4 - 2023 01 31 IA reports issued
North Ayrshire Council · 31 January 2023
Back to Audit and Scrutiny Committee — 31 January 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 31 January 2023 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed between November and December 2022. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission and consideration of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed between November and December 2022. Internal control reviews have been completed in respect of the areas detailed in Appendix 1 to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix 1 includes the report and action plan from each audit. 2.3 The findings from five separate audit assignments are detailed at Appendix 1 to this report and the levels of assurance for each are noted in the table below:
Page 2
Audit Title Assurance Level Facilities Management Procurement Substantial Accounts Payable Transaction Testing Q2 Reasonable Gifts and Hospitality Substantial Transport – Journeys and Hires Substantial Scottish Housing Regulator Annual Assurance Statement Substantial 3. Proposals 3.1 It is proposed that the Committee considers the outcomes from the Internal Audit work completed between November and December 2022. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Insurance), on 01294 324524. Background Papers None.
Page 4
FACILITIES MANAGEMENT PROCUREMENT 1 Background 1.1 Facilities Management (FM) procurement was last audited in 2017/18. 2 Objectives and Scope 2.1 The objective of this audit was to ensure:- • FM are taking steps to minimise food waste in schools • The environmental impact is considered when making food purchases • The Council’s Standing Orders relating to Contracts are being applied when procuring throughout FM (ie for Catering, Janitorial and Cleaning purchases) • GPC cards (procurement cards) are being used appropriately 3 Findings Food Waste 3.1 FM have confirmed they are taking the following steps to minimise food waste within schools:- • All primary school pupils must pre-order their lunches. This means Catering staff know exactly what meals they need to prepare. • Secondary school pupils have the option to pre-order their meals. Whilst this is not mandatory, it does give some guidance to Catering staff. • Software is used to analyse and report on popular menu choices and analyse meal uptakes in secondary schools. This supports Catering staff in planning production quantities. • Annual menu consultations are undertaken to ensure meal choices are popular, which helps minimise food waste. 3.2 The above confirms that FM are working to minimise food waste. Environmental Impact 3.3 North Ayrshire Council has been awarded a Gold Food for Life Award from the Soil Association for 106 of its sites. All the Council's schools, except one Academy which is a commercial kitchen, early learning centres and private early learning centres supplied by FM catering feature on the Gold Award list. 3.4 In order to obtain the gold award FM had to show its menus are healthy, ethical, use lots of local ingredients, supports good animal welfare practices and sustainable farming methods. 3.5 The Soil Association annually audits the Council’s application prior to issuing an award. 3.6 Audit has placed reliance on the Soil Association’s assessment, and subsequent award. Standing Orders
Page 5
3.7 Due to the high volume of catering purchases, FM have approval to use GPC cards to pay for catering supplies, so long as the Council has a contract with the supplier. 3.8 Catering and janitorial purchases are invoiced and processed via Integra. 3.9 Irrespective of the method of payment, the Council’s Standing Orders must be applied to all purchases. 3.10 Audit selected a sample of 19 suppliers paid via invoice, and 12 suppliers paid via GPC card - with varying levels of actual spend - and reviewed the contract in place to ensure if complied with Standing Orders. 3.11 No issues were noted – appropriate contracts were identified for all 31 suppliers tested, and only catering suppliers had been paid via GPC card. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard FM procurement. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 6
ACCOUNTS PAYABLE TRANSACTION TESTING Q2 1 Background 1.1 This audit used computer audit software called IDEA (Interactive Data Extraction and Analysis) to interrogate the Accounts Payable (AP) System and examined any anomalies which arose. 1.2 There were 4,161 active Trade Suppliers (for processing payments to standard suppliers, individuals, and social services) and 479 Sundry Suppliers (for processing one-off sundry payments) on Integra as at 01/07/22. 1.3 There were 49,891 invoices paid to trade and sundry suppliers during the period of the audit totalling just over £151 million. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • duplicate suppliers are identified and de-activated to minimise the risk of duplicate invoices being paid. • duplicate invoices have not gone undetected. • advance payments have been reported to Financial Management for the list of pre-payments at financial year-end. • high value invoices have been properly authorised. • invoices paid to employees are bona fide. 2.2 The audit period was 1st January 2022 to 30th June 2022. This audit will be carried out again in quarter 4. 3 Findings Supplier Tests 3.1 Testing was carried out to identify duplicate trade suppliers on the system. Testing identified 28 duplicate suppliers either by supplier name or bank details. These were passed to the AP team to review and deactivate as appropriate. (Action a) 3.2 Testing also highlighted 14 active suppliers with no bank details recorded on Integra. These were passed to the AP team for information purposes. Invoice Tests 3.3 The auditor tested for duplicate invoices for payments to suppliers and identified 193 possible duplicates that were investigated further. This confirmed that 65 were duplicates but had already been identified and action taken by the AP team. This testing therefore identified 8 potential duplicate invoices totalling £15,781.40, which have not already been identified by the AP team. The potential duplicates have been passed to the AP team to check and arrange recovery. (Action b) 3.4 There were 104 invoices with a payment date before the invoice date. Testing was carried out on a sample of 10 and in 5 cases the invoice date was keyed
Page 7
incorrectly and in 5 cases the invoice date was keyed correctly and has been paid in advance. However, it should be noted that most of them were paid a week or less in advance. 3.5 There were 320 invoices with a payment date more than 1 year after the invoice date. Testing was carried out on a sample of 10 and in 6 cases the correct invoice date was keyed and there was a significant delay in the receipt of invoice. In one case an invoice was dated 07/12/16 and was received 03/03/22. The other 4 had the dates wrongly keyed. Financial Management confirmed that there are no VAT implications when paying invoices more than 1 year old. However, it should be noted that invoice date keying errors will impact the monitoring of paying invoices on time. 3.6 The Team Leader (Procurement) advised a reminder will be issued to users that process invoices about the importance of accuracy when entering invoice dates. Advance Payment Tests 3.7 The auditor tested for round sum amounts over £20,000 to help identify any advance payments. There were 40 invoices found meeting this criterion plus an additional 10 payments over £20,000 were randomly selected that were not round sum amounts. This resulted in 22 being passed to Financial Management to confirm the correct action had been taken ahead of the annual accounts being closed. The Financial Management review confirmed the correct action had been taken and no adjustments were required. High Value Payment Tests 3.8 There were 1,639 invoices between £10,000 and £100,000 and 15 were selected for audit testing and the auditor noted the following: • Testing found that 1 HSCP invoice for £64,783.80 had been approved by 4 different Care at Home Managers but 3 are not authorised signatories and one approved above their approval limit. The Business Support Officer will arrange for the Care at Home Managers to be added to the authorised signatory list. • Testing found one Building Services invoice for £93,308.31 had been approved by an authorised signatory but it was above their approval limit. The Senior Officer agreed to only authorise invoices within their approval limit. • There were 3 invoices with no payments over £10k report attached. 3.9 There were 236 invoices over £100,000 totalling £72,444,332.32 and 15 were selected for audit testing and the auditor noted the following: • 1 invoice had no payments over £10k report attached. Creditors to Payroll Data Match 3.10 The auditor tested for employees who have been paid via Integra. There were 31 supplier bank details matching an employee’s bank details. All invoices paid to these suppliers were checked and there were no concerns to note. 4 Internal Audit Opinion
Page 8
4.1 Overall, reasonable assurance was obtained with regard to the controls around the processing of invoices, in particular to preventing duplicate invoices being processed as the number of potential duplicates identified is relatively low. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 9
KEY FINDINGS AND ACTION PLAN ACCOUNTS PAYABLE TRANSACTION TESTING Q2 Action a Finding Testing was carried out to identify duplicate trade suppliers on the system. Testing identified 28 duplicate suppliers either by supplier name or bank details. These were passed to the AP team to review and deactivate as appropriate. Action Description Procurement should review the list of duplicate suppliers and de-activate suppliers as appropriate. Risk Duplicate invoices may be paid to the same supplier via different supplier numbers. Priority (1, 2, 3) 1 Paragraph Reference 3.1 Managed by Mark Boyd, Head of Service (Finance) Assigned to Suzanne Quinn, Senior Manager (Corporate Procurement) Due Date 30th November 2022 Management Comment The Accounts Payable Team will investigate the 28 potential duplicate suppliers by 30/11/2022 and report findings and action taken to remove to Internal Audit. Action b Finding Testing identified 8 potential duplicate invoices totalling £15,781.40, which have not already been identified by the AP team. Action Description AP should review the potential duplicate invoices and arrange for recovery of monies paid twice. Risk The Council has paid the same invoice twice and the money has not been recovered. Priority (1, 2, 3) 1 Paragraph Reference 3.3 Managed by Mark Boyd, Head of Service (Finance) Assigned to Suzanne Quinn, Senior Manager (Corporate Procurement) Due Date 30th November 2022 Management Comment The Accounts Payable Team will investigate the 8 potential duplicate invoices totalling £15,781.40 by 30/11/2022 and recover where appropriate or to notify Internal Audit why the duplicate payment is legitimate. Recovery of funds can take several months. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 10
GIFTS AND HOSPITALITY 1 Background 1.1 Directorates are responsible for recording gifts and hospitality in compliance with the Council’s guidance in the Employee Code of Conduct. 1.2 The HR Operations team are accountable for the Employee Code of Conduct document. 1.3 Previous audit work completed in 2017 identified 6 actions in relation to communicating and recording gifts and hospitality. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • All employees are made aware of the Employee Code of Conduct and have access to an up-to-date copy • Gifts and hospitality are being recorded by services as required in the Employee Code of Conduct and that gifts and hospitality are only being accepted as permitted by the code. 3 Findings 3.1 The Code of Conduct document is available to all employees with IT network access. Copies for employees who do not have IT access should be provided by the service. 3.2 New starts receive the Code of Conduct via their offer of employment. 3.3 The HR Operations team put reminders regarding the requirements of the Code of Conduct in relation to Gifts and Hospitality in the “People Matters” newsletter, which is distributed to all employees, in November 2019, December 2020 and December 2022. 3.4 Six current Gifts and Hospitality registers were provided by services. These follow a standard format recorded on a mixture of Microsoft Word and Excel documents. 3.5 A sample of records recorded in the registers indicated that there were no items of substantial value recorded. Where required they have been appropriately authorised. Some services have recorded all donations which ensures transparency. Cash donations were returned to the donors with a covering letter. 3.6 Education has issued guidance to parents and carers advising them to consider not giving gifts to school staff. 3.7 No potential conflict of interest or potential collusion with suppliers was identified from the registers provided. 3.8 No whistle blowing incidents were identified.
Page 11
4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to compliance with the Employee Code of Conduct in respect of Gifts and Hospitality. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 12
TRANSPORT – JOURNEYS AND HIRES 1 Background 1.1 The Council’s Corporate Transport Hub manage and coordinate mainstream and additional support needs (ASN) school transport. School transport is delivered in partnership with Strathclyde Partnership for Transport (SPT), taxi contractors and/or parents/carers to ensure the most efficient, suitable and economical use of resources to support children and young people to access their educational entitlement. 1.2 The Transport Hub also manage and coordinate transport for the Health and Social Care Partnership (HSCP) which are requested for service users who are eligible according to the HSCP Policy and Procedures document. 1.3 A new IT system, Flexi Route, for managing journeys and hires, was implemented in 2021. This system interfaces with Integra but the invoices paid via this interface are stored in the Corporate Transport Hub’s shared drives. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure that: • suitable policies and procedures are in place in relation to the provision of transport to pupils and service users • processes for appointment of contractors comply with the Council’s Standing Orders for Contracts, are equitable and obtain value for money • controls are in place to restrict access to personal and sensitive data and adhere to the GDPR • processes are in place to pay contractors promptly and accurately. 2.2 The audit focussed on journeys provided by taxi contractors rather than those provided by SPT. 3 Findings Policies and Procedures 3.1 Transport policy documents were provided by Education and HSCP and no issues were noted. 3.2 The Corporate Transport Hub are in the process of producing a suite of procedure documents for staff, including screenshots from the Flexi Route system. The procedures were reviewed by the auditor. Feedback was provided with some suggested minor improvements. Appointment of Contractors 3.3 The Corporate Transport Hub provided a list of ledger codes they use to charge invoices for transport contractors. Details of invoices charged to these codes
Page 13
over a 12-month period were extracted from Integra and analysed to identify the contractors. This identified 58 suppliers, 9 of which were in receipt of over £100,000. 3.4 A sample of contractors from the analysis at 3.3 was selected for further testing. Contract and tender documentation was held either on the Corporate Transport Hub’s shared drives or the Corporate Procurement Unit’s shared drive, depending on the type of document. All the sample contractors had been appointed as part of a large procurement exercise run in co-operation between these two teams, known as a Dynamic Purchasing System (DPS). All the documentation required for audit was available and no issues were identified. 3.5 There isn’t a routine contract monitoring regime per se, but all vehicles are subject to regular inspection by the Council’s Transport Garage. The Corporate Transport Hub investigate any issues raised during these inspections or by parents, carers and Council employees within their own team or others. They may request a face-to-face meeting with the contractor and have an escalation process if contract terms and conditions have been breached, including warning letters and eventual termination of contract. They involve the Council’s Legal team before issuing any written warnings. 3.6 The Corporate Transport Hub hold a record of variations to contract in their shared drive. 224 variations during a 12-month period were identified from review of these records and a sample were selected for further testing. If the variation results in a change of less than 5 miles in a route, then the price paid to the contractor doesn’t change. No issues were identified from the review of the sample variations. Data and IT Security 3.7 Service User data is held in the Corporate Transport Hub shared drive, for which access is restricted to the Transport Hub team, and the Flexi Route system, which also has access restricted to the Transport Hub team and a small number of users in client teams. 3.8 At the time of audit testing, there were 29 users set up in Flexi Route and 16 of them had admin access, which is a high proportion of the small number of users. This is because certain functions can only be completed with the admin access. The Team Manager confirmed that the user list is kept under review and certain users would only have access for a limited time, such as Internal Audit and Transformation team members. 3.9 Sensitive data is transmitted to contractors to allow them to provide the required service. It is emailed to them in a protectively marked email or occasionally, if they require hard copies, they must come into the Transport Hub to receive the information in person. All contractors are required to sign a Data Processing and Sharing Agreement. 3.10 All of the contractors in the sample at 3.4 had signed the Data Processing and Sharing Agreement with the Council as part of the contract documentation.
Page 14
Payment of Contractors 3.11 A sample of payments to contractors was tested to ensure that the journeys and pricing were in line with the contracts and correctly authorised and the invoices were arithmetically correct, ledger postings were correct and VAT invoices contained the required details. No issues were noted. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the administration of pupil and service user transport by the Corporate Transport Hub. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 15
SCOTTISH HOUSING REGULATOR ANNUAL ASSURANCE STATEMENT 1 Background 1.1 The Scottish Housing Regulator (SHR) is responsible for monitoring, assessing, and reporting on social landlords’ performance. A regulatory framework is in place to support the SHR with this task. 1.2 This framework requires the Council to submit an Annual Assurance Statement (AAS) stating whether all requirements of the regulations have been met. 1.3 The Council’s Audit & Scrutiny Committee is responsible for approving the AAS prior to its submission. 2 Objectives and Scope 2.1 The objective of this audit is to ensure there is sufficient evidence to support the statements made in the Council’s 2021/22 AAS. 3 Findings 3.1 The Scottish Federation of Housing Associations (SFHA) has a self-assessment toolkit to help social landlords assess their compliance with regulatory requirements. 3.2 Recording detailed responses to the questions in the toolkit helps provide evidence of compliance by creating an audit trail of the Council’s decision making process. 3.3 Whilst this toolkit has been used by the Council in prior years, it wasn’t updated in 2021/22. (action point a) 3.4 There are 5 requirements covered within the SHR regulations for ‘Assurance and Notification’. Audit has asked Housing to provide evidence of compliance for each of these. Requirement 1 of ‘Assurance and Notification’ regulation:- Prepare an Annual Assurance Statement in accordance with our published guidance, submit it to us between April and the end of October each year, and make it available to tenants and other service users. 3.5 The Annual Assurance Statement for the financial year ending 31 March 2022 was presented to, and approved by, the Audit & Scrutiny Committee on 27th September 2022 and submitted to the SHR later the same day. 3.6 A copy of the 2021/22 Assurance Statement, along with a supporting evidence document has been made available to tenants via the Council’s website. 3.7 There is sufficient evidence to confirm compliance with Requirement 1. Requirement 2 of ‘Assurance and Notification’ regulation:-
Page 16
Notify us during the year of any material changes to the assurance in its Assurance Statement. 3.8 Housing confirmed that no material changes occurred during the year, therefore no notifications were made to the SHR. 3.9 Housing explained that any significant issues arising with the completion of compliance testing ie gas safety testing, ensuring properties are EICR (Electrical Installation Condition Reports) compliant and the installation of smoke detection equipment would be highlighted immediately by PMI (who are responsible for managing the testing programme) 3.10 In addition, the progress of all capital programmes managed by PMI, including compliance testing, are discussed at the Housing Asset Management Board (HAMB) meetings, which are held every 2 months. 3.11 Audit obtained copies of the most recent minutes from the HAMB and confirmed there was evidence of compliance testing/housing programmes being discussed. 3.12 Housing have demonstrated that any significant issues with compliance would be highlighted by ongoing monitoring processes. This would allow a timely disclosure to the SHR. Audit has accepted this as sufficient evidence of compliance with Requirement 2. Requirement 3 of ‘Assurance and Notification’ regulation:- Have assurance and evidence that it is meeting all of its legal obligations associated with housing and homelessness services, equality and human rights, and tenant and resident safety. 3.13 Housing directed Audit to the Council’s 2020/21 Assurance Toolkit as evidence of compliance. 3.14 Housing has confirmed that a review of the 2020/21 toolkit was undertaken prior to relying on it as evidence for 2021/22. 3.15 Audit selected a sample of the evidence sources listed in the 2020/21 toolkit and asked Housing to prove that these remain relevant in 2021/22. 3.16 Policies and procedures help Housing ensure that legal requirements are being met by providing Officers with a detailed framework within which to operate. Audit selected a sample of 3 of the policies/strategies noted in the toolkit and confirmed these remain available to Council Officers during 2021/22. 3.17 Performance monitoring helps Housing remain focussed on meeting its targets. Audit requested copies of the most recent minutes for 3 of the performance monitoring groups noted in the toolkit – as evidence that these groups are still meeting regularly. 3.18 Whilst 2 of the 3 groups listed no longer meet, Housing were able to provide minutes from 2 alternative groups that cover performance monitoring (action point a).
Page 17
3.19 In addition to the above, Audit asked for:- • A copy of the annual report to the Scottish Government re the RRTP (rapid re-housing transition plan) – as this confirms the monitoring of the Council’s ongoing works and improvements in the area of homelessness • A copy of the most recent Scottish Statistical Bulletin – as this would list any incidences of the Council providing unsuitable temporary accommodation. • A copy of the most recent care inspectorate review covering the Council’s support provider status for homeless applicants - as this shows the Council has a robust process in place for such applications 3.20 All of the above documents were provided by Housing. 3.21 The Council declared it didn’t achieve all its compliance testing within the 2021/22 AAS – 360 gas safety checks were not completed during the year, 6090 properties were not EICR (Electrical Installation Condition Reports) compliant, and 735 properties did not have the new smoke detection equipment installed. 3.22 Audit obtained copies of the reports from PMI which confirmed the accuracy of the above statistics. 3.23 Audit has accepted the above as sufficient evidence of compliance with Requirement 3. Requirement 4 of ‘Assurance and Notification’ regulation:- Notify us of any tenant and resident safety matters which have been reported to or are being investigated by the Health and Safety Executive, or reports from regulatory or statutory authorities, or insurance providers, relating to safety concerns. 3.24 Housing has confirmed that no issues were reported to the Health and Safety Executive in 2021/22. 3.25 Regular meetings are held with the Council’s Health & Safety team which would highlight any reported safety matters to the Housing team. 3.26 Audit has accepted the explanation from Housing as sufficient evidence that Requirement 4 has been met. Requirement 5 of ‘Assurance and Notification’ regulation:- Make its Engagement Plan easily available and accessible to its tenants and service users, including online. 3.27 Housing directed Audit to the ‘Tenant Participation’ section on the Council website. 3.28 This section provides a link to the SHR website through which users can access the Council’s Engagement Plan. 3.29 It also provides a link to the Council’s ‘Customer Connections Strategy’ and makes it clear that this document takes into account the requirements of the Scottish Social Housing Charter.
Page 18
3.30 Information for tenants such as the tenant handbook, annual performance information, quarterly newsletters, and advice on how tenants can participate in future decision making is also available. 3.31 Audit has accepted the information available via the Council’s website as sufficient to meet Requirement 5. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard the evidence to support the Council’s 2021/22 AAS. 4.2 The re-introduction of the Assurance Toolkit would provide a more concise audit trail of the assurance decision reported in the AAS. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 19
KEY FINDINGS AND ACTION PLAN SCOTTISH HOUSING REGULATOR ANNUAL ASSURANCE STATEMENT Action a Finding The SFHA Assurance Toolkit wasn’t updated when completing the 2021/22 Annual Assurance Statement. Action Description The Assurance Toolkit should be updated each when completing the Annual Assurance Statement. The toolkit should provide audit evidence of the current processes and procedures within the Council. Risk Prior year toolkits may not reflect current processes. Priority (1, 2, 3) 3 Paragraph Reference 3.3; 3.18 Managed by Yvonne Baulk, Head of Service (Housing and Public Protection) Assigned to Fiona Ellis, Senior Manager (Housing Strategy & Development) Due Date 30th June 2023 Management Comment The aim for 2023 is to have the Annual Assurance Statement presented to Audit & Scrutiny prior to the summer recess and immediately after the ARC submission to the Scottish Housing Regulator. Therefore, the toolkit will be reviewed and updated prior to the end of June 2023. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.