6. 2023 09 05 IA reports issued
North Ayrshire Council · 5 September 2023
Back to Audit and Scrutiny Committee — 5 September 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 5 September 2023 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed between May and August 2023. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission and consideration of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed between May and August 2023. Internal control reviews have been completed in respect of the areas detailed in Appendix 1 to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix 1 includes the report and action plan from each audit. 2.3 The findings from five separate audit assignments are detailed at Appendix 1 to this report and the levels of assurance for each are noted in the table below: Agenda Item 6
Page 2
Audit Title Assurance Level Glow Reasonable Transport Substantial Payroll Transaction Testing Reasonable ASN Provision Reasonable Income Collection Reasonable 3. Proposals 3.1 It is proposed that the Committee considers the outcomes from the Internal Audit work completed between May and August 2023. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2023-2028. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 4
GLOW 1 Background 1.1 Glow is Scotland’s national digital learning platform provided by the Scottish Government and managed by Education Scotland. It provides learners and educators across Scotland with an environment that can support learning across the whole curriculum through the core services such as Microsoft M365, Google Workspace for Education and WordPress blogs. 1.2 The scope of the audit was restricted to staff use and did not cover pupil use. 1.3 Every staff member and pupil will be set up with a Glow account. SEEMiS is a supported management information system used in Scottish local authority schools to record pupil information such as personal information and attendance. Glow accounts are provisioned based on the data received from SEEMiS. 1.4 There is one tenancy for all Scottish Local Authorities. The system is a single sign on, so once a user has been authenticated, they will gain access to Google and Microsoft software and apps. 1.5 The Glow Connects website provides Glow Policy documents and this includes the Data Privacy Impact Assessment which assesses the privacy implications associated with the use of Glow. One of the risks states “teaching staff may use Glow to store sensitive information”. The Education Scotland response states that the Glow Community Rules makes it clear that sensitive information must not be stored or shared in Glow. 2 Objectives and Scope 2.1 The objectives of the audit are to ensure that: • Appropriate guidance and staff training is provided to Glow users, focusing on the storage, and sending of personal/sensitive data. • There is a robust process in place for new starts, movers and leavers and strong password controls are in place. • Access to administrator roles is restricted to a small number of key staff and there is an approval process in place for adding new applications. • Every school has at least 2 corporate email accounts for sending personal/sensitive data and are advised they should be used for such purpose. • There are proper controls in place for the data synchronisation process between SEEMiS and Glow. 3 Findings Guidance and Staff Training 3.1 There are several guidance documents available on the Glow Connects website. A Glow Information document is issued to all probationers and reissued to existing staff annually. This guidance refers to the additional guidance provided on the Glow Connects website rather than incorporating it within the guidance. Although guidance is available to users, there is no mandatory local guidance that
Page 5
Glow users are asked to read and sign up to that ensures there is evidence users have been made aware that personal and sensitive data should not be stored in Glow or shared via Glow email. The Information for Educators document on the Glow Connects website should be incorporated into the mandatory local guidance. In addition, there is no guidance issued to a new Glow user when advised via email that a new account has been set up and the login details are provided to ensure they are advised of the rules before using the system. (action a) 3.2 There is no mandatory training provided to Glow users which incorporates the types of data suitable to store and send via this system. (action b) User Access Controls 3.3 The Password Guidance recommends the use of passphrases which is in line with the Acceptable Use Policy. The auditor was provided with the password policy for NA Central which requires a strong password for teaching staff and non- teaching staff and a very strong password for administrators. Although each school can amend their password policy, the password strength can only be increased from that evidenced at NA Central and cannot be weakened. There are no findings to note from this testing. 3.4 It was not possible to obtain a full list of all Glow users so the auditor selected a sample of 5 primaries, 5 academies and the NA Central location to perform various audit tests. User testing identified the following findings which were passed to the Digital Development Officer to review and action: • There were 55 users that did not match to the Payroll system. • There were 50 users with a Teaching role in Glow that had no GTC number on the Payroll system, indicating they should have been allocated a non-teaching role. • There were 26 duplicate users by testing same first name and surname. • There were 27 generic usernames found. • There were 9 email accounts that do not follow the standard email naming format. • There were 23 employees that had moved schools within NAC but the Glow account had not been updated. • There were 58 users that had left the Council and still had an active Glow account. 3.5 The above testing highlighted that 5 SEEMIS work records had not been closed for movers and 18 SEEMIS work records had not been closed for leavers, indicating that the correct action had not been taken on a timely basis to ensure the SEEMIS work record was closed allowing Glow to be updated. (action c) Administrator User Controls 3.6 There were 484 users with administrator access and 310 users had super admin rights. Further testing identified 24 schools had 5 or more super admin users with some schools having up to 14 super admin users. The results were passed to the Digital Development Officer who contacted the relevant schools to reduce these numbers to a more reasonable level. However, the Digital Development Officer advised that every generic school Glow account has been granted Super Admin
Page 6
rights. Although the number of Glow accounts with Super Admin rights has been restricted, given that the school Glow account is a generic account, more than 1 staff member will have access to it therefore increasing the number of Glow users with Super Admin roles. On the advice of audit the generic school Glow accounts no longer have Super Admin rights. 3.7 The auditor advised that an annual review of administrator access should be carried out to ensure the number of administrators is reasonable and the number of super admin users remains restricted to a limited number of users. The Digital Development Officer provided an information sheet to the schools explaining the different admin rights to ensure the proper level of admin rights are allocated going forward. (action d) Email Controls 3.8 Due to the risk identified of using Glow email to send personal or sensitive information, Education advised users that Outlook email in Glow should not be used to send personal or sensitive information via this system. Instead, at least 2 employees in every school were given a Corporate Outlook email address which is to be used for sending personal or sensitive information. The auditor tested to ensure all schools had at least 2 employees with a Corporate Outlook email address and there were no findings to report from this testing. SEEMiS and Glow Data Synchronisation Process 3.9 The audit testing in this area was limited to obtaining confirmation from RM Unify regarding the data synchronisation process and testing a sample of new starts to verify that they had a Glow account set up and a sample of leavers had their Glow account deactivated. There were no findings to report from this testing. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to the controls around the Glow system. Although guidance is available to users, there is no evidence that users have been advised that personal/sensitive data should not be stored or sent via Glow, either via guidance or training. In addition, a significant number of users had Super Admin rights and action was taken to reduce users with this level of access. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited.
Page 7
Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 8
KEY FINDINGS AND ACTION PLAN GLOW Action a Finding A Glow Information document is issued to all probationers and reissued to existing staff annually. This guidance refers to the additional guidance provided on the Glow Connects website rather than incorporating it within the guidance. Although guidance is available to users, there is no mandatory local guidance that Glow users are asked to read and sign up to that ensures there is evidence users have been made aware that personal and sensitive data should not be stored in Glow or shared via Glow email. In addition, there is no guidance issued to a new Glow user when advised via email that a new account has been set up and the login details are provided to ensure they are advised of the rules before using the system. Action Description Mandatory local guidance for Glow should be prepared and should incorporate the Information for Educators document provided on the Glow Connects website. The Glow guidance should be included in the email issued to all new Glow users. The Glow guidance should be incorporated into the mandatory e-learning module to provide evidence users have been made aware that personal and sensitive data should not be stored in Glow or sent via Glow email. Risk Without proper guidance, Glow users may use Glow to store or send personal or sensitive data which may result in a data breach and a potential fine from the Information Commissioner. Priority (1, 2, 3) 2 Paragraph Reference 3.1 Managed by Andrew McClelland, Head of Service (Education) Assigned to Susan Lauder, Senior Manager (IT Strategic Lead) Due Date August 2023 Management Comment Local guidance document to be created and sent to all users initially. Guidance will be on NACED Inform. New users will receive this guidance by email when account set up. Mandatory i-learn module to be created which must be completed annually by all users of Glow. All users will be required to complete this in August 2023 at the start of the new school session. Action b Finding There is no mandatory training provided to Glow users which incorporates the types of data suitable to store and send via Glow. Action Description Mandatory e-learning training that covers the type of data that can and cannot be stored and sent via Glow should be provided to all Glow users on an annual basis and should be provided to all new users as soon as possible.
Page 9
Risk Without proper training, Glow users may use Glow to store or send personal or sensitive data which may result in a data breach and a potential fine from the Information Commissioner. Priority (1, 2, 3) 2 Paragraph Reference 3.2 Managed by Andrew McClelland, Head of Service (Education) Assigned to Susan Lauder, Senior Manager (IT Strategic Lead) Due Date August 2023 Management Comment Mandatory i-learn module to be created which must be completed annually by all users of Glow. Action c Finding The user testing on movers and leavers highlighted that the SEEMIS work record had not been changed or closed on a timely basis. Action Description Communication should be issued to ensure that SEEMIS work records are changed and closed on a timely basis for movers and leavers to ensure the Glow account is updated accordingly. Risk Leavers and movers continue to have access to Glow inappropriately. Priority (1, 2, 3) 2 Paragraph Reference 3.5 Managed by Andrew McClelland, Head of Service (Education) Assigned to Lynn Taylor, Senior Manager Due Date June 2023 Management Comment A communication will be issued re HT Comms for sharing with EBAs and by email to all EBOs reinforcing this action. Action d Finding There were 484 users with administrator access and 310 users had super admin rights. Further testing identified 24 schools had 5 or more super admin users with some schools having up to 14 super admin users. Action Description An annual review of administrator access should be carried out to ensure the number of administrators is reasonable and the number of super admin users remains restricted to a limited number of users. Risk Staff have full access to the system and have an access level higher than their job role. Priority (1, 2, 3) 2 Paragraph Reference 3.7 Managed by Andrew McClelland, Head of Service (Education) Assigned to Susan Lauder, Senior Manager (IT Strategic Lead) Due Date August 2023 Management Comment This action is complete to date and will be completed on an annual basis – from August 2023.
Page 10
Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 11
TRANSPORT 1 Background 1.1 This audit was carried as an addition to the approved 2023/24 Audit Plan following a concern that was raised anonymously. 2 Objectives and Scope 2.1 The objective of this audit was to ensure that:- • All Council vehicles are being MOT’d timeously • There is a detailed audit trail available for all disposals • External hires are being arranged in accordance with the Council’s Standing Orders relating to Contracts 3 Findings MOTs 3.1 KPIs generated by Fleetwave (Transport’s fleet management system) are the key method used to monitor when MOTs are due. 3.2 A traffic light system is used to flag to officers when MOTs are getting close to their due date. 3.3 In order to ensure that MOTs are being carried out on or before their due date, Audit tested a sample of:- • 30 vehicles that were MOT’d between 1 Mar 22 and 31 Dec 22 • 19 vehicles that were MOT’d between 1 Jan 23 and 5 May 23 3.4 Audit found a total of 11 vehicles that had not been MOT’d on time. Transport confirmed that all these vehicles were off the road awaiting repairs prior to their MOT date. Delays in repairs prevented the vehicles being fit for MOT on their due date. Disposals 3.5 Audit selected a sample of 10 disposals made between 1 April 21 and 31 March 23 and for each ensured there was evidence of:- • Written justification for the need to dispose – approved by both the Workshop Manager and Senior Transport Manager • The DVLA being notified of the disposal (V5) • A receipt for the disposal. 3.6 3 of the disposals tested were planned - 1 was the disposal of an excess vehicle and 2 were part of the vehicle replacement programme.
Page 12
3.7 For the remaining 7 vehicles - disposals were based on the vehicles being uneconomical to repair. Detailed repair costing information was available to justify the decision. All disposal decisions had been approved. 3.8 Transport provided evidence of the DVLA being notified of all disposals. 3.9 All vehicles tested were disposed of either via auction or salvage – which is in line with the Service’s Asset Management Plan. Invoices were available for all disposal proceeds. External Hires 3.10 Audit analysed all spend on external hires during 2022/23. For suppliers where expenditure was > £10k, Audit sought confirmation that a procurement contract was in place. 3.11 As a result, Transport has agreed to investigate whether STAR agreements should be put in place with 2 suppliers who provide specialist services not available via procurement frameworks. 3.12 No other issues were noted during testing. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard the areas of Transport covered within this Audit. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 13
PAYROLL TRANSACTION TESTING 1 Background 1.1 This audit was conducted as part of the approved 2022/23 Internal Audit Plan and used computer audit software to interrogate the HR Payroll system and examined any anomalies which arose. 1.2 Audit software called IDEA (Interactive Data Extraction and Analysis) has been used to carry out this testing. 1.3 The Employee Account is used to access and complete internal online forms for contract amendments and terminations. 1.4 Payroll Transaction Testing is usually carried out every 6 months and an audit report issued for each audit. In 2022/23, 2 audits have been carried out but only 1 audit report will be issued covering the findings and actions from both audits. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • High overtime payments are valid and properly authorised and no duplicate overtime payments have been made. • Employees working an average of 48+ hours per week have complied with the working time directive regulations. • Employees last pay is correct, properly authorised and any overpayments have been identified and rectified. • Salary amendments are valid and authorised. • High mileage claims are in line with the Terms and Conditions of Employment, are valid and authorised. • Travel and Subsistence expenses are in line with the Terms and Conditions of Employment, are valid and authorised. • Employees details are valid and complete. • Allowances and deductions are in line with the Terms and Conditions of Employment, are valid and properly authorised. 2.2 The quarter 1 audit covered the period 1st March 2021 to 31st March 2022. Testing covered the following areas – overtime testing, leavers last pay, salary amendments, employee details and allowances. 2.3 The quarter 3 audit covered the period 1st April 2022 to 30th September 2022. Testing covered the following areas – overtime testing, working time regulations, leavers last pay, salary amendments, high mileage claims, travel and subsistence expenses, employee details, allowances and deductions. 3 Findings for quarter 1 audit Overtime Testing 3.1 A sample of 10 high overtime payments were selected and it was noted that in 2 out of 10 cases the overtime forms did not record the reason for the overtime.
Page 14
3.2 The hours worked on one of the Building Service standby timesheets was higher than the times recorded on the job details form even though the job details form states “total hours for each day must be the same as the attendance on the front of this sheet”. (action a) 3.3 The auditor testing for potential duplicate overtime to the same employee by testing same payment period and amount but paid in different payrun. There were no findings to note from the sample tested. Leavers Last Pay 3.4 A sample of 10 leavers were selected to check their last pay and in 7 out of 10 cases the termination forms were submitted after the leaving date. In 9 cases the employee continued to be paid after they left which resulted in an overpayment. The overpayments have been identified and rectified by the Payroll team. One of the overpayments has been calculated incorrectly and the employee is owed £78.17 which Payroll have agreed to rectify. It should be noted that in one case the overpayment was significant enough to trigger Payroll notifying Internal Audit and the normal process was followed. 3.5 One of the termination forms was approved by someone who is an authorised signatory but is not authorised to approve terminations. The auditor advised that if it is part of their role to approve termination forms, they should speak to their line manager to amend the authorised signatories on the HR Payroll system to include terminations. 3.6 The auditor tested for employees who left within 21 days and there were 19 employees meeting this criteria so all were checked. In 15 cases the termination forms were received after the leaving date and in 1 case there was no termination form. In 1 case the employees only pay processed in error and this was rectified before payment was made to the employee. Salary Amendments 3.7 A sample of 10 salary amendments were selected and in 3 out of 10 cases the contract amendment form was received after the amendments effective date. Employee Details 3.8 The auditor tested for employees with the same post number but different employee number and found 54 but in 45 there were no overlaps in pays which left 9 to check further and 8 were passed to Resourcing to query. Resourcing provided explanations for each and there were no findings to note. 3.9 The auditor also tested for blank national insurance numbers, invalid national insurance numbers, blank date of birth, duplicate bank details and employees without bank details. There are no findings to report for this testing. Allowances
Page 15
3.10 The allowances paid were summarised and the 2 selected to test further were Responsibility Allowance and Contracted Overtime 4.5hours at time and a half. There are no findings to report from this testing. It should be noted that the Senior Manager, Facilities Management, advised 4 janitors are in receipt of Contracted Overtime 4.5 hours at time and a half is an allowance which along with the Weekend Check allowance results in a 47¾ hours historical contract from Strathclyde Region days. 4 Findings for quarter 3 audit Overtime Testing 4.1 A sample of 10 high overtime payments were tested. 4.2 The hours worked on one of the Building Service standby timesheets was higher than the times recorded on the job details form even though the job details form states “total hours for each day must be the same as the attendance on the front of this sheet”. (action a) 4.3 The following findings were noted for the Streetscene employees in the sample: • One of the overtime forms has been signed by a supervisor who is not an authorised signatory. • One of the employees had 2 overtime forms to support the overtime payment and neither had been signed or dated by a supervisor. The forms had been keyed by the Payroll team. The Senior Manager (Employee Services) has issued an email to the Payroll team to remind them that a thorough check is made to ensure there is the required evidence that the timesheet has been approved and the approval has been carried out by an authorised signatory. • 3 of the employees’ overtime forms did not record the reason for the overtime worked. (actions b, c, d) 4.4 The auditor tested for potential duplicate overtime to the same employee by testing same payment period and amount but paid in different payrun. There were no findings to note from the sample tested. Working Time Regulations 4.5 There were 53 employees working an average of 48+ hours per week either based on basic hours only or basic hours and overtime hours. A sample of 14 were checked and only 4 had the opt out recorded on the Working Time Regulations screen on the HR Payroll system. The auditor contacted each service to request a copy of the working time regulations opt out form. 4.6 There was 1 Community Facilities employee in the sample and the employee had not completed a working time regulations opt out form. The Team Manager confirmed the employee has now completed the working time regulations opt out form. The Team Manager also confirmed Community Facilities employees would be reminded to advise the Service if they commence additional contracts. 4.7 There were 2 Building Services employees in the sample and one of the employees had not completed a working time regulations opt out form. The
Page 16
Senior Manager confirmed the employee has now completed the working time regulations opt out form. 4.8 There were 2 Waste Operations employees in the sample and neither of them have completed the working time regulations opt out form. The Senior Manager confirmed the employees have now completed the working time regulations opt out form. 4.9 There were 4 Facilities Management employees in the sample and 3 had completed the working time regulations opt out form and 1 had not. The Senior Manager confirmed the employee would be advised the complete the working time regulations opt out form and will complete a sense check review. 4.10 There were 5 Streetscene employees in the sample and none of them have completed a working time regulations opt out form. The Senior Manager confirmed that the service is reviewing this to ensure the opt out process is properly documented. Leavers Last Pay 4.11 A sample of 10 leavers were selected to check their last pay and in 9 out of 10 cases the termination forms were submitted after the leaving date. In 3 cases this resulted in overpayments which have been identified and rectified by the Payroll team. 4.12 The auditor tested for employees who left within 21 days and there were 13 employees meeting this criteria so all were checked. In 2 cases where the employee started and left on the same day, the monthly pay was processed and re-banked. In 2 cases the full monthly pay was processed resulting in an overpayment but action was taken to reclaim the overpayment so the employees were only paid for actual days worked. Salary Amendments 4.13 A sample of 10 salary amendments were selected and in 7 out of 10 cases the contract amendment form was received after the amendments effective date. There are no other findings to note. Mileage Claims 4.14 A sample of 10 high mileage claims were selected and in 2 cases the form was not submitted within 3 months, but an explanation was provided for the delay and was approved by an authorised signatory. There are no other findings to note. Travel and Subsistence Expenses 4.15 A sample of 10 travel and subsistence claims were selected and in 1 case the employee was overpaid £193.80 due to an error when the claim was submitted which resulted in the same claim being submitted and approved 7 times. This was identified by the employee and rectified by the Payroll team. The Senior Manager, Employee Services, investigated and found the reason for this error
Page 17
was due to a missing email address for the requested approver in the HR21 system and when corrected resulted in all claims being approved. Employee Details 4.16 The auditor tested for employees with the same post number but different employee number and found 53 but in 44 there were no overlaps in pays which left 8 to check further and 5 were passed to Resourcing to query. Resourcing provided explanations for each and advised in one case there was a mix up with post numbers and this has been passed to Payroll to rectify. 4.17 The auditor also tested for blank national insurance numbers, invalid national insurance numbers, blank date of birth, duplicate bank details and employees without bank details. There are no findings to report for this testing. Allowances and Deductions 4.18 The allowances paid were summarised and the 3 selected to test further were Mental Health, Responsibility Allowance and Statutory Officer. A sample of 10 payments were selected and in 4 cases the contract amendment form or the approval email was received after the start date for the new allowance; however, the allowances were set up on the HR Payroll system with the correct start date. 4.19 Selected a sample of 5 deductions and there were no findings to note. 5 Internal Audit Opinion 5.1 Overall, reasonable assurance was obtained with regard to the testing carried out on the HR Payroll system. It should be noted that the late submission of forms continues to be identified and in the case of termination forms resulted in 12 employees continuing to be paid after the leaving date. The Senior Manager, Employee Services will issue a reminder to all services to ensure that paperwork is submitted in advance. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk
Page 18
management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 19
KEY FINDINGS AND ACTION PLAN PAYROLL TRANSACTION TESTING Action a Finding The hours worked on 2 Building Service standby timesheets were higher than the times recorded on the job details form even though the job details form states “total hours for each day must be the same as the attendance on the front of this sheet”. Action Description Approvers should be reminded to ensure that the job details forms are properly completed and the total hours for each day agrees to the hours recorded on the standby timesheet before approving. Risk Overtime paid for hours not worked. Priority (1, 2, 3) 2 Paragraph Reference 3.2, 4.2 Managed by Yvonne Baulk, Head of Service (Housing & Public Protection) Assigned to Leigh-Ann Mitchell, Senior Manager (Governance) Due Date 31st July 2023 Management Comment The timesheets in question have been reviewed and the differences are down to human error. The operative was including travel time and the two hour call out charge on the front of the form but only recoding direct time on the job on the back causing them both to differ. This has been discussed with the operative and he is now aware that both the front and back of the form require to match and all information should be recorded. In addition to this an email will be issued to all supervisors reminding them that both the front and back of timesheets should be checked and should match before authorising and issuing for payment. Action b Finding A Streetscene overtime form has been signed by a supervisor who is not an authorised signatory. Action Description Supervisors should be reminded they should only approve overtime if they are an authorised signatory and if this is part of their role they should arrange to be added as an authorised signatory. Risk Overtime may not be suitably authorised. Priority (1, 2, 3) 2 Paragraph Reference 4.3 Managed by Thomas Reaney, Head of Service (Neighbourhood Services) Assigned to Wallace Turpie, Senior Manager, Operations (Streetscene & Waste) Due Date Complete Management Comment The Senior Manager Operations (Streetscene & Waste) and Operations Manger (Streetscene) met on 28th June 2023 to review all authorised signatories within the Streetscene Operations. This identified several gaps where people had changed job or “acted up” to cover holiday periods and sickness. A comprehensive list has been developed and this has been submitted to Business Support HR via e-forms.
Page 20
Action c Finding There were 2 overtime forms completed by a Streetscene employee that had not been signed or dated by a supervisor. Action Description Staff should be reminded to ensure that overtime forms have been approved before they are sent to Payroll to process. Risk No independent check overtime hours worked are correct and valid. Priority (1, 2, 3) 1 Paragraph Reference 4.3 Managed by Thomas Reaney, Head of Service (Neighbourhood Services) Assigned to Mark McNeil, Operations Manager (Streetscene) Due Date Complete Management Comment The Operations Manager (Streetscene) has briefed the supervisory group to ensure forms are all signed and dated properly and only submitted once complete and to include the reason for the overtime. Action d Finding There were 3 Streetscene employees whose overtime forms did not record the reason for the overtime worked. Action Description The reason for the overtime hours being claimed should be noted on the overtime form. Risk There is a lack of audit trail to justify the overtime hours being claimed. Priority (1, 2, 3) 2 Paragraph Reference 4.3 Managed by Thomas Reaney, Head of Service (Neighbourhood Services) Assigned to Mark McNeil, Operations Manager (Streetscene) Due Date Complete Management Comment The Operations Manager (Streetscene) has briefed the supervisory group to ensure forms are all signed and dated properly and only submitted once complete and to include the reason for the overtime. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 21
ASN PROVISION 1 Background 1.1 This audit has focussed on the external day placement element of the Council’s overall ASN (Additional Support Needs) provision. 1.2 External day placements are provided by 3rd party suppliers and are used when a child or young person requires specific support that cannot be met from North Ayrshire Council resources. 1.3 The Council only uses such placements in exceptional circumstances – after all other provision, approaches and strategies available via NAC resources have been considered and either trialled or ruled out as being inappropriate. 2 Objectives and Scope 2.1 The objective of this audit was to ensure:- • There is evidence of an in-depth assessment process prior to an external day placement being approved for a child or young person • Any changes to a child or young person’s placement have been suitably considered and approved prior to the change being actioned • The financial implications of new placements, changes to existing placements and child or young person’s leaving placements are being accurately monitored • Access to sensitive electronic data is being restricted to only those who need it. 3 Findings 3.1 The Service has a detailed Inclusion Process that sets out the Council’s approach to ASN placements. 3.2 In addition, the Service also has step by step procedures that deal with the administration of the overall process. 3.3 During audit testing it became clear that these step by step procedures are for situations where there is time to plan a placement. The volatile nature of some cases means there isn’t always the time, or need, to go through all the steps. Audit has therefore focussed on ensuring the intention behind the steps, rather than the specific steps themselves, are being achieved for all cases. Approval of an external day placement 3.4 Audit reviewed all new external placements in 2022/23 and ensured:- • The Council’s Inclusion Group (IG) had given the child or young person’s Psychologist authority to investigate the suitability of an external day placement • There is evidence of any suggestions or recommendations made by the IG being fulfilled by the child or young person’s Psychologist • The Principal Psychologist has approved the placement.
Page 22
3.5 IG approval (or Head of Service approval in cases of emergency placement) was available for all new starts. 3.6 There is no formal process for recording responses to IG suggestions/ recommendations. It is therefore not possible to confirm whether these factored into the final placement decision. (action point a) 3.7 There isn’t always written confirmation of the Principal Psychologist approving the final placement choice. (action point a) Changes to existing placements 3.8 The Council’s Inclusion Process states that any significant changes to a placement should be brought to the IG for consideration. 3.9 Audit identified only 1 significant change of placement during audit testing. The case was not brought to the IG for consideration, nor was it approved by the Principal Psychologist. (action point b) Financial implications of placements 3.10 For all new starts, leavers and change of placements since 1 April 2022, Audit reviewed the invoices from suppliers to ensure the Council had been charged for the correct number of days service. 3.11 1 incident of a minor overcharge to the Council was identified during detailed testing. The Service has subsequently contacted the supplier and agreed a reduction in a future invoice to offset the overpayment. 3.12 When testing leavers, the Service had to confirm dates for 2 leavers with suppliers as these were not clear/recorded in the Council’s own records. (action point c) 3.13 Audit also reviewed the financial projections for the above cases to ensure these were accurate. No issues were noted. Access to data 3.14 The Service provided details of 2 filepaths, 2 SharePoint locations and FORT software that are used to store and share sensitive data. 3.15 For each of the above 5 storage locations, Audit obtained details of all officers with access. Reviewing the job titles of these officers highlighted no concerns. 3.16 FORT is a hosted system, therefore data is stored external to the Council. 3.17 Audit obtained a signed copy of the data sharing agreement signed by the Principal Educational Psychologist and a representative of the supplier. The Service was also able to provide a DPIA (Data Protection Information Assessment) which, at the time of the audit, was being reviewed by the Information Governance Team.
Page 23
4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard the areas covered by this Audit. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 24
KEY FINDINGS AND ACTION PLAN ASN PROVISION Action a Finding Not all steps of approving a day placement are being formally evidenced. Action Description Consideration should be given to expanding IG Outcome minute to include:- • a box for the child or young person’s Psychologist to respond to any comments or recommendations made by the IG group. • a box for the child or young person’s Psychologist to confirm what external provider they have selected, and why. • a box for the Principal Psychologist to sign to evidence that they are satisfied with the Education Psychologist’s choice and approve the placement. Risk The Council can’t evidence or justify its decision making process surrounding a child or young person’s placement decision. No evidence of budget holder approving expenditure. Priority (1, 2, 3) 1 Paragraph Reference 3.6; 3.7 Managed by Andrew Mcclelland, Head of Service Assigned to Gail Nowek, Principal Education Psychologist Due Date 31/07/2023 Management Comment Changes to the minute template of the \Inclusion \group will be made to include: • a box for the young person’s Psychologist to respond to any comments or recommendations made by the IG group. • a box for the young person’s Psychologist to confirm what external provider they have selected, and why. • a box for the Principal Psychologist to sign to evidence that they are satisfied with the Education Psychologist’s choice and approve the placement. • The changes to the paperwork will also be further ratified by the Supporting Needs workstream.
Page 25
Action b Finding Audit identified only 1 significant change of placement during audit testing. The case was not brought to the IG for consideration, nor was it approved by the Principal Psychologist. Action Description A reminder should be sent to all Psychologists and HSCP officers who deal with placements of the need to present all potential significant placement changes to the IG for consideration. Using the revised IG outcome minute proforma (as suggested in action a) will ensure detailed justification for the final placement decision, along with the Principal Psychologist’s approval is formally recorded. Risk The expertise of IG members is not being sought; the Council can’t evidence its decision making process when changing a pupil’s placement; no evidence of budget holder approving expenditure. Priority (1, 2, 3) 1 Paragraph Reference 3.9 Managed by Andrew Mcclelland, Head of Service Assigned to Gail Nowek, Principal Education Psychologist Due Date 31/07/2023 Management Comment Psychologists and relevant HSCP officers will be reminded by email and at through discussion at Team meeting of the need to present all potential significant placement changes to the IG for consideration. The revised IG outcome minute proforma (as suggested in action a) will be used to ensure detailed justification for the final placement decision, along with the Principal Psychologist’s record of formal approval. Action c Finding Not all key dates relating to young people are being recorded. Action Description All Psychologists should be reminded of the need to keep a formal record of all key dates relating to young peoples’ placements. Risk Incomplete records. The Council cannot evidence the dates of the placement if there are any future queries. Priority (1, 2, 3) 2 Paragraph Reference 3.12 Managed by Andrew Mcclelland, Head of Service Assigned to Gail Nowek, Principal Education Psychologist Due Date 31/07/2023 Management Comment All Psychologists will be reminded by email and through discussion at Team meeting of the need to keep a formal record of all key dates relating to young peoples’ placements.
Page 26
Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 27
INCOME COLLECTION – ACCESS CONTROLS 1 Background 1.1 CivicaPay is the Council’s income management system. This system was introduced in 2021 as a replacement for PARIS. 1.2 CivicaPay holds sensitive information. This Audit has therefore focussed on ensuring that access to CivicaPay is strictly limited to those who need it for work purposes. 2 Objectives and Scope 2.1 The objective of this audit was to ensure:- • access to CivicaPay is tightly controlled • user accounts are regularly reviewed to ensure they remain relevant and necessary. 2.2 Resourcing issues in the client service have limited the scope of this audit to the areas noted above in 2.1, however the intention is to re-visit Income Collection in more detail in 2024/25. 3 Findings Access controls 3.1 Access to CivicaPay is controlled via:- • line managers having responsibility for submitting new user requests • administrators actioning the monthly movers/leavers reports circulated by ICT to remove all user accounts that are no longer necessary for work purposes • the deactivating of user accounts that haven’t been accessed in 90 days. 3.2 Password controls such as:- • only allowing 3 incorrect logins before the user account is locked, • not allowing users to reuse any of their last 4 passwords, • forcing password changes every 90 days. are in place, however Audit did note that the minimum number of characters for passwords within the system does not comply with the Council’s ‘Creating secure passphrases guidance’. (action point a) User Testing 3.3 Audit obtained a list of all active CivicaPay user accounts as at February 23 and compared this to a list of all employees from CHRIS. 3.4 No instances of employees who have left the Council still having active CivicaPay accounts were identified.
Page 28
3.5 6 user accounts were identified as belonging to NHS employees. The users are not NAC employees and therefore Audit sought confirmation that 3rd party user agreements (or an equivalent) have been signed. 3.6 ICT has confirmed that the NHS users should be receiving the quarterly AUP (Acceptable Use Policy) meta-compliance message through which they would confirm to adhere to NAC ICT policies and procedures. 3.7 However, further investigation has highlighted that these individuals did not receive the most recent message. ICT are investigating this issue at present with the intention of ensuring they are included in all future messages. (action point b) 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard the access controls covered by this audit. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 29
KEY FINDINGS AND ACTION PLAN INCOME COLLECTION Action a Finding Password controls within CivicaPay do not fully comply with the Council’s ‘Creating secure passphrases guidance’. Action Description Minimum number of characters criteria within CivicaPay to be increased to 12. Risk Unauthorised access to CivicaPay more likely due to weak passwords; Council guidance not being applied. Priority (1, 2, 3) 2 Paragraph Reference 3.2 Managed by Mark Boyd, Head of Service (Finance) Assigned to David Forbes, Senior Manager (Financial Management) Due Date 30 September 2023 Management Comment Engagement with the vendor will be undertaken to establish the scope for changes to password character configuration to be brought in line with the Council standards. Action b Finding NHS users are not being asked to formally comply with the Council’s ICT AUP (Acceptable Use Policy). Action Description Quarterly meta-compliance messages regarding the Council’s AUP should be received and accepted by all system users. If a user is unable to receive meta-compliance messages then an alternative route for 3rd party acceptance should be sought. Risk Inappropriate use of Council ICT systems due to lack of knowledge. Priority (1, 2, 3) 1 Paragraph Reference 3.7 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to James McNeil, Team Manager (ICT) Due Date 30 October 2023 Management Comment The 6 staff identified by Audit as not having received and accepted the 3rd party AUP during the audit were resent via Metacompliance. Going forward, 3rd party acceptance by staff who are identified as NHS or other non-NAC will be sought using a Microsoft Form. This form will contain all the information necessary to read and accept the Council’s ICT AUP (Acceptable Use Policy). Form responses will be monitored for acceptance. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.