7 - IA annual report 2022-23
North Ayrshire Council · 30 May 2023
Back to Audit and Scrutiny Committee — 30 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 30 May 2023 Audit and Scrutiny Committee Title: Internal Audit Annual Report 2022/23 Purpose: To provide the Committee with an annual report on the work of Internal Audit during 2022/23 and provide an opinion on the governance, risk management and internal control environment of the Council. Recommendation: The Committee is asked to note the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 1. Executive Summary 1.1 The purpose of this report is to present the annual report on the internal audit activity during 2022/23, and to provide an independent opinion on the adequacy and effectiveness of the Council’s governance, risk management and internal control systems for the year ended 31 March 2023. 2. Background 2.1 The Public Sector Internal Audit Standards (PSIAS) require that the Chief Internal Auditor prepares an annual report on the activities of Internal Audit and that the report should contain a view on the adequacy of the Council’s governance, risk management and internal control frameworks. The annual report for 2022/23 is attached at Appendix 1 and outlines the role of Internal Audit, the performance of the section during the year and the key audit findings. It also contains the annual internal audit opinion. 2.2 The required annual report for financial year 2022/23, together with the statement on internal controls, is included in Appendix 1. 2.3 The revised internal audit plan for 2022/23 (approved by the Audit and Scrutiny Committee in September 2022) has been substantially completed. Audit fieldwork remains in progress on six assignments. One audit assignment is at draft report stage, meaning the assurance opinion can be included in the overall annual audit opinion. 2.4 All audit findings during the year support and inform the objective opinion of the Senior Manager (Audit, Fraud, Safety and Risk) on the adequacy of the Council’s
Page 2
governance, risk management and internal control environment. The assurance category given to each individual audit informs the overall level of assurance. 2.5 The annual internal audit opinion also contributes to the Annual Governance Statement which is published as part of the Council’s annual accounts and is included under separate cover to this Audit and Scrutiny Committee meeting for approval. 2.6 Based on the audit work carried out, the opinion of the Senior Manager (Audit, Fraud, Safety and Risk) is that reasonable assurance can be placed on the adequacy and effectiveness of the Council’s systems of governance, risk management and internal control. 3. Proposals 3.1 It is proposed that the Committee notes the content of the annual report and the opinion of the Senior Manager on the Council’s governance, risk management and internal control environment. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None.
Page 3
5. Consultation 5.1 Council Services are consulted on the findings of Internal Audit throughout the year. No specific consultations have taken place in relation to this annual report. Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 4
Appendix 1 INTERNAL AUDIT ANNUAL REPORT 2022/23 1. Introduction 1.1. The purpose of this report is to summarise the Internal Audit activity for 2022/23 and provide an opinion on the overall adequacy and effectiveness of the Council’s governance, risk management and internal control frameworks. 1.2. The Council’s Section 95 Officer has overall responsibility for Internal Audit in North Ayrshire Council. The Senior Manager (Audit, Fraud, Safety and Risk) reports to the Section 95 Officer, with the right of access to the Chief Executive and the Chair of the Audit and Scrutiny Committee on any audit matter. These rights of access help ensure the organisational independence of Internal Audit. 1.3. The presence of an effective internal audit function contributes towards, but is not a substitute for, effective control. It is the responsibility of management to have adequate controls in place and to ensure these controls are operating effectively. A sound control system will help safeguard assets, ensure records are reliable, promote operational efficiency and ensure adherence to Council policy and procedure. Such systems of internal control can provide only reasonable and not absolute assurance against loss. 2. Reporting requirements of the Public Sector Internal Audit Standards (PSIAS) 2.1. Internal Audit operates in accordance with the PSIAS requirements and is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. 2.2. Internal Audit operates within the Internal Audit Charter, most recently approved by the Audit and Scrutiny Committee in March 2023. 2.3. The PSIAS places a number of reporting obligations on the Chief Internal Auditor in respect of the annual report. These obligations are summarised below: PSIAS Ref Requirement Evidence 1110 The chief audit executive must confirm to the board, at least annually, the organisational independence of the internal audit activity. The Senior Manager reports directly to the Audit and Scrutiny Committee, and unfettered access is available to the Chief Executive as required. 1320 The results of the quality and assurance programme and progress against any improvement plans must be reported in the annual report. The results of the external quality assessment, carried out in 2022, were reported to the Audit and Scrutiny Committee in September 2022. An update against the action plan is included in Annex B.
Page 5
PSIAS Ref Requirement Evidence 2450 The chief audit executive must deliver an annual internal audit opinion and report that can be used by the organisation to inform its governance statement. This report to Audit and Scrutiny Committee provides the annual report and statement of assurance on internal controls. 2450 The annual internal audit opinion must conclude on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control. This report to Audit and Scrutiny Committee provides the annual statement of assurance at Annex C. 2450 The annual report must also include a statement on conformance with the Public Sector Internal Audit Standards and the results of the quality assurance and improvement programme. This report to Audit and Scrutiny Committee provides a statement on the conformance with the PSIAS at Section 5 below. 3. Planned and Actual Activity during 2022/23 3.1. The internal audit plan was approved by the Audit and Scrutiny Committee in March 2022 with a mid-year change to the plan approved in September 2022. ‘Productive’ time is allocated in the plan to the delivery of audit assignments with a balance of time retained within the service for ‘non-productive’ activities which includes management and strategy, attendance at meetings, administration and staff training and development. 3.2. The mid-year revised plan included 26 assignments where an audit output was anticipated. 16 of these have been completed, one is at draft report stage, six are work in progress, and three are deferred. The results of the draft reports and work in progress assignments will be reported to a future meeting of the Audit and Scrutiny Committee. 3.3. In line with the Council’s defalcation procedures, all instances of suspected fraud and irregularity should be reported to Internal Audit. These are investigated by the specialist Corporate Fraud Team and are not included within this annual report. 3.4. All audit reports finalised during 2022/23 were reported to meetings of the Audit and Scrutiny Committee. A summary of outputs achieved are included in Annex A. 3.5. Detailed below are the most significant findings from the audit work finalised during 2022/23: • A non-fraud investigation identified control weaknesses within a Council establishment particularly around financial procedures and cash controls. Remedial action has been taken to enhance cash handling training within the service, with a further action to enhance the procedures in place. Further work has been carried out by Internal Audit across similar establishments, with
Page 6
Reasonable assurance concluded in those other areas. This provides some assurance that the weaknesses identified during the investigation are not systemic. • A programme of audit work is in place relating to cyber resilience, with the planned audit work following the categories and domains contained within the Scottish Government’s Cyber Resilience Framework. One report was issued in early 2022/23 which had a limited assurance opinion. As a result of this, a formal follow up review was also carried out by Internal Audit during the year. The follow up concluded with Reasonable assurance, with some further areas for improvement identified. • A review of Off-Payroll Working (IR35) identified that adequate procedures had been implemented corporately, including guidance for services as well as an iLearn module training course. However the findings from the services reviewed identified that there was limited assurance over operational application of IR35 regulations. This area will be considered again soon in a forthcoming audit plan. 3.6. These findings, together with those from other audits carried out and the individual assurance levels detailed above, contribute to the annual internal audit opinion in Annex C of this report. 4. Audit Resources 4.1. The Internal Audit section is directly managed by the Team Manager (Internal Audit), who reports to the Senior Manager (Audit, Fraud, Safety and Risk). The Senior Manager is responsible for Internal Audit, as well as Corporate Fraud, Risk and Insurance and Corporate Health and Safety. 4.2. As well as the Team Manager, the Internal Audit team consisted of two part-time Internal Auditors as well as a part-time Computer Auditor. 4.3. All staff within the section hold a relevant qualification, either through an institute which is part of the Consultative Committee of Accountancy Bodies (CCAB) or the Institute of Internal Auditors (IIA). 4.4. The Internal Audit Charter requires the Senior Manager to report to the Section 95 Officer and the Audit and Scrutiny Committee if resources available fall below an acceptable level for the audit work required. No instances of resource limitation have occurred during 2022/23. 5. Performance 5.1. During 2022/23, Internal Audit provided regular updates to the Audit and Scrutiny Committee on the activities of the service. Elected Members had the opportunity to discuss all Internal Audit reports and question either the Senior Manager or relevant officers from Council services. The Senior Manager also carried out Elected Member training to the Committee in May 2022. 5.2. The Council’s performance management system, Pentana, is used to follow-up on audit action points. Officers with responsibility for implementing audit actions are required to update the system and updates are provided to the Audit and Scrutiny Committee on a quarterly basis. Where actions are overdue, officers are required to
Page 7
attend the Committee to update Elected Members on plans to ensure that actions are implemented. 5.3. The Senior Manager is required to confirm annually internal audit’s compliance with the Public Sector Internal Audit Standards (PSIAS). A significant achievement during 2022/23 was the successful completion of the External Quality Assessment. Under the terms of the PSIAS, each organisation’s Internal Audit team is required to undertake an External Quality Assessment (EQA) at least once in each five-year period. This helps to ensure compliance with the standards. 5.4. A peer to peer review network of the Scottish Local Authorities Chief Internal Auditors Group (SLACIAG) is in place. The review of the Council's Internal Audit team was completed by West Dunbartonshire Council and was reported to the Audit and Scrutiny Committee in September 2022. The review assessed the compliance of the Council's Internal Audit team with the 14 sections of the PSIAS and noted that the team fully conforms with 13 of the standards and generally conforms with the remaining one. Overall the assessor was able to provide substantial assurance that the Council's Internal Audit team complies with the requirements of the PSIAS. There were four minor routine recommendations for improvement which will further improve compliance. All actions are completed and the details of this are included in Annex B. In summary, the Internal Audit service continues to conform with the PSIAS. 5.5. A range of performance indicators are used to monitor performance within the section, and these are detailed in the table below, along with the two previous years’ actual figures. These are tracked by the Team Manager on a quarterly basis and are discussed with audit staff to review performance and identify opportunities for development. 2020/21 Actual 2021/22 Actual 2022/23 Target 2022/23 Actual Percentage of auditor time spent productively 82% 82% 87% 83% Training days per auditor 4.2 days 5.8 days 3.6 days 4.4 days Audits completed in budgeted days 24% 23% 75% 33% Final reports issued 22 22 n/a 25 Draft reports issued within 21 days of fieldwork completion 83% 81% 100% 91% Final reports issued within 14 days of return of action plan 95% 100% 100% 96% Actions implemented on time by Council services 68% 83% 80% 73% Ad-hoc requests for advice from Council services 63 requests 27 requests n/a 51 requests 5.6. While some of the indicators are slightly below target, it is important to note that the key measure of internal audit is the achievement of organisational value and this is demonstrated in the volume of activity noted in Annex A and the significant progress made in achieving the risk based internal audit plan. 5.7. With regard to ‘audits completed in budgeted days’, this remains below target however this reflects the completion of individual audit assignments rather than the
Page 8
audit plan as a whole. Most audits which exceeded the budgeted days did so by only a day or two. 5.8. Internal Audit has a strong working relationship with all Council services and is frequently asked for audit advice on an ad-hoc basis. The volume of these requests is outwith the control of Internal Audit however it is noted that there has been a return to a higher level of requests than in 2021/22. The significant level of requests in 2020/21 was particularly high, and an immediate response to changed processes and procedures relating to Covid-19 arrangements in light of new working practices. 5.9. The Internal Audit section also calculates two annual performance indicators which are required by the CIPFA Directors of Finance group. These are as follows: 2020/21 2021/22 2022/23 Productive days achieved per audit plan 86.47% 85.36% 83.90% Cost of Internal Audit per £1m of net expenditure £529.51 £491.13 £457.33 5.10. ‘Productive days achieved per audit plan’ is lower than in previous years however it should be noted that this indicator reflects back to the original internal audit plan approved in March 2022 as the base point, rather than the mid-year revision approved by Audit and Scrutiny Committee in September 2022. The indicator therefore does not capture the adaptive nature of internal audit and the need for flexibility during the year. There are two main reasons for the indicator being lower than in previous years: sickness absence has been higher during the year than anticipated at the outset and the Senior Manager spent more time on other duties than anticipated due to unplanned commitments, including preparing a response to the Scottish Covid-19 inquiry. The methodology for this indicator will be reviewed during 2023/24 to identify if this flexibility, also encouraged by the PSIAS, can be captured going forward. 5.11. The ‘cost of Internal Audit per £1m of Council net expenditure’ was £457.33 in 2022/23, a decrease from £491.13 in 2021/22. The lower cost in 2022/23 is due to the same reasons noted above, that the Senior Manager spent more time on other duties within the remit of the post, particularly around Health and Safety and Insurance. The indicator also reflects that risk management has been incorporated back within the team which has lowered the proportion of the Senior Manager’s time spent in audit. 6. Other Responsibilities 6.1. The Senior Manager is also the Chief Internal Auditor for the North Ayrshire Integration Joint Board (NAIJB). In the interests of information sharing, the results of the NAIJB audit work are shared with the Audit and Scrutiny Committee. 7. Opinion 7.1. There is a formal requirement for the Chief Internal Auditor to prepare an assurance statement on the adequacy of internal control systems within the Council. The internal audit annual statement on the adequacy of internal controls is included in Annex C. 8. Conclusion 8.1. The 2022/23 internal audit plan has been satisfactorily completed. There are no limitations of scope to the issued audit opinion.
Page 9
Summary of Internal Audit Work 2022/23 Annex A Type Audit Opinion Reported to A&S Committee Actions Arising Priority 1 Priority 2 Priority 3 Total COMPLETED WORK Investigation Visit to a Care Establishment Limited/Reasonable 15/11/2022 4 2 0 6 Assurance Off-Payroll Working (IR35) Limited/Substantial 27/09/2022 5 0 1 6 Assurance Accounts Payable Transaction Testing Q4* Reasonable 27/09/2022 1 0 0 1 Assurance Leavers and Movers Processes* Reasonable 27/09/2022 1 0 0 1 Assurance VAT* Reasonable 27/09/2022 1 0 0 1 Assurance Funding Support to Businesses* Reasonable 27/09/2022 0 0 0 0 Assurance Accounts Payable Transaction Testing Q2 Reasonable 31/01/2023 2 0 0 2 Assurance Cyber Resilience Network Security Controls Reasonable 31/01/2023 0 1 1 2 Assurance Financial Controls within ASN and Primary Schools Reasonable 28/03/2023 1 3 0 4 Assurance Social Care Establishments Reasonable 28/03/2023 3 0 0 3 Assurance Compliance with the Cyber Resilience Framework Follow Up Reasonable 30/05/2023 1 1 0 2 Assurance Museums and Heritage Assets Reasonable 30/05/2023 0 0 0 0 Assurance Accounts Payable Transaction Testing Q4 Reasonable 30/05/2023 1 0 0 1 Assurance Social Media* Substantial 27/09/2022 0 0 0 0 Assurance CM2000* Substantial 27/09/2022 0 1 1 2 Assurance Care Home Admissions* Substantial 15/11/2022 0 0 0 0 Assurance Roads Stores Controls Substantial 15/11/2022 0 0 0 0 Assurance Building Services Procurement Substantial 15/11/2022 0 0 0 0 Assurance Facilities Management Procurement Substantial 31/01/2023 0 0 0 0 Assurance Transport – Journeys and Hires Substantial 31/01/2023 0 0 0 0 Assurance Scottish Housing Regulator Annual Assurance Statement Substantial 31/01/2023 0 0 1 1
Page 10
Summary of Internal Audit Work 2022/23 Annex A Type Audit Opinion Reported to A&S Committee Actions Arising Priority 1 Priority 2 Priority 3 Total Assurance Gifts and Hospitality Substantial 31/01/2023 0 0 0 0 Annual Accounts Community Councils n/a n/a n/a n/a n/a n/a Annual Accounts Tenants and Residents Associations n/a n/a n/a n/a n/a n/a REPORTING PHASE** Assurance Glow Reasonable tbc 0 4 0 4 WORK IN PROGRESS Assurance Payroll Transaction Testing Q1/Q3 tbc tbc tbc tbc tbc tbc Assurance Income Collection tbc tbc tbc tbc tbc tbc Assurance Employee Services – HR Payroll System/Processes tbc tbc tbc tbc tbc tbc Assurance ICT Supplier Management tbc tbc tbc tbc tbc tbc Assurance ASN Provision tbc tbc tbc tbc tbc tbc Assurance Early Years Provision tbc tbc tbc tbc tbc tbc OTHER/ONGOING Consultancy O365/Information and Collaboration Project Board n/a n/a n/a n/a n/a n/a Consultancy Ayrshire Growth Deal n/a n/a n/a n/a n/a n/a Consultancy Municipalisation Project Board n/a n/a n/a n/a n/a n/a Consultancy Education Maintenance Allowance (EMA) n/a n/a n/a n/a n/a n/a Consultancy Aids and Adaptations Working Group n/a n/a n/a n/a n/a n/a Small Advisory 51 various requests n/a n/a n/a n/a n/a n/a * 2021/22 audit but not sufficiently concluded at the time of the 2021/22 annual report, therefore opinion included 2022/23. ** Audits not yet finalised but sufficiently in draft to conclude on the level of assurance.
Page 11
External Quality Assessment July 2022 – Action Plan Progress Annex B No Importance Recommendation Management Response Responsible Officer/ Agreed Completion Date Status 1 Routine The Internal Audit Charter should be enhanced to provide specific reference to the “Mission of Internal Audit” at its next review. This will be incorporated into the next iteration of the Internal Audit Charter, which is due for review at the next audit planning round for 2023/24. Laura Miller, CAE 31 March 2023 Complete 2 Routine The Chief Audit Executive has recognised the need to improve the documentation of the audit risk assessment process and the overall assurance process. Consideration should also be given to the inclusion of the risk factors which have influenced the audit plan in relation to the risk-based audit assurance work in the covering report. Work commenced to improve the documentation of the risk assessment at the 2022/23 audit planning process. In addition, the overall assurance process was also more fully documented at the time the annual internal audit report and opinion for 2021/22 was produced. Further action will also be taken during the 2023/24 internal audit planning process to document the risk factors which have influenced the audit plan and ensuring these are referenced within the covering report. Laura Miller, CAE 31 March 2023 Complete 3 Routine The Chief Audit Executive has recognised the need for referencing audit work to the strategic and service risk registers within the audit planning process. The audit universe was amended for the 2022/23 audit planning process to include reference to the strategic and service risk registers. Laura Miller, CAE Complete Complete 4 Routine The Chief Audit Executive has recognised the need to include a specific section on exclusions within the audit programme. It is recommended that where exclusions are identified that these are also included in the draft and final reports issued to management. Standard templates relating to the audit engagement (the audit programme and the audit report) will be amended to capture the need to document exclusions from the scope of the audit. This will also be reflected in the Audit Manual. Laura Miller, CAE 30 September 2022 Complete
Page 12
Annex C Internal Audit Annual Statement on the Adequacy of Internal Controls To the Members and Chief Executive of North Ayrshire Council As Chief Internal Auditor for North Ayrshire Council, I am pleased to present my annual statement on the overall adequacy and effectiveness of the framework of governance, risk management and control of the Council for the year ended 31 March 2023. Respective responsibilities of management and internal auditors in relation to governance, risk management and control It is the responsibility of the Council’s senior management to determine, establish and maintain sound systems of governance, risk management and control to ensure that the organisation’s resources are properly applied in a manner and on the activities intended and that these arrangements are sufficient to address the risks facing their services. This includes responsibility for the prevention and detection of fraud. Management is also charged with monitoring the continuing effectiveness of these arrangements and taking action as appropriate. It is the responsibility of the Chief Internal Auditor to provide an annual assessment of the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control. Sound internal controls The main objectives of the Council’s internal control systems are to: • ensure adherence to management policies and directives in order to achieve the organisation’s objectives; • safeguard assets; • ensure the relevance, reliability and integrity of information, so ensuring as far as possible the completeness and accuracy of records; and • ensure compliance with statutory requirements. Any system of control can only ever provide reasonable and not absolute assurance that control weaknesses or irregularities do not exist or that there is no risk of material errors, losses, fraud, or breaches of laws or regulations. Accordingly, the Council is continually seeking to improve the effectiveness of its systems of internal control. The work of internal audit Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. The Internal Audit section operates in accordance with United Kingdom Public Sector Internal Audit Standards (PSIAS) which came into force with effect from 1 April 2013 (updated in March 2017). The requirements under PSIAS represent best practice and are mandatory.
Page 13
Annex C The Chief Internal Auditor prepares an annual internal audit plan which outlines the programme of work to be undertaken. The plan is developed utilising a risk-based methodology and takes into account the requirement placed upon the Chief Internal Auditor to deliver an annual internal audit opinion. The plan needs to be flexible to reflect the changing risks and priorities of the organisation. The plan, and any material changes to the plan during the year, are approved by the Audit and Scrutiny Committee. All internal audit reports are brought to the attention of management, including system weaknesses and/or non-compliance with expected controls, together with agreed action plans. It is management’s responsibility to ensure that due consideration is given to internal audit reports and that appropriate action is taken on audit recommendations. This includes management taking remedial action where appropriate or accepting that there may be a level of risk exposure if the weaknesses identified are not addressed for operational reasons. Internal Audit is required to ensure that appropriate arrangements are made to determine whether action has been taken on internal audit recommendations or that management has understood and assumed the risk of not taking action. Matters arising from internal audit work are also reported to the Chief Executive, Head of Finance (as Section 95 Officer), Members of the Audit and Scrutiny Committee, and external audit. Summary of Internal Audit Activity 2022/23 A total of 22 internal audit reports have been issued during 2022/23. Nine audit opinions give substantial assurance and 11 reasonable assurance. Two reports with a wider scope have combined audit opinions of Limited/Reasonable and Limited/Substantial. A further audit report is in draft and anticipated to have a Reasonable assurance opinion. A diverse range of audit areas have been covered during the year. As well as planned assignments, Internal Audit also offers advice and guidance on the Council’s control environment as and when required and will carry out non-fraud investigations which are brought to our attention. A range of recommendations have been raised in the areas covered by the 2022/23 internal audit plan. Many expected key controls have been in place and operating effectively, however Internal Audit has also identified scope for improvement in some systems. All 32 action points raised in the year have been accepted by management and will result in continued improvement of the Council’s governance, risk management and control environment. Basis of Opinion The evaluation of the control environment is informed by a number of sources: • the audit work undertaken by Internal Audit during the year to 31 March 2023; • the audit work undertaken by Internal Audit in previous years and knowledge of any significant audit findings after the year end; • the assessment of risk completed during the preparation of the annual audit plan; • reports issued by the Council’s external auditors and other review and inspection agencies; • knowledge of the Council’s governance, risk management and performance monitoring arrangements; and
Page 14
Annex C • any other items brought to the attention of internal audit by whatever means which may warrant further investigation. Opinion On the above basis, Internal Audit can provide reasonable assurance over the framework of governance, risk management and control and that adequate controls were in place and were operating throughout the Council in 2022/23. Laura Miller FCCA Senior Manager (Audit, Fraud, Safety & Risk) 30 May 2023