10 - 2023 05 30 IA reports issued
North Ayrshire Council · 30 May 2023
Back to Audit and Scrutiny Committee — 30 May 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 30 May 2023 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed between March and April 2023. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission and consideration of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed between March and April 2023. Internal control reviews have been completed in respect of the areas detailed in Appendix 1 to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix 1 includes the report and action plan from each audit. 2.3 The findings from two separate audit assignments are detailed at Appendix 1 to this report and the levels of assurance for each are noted in the table below:
Page 2
Audit Title Assurance Level Museums and Heritage Assets Reasonable Accounts Payable Transaction Testing Q4 Reasonable 3. Proposals 3.1 It is proposed that the Committee considers the outcomes from the Internal Audit work completed between March and April 2023. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 4
MUSEUM AND HERITAGE ASSETS 1 Background 1.1 The Council currently holds around 10,000 museum and heritage assets over several locations. 1.2 A combination of manual records and document management software are used to record and track the movement of these assets. Both the manual documents and software comply with accreditation standards set by the Collections Trust. 2 Objectives and Scope 2.1 The objective of this audit is to ensure:- • a detailed and accurate asset register is being maintained • there are sufficient controls around the addition, disposal and lending of assets • risk associated with the imminent software change have been considered and mitigated • risks facing the Service are being considered and mitigated wherever possible. 3 Findings Asset Register 3.1 The Service made it clear from the outset of the audit that historical issues have resulted in a number of asset records being either incomplete or missing. 3.2 The Service provided Audit with a multi-stage plan to correct this, although also highlighted the time-consuming nature of the task along with resourcing limitations meaning that no final date has been set for the completion of the task. 3.3 The Service also highlighted that whilst all efforts are being made to complete records, there are historical instances where paperwork was never generated. 3.4 Heritage asset information is held by Financial Management as part of the Council’s fixed asset register and Corporate Insurance as part of the Council’s insurance policy. 3.5 Reliance is placed on Heritage Officers, with support from external valuers, identifying assets of value and ensuring these are included in the registers noted in 3.4. 3.6 Audit compared the list of assets held by Financial Management to that held by Insurance. 3.7 One collection of books valued at £100,000 on the Financial Management register was not listed on the Insurance policy. Arrangements to get an updated valuation with the intention of adding the collection to the insurance policy were made during the course of the audit.
Page 5
Additions, Disposals and Lending of Assets 3.8 The Service has a detailed procedure document which sets out the process involved in adding, disposing or loaning assets. 3.9 Audit reviewed a sample of 5 recent additions to Adlib, the collections management system, to ensure that records are being created in detail, with copies of all relevant manual documents being scanned and attached to the electronic record. No issues were noted. 3.10 No assets have been disposed of since 1 April 2022. 3.11 The Council has one asset currently on long-term loan to the National Museum of Scotland. 3.12 The Service was able to provide copies of the loan agreement and indemnity insurance certificate for the asset. System Upgrade 3.13 Adlib has been bought over by Axiell. The support for the existing software will soon end and therefore the Service is considering migrating its data from Adlib to Axiell Collections software. 3.14 Moving to Axiell would mean a change is the way that Council data is stored. Currently Adlib is hosted on a Council server and is therefore subject to Council security and back-up processes. Axiell would not be hosted in-house, but would instead be hosted by the software company. 3.15 Axiell would host the software within one of its data centres and would also take responsibility for managing server hardware, operating systems, data back-up and disaster recovery on behalf of the Council. 3.16 At the conclusion of the Audit, the Service was still in discussion with Axiell over the location of their data centres. There is a risk associated with Council data leaving the UK or EU as it loses the protection of GDPR and therefore the Service is looking to confirm that data will be held either be held within the EU or within a country that the UK has an adequacy arrangement in place with. 3.17 The Service is also in the process of testing the Axiell software to ensure it will fulfil all the Council requirements. 3.18 The Service has confirmed that no data migration will occur until the points noted at 3.16 and 3.17 are suitably resolved. If these points cannot be resolved to the satisfaction of the Service, consideration will be given to other software suppliers. Risks 3.19 There are a number of risk associated with the holding and storage of Heritage assets – there is the need to maintain specific levels of humidity, light and temperature in order to protect certain assets.
Page 6
Physical Risks to assets 3.20 The Council has a ‘Conservation and Care Plan’ that sets out the steps that will be taken to prevent any harm to the Council’s collection. This Care Plan covers areas such as:- • Provision of suitable building conditions • Environmental monitoring • Environmental controls • Housekeeping • Interventive conservation • Handling, moving and transport • Expertise, advice and services 3.21 Audit selected a sample of the controls listed in the above document for review and found:- • As part of the Museum’s Accreditation, the security of the Heritage Centre was assessed by the Police. The Service has confirmed that recommendations resulting from this visit were implemented. • Display cases are of museum accredited standard. • The temperature of assets held within the Heritage Centre is controlled via air-conditioning. The Council has a contract for the maintenance and annual servicing of these units. • Sensors within the Heritage Centre record light levels, UV levels, humidity and temperature daily. Software alerts Officers if any reading falls outwith a reasonable range. • The Garrison does not have sensors fitted, although Officers do take manual readings whilst on site. • The placement of assets outwith the Council’s two museums is undertaken on a case by case basis. The suitability of the environment and security on site will be considered prior to placing an asset. Financial Risk 3.22 The Service is working through having its assets assessed by a professional valuation company. This allows financial values to be attached to assets for Insurance purposes. All items valued at > £10,000 are added to the Council policy during the annual Insurance renewal process. Risk to asset records 3.23 The Service is working to correct historical record keeping issues (as noted in paragraph 3.2). 3.24 Manual records are stored in a fireproof safe, which Audit viewed during a site visit. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained during the audit.
Page 7
4.2 The Service is working to improve the quality of its records by reviewing incomplete historical records and, if the information is available, updating them. 4.3 The most pressing issue facing the Service is the decision on whether to move to Axiell Collections software. At the conclusion of this Audit, the Service is still working to assess the suitability of the hosting arrangement for the software along with working on confirming the adequacy of its functionality. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 8
ACCOUNTS PAYABLE TRANSACTION TESTING Q4 1 Background 1.1 This audit used computer audit software called IDEA (Interactive Data Extraction and Analysis) to interrogate the Accounts Payable (AP) System and examined any anomalies which arose. 1.2 There were 47,068 invoices paid to trade and sundry suppliers during the period of the audit totalling just over £151 million. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • duplicate invoices have not gone undetected. • invoices paid to employees are bona fide. 2.2 The audit period was 1st July 2022 to 31st December 2022. This audit will be carried out again in quarter 2 of 2023/24. 3 Findings Invoice Tests 3.1 The auditor tested for duplicate invoices for payments to suppliers and identified 184 possible duplicates that were investigated further. This confirmed that 69 were duplicates but had already been identified and action taken by the AP team. This testing therefore identified 19 potential duplicate invoices totalling £11,629.93 and one potential duplicate credit note totalling £109.34, which have not already been identified by the AP team. The potential duplicates have been passed to the AP team to check and arrange recovery. (Action a) 3.2 There were 77 invoices with a payment date before the invoice date. Testing was carried out on a sample of 10 and in 9 cases the invoice date was keyed incorrectly and had not been paid in advance. In 1 case the due date was keyed as no invoice date was noted on the invoice. However, it should be noted that most of the invoices were paid a week or less in advance. 3.3 There were 159 invoices with a payment date more than 1 year after the invoice date. Testing was carried out on a sample of 10 and in 6 cases the correct invoice date was keyed and there was either a significant delay in the receipt of invoice or a significant delay in payment of invoice. The other 4 had the dates wrongly keyed. Financial Management confirmed that there are no VAT implications when paying invoices more than 1 year old. However, it should be noted that invoice date keying errors will impact the monitoring of paying invoices on time. Creditors to Payroll Data Match
Page 9
3.4 The auditor tested for employees who have been paid via Integra. There were 55 supplier bank details matching an employee’s bank details. All invoices paid to these suppliers were checked and there were no concerns to note. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the controls around the processing of invoices, in particular to preventing duplicate invoices being processed as the number of potential duplicates identified is relatively low. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 10
KEY FINDINGS AND ACTION PLAN ACCOUNTS PAYABLE TRANSACTION TESTING Q4 Action a Finding Testing identified 19 potential duplicate invoices totalling £11,629.93 and one potential duplicate credit note totalling £109.34, which have not already been identified by the AP team. Action Description AP should review the potential duplicate invoices and arrange for recovery of monies paid twice. Risk The Council has paid the same invoice twice and the money has not been recovered. Priority (1, 2, 3) 1 Paragraph Reference 3.1 Managed by Mark Boyd, Head of Service (Finance) Assigned to Suzanne Quinn, Senior Manager (Corporate Procurement) Due Date 31st May 2023 Management Comment The Accounts Payable Team will investigate the 19 potential duplicate suppliers by 31st May 2023 and report findings and action taken to remove to Internal Audit. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.