3.IA Annual Report 2023-24 (AEPB) FINAL
North Ayrshire Council · 23 August 2024
Back to Ayrshire Economic Partnership Board — 23 August 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
AYRSHIRE ECONOMIC PARTNERSHIP BOARD MEETING – 23 AUGUST 2024 REPORT BY CHIEF AUDITOR, EAST AYRSHIRE COUNCIL SUBJECT: AGD INTERNAL AUDIT ANNUAL REPORT 2023/24 PURPOSE OF REPORT 1. The purpose of this report is provide for noting an annual report on internal audit activity in line with obligations laid out in the Ayrshire Growth Deal (AGD) Governance Document (Appendix 1). Specifically this report provides: • a summary of AGD internal audit work both prior to and since inception; and • an annual internal audit opinion for the AGD. RECOMMENDATIONS 2. The Partnership Board is asked to: (i) Consider and endorse the Internal Audit Annual Report 2023/24. (ii) Recommend the report for consideration by the Ayrshire Economic Joint Committee (AEJC), noting the statutory context at paragraph 3 within which the internal audit function operates including freedom from limitations on the scope of work including reporting. BACKGROUND REQUIREMENT TO HAVE AN INTERNAL AUDIT FUNCTION 3. The Local Authority Accounts (Scotland) Regulations 2014 require local authorities to operate a professional and objective internal auditing service; in practice this means that the internal audit function is operationally independent; free from limitations on the scope of its work and that the Chief Auditor reports independently with no undue influence. The internal audit service must be provided in accordance with recognised standards and practices which are currently those set out in the Public Sector Internal Audit Standards (PSIAS). It is the responsibility of each authority to ensure compliance with the PSIAS.
Page 2
CONTROL ENVIRONMENT WITHIN COUNCILS 4. It is primarily the responsibility of management to establish an appropriate and sound system of internal controls, and to monitor the continuing effectiveness of that system. 5. Internal Audit reports are presented to senior management and include recommendations that, when implemented, will further improve the control environment. TRUST IN INTERNAL AUDIT – EXTERNAL AUDIT REVIEW 6. Internal Audit is subject to annual review by the Councils’ external auditors with the outcome of these reviews included in each Council’s Annual Audit Report. The most recent reports are for 2022/23 with no significant issues arising providing assurance for those placing confidence in the work of Internal Audit. All three Annual Audit Reports are available on the Audit Scotland website. MAIN REPORT INTERNAL AUDIT WORK PRIOR TO AND SINCE INCEPTION 7. Thirteen assignments have been carried out across the three Ayrshire Councils for the AGD. The scope and outcomes of these exercises are summarised at Appendix 2. Outcomes reported to date range from one limited assurance outcome, through to reasonable assurance and up to sound in most areas. It is noted that the one limited assurance assignment in 2022/23 was accompanied by immediate management action with the eight recommendations tested in 2023/24 and found to be sufficiently implemented which provides assurance to the wider stakeholders. 8. In 2021/22 we noted a potential risk from staff turnover and long term sick absence within the Programme Management Office (PMO); management at that time moved quickly to put interim cover arrangements in place and recognised the longer term risk by progressing a review of the PMO structure. During 2022/23 the senior post was filled on a permanent basis and the second tier post filled during 2023/24 in addition to the clerical post. The Accountable Body’s Chief Financial Officer continues to oversee resilience aligned with the progress of the projects. 9. Our work continues to be informed by the Audit Scotland publication Scotland’s City Region & Growth Deals (January 2020) and the follow-up published in June 2023, recognising AGD internal audit good practice, which was considered by the AEPB and AEJC on 7 August 2023. That follow-up report also reinforced that the 2023 AEJC agreement to review the AGD risk register quarterly is good practice. AGD ANNUAL INTERNAL AUDIT OPINION 2023/24 10. Work carried out in 2023/24 is sufficient to allow the Chief Auditor to produce an Annual Internal Audit Opinion for the year to 31 March 2024. The most that Internal Audit will provide in the annual opinion is reasonable assurance based on the risk based plan and a rolling programme of work. This is similar to the
Page 3
scope of external audit work in the context of a Council’s financial statements which aims to give reasonable assurance on the statements. 11. Our overall opinion, based on the work presented in Appendix 2 is that reasonable assurance can continue to be placed upon the adequacy and effectiveness of the AGD’s framework of governance, risk management and control in the year to 31 March 2024. The Chief Auditor continues to be satisfied that a robust approach is taken by the three internal audit teams with recommendations being adopted by management supporting the assurance framework within which the AGD operates. AUTHORITY WIDE ANNUAL INTERNAL AUDIT OPINIONS 2023/24 12. AGD operations are managed through the control environments of the three Ayrshire Councils. The Chief Auditors in all three Councils have issued annual authority wide opinions of reasonable assurance providing wider assurance to the AGD stakeholders. IMPLICATIONS 13. Eight implications have been considered in the preparation of this report. Implications Yes No Paragraph number in report 1. Policy/Strategic Planning No 2.Governance No 3. Human Resources No 4. Equality and Fairer Scotland Duty No 5. Financial No 6. Risk Yes Para 14 7. Community Wealth Building No 8. Net Zero No RISK IMPLICATIONS (INTERNAL AUDIT RESOURCES) 14. Each year there is the ongoing risk of significant unplanned work emerging in each Council, planned resources for AGD work not being available and work not being carried out to an acceptable standard which would compromise the ability to complete sufficient work to produce an Annual Internal Audit Opinion for the AGD; local mitigations should offset the potential impact of these risks. APPENDICES 15. The annual report is supported by two appendices: • Appendix 1: AGD Governance Document (Internal Audit Extract) • Appendix 2: AGD Internal Audit Assignments Eilidh Mackay Chief Auditor, East Ayrshire Council 15 August 2024
Page 4
BACKGROUND PAPERS 1. Public Sector Internal Audit Standards (PSIAS) (3rd edition March 2017) 2. Chartered Institute of Public Finance and Accountancy (CIPFA) Local Government Application Note for the United Kingdom Public Sector Internal Audit Standards (2nd edition February 2019) 3. Chartered Institute of Public Finance & Accountancy (CIPFA), CIPFA Statement on the Role of the Head of Internal Audit in Public Service Organisations (2nd edition April 2019) 4. Audit Scotland, Scotland’s City Region & Growth Deals (January 2020) 5. Audit Scotland, Scotland’s City Region & Growth Deals Follow-Up (August 2023) 6. AGD Governance Document V15 Deal Documents - All Documents (south-ayrshire.gov.uk) Person to Contact: Eilidh Mackay, Chief Auditor, East Ayrshire Council Email: eilidh.mackay@east-ayrshire.gov.uk Implementation Officers: Eilidh Mackay, Chief Auditor, East Ayrshire Council John McCallum, Senior Manager (Audit, Fraud, Safety & Risk), North Ayrshire Council Email: johnmccallum@north-ayrshire.gov.uk Cecilia McGhee, Chief Internal Auditor, South Ayrshire Council Email: Cecilia.McGhee2@south-ayrshire.gov.uk
Page 5
Appendix 1 AGD GOVERNANCE DOCUMENT V15 (INTERNAL AUDIT EXTRACT) 2.16 The Accountable Body’s Chief Auditor will be appointed as Chief Auditor for the AGD to coordinate Internal Audit activity. 2.17 Each partner will be responsible for allocating Internal Audit resources as required for local AGD activities. The Accountable Body’s Internal Audit section will reserve the right to review programme and project activities as required and request information from all partners regarding these activities. 2.18 Each year a consolidated Internal Audit Plan will be presented to the AEJC and AREP having been prepared following: • consultation with relevant senior officers of the AGD PMO; • consideration of the risks affecting the AGD at programme and project level; • consideration of both internal and external factors affecting the AGD; • consideration of previous internal and external audit findings; • consideration of all of these elements which will inform Public Sector Internal Audit Standards (PSIAS) based risk assessments carried out locally by the Accountable Body and Partner Authorities; and • any relevant items subsequently included in local Internal Audit plans approved by each partner’s audit committee in line with PSIAS obligations will be reflected in the consolidated AGD Internal Audit Plan. 2.19 All AGD Internal Audit work will be carried out in line with the PSIAS with individual Internal Audit assignment reports presented to the AEJC and AREP for noting. 2.20 The relevant annual Internal Audit Report will be submitted to both UK and Scottish Governments upon completion. The AEJC and AREP will be advised of the overall outcomes from Internal Audit work in an annual Internal Audit Report the timing of which is anticipated to align with the annual accounts timetable and will be reported to the AEJC and AREP for noting in line with PSIAS requirements. The Annual Internal Audit Report will include a summary of AGD internal audit work in year by all partners, an annual opinion for the AGD and for further assurance will also include the authority–wide Annual Internal Audit opinions prepared by each partner. 2.21 Actions arising from Internal Audits will be followed up by the relevant Internal Audit team in line with established arrangements in that authority and these follow-up reports will be presented to the AEJC and AREP for noting. 2.22 Further audit, advisory consultancy or investigative work may be requested by the AEJC and AREP. 2.23 The Accountable Body’s Chief Auditor will liaise with partner Chief Auditors through established arrangements.
Page 6
Appendix 2 AGD INTERNAL AUDIT ASSIGNMENTS PRIOR TO AND SINCE INCEPTION Year Council Type of Audit Work Scope Outcome Link to “Audit Room” on AGD Portal (members only) Up to and including 2020/21 East Ayrshire Council Advisory Both prior to the AGD being signed off on 20 November 2020 and since advice has been provided on governance arrangements. Advisory Not applicable 2021/22 East Ayrshire Council Advisory & Assurance The aims and objectives were to inform the lead client, the Chief Financial Officer and Head of Finance & ICT, on how well systems and processes within the Programme Management Office (PMO) which are designed to keep the Ayrshire Growth Deal (AGD) on track, are working in practice; and to advise on any scope for improvement in systems and compliance verification processes which are identified by our assurance work. This included advising on the update of the AGD Governance Document V15. Our overall assessment of controls concluded that there was sound assurance in most areas - key controls exist and are applied consistently and effectively in most areas. Non- compliance has only been identified in low risk or medium risk areas. 21-22 EAC Internal Audit Report - Advisory & Assurance.pdf
Page 7
2021/22 North Ayrshire Council Governance The scope of this audit was limited to North Ayrshire Council’s role in the projects. It focused on the governance structures across the Council’s participation in the deal rather than individual projects. The main objectives of the audit were to ensure that: · governance structures and roles and responsibilities of officers and elected members within North Ayrshire Council, in relation to the Ayrshire Growth Deal are clearly defined and communicated in order to enable good governance and strong accountability · North Ayrshire Council has adequate risk management arrangements in place in relation to the Ayrshire Growth Deal · suitable arrangements are in place to monitor the progress of the Ayrshire Growth Deal programmes within North Ayrshire, including appropriate reporting and scrutiny arrangements · there are adequate arrangements in place to ensure that North Ayrshire Council is fulfilling the requirements of the Project Management Office and external funding providers. Overall, reasonable assurance was obtained with regard to the governance arrangements for the Ayrshire Growth Deal within North Ayrshire Council. Overall good governance arrangements are in place, but some of the projects are still at an early stage of development and therefore it has not been appropriate to fully develop the governance arrangements yet. 21-22 NAC Internal Audit Report - AGD Governance.pdf 2021/22 South Ayrshire Council Governance The aim of the assignment was to obtain assurance that there are adequate governance arrangements in place for Reasonable assurance was obtained that 21-22 SAC Internal Audit Report - AGD Governance.pdf
Page 8
South Ayrshire Council Ayrshire Growth Deal (AGD) portfolio of projects. there are adequate internal governance arrangements in place for South Ayrshire Council’s portfolio of AGD projects. 2022/23 East Ayrshire Council Assurance Testing of AGD Grant Claims. The aim of this assignment was to provide assurance to the EAC Chief Financial Officer and Head of Finance & ICT that the AGD Quarter 4 2021/22 Grant Claim Forms had been completed accurately and in line with the requirements of the UK and Scottish Governments and AGD procedures, prior to the deadline for their sign-off on 22 April 2022. Our work was carried out in “real-time” and the Chief Financial Officer was immediately advised of the assurance which could be placed on processes prior to the sign-off and submission of the claim. The value of the Grant Claim was £0.335m (Community Wealth Building - £154,408, Working for a Healthy Economy - £180,748).Assurance was also sought for the residual element of the Quarter 4 2021/22 Grant Claim, which was claimed for in July 2022 along with the Quarter 1 2022/23 Grant Claim. This review was retrospective due to the low value of the claim (£0.010m). Sound assurance. We found that both elements of the Quarter 4 Grant Claim had been completed accurately, were fully signed by appropriate officers and were in line with the requirements of the UK and Scottish Governments and AGD procedures. We also identified areas for consideration for continuous improvement. 22-23 – EAC AGD Grant Claims
Page 9
Follow-up Advisory Follow-Up of 2021/22 Findings Advisory work included: • Governance Document revision • Risk Register • Benefits Realisation Plan • Support to Audit Scotland follow- up exercise (see paragraph 8) • Attendance at AEPB and AEJC meetings to inform our work All actions fully implemented. 22-23 – EAC AGD Advisory & Assurance – Follow Up 2022/23 North Ayrshire Council Assurance Contingency budget in place and the aim would be to reserve this for any claims audits in year. No work required Not applicable 2022/23 South Ayrshire Council Assurance Follow-up Testing of internal governance arrangements. Follow-Up of 2021/22 Findings. Limited assurance with immediate action taken by senior management. All actions sufficiently implemented. Confidential. 22-23 - SAC - AGD Governance Arrangements - Follow-Up.pdf 2023/24 East Ayrshire Council Advisory Work included support to Audit Scotland national review, advice on Programme Risk Register, Senior Auditor embedded in AGD PMO as critical friend. Advisory Not applicable
Page 10
2023/24 North Ayrshire Council Assurance The audit was structured as 3 mini- audits covering each of the revenue projects, reflecting the different stages each project had reached and the different natures of the projects. The main objectives of the audit were to: • Ensure that controls within the management of the Community Wealth Building project are suitable and operating effectively. • Ensure that controls to manage the contract for the delivery of Working for a Healthy Economy are suitable and operating effectively. • Provide audit advice regarding the proposals for the Ayrshire Skills Investment Fund, including an employer grants scheme. Substantial assurance LINK TO FOLLOW 2023/24 South Ayrshire Council Follow-up Follow-Up of 2022/23 Findings. All actions sufficiently implemented Confidential