8 - 2023 03 28 IA action points follow up Q3
North Ayrshire Council · 28 March 2023
Back to Audit and Scrutiny Committee — 28 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 28 March 2023 Audit and Scrutiny Committee Title: Internal Audit and Corporate Fraud Action Plans: Quarter 3 update Purpose: To advise the Audit and Scrutiny Committee on the progress made by Council Services in implementing the agreed actions from Internal Audit and Corporate Fraud reports as at 31 December 2022. Recommendation: That the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 1. Executive Summary 1.1 The CIPFA document 'Audit Committee Principles in Local Authorities in Scotland' highlights that Audit Committees should monitor and review the progress made in implementing audit recommendations. 1.2 Service managers are responsible for ensuring that agreed actions arising from Internal Audit and Corporate Fraud reviews are implemented. This provides assurance that identified control weaknesses have been addressed and are being managed effectively. 1.3 All actions are monitored on the Pentana system and service managers are responsible for updating Pentana as they progress each action. This enables Internal Audit to monitor progress on a 'real-time' basis and address any delays in implementation. 1.4 This report details the position at 31 December 2022. 2. Background 2.1 The last report to the Audit and Scrutiny Committee on 15 November 2022 highlighted that there were 13 actions outstanding at the end of September 2022: one that had not been started or were only partially implemented and 12 where the due date had not yet passed.
Page 2
2.2 In addition to these 13 carried forward actions, there have been 12 new actions agreed, giving a total of 25 action points for review. 2.3 Services have completed 16 actions since the last report. All Council Services are required to retain evidence of work carried out in completing their actions and Internal Audit carries out 'spot-checks' on a sample of completed actions on an ongoing basis. 2.4 Of the remaining nine actions, eight were either not started or only partially complete at 31 December 2022 and the remaining action was not due for completion until after that date. 2.5 Appendix 1 to this report provides the Committee with full details of the eight actions that were not completed within the agreed timescales. 3. Proposals 3.1 It is proposed that the Committee (a) notes the current position with the implementation of Internal Audit and Corporate Fraud actions; and (b) challenges those Services that have not implemented actions within the previously agreed timescales. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The effective implementation of agreed Internal Audit and Corporate Fraud actions helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024.
Page 3
Community Wealth Building 4.7 None. 5. Consultation 5.1 Council Services are consulted during the completion of each Internal Audit and Corporate Fraud review and have also provided updates on progress made in implementing action points. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 4
4 Actions due by 31st December 2022 but not started or partially complete Code CFT3120f Description Audit Action: Education Service should consider routes to recover the embezzled funds as recommended for any financial loss to the Council, through fraudulent activity, in its Counter Fraud and Corruption Strategy. Audit Risk: Loss of council funds, No deterrent or consequences for wrongdoing or breach of Council policy, procedures and regulations. Priority 1 Latest Note Legal Services have advised the Service not to progress recovery until the outcome of the court case is known, as the court may impose repayment on the subject. The case is currently still pending at court. Next review date, as agreed with Audit, is 30 April 2023. Progress Bar Original Due Date 30-Apr-2022 Due Date 31-Oct-2022 Parent Code & Title CFT3120 Allegation against an Education Business Assistant (Early Years) Managed By Lindsay Morris Assigned To Lindsay Morris
Page 5
5 Code IA2017PA020b Description Data protection information awareness for schools training should be agreed and implemented as soon as possible. Priority 1 Latest Note There is only one school left to complete this training, which is Garnock Campus. Sessions have been arranged at this school twice, in November 2022 and February 2023, and on both occasions these were cancelled at short notice due to trainer availability. The Head of Service (Democratic Services) has given a commitment that the training will proceed at the next agreed date, which is 30th May 2023. Progress Bar Original Due Date 01-Jun-2018 Due Date 22-Nov-2022 Parent Code & Title IA2017PA020 Email Controls In Education Managed By Andrew McClelland Assigned To Susan Lauder Code IA2019IJB001d Description HSCP Management should work with officers from East and South Ayrshire HSCP’s to progress the fair share methodology at the earliest opportunity, including developing detailed Directions with commissioning plans Priority 1 Latest Note The pan Ayrshire work on Directions has recommenced and workstreams have been agreed to take forward the elements in relation to - Integration Schemes, Set Aside, Joint Commissioning Plans and Lead Partnership Arrangements. Expected completion date 31st March 2024. Progress Bar Original Due Date 31-Mar-2019 Due Date 31-Dec-2022 Parent Code & Title IA2019IJB001 IJB Lead Partnership Arrangements Managed By Caroline Cameron Assigned To Caroline Cameron
Page 6
6 Code IA2020PA007a Description Audit Action: Carefirst should be considered as a storage location for holding all relevant placement information – as a replacement to the current systems being used. This would ensure that all data is held securely against each young person’s record, whilst remaining accessible to those with appropriate system access rights. In addition, Carefirst could be used to hold financial cost information on each placement. This would reduce the reliance on spreadsheets. Audit Finding: Highly sensitive young person placement data is being kept in paper files by Education, with no direct electronic equivalent being available. Risk: Data loss due to paper files not being backed up; inability to locate highly confidential data; GDPR breaches Priority 1 Latest Note We now have a secure filing system for all Psychological Service files - Fast Online Referral Tracking (FORT) - we still need to complete archiving our paper files. Archiving is expected to be complete by the end of June 2023. Progress Bar Original Due Date 31-Dec-2019 Due Date 31-Dec-2022 Parent Code & Title IA2020PA007 External Residential and Education Placements Managed By Caroline Amos Assigned To Gail Nowek
Page 7
7 Code IA2021PA009b Description Audit Action: The team should liaise with the Transformation team to streamline this part of the process and reduce the number of times the same information must be keyed. Audit Finding: The admin team are required to update the budget monitoring spreadsheet, an operational access database and the CareFirst system at each stage of this process for all council tenant jobs. In addition, the access database is not supported by IT Services. Risk: Inefficient use of staff time and increased risk of keying errors. Priority 2 Latest Note We are currently working with the Eclipse team to build the Community OT process into the system. We are hoping to capture reporting information within this process. Unfortunately there have to be no new developments to CareFirst therefore this will be hopefully come into place by August 23. We are also running our budget reports from Integra and validating the information against our old process. Once we are confident that this is accurate the database and some of the fields in the spreadsheet can be reduced. Validation will run for approximately 3 months. Progress Bar Original Due Date 31-Dec-2021 Due Date 31-Dec-2022 Parent Code & Title IA2021PA009 Aids and Adaptations Managed By David Thomson Assigned To Lynn Kirkland
Page 8
8 Code IA2022PA019b Description Audit Action: A minimum technical standard for CCTV systems should be set for the Council. A Council-wide audit of CCTV inventory should be carried out to assess compliance of CCTV assets against the standards, which will give an indication of the level of capital investment required to bring the Council’s CCTV systems up to an appropriate standard and form the basis of a bid for capital. An approval process should be introduced to ensure new CCTV purchases meet the requirements of the standards. Audit Finding: Audit were advised that there are various capital budgets in place covering vehicles and property lifecycle investment. However, there is no formal replacement programme for CCTV equipment. Risk: Substandard systems that aren’t fit for the intended purpose. CCTV footage is not available or not usable when required. Priority 2 Latest Note The corporate asset register for all CCTV systems has been completed, however it is evident that the data which has been returned by the services requires to be further scrutinised in terms of both the DPIA’s and the physical assets reported. Work, including cross checking with other council data sets, is underway to ensure that all systems have been recorded and Protective Services are exploring the best method of capturing the physical data. The options being explored for this are either establishing an in-house team or utilising the existing the CCTV maintenance contracts and a budget pressure bid of £40K has been submitted for 23/24 to commence this work as soon as possible. Protective Services are, on request, currently advising on the operational requirements for new or replacement systems to ensure compliance for projects ongoing at the moment. This process will be finalised and formally embedded once the quantity and quality of the physical assets has been fully determined. The Corporate CCTV policy, published in August 2022 is being kept under review to take account of industry best practice and developments. Work is underway to rollout the I-Learn CCTV awareness course for those operating and responsible for CCTV systems which is anticipated to “go-live” on 10th March 2023. Note that that this essentially forms phase 1 of a wider project to have fully compliant council CCTV systems, subsequent phases being the physical asset surveys, then the prioritised replacement/removal programme. The quantum on funding required
Page 9
9 will be established on completion of the physical surveys. Expected completion of audit action by end of financial year 2023/24. Progress Bar Original Due Date 30-Jun-2022 Due Date 31-Dec-2022 Parent Code & Title IA2022PA019 CCTV in Council Buildings and Vehicles Managed By Aileen Craig Assigned To Mark Boyd; Russell McCutcheon Code IA2023PA006b(1) Description Action Description: Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Finding: IR35 is not being considered, evidenced, and applied consistently throughout the Council. Risk: Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority 1 Latest Note This has been progressing – we identified Lynne Ferguson (Business Support) and Lee Thomson (Finance) to be the experts around IR35 and undertake the training, who could then be a point of contact for managers who were looking at engaging someone via an agency. 3 of the CFJ SMT have now completed the training. New completion date: 31/3/23 Progress Bar Original Due Date 31-Oct-2022 Due Date 31-Oct-2022 Parent Code & Title IA2023PA006 Off Payroll Working (IR35) Managed By Alison Sutherland Assigned To Alison Sutherland
Page 10
10 Code IA2023PA006b(2) Description Action Description: Services should revisit all agency staff transactions in 21/22 and assess whether these could have fallen within the scope of IR35. All decisions should be evidenced, and if deemed within the scope of IR35 appropriate corrective action should be taken. Finding: IR35 is not being considered, evidenced, and applied consistently throughout the Council. Risk: Council faces fines and penalties from HMRC for not correctly applying IR35 legislation. Priority 1 Latest Note This has been progressing - we identified Lynne Ferguson (Business Support) and Lee Thomson (Finance) to be the experts around IR35 and undertake the training, who could then be a point of contact for managers who were looking at engaging someone via an agency. 1 of the MH SMT has now completed the training New completion date 31/3/23 Progress Bar Original Due Date 31-Oct-2022 Due Date 31-Oct-2022 Parent Code & Title IA2023PA006 Off Payroll Working (IR35) Managed By Thelma Bowers Assigned To Thelma Bowers