above list is not exhaustive and, as noted at 4.2, the tactics used by fraudsters change over time and new fraud risks will continue to emerge. Increasing financial constraints and changes to the way in which Councils deliver and manage their services can all increase the risk of fraud. For example, the transfer of assets to community groups could result in local authorities losing control of how assets and funding are managed; with small organisations being less experienced in managing public funds, the risk of financial mismanagement and abuse of funds could increase. The Council must remain alert to such emerging fraud risks and ensure that good governance structures and controls are in place to counter these. 4.19 There are a number of danger signs or ‘red flags’ to which the Council must be alert in order to maximise the opportunity to identify potential frauds. These include: • Significant changes in behaviour • Individuals with large personal debts and a desire for personal gain • Audit findings deemed to be errors or irregularities • Transactions taking place at odd times, odd frequencies, involving unusual amounts or to odd recipients • Internal controls that are not enforced or often compromised by higher authorities • Discrepancies in accounting records or unexplained items on reconciliations • Missing documents or only photocopies available • Inconsistent, vague or implausible responses to enquiries • Missing inventory or physical assets • Common names or addresses of payees or customers • Alterations on documents such as back-dating • Duplications such as duplicate payments • Collusion among employees, where there is little or no supervision • Situations where one employee has control of a process from start to finish with no or inadequate segregation of duties. 131
Page 132
29/08/2022 Page 7 of 8 [PUBLIC] 5 North Ayrshire Council Approach 5.1 The Council will follow 5 key steps in managing its approach to tackling fraud and corruption. The approach covers proactive steps, aiming to prevent fraud and corruption occurring, and reactive steps when suspected instances are identified. 5.2 Deter – the Council will seek to maximise publicity around successful detection and prosecution activity in order to deter potential fraudsters. 5.3 Prevent – the Council will seek to prevent fraud by implementing strong internal controls in all activities across the organisation. Heads of Service are responsible for implementing and testing robust control mechanisms, which will also be subject to periodic review by Internal Audit in line with the approved audit plan. The Council will also seek to prevent fraudulent activity by raising awareness of this Strategy, along with other key policies. 5.4 Detect – the Council will actively seek to detect fraudulent activity through a number of means. This will include: data sharing with key partners, such as through the National Fraud Initiative (NFI); pro-active data matching between different systems and data sets; encouraging whistleblowing by employees or members of the public; regular management checks on the adequacy of internal controls, and reviews by Internal Audit. 5.5 Investigate – allegations of fraudulent activity will always be reviewed by senior management and referred to the Corporate Fraud Team for investigation where appropriate. This will be done in line with the Council’s approved defalcation procedures. As well as recommendations for enforcement actions, an investigation by the Corporate Fraud Team will result in a range of recommendations to tighten controls to help prevent a future reoccurrence. 5.6 Enforce – the Council will always pursue a triple-track response to any instances of fraud or corruption which are found to be proven: • Disciplinary action – any fraudulent or corrupt activity by employees will be regarded as ‘gross misconduct’ and appropriate action will be taken under the Council’s disciplinary procedures. • Criminal proceedings – following the conclusion of any Corporate Fraud Team investigation, fraudulent or corrupt activity may be referred on to Police Scotland or reported directly to COPFS for their consideration of criminal prosecution (with the approval of the Chief Executive). • Recovery action – the Council will seek to recover any financial loss it has suffered through fraudulent or corrupt activity, either through court proceedings or by pursuing civil action. 6 Key Partners 6.1 The Council will maintain arrangements with other public agencies to encourage the exchange of information about fraud and corruption. Any exchange of data is undertaken in accordance with the principles of the Data Protection Act 2018 and UKGDPR. 6.2 These agencies include: 132
Page 133
29/08/2022 Page 8 of 8 [PUBLIC] • Police Scotland – both at local level and through the national Public Sector Counter Corruption Unit (PSCCU). • Crown Office and Procurator Fiscal Service (COPFS) • Other local authorities • Local and national Internal Audit and Corporate Fraud networks • The National Anti-Fraud Network (NAFN) • Audit Scotland • Department of Work and Pensions (DWP) • Chartered Institute of Public Finance and Accountancy (CIPFA) • The Council’s insurers, currently Zurich Municipal. 6.3 The Council also participates in the UK-wide National Fraud Initiative (NFI), which allows the secure sharing of data between public bodies and highlights potential fraudulent activity for further investigation. The Cabinet Office processes the data provided by the participating organisations. 7 Reporting 7.1 This strategy reinforces the Council’s approach to dealing with fraud by setting out the way in which members of the public can report their concerns around suspected fraud. 7.2 The Council wants to know about fraud, corruption, embezzlement, bribery, money laundering and theft as generally defined at paragraphs 3.2 – 3.7 above. 7.3 Employees and Elected Members are expected to raise any concerns they have, without fear of recrimination. The Council also encourages members of the public who suspect fraud in the Council to contact North Ayrshire Council. The following reporting mechanisms are in place: By telephone to the Corporate Fraud Team 01294 324585 01294 324586 By email to the Corporate Fraud Team corporatefraud@north-ayrshire.gov.uk By writing to the Corporate Fraud Team North Ayrshire Council Corporate Fraud Team, 2nd Floor, Cunninghame House, Irvine, KA12 8EE. Twitter @NAC_CorpFraud Facebook Corporate Fraud Team, North & East Ayrshire Councils 7.4 Further information on the Corporate Fraud Team can be found on our website at www.north-ayrshire.gov.uk/council/fraud-against-the-council.aspx 7.5 For suspected Housing Benefit fraud, the Department for Work and Pensions (DWP) should be contacted via https://www.gov.uk/report-benefit-fraud 133
Page 134
134
Page 135
NORTH AYRSHIRE COUNCIL 27 September 2022 Audit & Scrutiny Committee Title: Annual Assurance Statement to the Scottish Housing Regulator 2021/22 Purpose: To advise the Committee of the Council’s Annual Return on the Charter 2021/22 submission, and request endorsement of the Annual Assurance Statement to be submitted to the Scottish Housing Regulator. Recommendation: That the Committee: (i) notes the Annual Return on the Charter submission 2021/22; (ii) notes the supporting evidence provided to demonstrate compliance with the regulatory framework; (iii) notes the Council’s Covid related non-compliance with our gas, electrical and fire safety legal responsibilities, but also notes that all outstanding gas safety checks for 2021/22 have now been carried out; and (iv) authorises the Chair to sign the Annual Assurance Statement at Appendix 1. 1. Executive Summary 1.1 The Scottish Housing Regulator’s framework for the regulation of social housing in Scotland includes the requirement for an Annual Assurance Statement to be submitted alongside the Annual Return on the Charter (ARC). The statement must be approved by the appropriate Committee within the organisation prior to submission. 1.2 This report provides information on performance reported in the ARC, highlighting areas of high or improving performance, declining performance, or requiring improvement, and areas of non-compliance attributable to the COVID-19 pandemic and supply chain issues. The report also provides information on how the Council gains assurance that it is compliant with the Regulatory Framework. 1.3 Endorsement of the Annual Assurance Statement will ensure that the Council complies with regulatory requirements set out in the Housing (Scotland) Act 2010. 2. Background 2.1 The Housing (Scotland) Act 2010 sets out the statutory objectives, functions, duties and powers of the Scottish Housing Regulator (SHR), a non-ministerial department responsible for regulating social housing in Scotland. Agenda Item 11 135
Page 136
2.2 In 2012, the Scottish Government’s Social Housing Charter was established. It sets out the standards and outcomes that tenants, homeless people, homeowners, and gypsy/travellers can expect from social landlords. This is monitored via landlords’ ARC submissions to the SHR. 2.3 In February 2019, the Scottish Housing Regulator issued a revised framework for the regulation of social housing in Scotland. The new framework includes the requirement for landlords to submit an Annual Assurance Statement which has been agreed by a Board or Committee within the organisation. The Council must provide assurance that it complies with the relevant requirements of Chapter 3 of the Regulatory Framework. 2.4 The Assurance Statement is confirmation that, as a landlord, the Council: • meets all legal duties and responsibilities, and adheres to relevant guidance and the requirements of other regulators • meets its statutory duties to prevent and alleviate homelessness • adheres to statutory guidance from the Scottish Housing Regulator • takes account of regulatory advice from the Scottish Housing Regulator and from other regulators • complies with all regulatory requirements The Council must also confirm plans to fix any instances where there is a material non-compliance and notify the SHR about any material changes in their level of assurance during the year. 2.5 The SHR has requested that landlords provide assurance in their Statement that they have appropriate plans to implement an effective approach to the collection of equalities information and that they have started to consider how they can adopt a human rights approach in their work. 2.6 As a landlord, we collect data relating to each of the protected characteristics for existing tenants, new tenants, people on waiting lists, governing body members, staff, people who apply to us as homeless and service users on our Gypsy/ Traveller site. We are currently undergoing a system review alongside our partner landlords within the North Ayrshire Housing Register and have incorporated equalities data into the brief for the review to further develop our approach. We have also begun to consider how we can adopt a human rights approach in our work. Guidance issued by the Scottish Housing Regulator in 2021 will further inform this strategy. Performance 2.7 The revised performance framework issued in early 2019 resulted in the removal of some historical indicators, introduction of new performance measures and changes in some methods of calculation. 2.8 Whilst comparative information from other local authorities for the 2021/22 ARC is not yet available, the 2020/21 comparisons from the Scottish Social Housing Charter show that North Ayrshire Council remains a high performing local authority housing service. Of the 43 indicators reported in 2021/22 ranked against other Scottish local authorities, North Ayrshire is in: 136
Page 137
• The top quartile for 24 indicators (60%) • The second quartile for 4 indicators (10%) • The third quartile for 4 indicators (10%) • The bottom quartile for 8 indicators (20%) 2.9 It was reported in the 2020/21 Annual Assurance Statement report that levels of performance were unlikely to be maintained or improved in the 2021/22 ARC return, due to the ongoing impact of the COVID-19 pandemic. This position should, however, be reflected nationally. When the 2021/22 comparisons are published, indicators will be scrutinised to determine areas where this is not the case, and improvement plans developed. 2.10 The areas highlighted below identify key areas of high/improving performance and areas where there has been a decline or improvement is required. Areas of high or improving performance 2.11 Tenant satisfaction is high in terms of overall services as a landlord, and opportunities for tenants to participate and keep informed about services and decisions. Performance in this area is based on our tri-annual tenant satisfaction survey, which took place during summer 2021 to provide an updated position for the 2021/22 ARC submission. 2.12 The average length of time taken to complete emergency repairs reduced from 3.45 hours in 2020/21 to 2.61 hours, and from 9.75 to 7.66 days for non-emergency repairs. The increase in performance is more in line with pre-pandemic figures whilst Building Services continued to comply with COVID-19 guidance and the shortage of materials and labour. 2.13 The average time taken to re-let properties decreased from 27.13 days in 2020/21 to 22.38 days in 2021/22. Void turnaround times are returning to pre-pandemic performance levels. A review of the void process is ongoing to identify further improvements. 2.14 The percentage of antisocial behaviour cases resolved during 2021/22 was 84.24%, which is slightly higher than the previous year’s performance of 82.97%. The method of calculation for the ARC does not consider that cases may open close to the end of the reporting year, or may be complex, and are therefore not closed in the same reporting year. Our internal performance reporting confirms that 99.3% of cases were resolved within target during 2021/22. There has been a 17% decrease in reported antisocial behaviour since 2020/21. 2.15 Whilst the number of court actions resulting in eviction has significantly decreased from 33.33% in 2020/21 to 0% in 2021/22, this is because, in line with COVID-19 guidance, no court actions were initiated, for rent arrears, antisocial behaviour, or other reasons. 137
Page 138
Areas with a decline in performance or requiring improvement 2.16 There has been a decline in performance relating to the adaptations process, with the number of households waiting on an adaptation to their home increasing from 12 in 2020/21 to 142 in 2021/22. The average number of days to complete an approved adaptation also increased from 54.79 to 74.33. A joint improvement group with membership from the Health and Social Care Partnership, Housing, Building Services and Property Management and Investment has been reviewing this process to consider ways to achieve the best possible outcome for tenants. 2.17 The percentage of tenancy offers refused during the year increased slightly from 32.99% to 34.76%. This may be attributable to an overall increase in lets and a reduction in lets to homeless customers. 2.18 Satisfaction levels of tenants who had repairs or maintenance carried out in the last 12 months has decreased from 86.73% to 85.71% since 2020/21. This is based on responses from 98 tenants in 2020/21 and 2021/22 – an unusually low number due to the survey process being affected by the pandemic. 2.19 Gross rent arrears as a percentage of rent due increased from 5.46% in 2020/21 to 6.63% in 2021/22 despite ongoing communication with, and support to, tenants in arrears throughout the pandemic. Although a slightly improved position has been observed in recent months, rent arrears accrued during the pandemic are at a level where it will be extremely difficult for many households in North Ayrshire to recover from, given the impact COVID-19 has had on the economy and employment prospects. 2.20 Homelessness applications have increased by 14% in the last 12 months compared to a national average of 3%. There continues to be a significant proportion of households being asked to leave their home by either family or friends; in addition, we have seen an increase in action taken by landlords to recover their tenancy. 2.21 During 2021/22 there was a 10% decrease in tenants claiming Universal Credit. This decrease is broadly similar to the national reduction in those in receipt of Universal Credit and is due to recovery from the COVID-19 pandemic. The arrears attributed to these tenants (with technical arrears removed) has decreased by 15%, in comparison to an increase of 108% the previous year. A review of our welfare rights and debt advice cases indicates that tenants are experiencing significant financial difficulty due to pandemic, which is expected to worsen with the cost of living rising over the winter months. Area of non-compliance 2.22 During 2021/22, 360 properties did not receive their annual gas safety check within the statutory timescales. There is still ongoing reluctance by some tenants to grant access to their property due to their concerns about risk of COVID-19 transmission. During 2021 we implemented our access policy, which enabled forced entries to recommence, however whenever a tenant cited COVID-19 this process was halted, with an alternative later date agreed with the tenant. 138
Page 139
2.23 Under normal circumstances, this level of non-compliance would be deemed material and merit a notification to the Regulator. As this non-compliance was a direct result of the COVID-19 pandemic and all efforts were made to ensure compliance at the earliest opportunity, it is not considered material. All outstanding gas safety checks from 2021/22 have now been carried out. 2.24 During 2021/22 new legislation was introduced which reduced the statutory inspection regime for electrical installations from ten to five years. Despite engaging two contractors, 6,090 properties were non-compliant at the end of 2021/22. 2.25 Our Property Management & Investment team have procured a third contract to accelerate the testing programme. However, accessing properties remains a challenge, with a 50% average access rate. Our Building Services team have commenced working at weekends to assist in reducing the number of outstanding inspections. During 2022 PMI have implemented the Council’s access policy to enable electrical inspections to be undertaken, similar to the arrangements already in place for gas compliance checks. It is anticipated that all outstanding properties will be compliant by the end of March 2023. 2.26 Also during 2021/22, new legislation was introduced with regards to smoke detection equipment. At the end 2021/22, 735 of our properties were non-compliant due to access issues. 2.27 During 2022 the Council’s access policy was again implemented for this area of compliance. It is anticipated that all outstanding properties will be compliant by the end of March 2023. Assurance 2.28 The overall performance of the Housing Service is continuously reviewed by the Head of Service and Housing Senior Management Team, with key performance information and action plans presented to the North Ayrshire Network, Housing Business Plan Group and Council’s Cabinet regularly during each year. 2.29 Some ARC indicators also form part of the corporate performance monitoring framework, scrutinised by Chief Officers and elected members. 2.30 The Scottish Federation of Housing Associations (SFHA) Self Assurance Toolkit has also been utilised as a further method of self-assessment. The toolkit provides guidance to social landlords on gathering evidence to demonstrate compliance with regulatory requirements and standard and focuses on questions that governing bodies should ask to gain assurance that this is being achieved. 2.31 The ARC 2021/22, which can be accessed at Annual Return on the Charter (north- ayrshire.gov.uk), demonstrates the Council’s performance against the outcomes in the Scottish Social Housing Charter. 2.32 Supporting evidence to demonstrate compliance with the regulatory framework and relevant legislation can be accessed at AAS Supporting Evidence (north- ayrshire.gov.uk). 139
Page 140
2.33 The Annual Assurance Statement, which is attached at Appendix 1, confirms that the Council has complied with the regulatory framework, all standards, and outcomes. It highlights North Ayrshire’s non-compliance with our legal responsibilities around gas, electrical and fire safety. It also confirms the equalities data currently captured, and that North Ayrshire is considering how to adopt an increased human rights approach in our work. This Statement will be made available to tenants as part of the Council’s performance reporting process. 3. Proposals 3.1 It is proposed that the Committee (i) notes the Annual Return on the Charter submission 2021/22; (ii) notes the supporting evidence provided to demonstrate compliance with the regulatory framework and relevant legislation; (iii) notes the Council’s Covid related non-compliance with our legal gas, electrical and fire safety responsibilities due to the COVID-19 pandemic, but also notes that all outstanding gas safety checks for 2021/22 have now been carried out ; and (iv) authorises the Chair to sign the Annual Assurance Statement at Appendix 1. 4. Implications/Socio-economic Duty Financial 4.1 None Human Resources 4.2 None Legal 4.3 Approval of the Annual Return on the Charter submission 2021/22 and supporting evidence, and signature of the Annual Assurance Statement, will ensure that the Council complies with regulatory requirements set out in the Housing (Scotland) Act 2010. Equality/Socio-economic 4.4 None Environmental and Sustainability 4.5 None Key Priorities 4.6 None Community Wealth Building 4.7 None 140
Page 141
5. Consultation 5.1 Consultation has taken place with Services within Housing and Public Protection; Sustainability, Transport and Corporate Property; Corporate Performance; the Health and Social Care Partnership; and the Scottish Housing Regulator during the preparation of the Annual Return on the Charter and Annual Assurance Statement. RUSSELL McCUTCHEON Executive Director (Place) For further information please contact Fiona Ellis, Senior Manager (Housing Strategy & Development, on 07795 805570. Background Papers 0 141
Page 142
North Ayrshire Council Annual Assurance Statement 2021/22 North Ayrshire Council complies with the requirements set out in Chapter 3 of the Regulatory Framework. North Ayrshire Council is assured that we: Adhere to relevant guidance and the requirements of other regulators; Meet our statutory duties to prevent and alleviate homelessness; Adhere to statutory guidance from the Scottish Housing Regulator; Take account of regulatory advice from the Scottish Housing Regulator and from other regulators; and Comply with all regulatory requirements, encompassing: • Assurance and notification • Tenant and service user redress • Whistleblowing • Equalities and human rights • Scottish Social Housing Charter Performance. We did not meet our legal obligations around tenant and resident safety as we did not comply with gas safety legislation for 360 properties during 2020/21. Due to new legislation introduced during 2021/22 regarding electrical testing and smoke detection equipment, 6,090 properties were non-compliant with regards to having an EICR and 735 for not having the new smoke detection equipment installed. There is an ongoing reluctance by some tenants to grant access to their property due to their concerns about risk of COVID-19 transmission. Labour shortages within the electrical industry affected the testing programme alongside access issues. All efforts were made to ensure compliance at the earliest opportunity and appropriate records were kept. As a landlord, we collect data relating to protected characteristics for existing tenants, new tenants, people on waiting lists, governing body members, staff, people who apply to us as homeless and service users on our Gypsy/Traveller site. We are currently undergoing a system review alongside our partner landlords within the North Ayrshire Housing Register and have incorporated equalities data into the brief to further develop our approach. We have also begun to consider how we can adopt a human rights approach in our work. Guidance issued by the Scottish Housing Regulator in 2021 will further inform this strategy. North Ayrshire Council’s Audit and Scrutiny Committee has considered sufficient evidence to give this assurance. The Annual Assurance Statement was approved by Audit and Scrutiny Committee on 27 September 2022. Authorised by:________________________ Chairperson of the Committee Printed name: ________________________ Date:_______________________________ 142
Page 143
North Ayrshire Council Housing Services Annual Assurance Statement 2021/22 Supporting Evidence September 2022 143
Page 144
Introduction In February 2019, the Scottish Housing Regulator (SHR) issued a revised framework for the regulation of social housing in Scotland. The new framework includes the requirement for landlords to submit an Annual Assurance Statement which has been agreed by a Board or Committee within the organisation. We must provide assurance that the organisation complies with the relevant requirements of Chapter 3 of the Regulatory Framework. This document provides evidence to support our Statement that North Ayrshire Council is assured that we: ✓ Adhere to relevant guidance and the requirements of other regulators; ✓ Meet our statutory duties to prevent and alleviate homelessness; ✓ Adhere to statutory guidance from the Scottish Housing Regulator; ✓ Take account of regulatory advice from the Scottish Housing Regulator and from other regulators; and ✓ Comply with all regulatory requirements, encompassing: • Assurance and notification • Tenant and service user redress • Whistleblowing • Equalities and human rights • Scottish Social Housing Charter Performance. As a landlord, we are also required to meet all legal duties and responsibilities. During 2021/22 we were unable to do this, as some properties did not have an annual gas safety check, electrical safety certificate or installation of the new smoke detection equipment within the legal timescales due to the continued impact of COVID-19 on gaining access to tenants’ homes. We have provided information on this non-compliance in our Annual Assurance Statement and further detail in this supporting evidence. In August 2020, the Scottish Housing Regulator published advisory guidance to assist landlords to adapt their approach to the submission of the AAS to reflect the impact of the pandemic. They requested that landlords include their position in relation to equalities and human rights in the 2021 Annual Assurance Statement. At that time, it was anticipated that the guidance on equalities data collection would have been available to landlords, however, the impact of the COVID-19 pandemic has slowed the production of that guidance, which became available following the 2021 submission. In recognition of this position, the SHR has requested that landlords provide assurance in their Statement that they have appropriate plans to implement an effective approach to the collection of equalities information and that they have started to consider how they can adopt a human rights approach in their work. 144
Page 145
Regulatory Requirements Assurance and notification We prepare an Annual Assurance Statement in accordance with guidance and submit it to the Scottish Housing Regulator (SHR) annually. The statement is available to tenants and other service users. We will notify the SHR during the year of any material changes to our assurance as set out in the Statement. We can evidence that we meet all legal obligations associated with housing and homelessness services, and equality and human rights. We have not met our legal obligations around tenant and resident safety as we did not comply with gas safety legislation for 360 properties during 2021/22. Due to new legislation introduced during 2021/22 regarding electrical testing and smoke detection, 6,090 properties were non-compliant with regards to having an EICR and 735 for smoke detection There continues to be an ongoing reluctance by some tenants to grant access to their property due to their concerns about the risk of COVID-19 transmission. All efforts were made to ensure compliance at the earliest opportunity and appropriate records were kept, we have not considered this a material non-compliance. We notify the SHR of any tenant and resident safety matters involving the Health and Safety Executive or reports from other regulatory bodies relating to safety concerns. There were no issues to report during 2021/22. ‘Customer Connections’, our Tenant Participation Strategy, is available to tenants and service users on the Council website. Customer Connections Strategy (north-ayrshire.gov.uk) Tenant and service user redress Information on how to report any concerns around significant performance failures is available to tenants. Further information is contained in the Scottish Housing Regulator leaflet. North Ayrshire Council’s Complaints Handling Procedure is readily available to tenants and other service users. It sets out the information they need to exercise their right to complain and seek redress. Responses are provided within timescales set out in the Procedure, in accordance with guidance from the Scottish Public Services Ombudsman (SPSO). We have mechanisms in place to learn from complaints and other tenant and service user feedback, in accordance with SPSO guidance. Whistleblowing North Ayrshire Council has a policy and procedure in line with the Public Interest Disclosure Act 1998 for whistleblowing by staff and elected members. This is readily available on the Council website and promoted through staff bulletins. 145
Page 146
Equalities and human rights Equality is one of the North Ayrshire Council's core values. The principles of equality and fairness are central to all council activities. Our Equality and Children’s Rights Impact Assessment process for all policies, procedures and proposals ensures we meet legislative requirements. All decisions made by the Council’s committees include an assessment of equalities implications. As a landlord, we collect data relating to each of the protected characteristics for existing tenants, new tenants, people on waiting lists, governing body members, staff, people who apply to us as homeless and service users on our Gypsy/Traveller site. We are currently undergoing a system review alongside our partner landlords within the North Ayrshire Housing Register and have incorporated equalities data into the brief to further develop our approach. We have also begun to consider how we can adopt a human rights approach in our work. Guidance issued by the Scottish Housing Regulator in 2021 will further inform this strategy. Scottish Social Housing Charter Performance We submit an Annual Return on the Charter to the Scottish Housing Regulator annually in accordance with published guidance. We have agreed our approach to this through the North Ayrshire Network (NAN), a group of representatives from the various Registered Tenant Organisations in North Ayrshire. You can read about our approach in Customer Connections, our Tenant Participation Strategy 2017-22. Each year, we report on performance in our autumn edition of Tenancy Matters. The NAN work with us to agree the content of the report, which includes comparisons with previous years, other landlords and national performance. Within this report we identify how we will address areas for improvement and ask for feedback on our approach. 146
Page 147
Standard 1 – The customer / landlord relationship Outcomes: Equalities We promote equality and embrace diversity in all parts of Housing Services. All the information we produce is in line with the Council’s Communications Strategy. All leaflets, and a number of documents, are published in Plain English and can be made available in large print, braille, tape or CD, and can be translated on request. Communication Housing Services provide a comprehensive range of information available in some leaflets, on the Council website and on social media. The Tenant Editorial Panel approves all leaflets prior to issue to ensure they are fit for purpose and easy to understand. Our ‘tenant approved’ logo shows tenants have endorsed our publications. In recent years we have developed a social media profile through Facebook and Twitter to encourage digital engagement with a wider and more diverse customer base. We commission an independent organisation to undertake a tenant satisfaction survey at least every three years. The results of this help us to focus our efforts in improving communication and participation and understand what is important to our customers. We carried out our survey during summer 2021 with the next one scheduled for summer 2024. Participation The North Ayrshire Network (NAN) customer group has responsibility for ensuring that we continually improve the way we deliver services to tenants and customers. Part of their role is to challenge our performance against the indicators, outcomes and standards in the Charter. To do this, Housing Services report to the Network through presenting on performance both mid-year and prior to submitting the Charter annually, working together on developing our annual report to tenants and communicating any changes from the Scottish Housing Regulator directly to the group. Our Tenant Inspection Panel scrutinise one area of service per year. They can decide this independently through review of our performance information, or with support from Officers. Scrutiny provides an opportunity for tenants to drive improvement in the services most important to them. This process continued virtually during the pandemic. Customer Connections, our Tenant Participation Strategy for 2017 – 2022 encompasses and reflects the requirements of the Scottish Social Housing Charter and the Council’s priorities. These support communities’ tenants and residents to grow and develop opportunities for active engagement and participation for all citizens by listening to local needs and aspirations. 147
Page 148
Our latest tenant satisfaction survey told us that 92% of tenants are satisfied with the opportunities given to them to participate in our decision-making processes. Standard 2 – Housing quality and maintenance Outcomes: Quality of housing Our housing stock is in very good condition and is well maintained. We take a proactive approach to housing asset management and target improvements to ensure that our properties are SHQS and EESSH compliant. Properties are refurbished to ensure they remain attractive, meet modern requirements and tenant expectations. We have a range of planned maintenance programmes which are designed to achieve economies by replacing major element components just before they would otherwise require responsive repairs; anticipate changes in minimum acceptable standards; and reduce future requirements for cyclical maintenance. We have not met our legal obligations around tenant and resident safety during 2021/22 as we did not comply with gas safety legislation for 360 properties. Due to new legislation introduced during 2021/22 regarding electrical testing and smoke detection, 6,090 properties were non-compliant with regards to having an EICR and 735 for smoke detection. There is still ongoing reluctance by some tenants to grant access to their property due to their concerns about risk of COVID-19 transmission. Additional contracts were put in place to try and achieve this by the date given, however supply chain and labour shortages for contractors impacted the programme. All efforts were made to ensure compliance at the earliest opportunity and appropriate records were kept. We aim to have all EICRs and outstanding smoke detection by end of March 2023. Our ambitious Estate Based Regeneration Programme was approved in 2019 and makes financial provision for investment in our housing estates over a ten-year period. This includes a tenant led budget offering a participatory budgetary approach. Repairs, maintenance and improvements North Ayrshire Council is committed to delivering a high quality, efficient and effective reactive and planned maintenance service to all our tenants and factored owners in a manner which maintains high customer satisfaction. Our Repairs Policy sets out the service provided by the Council for repairs and maintenance and aims to ensure the needs of our current and future tenants are met in relation to the provision of high-quality housing. The policy was developed in consultation with tenant representatives. The average length of time taken to complete emergency repairs reduced from 3.45 in 2020/21 to 2.61 hours in 2021/22, and from 9.75 to 7.66 days for non-emergency repairs. The increase in performance is more in line with pre-pandemic figures whilst Building Services continued to comply with COVID-19 guidance and the shortage of materials and labour. 148
Page 149
Satisfaction levels of tenants who had repairs or maintenance carried out in the last 12 months decreased from 86.73% to 85.71% during the same period. This is based on responses from 98 tenants in 2021/22, which is the same amount as the previous year due to the survey process being impacted during the pandemic. An efficient and effective void repairs service provides a quick turnaround on empty properties, which helps to speed the repairs process and reduce void rent loss. Void performance is affected by the additional time taken to rehouse tenants from our regeneration projects. The Council agreed to demolish a number of blocks of flats and rehouse all tenants, with an enhanced package of works carried out in tenants’ new homes. A general increase in the number of properties requiring major works such as central heating, rewiring and full decoration has also impacted on performance. The average time taken to re-let properties has reduced from 27.13 days in 2020/21 to 22.38 days in 2021/22, with figures returning to pre-pandemic performance levels. A review of the void process is ongoing to identify further improvements. Standard 3 – Neighbourhood and community Outcome: Estate management, antisocial behaviour, neighbour nuisance and tenancy disputes Estate Management covers a broad range of situations and activities such as new tenant visits, permissions for garages and driveways in garden ground, abandoned tenancies, untidy gardens, neighbour disputes, problems with pets, abandoned vehicles, tackling graffiti and illegal dumping/fly- tipping. We have a comprehensive procedure manual to ensure we meet our responsibilities as landlord, and to support tenants to meet their responsibilities detailed in their Tenancy Agreement. Every effort is made to support tenants to address breaches of tenancy, however if a tenant is unwilling to do so, the Council will pursue appropriate legal action. The Safer North Ayrshire Partnership (SNAP), comprising of a range of community planning partners, works together to deliver the multi-agency SNAP strategy which includes how we work together to tackle antisocial behaviour (ASB) and low-level crime. We experienced an 17% decrease in reports of ASB during 2021/22. This was a 1.27% improvement in performance - as measured in line with the ARC indicator - compared to the previous year. The Council has locally agreed targets for the closure of cases, which are based on the complexity and level of investigation required to resolve them. Our performance against locally agreed targets is 99.3% of cases resolved within agreed timescales, against a target of 94%. Our last tenant satisfaction survey saw a decrease of 12% in tenants satisfied with the management of the neighbourhood they live in compared to the previous survey carried out in 2018. 149
Page 150
Standard 4 – Access to housing and support Outcomes: Housing options and access to social housing A pilot voids project commenced in January 2022, which saw mandatory void targets being replaced by timescales mutually agreed by the Housing Officer and Building Services supervisor, based on the amount of work required. Initial reports are very positive, and performance has improved significantly. The pilot will be rolled out across the whole of our stock and following a successful review, it is expected that the new processes will be implemented later in 2022. Housing management have periodic meetings with officers from North Ayrshire Health and Social Care Partnership (NAHSCP), who manage the process for aids and adaptations, and our Building Services team who carry out the majority of works in Council dwellings. This allows us to monitor performance and expenditure. To ensure ongoing improvement and quality of service provision, Occupational Therapy (OT) assessments are reviewed by Senior Occupational Therapists. NAHSCP has a formal Adaptations Criteria and Policy for all staff to adhere to whilst assessing adaptations. Joint complex case reviews are held monthly, with Partnership and Housing representation, before any complex adaptation is agreed. OT staff have been trained to explore housing options with all services for housing applicants who have long term conditions, to ensure that accessible housing needs are met where adaptations are not appropriate. These tiers of governance provide a formal procedure for all decision making, ensuring resources are targeted to those most in need of adaptations. Processes have, at times, been adapted in line with government and national policy updates arising from COVID-19. There has been a decline in adaptations performance, with the number of households waiting for an adaptation to their home increasing from 12 in 2020/21 to 142 in 2021/22. The average number of days to complete an approved adaptation has also increased from 54.79 to 74.33. A joint improvement group involving Housing, Building and Property Management and Investment and the Health and Social Care Partnership continues to review this process to consider ways to achieve the best outcome for tenants. Homeless people We experienced a 14% increase in homelessness during 2021/22 - this is a 4% increase on pre-pandemic homeless approaches. The most significant increase relates to relationship breakdown within family households. We also continue to experience high levels of homelessness as a result of domestic violence and people being asked to leave the family home. In partnership with Community Planning partners, we have undertaken a significant amount of work in relation to violence against women to tackle domestic violence. We have: • launched a Domestic Abuse Policy for North Ayrshire Tenants and Residents 150
Page 151
• launched a staff Domestic Abuse Policy • developed and implemented a Multi-Agency Risk Assessment Conference (MARAC) across the three Ayrshire Local Authorities and NHS Ayrshire and Arran • developed and implemented a safe contact initiative • undertaken a range of work across schools in North Ayrshire to highlight and tackle gender-based violence, including coercive behaviour We did not lose contact with any households during 2021/22 and we experienced a 17% reduction in withdrawn applications. Whilst there has been an increase of 35% in applications being resolved prior to assessment, we have determined that this is as a result of people returning to the family home; the ability to do this had reduced significantly during the pandemic. The proportion of applications assessed as ‘not homeless’ has increased by 26% and remains significantly higher than pre-pandemic levels. Analysis has determined that, in the main, this was as a result of households approaching the Council following a dispute with people within the wider community (74% of not homeless cases). Whilst they were deemed not homeless following investigation, these households were provided with appropriate advice and support, enabling them to return home or source alternative accommodation. We have continued to prioritise lets to homeless people during 2021/22, with 45% of all North Ayrshire Council allocations being made to this group. This has resulted in an increase of households being housed into settled accommodation of 12%. These figures do not include allocations made to households threatened with homelessness, who are awarded insecurity of tenure points within our allocation policy which, when added to the above, takes the level of households resettled into a council tenancy to 47%. Our duration of homelessness has decreased from 28 weeks (196 days) pre-pandemic to 23 weeks (161 days) during 2021/22. Again this is as a result of increased lets to homeless. We have had no breaches of the Unsuitable Accommodation Order and have ensured that temporary accommodation continues to be available for anyone who needs it. Our inter-agency Rapid Rehousing Transition Plan (RRTP) details our ambitious targets for allocations to homeless households over five years, based on robust independent modelling. It also details our approach to Housing First and temporary accommodation provision. During 2021/22 we: ➢ Continued with the implementation of our Housing First Plan - we now have 60 tenancies created for our most complex households; ➢ Worked with national partners, including health colleagues, to identify further opportunities to prevent homelessness across North Ayrshire; ➢ Undertook renovations to our short stay hostel, improving the quality of accommodation available; ➢ Prioritised lets to homeless households and reduced the duration of homelessness. Standard 5 – Getting good value from rents and service charges Outcomes: 151
Page 152
Value for money Our robust Housing Revenue Account Business Plan provides clear strategic direction, ensuring that effective short, medium and long-term financial planning is undertaken. This clearly details how we will plan for, and deliver, key priorities such as compliance with the Scottish Housing Quality Standard and EESSH, investment in our current stock, our Council house building programme and rent setting. The Business Plan was developed by a cross stakeholder working group which included representation from elected members, tenant representatives and officers from within Housing, Property Management and Investment and Financial Services. This approach ensured balanced decision-making that can stand up to both internal and external scrutiny. The Plan provides a platform to develop an effective performance management and reporting framework that makes certain that we continue to provide value for money services to our tenants and, at the same time, keep rents at affordable levels. This is achieved while recognising that we are currently operating within an ever-changing and evolving economic environment that requires the flexibility to change and adapt. The plan is easily accessible to stakeholders. It provides information to demonstrate that the Council has a clear picture of its strategic direction and the associated financial position of the service to deliver this, over the 30-year planning period. This plan is reviewed annually, and we are focused on providing value for money through a number of measures, such as operating robust financial management processes, implementing value for money principles, exploring efficiency opportunities, and managing competitive contractual arrangements. 89% of tenants felt that the rent for their property represents good value for money during our last tenant satisfaction survey. Rents and service charges Our rent levels remain lower than the national average, however we continue to invest significantly in our existing stock and new house building programme. We face challenges in, for example, changes to welfare reform, demographics and the housing stock profile. We are committed to delivering services in new, improved and more cost-effective ways. Standard 6 – Other customers Outcomes: Gypsy/travellers North Ayrshire Council provides services, advice and assistance to Gypsy/Travellers who live permanently in North Ayrshire and to those who visit on a temporary basis. North Ayrshire manages one permanent site at Redburn Grove, Irvine. The site has 16 pitches, and each pitch has its own amenity block with separate kitchen, shower, toilet facilities and utility room. A community room is available on site for partner services to meet tenants and their children within a safe and comfortable environment. The room is used by several Services, including: Education, the Welfare Reform 152
Page 153
Advice team, Tenancy Support, the Community Link team and a regular GP surgery. Our Tenant Participation Team also support Redburn Grove tenants to hold regular tenants’ meetings. The meetings allow tenants the opportunity to work in partnership with Council staff as we consider the options for current and future service provision. Six of the families who were digitally excluded were issued with Chromebooks and Wi-Fi access for two years as part of the Connecting Scotland initiative. This will help these low-income households with employment support, attendance at virtual tenant meetings, and with engagement more generally. In 2016 the Scottish Government introduced minimum standards for Gypsy Traveller Sites across Scotland. North Ayrshire Council achieved the minimum standards at Redburn Grove; however we recognise that significant capital investment is required to ensure that it continues to meet expected standards. Work to replace kitchens within each amenity unit was completed in June 2021. This was the first phase of expenditure from the Council’s £0.074m share of the Scottish Government’s £2m capital investment fund. The second phase of the project included the installation of gates to every pitch, door replacement in the amenity units and the resurfacing of pitches. These projects were highlighted by the tenants as their priority for improvements on the site. The Scottish Government has developed a draft design guide for Gypsy/Traveller sites to be used for new sites or major refurbishments of existing sites. The design guide has been provided to give advice on what good quality, culturally appropriate accommodation should look like. The Scottish Government have also made available a new capital fund to run for five years from 2021-25. In October 2020, Scottish Government/COSLA sought views on likely future investment needs over the next five years. NAC responded that approximately £2.5m funding would be required in year three for Redburn Grove. The Scottish Government has outlined the criteria for the fund, including how residents and travelling community members must be involved, together with a process for project selection. Future improvement proposals for the Redburn site will follow on the completion of our engagement with current tenants, to confirm their preferences for future housing. Our response to unauthorised encampments is consistent and in line with the policy issued by the Scottish Government. Our Gypsy/Traveller Encampment Officer works to build relationships with visiting families to assess their needs. Where necessary they make referrals to partner organisations and provide advice on housing options, if required. The Officer also works closely with other landowners and members of the settled community and provides advice and assistance regarding the rights and responsibilities of Gypsy/Travellers who visit North Ayrshire. Refugees In 2015, North Ayrshire Council pledged a commitment to participate in the UK Government’s Syrian Resettlement Programme. The Council agreed to resettle 160 vulnerable Syrian refugees over a four-year period and to coordinate the programme, a Refugee Support Team was introduced to deliver the required objectives. This service, along with input from Community Planning Partners such as the Health and Social Care Partnership, Education, Department of Work and Pensions, Police Scotland and voluntary organisations, delivers robust resettlement packages to assist families to integrate into the local area and access vital services to meet their individual needs. The Council has fully participated in the Syrian Resettlement Programme and, due to meeting its initial target numbers earlier than expected, increased its pledge on two further occasions, taking the overall total to 211 refugees (43 families). The Council agreed to continue its humanitarian commitment and to participate in a new global resettlement programme, with the aim of resettling a further 30 refugees throughout 2020/21. This was paused due to COVID-19 restrictions on movement both overseas and in the UK. The programme recommenced; however, plans to resettle the 30 refugees by March 2022 have been interrupted by our response to the conflict in Ukraine. 153
Page 154
We have also provided support for families fleeing the conflict in Afghanistan, following the withdrawal of American and NATO forces in August 2021. We will continue to support these resettlement programmes and add to the 36 Afghan nationals (8 families) who have already arrived. More recently, the Council has responded to the humanitarian crisis created as a result of the conflict in Ukraine. We have pledged a significant number of Council properties to be used to provide accommodation for people fleeing the conflict. We are also providing support, advice, and assistance to those who have settled within the homes of North Ayrshire residents. We have set up a Welcome Hub within a local hotel to provide interim emergency accommodation and support to individuals and families while they await a more appropriate housing option. We will continue to monitor the situation in Ukraine and will increase our pledge of assistance, should that be required. 154