Internal Audit Update Report Sept 2022
North Ayrshire Council · 2 September 2022
Back to Ayrshire Shared Services Committee — 2 September 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 AYRSHIRE SHARED SERVICES JOINT COMMITTEE 2 SEPTEMBER 2022 INTERNAL AUDIT ANNUAL UPDATE REPORT: AYRSHIRE ROADS ALLIANCE Report by Chief Auditor SUBJECT: INTERNAL AUDIT ANNUAL UPDATE REPORT PURPOSE 1. This established annual report is intended to provide, for information, an update of internal audit work to the ASSJC. The report reflects Internal Audit outcomes since the inception of ARA and items included in the current year plan. RECOMMENDATIONS 2. It is recommended that Joint Committee: i. notes the outcomes of Internal Audit work to date as summarised at paragraph 12 and detailed at Appendix 1; ii. notes the ongoing annual opinion of reasonable assurance for EAC as laid out in paragraphs 13-14; iii. notes the ARA item included in the 2022/23 EAC Internal Audit plan as noted at paragraph 15; and iv. otherwise notes the contents of this report. BACKGROUND FRAMEWORK FOR INTERNAL AUDIT WORK 3. As the lead authority, East Ayrshire Council (EAC) provides the internal audit service to the Ayrshire Roads Alliance (ARA). South Ayrshire Council (SAC) is able to carry out Following the Public Pound (FTPP) type audits as desired and those reports would be a matter for SAC to consider. The Chief Auditors of both Councils work closely together including through the longstanding Pan- Ayrshire Chief Auditors Group. 4. ARA assignments are included in the annual EAC Internal Audit Plan approved by EAC’s Governance & Scrutiny Committee in line with Public Sector Internal Audit Standards (PSIAS). 5. The Public Sector Internal Audit Standards (PSIAS) require the Chief Auditor to establish a follow-up process to monitor and ensure management actions have been effectively implemented. We follow-up by testing evidence to gauge implementation of all recommendations.
Page 2
2 6. Individual internal audit assignment reports and follow-up exercises are shared with both EAC and SAC: • EAC - the established readership includes senior management and all Elected Members through the Councillors’ Noticeboard. • SAC – all reports are copied to the Director (Place) and shared with the SAC Chief Internal Auditor for onward reporting in line with SAC arrangements. 7. It was previously established that individual audit assignment reports will not be brought to the ASSJC as they can be sourced through the established reporting arrangements within both EAC and SAC. 8. Internal audit reports are also shared with the external auditor of EAC and SAC. External audit review the activities of internal audit with no issues raised for EAC since the inception of ARA. 9. The external audit report on the audit dimensions and best value for the year ended 31 March 2022 was considered by the Governance & Scrutiny Committee on 16 June 2022 and stated that a “robust internal audit function, as well as appropriate arrangements for the prevention and detection of fraud and error” were in place at EAC. 10. The Head of Roads continues to accept and welcome Internal Audit recommendations. DETAIL ASSURANCE LEVELS FOR INDIVIDUAL ASSIGNMENT REPORTS 11. Assignment reports, with the exception of some advisory work and fact- finding, conclude with an overall assessment of the controls under review using the list below as a guide. We also consider the context for each area under review including risk and materiality. sound assurance / sound assurance in most areas – objectives of internal control have been met in all/almost all areas within the scope of the audit; non-compliance has only been identified in low risk or medium risk areas. reasonable assurance - objectives of internal control have been met in the majority of areas; some weaknesses have been identified in medium risk areas; this tends to be the most common assurance outcome. limited assurance – the control objectives have not been fully achieved; control weaknesses have been identified in some high risk areas. no assurance – the control objectives have not been met; significant non- compliance and/or control weaknesses have been identified. INTERNAL AUDIT WORK – AN OVERVIEW 12. Appendix 1 lists internal audit work since 2013/14 at which point the EAC Chief Auditor was a member of the working group to establish ARA. Internal
Page 3
3 audit work has since been carried out every year since inception on 1 April 2014 with 15 assignments carried out and 10 follow-up exercises to test implementation of internal audit recommendations. The 15 assignments have generally resulted in good assurance outcomes with most assignments resulting in either reasonable, sound in most areas or sound assurance. Follow-up exercises since 2018/19 have resulted in scores of 100% (i.e. all recommendations either fully or sufficiently implemented). ANNUAL INTERNAL AUDIT OPINION: EAC 2021/22 13. ARA operates within the control systems of EAC, therefore the Chief Auditor’s annual opinion for EAC is of interest to the ASSJC. The most that Internal Audit can provide in an annual opinion for the Council is reasonable assurance based on the risk based plan and a rolling programme of work. This is similar to the scope of external audit work in the context of the Council’s financial statements which aims to give reasonable assurance on the statements. The Internal Audit annual opinion for 2021/22 continues to be one of reasonable assurance and was considered by the Governance & Scrutiny Committee on 21 April 2022. 14. The full EAC annual internal audit report can be found at the following link: Internal Audit 2021-22 Annual Report - internal audit 2021-22 annual report.pdf (east-ayrshire.gov.uk) PLANNED AUDIT ASSIGNMENTS FOR ARA – 2022/23 15. In line with PSIAS obligations a full risk based plan was agreed by the EAC Governance & Scrutiny Committee on 16 June 2022. This was later than usual due to the local government elections in May 2022. A summary plan had been agreed earlier in April 2022. The SAC Chief Internal Auditor was consulted during the planning process. It should be noted, that in line with good practice the plan can be changed in year to accommodate emerging priorities and contingencies are held (e.g. for small advisory / fact-finding) which ARA can make use of. The planned ARA work is as follows: • Payment Controls including measurement of works – Contract Audit / Anti- Fraud – 23 days allocated 16. The full EAC current annual plan can be found at the following link: Internal Audit Plan 2022-23 - Detailed - internal audit plan 2022-23 - detailed.pdf (east-ayrshire.gov.uk) POLICY/COMMUNITY PLAN IMPLICATIONS 17. No issues arising from this report. LEGAL IMPLICATIONS 18. No issues arising from this report.
Page 4
4 HUMAN RESOURCE IMPLICATIONS 19. No issues arising from this report. EQUALITY IMPACT IMPLICATIONS 20. There are no equality impact implications as: • the recommended actions do not affect people, and • the report is also to inform the Committee on performance. FINANCIAL IMPLICATIONS 21. No issues arising from this report. RISK IMPLICATIONS 22. Each year there is the ongoing risk of significant unplanned work emerging, planned resources not being available and work not being carried out to an acceptable standard which would compromise the ability to complete sufficient work. The Audit Manager and Chief Auditor oversee operations with the objective of targeting resources for the best outcomes. TRANSFORMATION STRATEGY 23. Good practice indicates that in order to innovate an organisation requires strong foundations which internal audit recommendations are designed to support. NET ZERO IMPLICATIONS 24. No issues arising from this report. BACKGROUND PAPERS 1. Public Sector Internal Audit Standards (PSIAS) (3rd edition March 2017) 2. Chartered Institute of Public Finance and Accountancy (CIPFA) Local Government Application Note for the United Kingdom Public Sector Internal Audit Standards (2nd edition February 2019) 3. Chartered Institute of Public Finance & Accountancy (CIPFA), Statement on the Role of the Head of Internal Audit in Public Service Organisations (2nd edition April 2019) 4. EAC Governance & Scrutiny Committee, 21 April 2022, Internal Audit Annual Report 2021/22 5. EAC Governance & Scrutiny Committee, 16 June 2022, External Audit Report on the Audit Dimensions and Best Value for the Year Ended 31 March 2022
Page 5
5 6. EAC Governance & Scrutiny Committee, 16 June 2022, Internal Audit Plan 2022/23 (Detail) APPENDICES Appendix 1: Internal Audit Assignments: 2013/14 to 2021/22 Eilidh Mackay Chief Auditor, East Ayrshire Council 16 August 2022 Person to Contact: Eilidh Mackay, Chief Auditor, eilidh.mackay@east-ayrshire.gov.uk Implementation Officers: Eilidh Mackay, Chief Auditor / Paul Davies, Audit Manager paul.davies@east-ayrshire.gov.uk
Page 6
6 Appendix 1 Internal Audit Assignments: 2013/14 to 2021/22 Year Assignment / Follow-Up Exercise Summary Assurance Level / Follow-Up % Score 2013/14 Support to working group to establish ARA Advisory to support governance, risk management and internal control arrangements. Advisory 1 April 2014 – ARA goes live 2014/15 Plant Hire Contract (coverage included ARA and other services) Objectives were to: • ensure that hires are awarded to the correct service provider in accordance with the framework agreement; • ensure that processes for managing plant on and off hire are rigidly controlled and properly recorded; and • ensure that the correct contractual prices are paid for plant hires provided in accordance with the framework terms & conditions. Reasonable 2014/15 ARA Inventory Inspections (unannounced visits) Objectives of the assignment were to: • verify the accuracy of inventory levels recorded within the store • report any areas for improvement identified, and • recommend actions to address areas for improvement. Reasonable 2014/15 ARA Profess Costing System The objectives of the assignment were to: • Consider the overall costing and financial reporting arrangements put in place for the Ayrshire Roads Alliance • Assess the status of implementation and roll-out of the PROFESS costing system, including the integration of inputs from the former East and South Ayrshire roads services • Consider whether the information needs of management Reasonable
Page 7
7 and stakeholders are being met by the current arrangements • Report any areas for improvement identified, and recommend actions to address areas for improvement 2015/16 TRIPS System Advisory Advisory to support governance, risk and internal control arrangement regarding the development of the established Transparent Roads Infrastructure Procurement Software (TRIPS) system used to manage the Roads Minor Works Framework Contract to support best value. Advisory 2016/17 Parking Income & Penalty Charge Notices (PCNs) The objective of the assignment was to: • review the systems for Parking-related income • report any areas for improvement identified, and • recommend actions for improvement. Reasonable 2016/17 ARA Profess Costing System – Follow-up To test implementation of the ten recommendations made in 2014/15. Score 67%. Six recommendations tested – four fully or sufficiently implemented and two not implemented. The four other recommendations were on hold pending completion of the definitive build of PROFESS RCM. 2016/17 Plant Hire – Follow-up To test implementation of four recommendations made in 2014/15. Score 75%. Three
Page 8
8 recommendations fully implemented and one partially implemented. 2016/17 ARA Inventory Inspections – Follow-up To test implementation of the five recommendations made in 2014/15. Score 60%. Three recommendations fully or sufficiently implemented; one partially and one not implemented. 2017/18 Performance Bonds The objectives of this audit assignment were to verify: • Policy and procedures accord with Scottish Government strategy and national guidance on best practice; • Corporate governance and reporting arrangements are fit for purpose and effectively applied; • Practical processes and supervisory controls are in place in ARA for implementing approved policy; • ARA’ s bond management is supported by effective partnership arrangements with third parties (e.g., with South Ayrshire Council; and with EAC’s Planning & Economic Development, Finance & ICT and Legal); • Bond values reflect application of the above and give sufficient budget to fund any necessary remedial work. Limited 2017/18 Use of Contractors The objectives of this audit assignment were to: • Establish the process for awarding roads works contracts. procured through the Transparent Roads Infrastructure Reasonable
Page 9
9 Procurement Software (TRIPS) • Ensure roads works are being awarded appropriately in line with Standing Orders Relating to Contracts and assess whether Best Value is being achieved. • Ensure adequate controls are in place with regards to processes for awarding works, payment of invoices and monitoring of contractor performance. 2017/18 Parking Income & PCNs – Follow-up To test implementation of the 13 recommendations made in 2016/17. Score 92%. Twelve recommendations fully or sufficiently implemented and one partially implemented. 2018/19 Girvan Harbour – office administration (unannounced visit) The objectives of this audit assignment were to: • understand the operation of Girvan Harbour and ensure that there are adequate arrangements in place to control income collected in respect of harbour operations • to identify areas for potential future audits. Limited 2018/19 ARA Payment Controls The aims and objectives of this audit assignment were to: • review the procedures in place for payment of contractors • verify that there are adequate controls in place to verify the work completed prior to approving invoices for payment. Sound 2018/19 Bridge Inspections The former EAC Depute Chief Executive (Safer Communities) with assistance from Internal Audit reviewed ARA-East’s arrangements for bridge inspection and reporting. Following this work, in 2019/20 Internal Audit undertook a full examination of ARA bridge inspection and reporting in both East and South Ayrshire. Advisory
Page 10
10 2018/19 Performance Bonds – Follow-up To test implementation of the two recommendations made in 2017/18. Score 100%. Both recommendations sufficiently implemented. 2018/19 Use of Contractors – Follow-up To test implementation of the two recommendations made in 2017/18. Score 100%. Both recommendations fully implemented. 2019/20 ARA Bridges – Follow- up To test implementation of the five recommendations made in 2018/19. Score 100%. All recommendations either fully or sufficiently implemented. 2019/20 ARA Girvan Harbour - Follow-up To test implementation of the five recommendations made in 2018/19. Score 100%. All recommendations either fully or sufficiently implemented. 2019/20 Ayrshire Roads Alliance: Road Bonds review of new processes The objectives of this audit assignment were to: • verify procedures in relation to roads bonds are adequate, have been updated to reflect the findings of previous audit work and have been fully implemented within the service, and • the audit will also seek to confirm that ARA’s internal review of the process, and scrutiny by external assessor (SGS Ltd), have verified control effectiveness; and that if necessary, procedures have been further revised to improve controls. Sound in most areas 2019/20 Ayrshire Roads Alliance: Bridge Inspections The objectives of this audit assignment were to: • Update the findings of 2018/19 work to reflect the undertaking and completion of the outsourced Principal Inspection programme and work done by ARA further to the Client Sound – South Reasonable – East
Page 11
11 Response agreed actions set out in the draft audit report and accompanying advisory note of 2018/19. 2020/21 ARA Roads Maintenance: materials & stores The objectives of this audit assignment were to: • Obtain assurance that the service has adequate arrangements in place to ensure proper control over the receiving, storing and issuing of materials and stores, and that these processes are operating efficiently and effectively. Reasonable 2021/22 ARA Roads Maintenance: materials & stores - Follow-up To test implementation of the five recommendations made in 2020/21. Score 100%. All recommendations fully implemented. 2021/22 Ayrshire Roads Alliance: Road Bonds review of new processes – Follow-Up To test implementation of the six recommendations made in 2019/20. Score 100%. All recommendations either fully or sufficiently implemented. 2021/22 Whistleblowing allegations – fact-finding Final report issued in 2021/22 to both Councils. N/A END