Internal Audit Annual Update Report
North Ayrshire Council · 5 September 2025
Back to Ayrshire Shared Services Committee — 5 September 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 AYRSHIRE SHARED SERVICES JOINT COMMITTEE 5 SEPTEMBER 2025 INTERNAL AUDIT ANNUAL UPDATE REPORT: AYRSHIRE ROADS ALLIANCE Report by Chief Auditor, East Ayrshire Council SUBJECT: INTERNAL AUDIT ANNUAL UPDATE REPORT PURPOSE OF REPORT 1. This established annual report is intended to provide, for noting, an update on internal audit work for the Ayrshire Roads Alliance (ARA). RECOMMENDATIONS 2. It is recommended that Joint Committee: i. notes the outcomes of a wide range of Internal Audit work for ARA carried out by East Ayrshire Council since inception as summarised at paragraphs 11-12 and detailed at Appendices 1 and 2; ii. notes the Chief Auditor’s ongoing annual opinion for 2024/25 of reasonable assurance for EAC arrangements as laid out at paragraph 13; iii. notes the ARA items included in the 2025/26 EAC Internal Audit plan as referred to at paragraph 14 and listed in Appendices 1 and 2; and iv. otherwise notes the contents of this report. BACKGROUND FRAMEWORK FOR INTERNAL AUDIT WORK 3. As the lead authority EAC provides the internal audit service to ARA. South Ayrshire Council (SAC) is able to carry out Following the Public Pound (FtPP) type audits as desired and those reports would be a matter for SAC to consider. The Chief Auditors of both Councils work closely together including through the longstanding Pan-Ayrshire Chief Auditors Group. 4. ARA assignments are included in the annual EAC Internal Audit Plan approved by EAC’s Governance and Scrutiny Committee in line with current professional standards which, until 31 March 2025 were those set out in the Public Sector Internal Audit Standards (PSIAS) and from 1 April 2025 are those set out in the Global Internal Audit Standards (GIAS) in the UK Public Sector. 5. Professional standards require the Chief Auditor to establish a follow-up process to monitor and ensure management actions have been effectively implemented. We follow-up by testing evidence to gauge implementation of recommendations (Appendix 2).
Page 2
2 6. Individual internal audit assignment reports and follow-up exercises are shared with both EAC and SAC as well as External Audit: • EAC - the established readership includes senior management and all Elected Members through the Councillors’ Noticeboard. • SAC – all reports are copied to the Director of Housing, Operations and Development and shared with the SAC Chief Internal Auditor for onward reporting in line with SAC arrangements. 7. The Head of Roads continues to accept and welcome Internal Audit recommendations. TRUST IN INTERNAL AUDIT - EXTERNAL AUDIT 8. External Audit report their annual conclusions on internal audit within their annual audit report to the Council. The most recent report is for 2023/24 with no significant issues arising providing assurance for those placing confidence in the work of Internal Audit. Our arrangements have remained stable since 2023/24. TRUST IN INTERNAL AUDIT - EXTERNAL QUALITY ASSESSMENT (EQA) 9. The PSIAS required a Quality Assurance and Improvement Programme (QAIP) to be in place including an independent EQA to be carried out every five years. EAC’s Governance and Scrutiny Committee considered the very positive outcomes from the most recent EQA exercise, carried out by the Chartered Institute of Public Finance & Accountancy (CIPFA), on 20 April 2023 as reported to the ASSJC on 1 September 2023. Our arrangements have remained stable since that EQA, with an equivalent exercise required in due course under the GIAS. MAIN REPORT ASSURANCE OUTCOMES FOR INDIVIDUAL ASSIGNMENT REPORTS 10. Assignment reports, with the exception of some advisory work and fact- finding, conclude with an overall assessment of the controls under review using the list below as a guide. We also consider context including risk and materiality. sound assurance / sound assurance in most areas – objectives of internal control have been met in all/almost all areas within the scope of the audit; non-compliance has only been identified in low risk or medium risk areas. reasonable assurance - objectives of internal control have been met in the majority of areas; some weaknesses have been identified in medium risk areas; this tends to be the most common assurance outcome. limited assurance – the control objectives have not been fully achieved; control weaknesses have been identified in some high risk areas. no assurance – the control objectives have not been met; significant non- compliance and/or control weaknesses have been identified.
Page 3
3 INTERNAL AUDIT WORK – AN OVERVIEW 11. Appendix 1 lists internal audit work since 2013/14 at which point the EAC Chief Auditor was a member of the working group to establish ARA. An overview of all outcomes is listed in the table below. Assurance Outcome Number of outcomes sound assurance / sound assurance in most areas 5 reasonable assurance 7 limited assurance 4 no assurance 0 advisory 5 Total outcomes 21 12. Appendix 2 lists 10 completed follow-up exercises since 2016/17 to test implementation of internal audit recommendations made since the inception of ARA. Follow-up exercises show improved performance since 2018/19 with all exercises carried out since that year resulting in scores of 100% which means that all recommendations tested were either fully or sufficiently implemented demonstrating ongoing management commitment to continuous improvement. ANNUAL INTERNAL AUDIT OPINION: EAC 2024/25 13. ARA operates within the control systems of EAC, therefore the Chief Auditor’s annual opinion for EAC is of interest to the ASSJC. The most that Internal Audit can provide in an annual opinion for the Council is reasonable assurance based on the risk based plan and a rolling programme of work. This is similar to the scope of external audit work in the context of the Council’s financial statements which aims to give reasonable assurance on the statements. The Annual Internal Audit Opinion for East Ayrshire Council in 2024/25 stated that, “reasonable assurance can continue to be placed upon the adequacy and effectiveness of the Council’s framework of governance, risk management and control in the year to 31 March 2025”. The opinion was considered by EAC’s Governance and Scrutiny Committee on 24 April 2025. PLANNED AUDIT ASSIGNMENTS FOR ARA – 2025/26 14. In line with professional standards a full risk based plan was agreed by EAC’s Governance and Scrutiny Committee on 5 June 2025. SAC were consulted during the planning process. It should be noted, that in line with good practice the plan can be changed in year to accommodate emerging priorities. The planned ARA work for 2025/26 is included in Appendices 1 and 2.
Page 4
4 15. The EAC Depute Chief Executive (Communities and Economy), the Head of Roads and the EAC Chief Auditor will agree the scheduling and detailed content of assignments in line with established arrangements. IMPLICATIONS 16. Eight implications have been considered in the preparation of this report. Implications Yes No Paragraph number in report 1. Policy/Strategic Planning No 2.Governance No 3. Human Resources No 4. Equality and Fairer Scotland Duty No 5. Financial No 6. Risk Yes Para 17 7. Community Wealth Building No 8. Net Zero No RISK IMPLICATIONS 17. Each year there is the ongoing risk of significant unplanned work emerging, planned resources not being available and work not being carried out to an acceptable standard which would compromise the ability to complete sufficient work. The likelihood is low to medium risk but the impact would be high risk. The EAC Audit Manager and Chief Auditor oversee operations with the objective of mitigating this risk. APPENDICES 18. Two appendices support this report: • Appendix 1: Internal Audit Assignments: 2013/14 to 2025/26 • Appendix 2: Internal Audit Follow-Up Exercises 2016/17 to 2025/26 BACKGROUND PAPERS 1. Public Sector Internal Audit Standards (PSIAS) (3rd edition March 2017) 2. Chartered Institute of Public Finance and Accountancy (CIPFA) Local Government Application Note for the United Kingdom Public Sector Internal Audit Standards (2nd edition February 2019) 3. Chartered Institute of Public Finance and Accountancy (CIPFA), Statement on the Role of the Head of Internal Audit in Public Service Organisations (2nd edition April 2019) 4. Institute of Internal Auditors (IIA) Global Internal Audit Standards (GIAS) (January 2024)
Page 5
5 5. EAC Governance & Scrutiny Committee, 26 September 2024, Annual External Audit Report 6. Global Internal Audit Standards in the UK Public Sector: Application Note (IASAB, December 2024) 7. Code of Practice for the Governance of Internal Audit in UK Local Government (CIPFA, February 2025) 8. EAC Governance & Scrutiny Committee, 24 April 2025, Internal Audit 2024/25 Annual Report and Annual Internal Audit Opinion 9. EAC Governance & Scrutiny Committee, 5 June 2025, Internal Audit Plan 2025/26 Eilidh Mackay Chief Auditor, East Ayrshire Council 25 August 2025 Person to Contact: Eilidh Mackay, Chief Auditor eilidh.mackay@east-ayrshire.gov.uk Implementation Officer: Paul Davies, Audit Manager paul.davies@east-ayrshire.gov.uk
Page 6
6 Appendix 1 INTERNAL AUDIT ASSIGNMENTS: 2013/14 TO 2025/26 Year Name Summary Assurance Outcomes 2013/14 Support to working group to establish ARA Advisory to support governance, risk management and internal control arrangements. Advisory 1 April 2014 – ARA goes live 2014/15 Plant Hire Contract (coverage included ARA and other services) Objectives were to: • ensure that hires are awarded to the correct service provider in accordance with the framework agreement; • ensure that processes for managing plant on and off hire are rigidly controlled and properly recorded; and • ensure that the correct contractual prices are paid for plant hires provided in accordance with the framework terms and conditions. Reasonable 2014/15 Inventory Inspections (unannounced visits) Objectives of the assignment were to: • verify the accuracy of inventory levels recorded within the store • report any areas for improvement identified, and • recommend actions to address areas for improvement. Reasonable 2014/15 PROFESS Costing System The objectives of the assignment were to: • consider the overall costing and financial reporting arrangements put in place for the Ayrshire Roads Alliance; • assess the status of implementation and roll-out of the PROFESS costing system, including the integration of inputs from the former East and South Ayrshire roads services; • consider whether the information needs of management and stakeholders are being met by the current arrangements; Reasonable
Page 7
7 • report any areas for improvement identified, and recommend actions to address areas for improvement 2015/16 TRIPS System Advisory Advisory to support governance, risk and internal control arrangements regarding the development of the established Transparent Roads Infrastructure Procurement Software (TRIPS) system used to manage the Roads Minor Works Framework Contract to support best value. Advisory 2016/17 Parking Income and Penalty Charge Notices (PCNs) The objectives of the assignment were to: • review the systems for Parking-related income • report any areas for improvement identified, and • recommend actions for improvement. Reasonable 2017/18 Performance Bonds The objectives of this audit assignment were to verify: • policy and procedures accord with Scottish Government strategy and national guidance on best practice; • corporate governance and reporting arrangements are fit for purpose and effectively applied; • practical processes and supervisory controls are in place in ARA for implementing approved policy; • ARA’ s bond management is supported by effective partnership arrangements with third parties (for example with South Ayrshire Council and with EAC’s Planning and Economic Development, Finance and ICT and Legal); • bond values reflect application of the above and give sufficient budget to fund any necessary remedial work. Limited 2017/18 Use of Contractors The objectives of this audit assignment were to: • establish the process for awarding roads works contracts procured through the Transparent Roads Infrastructure Procurement Software (TRIPS) • ensure roads works are being awarded appropriately in line with Standing Orders Relating to Contracts and assess whether Best Value is being achieved. Reasonable
Page 8
8 • ensure adequate controls are in place with regards to processes for awarding works, payment of invoices and monitoring of contractor performance. 2018/19 Girvan Harbour – office administration (unannounced visit) The objectives of this audit assignment were to: • understand the operation of Girvan Harbour and ensure that there are adequate arrangements in place to control income collected in respect of harbour operations • to identify areas for potential future audits. Limited 2018/19 Payment Controls The aims and objectives of this audit assignment were to: • review the procedures in place for payment of contractors • verify that there are adequate controls in place to verify the work completed prior to approving invoices for payment. Sound 2018/19 Bridge Inspections The EAC Depute Chief Executive (Safer Communities) with assistance from Internal Audit reviewed ARA-East’s arrangements for bridge inspection and reporting. Following this work, in 2019/20 Internal Audit undertook a full examination of arrangements for the Principal Inspections of road bridges. Advisory 2019/20 Arrangements for the Principal Inspection (PI) of road bridges The objective of this audit assignment was to: • update the findings of 2018/19 advisory work to reflect the undertaking and completion of the outsourced Principal Inspection programme and work done by ARA further to the Client Response agreed actions set out in the draft audit report and accompanying advisory note of 2018/19. Two outcomes: Sound in South and Reasonable in East 2019/20 Road Bonds review of new processes The objectives of this audit assignment were to: • verify procedures in relation to roads bonds are adequate, have been updated to reflect the findings of previous audit work and have been fully implemented within the service, and • the audit will also seek to confirm that ARA’s internal review of the process, and scrutiny by external assessor (SGS Ltd), have verified control effectiveness; and that if necessary, procedures have been further revised to improve controls. Sound in most areas
Page 9
9 2020/21 Roads Maintenance: materials and stores The objective of this audit assignment was to: • obtain assurance that the service has adequate arrangements in place to ensure proper control over the receiving, storing and issuing of materials and stores, and that these processes are operating efficiently and effectively. Reasonable 2021/22 Whistleblowing allegations – fact-finding Final report issued in 2021/22 to both Councils; interim outputs issued prior to that to support decision-makers following referral in summer 2019. Advisory 2022/23 Payment Controls (including measurement of works) The objective of this audit was to verify that payments made to contractors accurately reflect the quality and quantity of works carried out. If controls are absent or ineffective, then works may be incomplete, sub-standard or over-charged; • our audit involved reviewing ARA’s procedures for approving contractors’ invoices / certificates for payment, and confirming there are effective controls in place and operating to confirm the payments made for goods and services are appropriate; • we backed this up with a sample check of fifteen transactions, to confirm that approved procedures are being followed and controls applied to ensure the accuracy of payments and verify the evidencing of appropriate checks by the service; • our audit focussed on three high spend areas - bridge strengthening, road resurfacing and traffic management. Three outcomes: Limited (2) and sound assurance. Our audit confirmed that ARA has appropriate procedures in place incorporating robust controls, which when applied in practice, should ensure sound control of expenditure, and accurate payments to contractors. We noted an operational impact due to staff absence. ARA has responded positively to our findings.
Page 10
10 2023/24 Flood Risk Management The aims and objectives of this assignment were to support ARA self-assessment with regard to: • governance arrangements for statutory flood risk management duties, with a view to ensuring these are fit for the purpose of supporting strategic oversight, decision- making and accountability; • ARA’s contributions to the Local Flood Management Plans covering constituent council areas, with a view to ensuring Plans are consistent with East and South Ayrshire’s exposure to (and risk appetite for) flood risks; • Statutory obligations with regard to a watercourse inspection and clearance regime. Advisory. Service engaged with process; self- assessment checklist developed with assurance session being progressed with Depute Chief Executive and Head of Roads. 2024/25 Contract Controls The aims and objectives of this audit were to: • Verify payments made to major contractors accurately reflect the quality and quantity of works carried out; • Confirm service arrangements support achievement of best value and secure effective internal control. Report being finalised with seven recommendations which will further enhance the control environment. Scope expanded following request from EAC DCE (Communities & Economy). 2024/25 Stores The aims and objectives of this audit assignment were to: • Review processes for managing inventory within the Ayrshire Roads Alliance (ARA) stores. • Confirm that the security arrangements for ARA inventory are adequate. • Determine the arrangements for replenishing inventory when required and confirm adequate controls are in place. • Ensure inventory movements are recorded accurately Sound in most areas
Page 11
11 and reviewed; and confirm inventory on site can be matched to records. 2025/26 Digital Transformation of Workstreams The aims and objectives of this audit assignment are to: • Verify effective internal controls have been incorporated within processes subject to digital transformation. Work underway.
Page 12
12 Appendix 2 INTERNAL AUDIT FOLLOW-UP EXERCISES: 2016/17 TO 2025/26 Year Name Summary Score 1 April 2014 – ARA goes live 2016/17 PROFESS Costing System – Follow-up To test implementation of all ten recommendations made in 2014/15. Score 67%. Six recommendations tested with four fully or sufficiently implemented and two not implemented. The four other recommendations were dependent on the completion of the definitive build of PROFESS and could not be tested at the time of the follow-up; the Head of Service signed a Client Assurance Statement at that time agreeing actions required. 2016/17 Plant Hire – Follow-up To test implementation of all four recommendations made in 2014/15. Score 75%. Three recommendations fully implemented and one partially implemented. 2016/17 Inventory Inspections – Follow-up To test implementation of all five recommendations made in 2014/15. Score 60%. Three recommendations fully or sufficiently implemented; one partially and one not implemented. 2017/18 Parking Income and PCNs – Follow-up To test implementation of all 13 recommendations made in 2016/17. Score 92%. Twelve recommendations fully or sufficiently implemented and one partially implemented. 2018/19 Performance Bonds – Follow-up To test implementation of all two recommendations made in 2017/18. Score 100%. Both recommendations sufficiently implemented. 2018/19 Use of Contractors – Follow-up To test implementation of all two recommendations made in 2017/18. Score 100%. Both recommendations fully implemented.
Page 13
13 2019/20 ARA Girvan Harbour - Follow-up To test implementation of all five recommendations made in 2018/19. Score 100%. All recommendations either fully or sufficiently implemented. 2019/20 Arrangements for the Principal Inspection (PI) of road bridges – Follow-up To test implementation of all five recommendations made earlier in 2019/20. Score 100%. All recommendations either fully or sufficiently implemented. 2021/22 Roads Maintenance: materials and stores - Follow-up To test implementation of all five recommendations made in 2020/21. Score 100%. All recommendations fully implemented. 2021/22 Road Bonds review of new processes – Follow-Up To test implementation of all six recommendations made in 2019/20. Score 100%. All recommendations either fully or sufficiently implemented. 2024/25 Payment Controls (including measurement of works) – Follow-Up Follow up testing of implementation of all three recommendations made during the 2022/23 assignment. Rescheduled into 2025/26 – working with service to align with new digitised processes. 2024/25 Flood Risk Management – Follow-Up Advisory support as required for the self- assessment process previously created with formal follow-up of the recommendation raised. Rescheduled into 2025/26 due to recruitment of new flooding officer. Work anticipated to commence in late summer 2025. 2025/26 Contract Controls – Follow-Up To test implementation of the proposed seven recommendations in the current draft report. Work will be scheduled pending agreement of implementation schedules. END