internal audit - progress report 2016 / 17 a inte… · internal audit - progress report 2016 / 17...

1

Appendix A

Internal Audit - Progress Report 2016 / 17

September 2016

Audit Lincolnshire – Internal Audit Progress Report

1

Contents Introduction

2

Key Messages 2 Internal Audit work Completed July - September 2 Other Significant Work 7 Audits in Progress 7

Performance Information 7 Other Matters of Interest 8 Appendices Appendix 1 – Assurance Definitions 13 Appendix 2 - Major Improvement Needed or Inadequate Internal Audit Reports 14 Appendix 3 – Internal Audit Plan & Schedule 2016/17 15 Appendix 4 - Outstanding Internal Audit Recommendations 19

Contact Details: John Scott Audit Manager

City Hall, Beaumont Fee, Lincoln, LN1 1DD : 01522 873321 [email protected]

mailto:[email protected]


2

Introduction

1 The purpose of this report is to:

Advise of progress being made with the Audit Plan

Provide details of the audit work during the period

Provide details of the current position with agreed management actions in respect of previously issued reports

Raise any other matters that may be relevant to the Audit Committee role

Key Messages

2 The 2016/17 Audit Plan is 41% complete at the end of August.

Internal Audit Work Completed July - September

3 The following audits have been completed and final reports issued:

High

Substantial

Limited

Low

None

Governance & Risk

Shared Revenues & Benefits – Support Services

Housing Rents – Key Controls

Payment Card Industry Data Security Standards

None

None

Note The Audit Committee should note that the assurance expressed is at

the time of issue of the report but before the full implementation of the agreed management action plan. Definitions levels are shown in Appendix 1.

4 We are not reporting any Limited or Low assurance audits. 5 In the audits given High and Substantial Assurances we confirmed that the

Council has sound processes in place:

Governance and Risk (Substantial Assurance) Our review gives us substantial assurance that the Council has effective risk management and governance arrangements in place. We have identified


3

areas where control could be strengthened and we have made recommendations to assist management in reviewing these areas.

Risk Management

The Council is currently implementing a risk strategy based on identifying how much risk it is prepared to take (risk appetite) this in turn influences the proportionate level of control needed to manage that risk. A new risk register template has been developed to help Managers record, monitor and manage their risks, but risk appetite is not included on the template.

By including risk appetite on the register managers are assisted to review developing mitigations to help ensure they are not under or over controlling the risk, which in turn can allocate resources to manage that risk more effectively and economically.

Improvements are required in relation to how some aspects of operational risk management currently operate:-

Target dates are not always recorded against each risk action

Risk action plans are not always produced for each high/red risk.

Different risk register templates are in use across Directorates

The first two bullet points were previously reported in our risk and governance report in June 2015.

The recent organisational restructure has necessitated risk registers to be combined and this has caused some delays in finalising registers during the first quarter of 2016/17.

Comparison of red and amber issues identified in the Council’s combined assurance report to Directorate and Strategic risk registers identified that the majority of issues were included in the registers. We identified a few areas that should be considered for inclusion in risk registers. Corporate Governance

The Council is required annually to review the effectiveness of the governance framework through undertaking a self-assessment and this is reported through the Annual Governance Statement (AGS).

A key part of the process was assessment and review by a Risk Advisory Group (RAG) this group was put on hold during 15/16 and interim measures were put in place to develop the AGS through a senior officer group.

To ensure that the right governance structure is in place to develop and monitor the AGS throughout the year we have recommended that a replacement process for RAG is identified and put in place.


4

CIPFA/SOLACE have updated their good governance guidance for application in 2016/17 so any recommendations in the guidance should be taken into account when developing the structure and processes. Shared Revenues & Benefits – Support Services (Substantial Assurance) The scope of this audit was to review the support procedures are in place across the revenues and benefits shared service to ensure that:

Staff can consistently and effectively deliver their roles and responsibilities

Financial arrangements are equitable for both partners Support Service Administrative Arrangements Support service arrangements for the revenues & benefits shared service generally work efficiently and effectively. Staff have indicated definite improvements in delivery of support services and they have gained more confidence in how to access them. As the shared service agreement has been in place for five years now is an opportune time to consider the arrangements for delivery. To ensure that revenues and benefits shared service staff can consistently and effectively deliver their roles and responsibilities there are some improvements needed to increase the effective delivery of support services. The shared service receive from City of Lincoln Council, as host authority, all of the support services that would be expected. North Kesteven District Council provide accomodation for Sleaford based staff, health and safety in connection with the accomodation and IT network connections and other IT updating and maintenance services. As IT and health and safety are provided by both partner Council’s, staff at Sleaford are still experiencing some difficulties on who to contact for specific issues and this does affect speed of resolution and ultimately services delivery. The shared service is currently developing service level agreements with both IT sections and these should include responsibilities of each team. To clarify responsibility for health and safety we have recommended expanding the Delegation and Joint Support agreement to identify areas of risk and responsibility to strengthen awareness and support revenues and benefits staff in accessing these services. We have also recommended communication and training events for both of these support service areas. Data Sharing Arrangements Data sharing agreements are being developed between the partner Council’s, but are not yet in place. Given the length of time the partnership has been


5

operating these need to be completed as a priority. This has affected the Sleaford based staff’s official access to the North Kesteven District Council incident list and there is a risk to staff through potential threat situations from North Kesteven customers. Partnership Support Costs The curent support service arrangements may not be equitable for the partner local authorities in terms of time, resources and costs. Currently City of Lincoln Council provide the key support services and the cost of these is charged to City of Lincoln shared revenues and benefits through central support service charges, however these are not passed onto NKDC. However, a significant proportion would have been incurred prior to the shared services. North Kesteven do provide some services linked to health & safety (building), information technology and finance (exchequer). As part of the review we have not obtained the estimated costs of these services. We have recommended that dialogue commences through the Operational Board to consider whether the current position is equitable for both partners. Including, looking at which elements of the central support service costs incured by City of Lincoln Council are incurred as a result of the shared service and were not incurred prior to its formation and therefore should be funded partly by NKDC. Housing Rents – Key Controls (Substantial Assurance) We found that the following key controls are in place and working well;

There is an adequate separation of duties between debit control and collection.

Performance measures are in place and performance is monitored. Monthly reports with commentary are received by the Housing Services Team – Performance/Finance; performance is reported quarterly to the Housing Scrutiny Sub Committee and Performance Scrutiny Committee.

Performance monitoring measures a % of rent collected as a percentage of rent due and arrears as a % of rent debit – at the end of 2015/16 performance was better than target for both of these performance measures.

Rent Arrears Procedure and Guidance is in place, setting out the arrangements for following up non-payers and missed payments. Arrears monitoring reports are run weekly and monitor the performance of Housing Officers against targets.

Procedures are in place for monitoring and re-letting void properties.

Income received through the bank is reconciled to the rents system on a weekly basis.


6

The tenants’ rent account summary is agreed to the tenant control account in the main accounting system at the year end.

New tenants are being charged the correct weekly rent and a weekly report has been introduced to identify any properties and garages on the rent system that do not have a charge attached

We have recommended improvements to;

Strengthen the controls around system access and security settings for individual user access.

Introduce an additional review to identify and transfer income that has been in the suspense account for an extended period of time.

Payment Card Industry – Data Security Standards (Substantial Assurance)

The use of electronic methods of payment using credit and debit cards is continually increasing, as it is a quick and efficient way of making a payment. The Payment Card Industry recognise that there is a risk of card fraud and / or loss of cardholder data and have established a worldwide Payment Card Industry Data Security Standard (PCIDSS) to protect sensitive cardholder data and reduce card fraud. The standard applies to any organisation using electronic methods of payment. If data is lost fines and or costs could be incurred and reputation could be adversely affected; the public could lose confidence in the Council if there was a data breach linked to PCIDSS and that could impact on electronic transactions. As electronic payments are the Council’s preferred payment option and approximately 97% of payment transactions are made this way the Council needs to ensure that its card handling procedures meet the requirements of the Payment Card Industry Data Security Standards. We found that the Council’s PCIDSS compliance expired in October 2015 and since then staff resources have been committed to increasing the level of knowledge of the requirements on the Council, assessing the cardholder data environment, determining if there are any weak areas and addressing them. The advice of external consultants was obtained and there was close liaison with the Council’s payment merchant, Worldpay. An action plan was put in place and the Council re-achieved compliance on the 2nd August 2016. Recommendations were made to further enhance what is already being done;

Make reference to PCIDSS in the IT Security Policy (which is in the process of being updated) and in Financial Procedure Rules

Publish PCIDSS guidance on the intranet to further promote awareness and raise awareness of staff attending the TOFFS and Channel Shift Programmes so that PCIDSS requirements are considered when evaluating new ways of offering services – this was implemented before the audit was completed

Review partner organisation assurances


7

Other Significant Work 6 Housing Benefits Subsidy Testing Substantial progress has been made with this work. Testing of 21 Rent

Allowance and 14 Non-HRA Rent Rebate cases has been completed. Testing of 22 Rent Rebate cases is substantially complete and will be finished shortly. The findings have been passed to management and KPMG, who will issue a formal report later in the year.

7 Elections

Work has been completed to review the Council’s claims to the Electoral Claims Unit for administering the 2016 City Council, Police & Crime Commissioner and Referendum elections and they were found to be an accurate reflection of the expenses that had been incurred.

8 Counter Fraud

The counter fraud policy/strategy and risk register has been updated and is included as a separate report

9 Major Projects - Boultham Park Restoration and the Transport Hub Now that funding has been received and the projects are underway contract

management audits will be undertaken over the next 3-4 months.

Audits in Progress 10 The following work is in progress;

NNDR - fieldwork in progress

City Hall Phase 2 works – fieldwork in progress

Control Centre – draft report being agreed with management

Council Tax Key Controls – scheduled to start early September

Customer Services – draft report being agreed with management

Efficiency Targets – scheduled to start mid-September

ICT Security - Malicious code prevention / recovery – draft report stage

Performance Information 11 Our performance against targets for 2016/17 audit work is shown below:


8

Performance Indicator

Target

Actual

Percentage of plan completed 100% (50% at end of Sept)

41% at end of August

Percentage of recommendations agreed.

100% 100% (15 out of 15)

Percentage of recommendations implemented (of those due)

100% or escalated

50% (2 out of 4 due by 31 Aug).

Timescales Draft report issued within 10 working days of completing audit.

Final report issued within 10 working days of closure meeting / receipt of management responses.

Completion of audit within two months of fieldwork starting

100% (5 out of 5) 100% (5 out of 5) 100% (5 out of 5)

Client Feedback on Audit (average)

Good to excellent Good to excellent (3 returned out of 4 issued)

Other Matters of Interest 12 PSIAS External Inspection of internal audit is being undertaken in October

(5th-7th) 13 We are hoping to arrange a whole day Audit Committees Forum in October using a central venue which has excellent facilities. Date: 11th October 2016

Venue: The Council Chamber, North Kesteven District Council, Kesteven Street, Sleaford. NG34 7EF

Time: 9:30 – 16.00 approx

Feedback gathered after the initial Audit Committees Forum Day which took place in March 2016, suggested that attendees might be interested in making the Forum a regular twice yearly feature and it was proposed that the Forum should be opened up to all members of Audit Committees.


9

14. CIPFA Better Governance Forum – Audit Committee Update Recent Developments You May Need to Know About Legislation, Regulations and Consultations Appointment of Local Auditors Under the Local Audit and Accountability Act 2014, the Audit Commission, which had previously managed the appointment of external auditors for local government bodies and health trusts, was abolished and new responsibilities to manage their own appointment of local auditors given to those bodies. The Act also provides for the appointment by the secretary of state of a ‘sector led body’ to be an appointing person. This body would provide the option of a managed appointment process for those who wished to select it. Public Sector Audit Appointments (PSAA) have now been approved by DCLG to be a sector led body for principal authorities – councils, police and fire bodies. PSAA had already issued a prospectus setting out some of their proposals were they to be confirmed and they are seeking responses to their suggested approach. This is available on the PSAA website. If your organisation is considering choosing PSAA then it is likely that the formal invitation needs to be accepted in the autumn. The decision to choose this route must be made by the appropriate body: full council, the fire authority or the PCC. It cannot be delegated. The appointment route set out in the legislation is to establish an auditor panel to advise on appointment, with the final decision again being made by full council, the fire authority or the PCC as appropriate. Authorities can work collaboratively, sharing a panel if they choose. All appointments must be in place by December 2017. The previous issue of Audit Committee Update set out the details of the legislative requirements in more detail. There is also a publication, Guide to Auditor Panels, which can be downloaded from the CIPFA website. Reports, Recommendations and Guidance Delivering Good Governance in Local Government The guidance notes to support the new Framework are now available for English local authorities and for police. The publications for Welsh and Scottish authorities will be available in the autumn. The framework applies from April 2016 and will need to be reflected in the annual governance statement for 2016/17.

English local authorities

Police

Welsh local authorities

Scottish local authorities


10

Accountability System Statement The updated system statement sets out the core local government accountability framework. It includes how the system responds to failure and how the department (DCLG) gets assurance and information on financial sustainability and effectiveness. There is also a new section on how the framework is being adapted in the light of devolution deals within England. Communities and Local Government www.cipfa.org/services/networks/better-governance-forum


11

Derby City Council: Report in the Public Interest An external auditor issues a report in the public interest when there are serious failings of governance or financial management identified. Grant Thornton issued a report on Derby City Council because of the council’s failures of governance in the management of major projects and the inappropriate involvement of members in operational matters. All reports in the public interest are published on the PSAA website. The National Audit Office’s Role in Local Audit This National Audit Office leaflet provides information on its role in local audit. It includes examples of its recent value-for-money work focused on local services, and contact details for you to provide views and suggestions or to ask questions about their work. Recent studies have included:

financial sustainability of local authorities, capital expenditure and financing

local enterprise partnerships

financial sustainability of fire and rescue services. Cities and Local Growth – Public Accounts Committee The Public Accounts Committee (PAC) has examined the devolution of powers, funding and responsibility to local areas through a range of mechanisms, including local enterprise partnerships, city deals and devolution deals. The committee has expressed concerns that “not all devolution deals are coherent: they lack clear objectives; and are not aligned geographically with other policies or local bodies. There has been insufficient consideration by central government of local scrutiny arrangements, of accountability to the taxpayer and of the capacity and capability needs of local and central government as a result of devolution.” The committee has also expressed concern that existing arrangements for scrutiny at the local level of devolved functions are neither robust enough nor well supported. It has recommended that the government should set out its plans for ensuring there is robust local scrutiny by November 2016. Cities and Local Growth Cards on the Table: English Devolution and Governance A report by the Centre for Public Scrutiny considering the role of governance in shaping the development of devolution deals. It is intended to be a resource to support those developing devolution arrangements and also to support those who will provide scrutiny of the arrangements. Centre for Public Scrutiny Failing Well This report from the Institute for Government provides insights on dealing with failure and turnaround from four critical areas of public service delivery. The report raises concerns that there is a greater risk of failure in the public services as a result of


12

budget pressures and structural changes. It also highlights governance aspects that make an organisation more likely to fail. Institute for Government CIPFA Fraud and Corruption Tracker 2016 The CIPFA Fraud and Corruption Tracker (CFaCT) is an annual survey of the fraud and corruption detected in local authorities across the UK. It examines levels of fraud and corruption detected each financial year, types of fraud and emerging trends. CIPFA estimates that over £271m worth of fraud has been detected or prevented within the public sector in 2015/16. CIPFA Counter Fraud Centre National Fraud Initiative Reports from the latest data matching investigations in the UK are now available for Wales, Scotland and Northern Ireland. The report for England has not been published yet.

Northern Ireland report

Scotland report

Wales report


13

Appendix 1 - Assurance Definitions1

High

Our critical review or assessment on the activity gives us a high level of confidence on service delivery arrangements, management of risks, and the operation of controls and / or performance. The risk of the activity not achieving its objectives or outcomes is low. Controls have been evaluated as adequate, appropriate and are operating effectively.

Substantial

Our critical review or assessment on the activity gives us a substantial level of confidence (assurance) on service delivery arrangements, management of risks, and operation of controls and / or performance. There are some improvements needed in the application of controls to manage risks. However, the controls have been evaluated as adequate, appropriate and operating sufficiently so that the risk of the activity not achieving its objectives is medium to low.

Limited

Our critical review or assessment on the activity gives us a limited level of confidence on service delivery arrangements, management of risks, and operation of controls and / or performance. The controls to manage the key risks were found not always to be operating or are inadequate. Therefore, the controls evaluated are unlikely to give a reasonable level of confidence (assurance) that the risks are being managed effectively. It is unlikely that the activity will achieve its objectives.

Low

Our critical review or assessment on the activity identified significant concerns on service delivery arrangements, management of risks, and operation of controls and / or performance. There are either gaps in the control framework managing the key risks or the controls have been evaluated as not adequate, appropriate or are not being effectively operated. Therefore the risk of the activity not achieving its objectives is high.

These definitions are used as a means of measuring or judging the results and impact of matters identified in the audit. The assurance opinion is based on information and evidence which came to our attention during the audit. Our work cannot provide absolute assurance that material errors, loss or fraud do not exist.


14

Appendix 2 – Audits Where Assurance is Assessed as ‘Limited’ or ‘Low’ (Executive Summaries Only) There are none.

Audit Lincolnshire – Internal Audit Report

15

Appendix 3 – Internal Audit Plan & Schedule 2016/17

Area

Days Indicative Scope Planned Start

Actual Start

Final Report

Status / Assurance Level

CHIEF EXECUTIVE

Critical Service Areas 57

Elections

8

Expenses claimed for the 2016 Local, Police & Crime Commissioner and Referendum elections

Q2 July Aug Completed

Customer Services

10

Operation of the various customer access channels, including My Info

Q2 July Draft report being agreed

Efficiency Targets

7

Operation of the Towards Financial Sustainability Programme

Q2 Sept To start mid-Sept

Recovery 12 Corporate Recovery systems Q3

Shared Revenues & Benefits

10

Provision of Support Services

Q1 April 21 July Completed Substantial assurance

Work Based Learning

10

Financial control, strategy & business levy

Q3

Due Diligence Areas 115

Payroll 5 Key Controls Q3

Treasury Management 5 Key Controls Q3

Property, Plant & Equipment 5 Key Controls Q4

Corporate Governance

5

Key Controls

Q1 May 28 July Completed Substantial assurance

Performance Management

10

Operation of the Performance Management Framework

Q1 April 27 Jun Completed Substantial assurance

Risk Management

5

Key Controls

Q1 May 28 July Completed Substantial assurance

Financial Ledger/Budget Monitoring 5 Key Controls Q3


16

Area


Actual Start

Final Report


Council Tax 5 Key Controls Q3 Sept To start early Sept

Procurement

10

Compliance with CPR for purchases over £75,000

Q4

Payment Card Industry Data Security Standards

5

Compliance with card holder data security requirements

Q1 June 30 Aug Completed Substantial assurance

Information Governance

5

Data Protection & Information Governance healthcheck

Q3

ICT Security 10 Malicious code prevention / recovery Q2 July Draft report stage

ICT Systems 10 Channel Shift Q2/3

ICT 10 IT Disaster Recovery Q4

Counter Fraud 7 Strategy review & update Q2/3 Completed

Counter Fraud 3 Fraud Risk Register refresh Q1 Completed

Counter Fraud 5 National Fraud Initiative Q2 & Q4

Counter Fraud 5 Counter Fraud Partnership TBC

COMMUNITIES AND ENVIRONMENT


Private Sector Housing 10 HMO accreditation & enforcement Q4


Health & Safety 10 H&S action plan Q4

HOUSING AND REGENERATION


Maintenance 15 Responsive Repairs Q3

Tenancy Services 5 Allocations assessment & scoring Q3

Housing Company 10 Governance & risk management Q2/3

Housing Strategy 10 Implementation arrangements Q4

Control Centre

5

Management of operational risks

Q1 May Draft report being agreed


17

Area


Actual Start

Final Report



Housing Rents

5

Key Controls

Q1 May 31 Aug Completed Substantial assurance

PROJECTS 20

Transport Hub 5 Risk advice Q1/2 Ongoing

Increase days 10

Boultham Park 5 Governance & project management Q2/3 Increase days 8

Western Growth Corridor 5 Governance & project management TBC

City Hall Phase 2 5 Contract management Q1 June Fieldwork in progress

STRATEGIC & EMERGING RISKS 15

Risk management

15

Management & mitigation of strategic and directorate risks

Q3 Reduce days 5

OTHER RELEVANT AREAS 173

Financial Procedures 3 Advice / assistance with 2016 review TBC

Contingency

15

Completion of audits brought forward

Q1 April June All 2015/16 audits are complete.

Consultancy

15

Review of any emerging risks or management requests

Reactive fraud, error, complaint 10

HB Subsidy 50 Q1-2 May Substantially complete

Combined Assurance 10 Assess all critical areas Q4

Service Managers Group 3 Ongoing

PSIAS review 3 Q1 April In progress

Annual Governance Statement 1 Q1 May Completed

Advice 10 Ongoing

Recommendation Follow Up 10 Ongoing

Audit Management / Liaison 15 Ongoing

Audit Strategy & Planning 5 Ongoing


18

Area


Actual Start

Final Report


Audit Committee 20 Ongoing

Annual Audit Report 3 Q1 May Completed

TOTAL TIME FOR 2016/17 450


19

Appendix 4 - Outstanding Recommendations as at 31 August 2016

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet Due

Recommendation /

Agreed Action

Comments / Progress

H M

Assistant Director - Strategic Development Corporate Governance

Jan 2011

Substantial 5 4

1

Update Communication Strategy

30 September 2016 (31 March 2016) On track

IT Security May 2013

Limited 23 23

1

0 (1)

IT Disaster recovery plan (High)

Event logging, monitoring and audit policy

31 March 2017 Prev 31 October 2016 Project is progressing Complete

Strategic Priorities Dec 15

Substantial 5 3 2 Develop basic contract management guidance

Update LPMM guidance

30/10/2016 – in progress (Prev Sept 2016) 30 Sept 2016 90% complete

ICT Mobile Devices

Mar 16

Substantial 5 2 (1)

1 2 Audit of ICT assets (High)

Update various policies

Consider upgrading

31 Dec 2016 – linked to Corporate inventory check Prev (30 June 2016) 31 October 2016 Completed


20

EMM software

Review current settings on the MSS

Consider activating event logging for Airwatch

Completed 30 September 2016 30 September 2016

Performance Management

June 16

Substantial 4 1 3 A)To encourage data collectors to record any specific calculations or judgements when cleansing data to provide an adequate trail to support performance output.

B) Resolve ongoing reliability of telephony system issues through:

1 Obtaining commitment from the contractor all issues addressed

2 Test reliability

C)Review reporting from the choice based lettings system to establish if WLDC and NKDC data can be extracted from prime reports

D) A review of the leisure booking system is currently being undertaken to determine its ability to

a) 31/08/16 Completed b) Still in negotiation – technical workshop and further meetings. 30/11/96 Prev 30/09/16 c) Due to IT issues extended to 31/03/2017 from 30/09/16 d) Completed 30/09/16


21

meet the channel shift agenda re electronic booking & payment. This review will include the reporting facilities and whether changes can be made to receive performance information direct from the system.

Re-issue the Data Quality Policy to data owners and collectors and re-launch on the Council’s intranet

The Policy Unit will work with Service Managers to support them validate a sample of indicators each year.

A new section will be inserted in service plans for Service Managers to complete that as part of service review and change - indicators will be reviewed. Policy Unit will use the completed service plans to identify proposed changes

Completed 31/08/16 31/03/17 31/03/17


22

and will check that this has been completed.

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet Due

Recommendation /

Agreed Action

Comments / Progress

H M

City Solicitor Safer Recruitment

Mar 16

Substantial 6 2 1 3 Rec 1 Training for the Safeguarding Champion (High)

Recs 2a to 2e –HIGH Amendments to vacancy management form to capture assessment of DBS/Disclosure Scotland checks in relation to vacant post.

Rec 2a provide a link to the

30 Nov 2016 Prev 30 June 2016

Recs 2a to 2e – 90% complete - Extended see 2a below Vacancy Management from has been amended to prompt and record the need to consider if DBS/Disclosure Scotland check is required. List of posts that require DBS check is on City People.


23

lists which identify id a DBS/Disclosure Scotland check is required

Rec 3a Amend VM form to read Disclosure Scotland –

Rec 3b to 3c Issue guidance to determine if a DBS/Disclosure Scotland check is needed and insert hyperlink on VM form.

Rec 2a outstanding for Disclosures Scotland checks – list of posts still needs to be completed for Disclosure Scotland checks – BD&IT Manager and AD group further discussion 30th Nov 16 Prev Sept 2016.

Rec 3a) Completed

Rec 3b to 3c 80% comp - Extended Guidance has been produced and hyperlink on VM form for DBS. Guidance still needs to be completed in respect of Disclosure Scotland – links to 2a above –extended to 31/3/2017. Prev Sept 16.


24

Rec 4 Amendments to be made to interview assessment form

Rec 5 Update Recruitment & Selection Policy and deliver training

Rec 6 Issue guidance on the process for using agency staff & volunteers

Rec 4 Complete Amendments made during audit – fully complete March 2016

Rec 5 – Completed Policy updated and training delivered for recruiting managers and Assistant Director training booked in for end of June– completed

Rec 6 – 31 October 2016 (Volunteers) Prev 31 August 2016 Agency staff will be February 17 due to re-tender 31 March 2017


25

Payroll Apr 16 Substantial 7 5 2 Incorporate all aspects of payroll processing into the SLA (High)

Align all the authorisation structures

Complete guidance notes (High)

Establish a formal process to monitor performance against the SLA

Record key processing checks in more detail

Complete the update of the HR –payroll BCP

Obtain evidence & assurances from NKDC of the annual testing of their IT DR & BCP arrangements

Complete 30 Sept 2016 Prev 31 July 2016 Ongoing Completed 30 June 2016 Completed 30 June 2016 Completed 31/03/2017 (links to IT DR plan timescales) Prev June 16 Completed 30 June 2016


26

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet Due

Recommendation /

Agreed Action

Comments / Progress

H M

Chief Finance Officer Corporate Property

Feb 2015

Effective 1 1 Gas & Electrical Safety training (and audit)

90% complete Gas training completed with mini audit (Feb 16) Action plan completed To implement actions arising from Audit by end Dec 16. Electrical training to be organised first half 16/17 (completed); actions from audit (to be arranged) to be implemented by 31st October 16. NB (external) audit not yet confirmed so date will move.

Creditors 2014/15 May 2015

Some Improvement

3 2

1 Establish a project plan for the increased use of purchase orders

Extended to 30 Sept 16 On track.


27

Treasury Management

Feb 15

Some Improvement

2 1 1

Update Code of Practice for Treasury Management and accompanying Treasury Management Practices

It has been agreed that this is to be extended due to budget work and then closure of accounts taking priority – 31/10/16

Accountancy June 15

Effective 3 1 2 Review Financial Procedure Rules & update budget holder manual.

Extended to 31st October 16 Delayed due to restructure Budget holder manual 31/12/16

Property plant and equipment

May 15

Effective 1 1 Review inventories in line with FPR

This was not completed by the deadline because of the corporate restructure Extended to 31 Dec 16 Prev 31 March 2016

Revs and Bens Shared service

July 2015

Substantial 2 1 1 Create data sharing protocol

Extended to 30/09/16 On track (Prev 30 Jun 16) Final draft Information Sharing Agreement now available – will be finalised and complete by 30.9.16.


28

Debtors Mar 16

Substantial 5 3 (0)

2 Issue guidance on placing debtor accounts on hold (High)

Update procedure notes

Regularly review SO/CN awaiting approval

Assist services to reconcile their records to details held on Agresso

Completed Completed Being reviewed on a monthly basis. There is no standard report in Agresso for this so will have to be a download from Agresso and manipulated on a spreadsheet which can then be sent out to officers. This is currently being finalised and reviewed. It has been produced earlier due to workload pressures. To be actioned by end of this month and produced monthly thereafter. Revised date 31/10/2016


29

Investigate not allowing product prices to be overwritten

Superceded This has been investigated and there doesn’t appear to be a workable solution as Product codes have to be either all open or all closed. So the status quo remains which also allows some discretion which certain officer need. The risk is that an officer could type in the wrong amounts. This risk is offset by having the close scrutiny of income codes by revenue accountants during their monthly budget monitoring exercises.

Cash, Bank, Electronic Income

Apr 16 High 4 3 (2)

1 Establish an annual review process for cash collection contractor insurance certificates

Determine if reports of reversals can be obtained

30 September 2016 On track Completed 30 June 2016 This has being implemented (screen


30

shots) and is sent being sent to the Group Accountant on a monthly basis to review.

Creditors May 16

Substantial 2 1 (0)

1 Regularly review exception reports

Determine if any further duplicate payment controls are required

Completed 31 March 2017

Housing Benefits May 16

Substantial 9 1 8 Introduce a formal training & development plan

Improve the quality checking process

Update procedural guidance

30 September 2016 (on track) 31 October 2016 Prev 31 July 2016. QC Policy developed 14th Sept and finalise roll out October. This remains the update and timeline 31 Dec 2016 Prev 30 June 2016 Decision has now been made that we are remaining with Destin (current procedural guidance platform) This work is now being picked up with a view for it to be undertaken during Q2 and Q3 On track – significant progress


31

Improve the process to monitor conflicts of interest

Provide refresher training on the detection of fraudulent evidence

Consider increasing the level of satisfaction survey work undertaken

Introduce a process to learn from appeals

Consider the way forward for CTR counter fraud work

31 January 2017 Guidance issued to all Northgate system users in July 2016. Monitoring arrangements being progressed. 31 October 2016 On track 30 September 2016 On track 30 September 2016 On track 31 August 2016 31/03/2017 Prev 30 September 2016 Funding now obtained from LCFP – 6-month project relating to NNDR and CTS started end August 2016, outcomes to be monitored via regular project progress meetings.


32

Governance and Risk

July 16

4 4 New risk register templates have been developed and will be rolled out as part of the planned risk management training. As part of this training, the risk management tool kit will include the need for action plans for all red risks. The revised template includes risk appetite, this will be rolled out as part of the proposed training It has been agreed that the Business Management Team Leader will meet with all Assistant Directors to review their risks and links to the combined assurance report. Approval of the Annual Governance Statement will be through the Assistant Directors Group/CMT. Agreement on responsibility for developing the Annual

30 Nov 16 30 Nov 16 30 Sept 16 On track 31 Oct 16


33

Governance Statement and implementing the new CIPFA/SOLACE guidance still has to be agreed.

Shared Revenues and Benefits

July 16

Substantial

3 1 (0)

2 A communication event will be arranged through the Business Development & IT Manager

A process flow was developed identifying the different IT responsibilities of the Councils and this will be included in the Service Level Agreement

Health & Safety update will be programmed in for a management team meeting which includes Team Leaders

Health & Safety requirements will be included in the Delegation and Joint Support Agreement

Information sharing

30/11/16 31/10/2016 Prev 30/09/16 31/10/16 31/10/16 Completed


34

agreement will be progressed and access to NKDC incident list arranged. Discussions on the apportionment of support costs will be commenced at the next Operational Board to open the way for work to be commenced on identifying and apportioning costs, and to take a report to the Joint Committee.

Arrangements are in place re notification of NK incidents. 31/10/2016 Prev 31/08/16 Meeting taking place between RB Operational Board on 26.9.16 to discuss and progress.

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet Due

Recommendation /

Agreed Action

Comments / Progress

H M

Assistant Director - Housing Vehicle Fuel Management

Feb 2013

Limited 8 6

1 1

Increase analysis of fuel data Introduce instructions for fuel cards & update the Driver and Vehicle Codes of Practice.

28/02/17 Awaiting new fuel contract ( to be extended) In progress. New framework / contract to complete. 31/10/2016 30 September 2016


35

(31 May 2016) Almost complete – final amendments via union/JCC.

Reactive Repairs – Stores Contract

April 2013

Limited 7 7

Make a decision on the disposal of old stock (High)

Completed Old stock – disposed off.

Out of Hours Repairs

May 16

Substantial 6 3 (1)

3 Procedure notes (High)

Completion of timesheets

Introduce specific out of hours performance measures

Inspect and obtain feedback on out of hours work

Produce an out of hours risk assessment

Review the level of resources and management arrangements

Prev (July16) Drafted 31/12/2016 Complete 31/12/2016 Complete Complete 31/12/2016


36

Audit Area

Date Assurance Number of Recs

Implem’d Outstanding

Not Yet Due

Recommendation / Agreed Action

Comments / Progress

H M

Assistant Director - Communities & Street Scene Waste Collection, Recycling, Street Cleansing & Grounds Maintenance

Oct 2015

High 3 3

Monitor action on complaints quarterly

Complete

Parking Services Dec 15

Substantial 11 10 1 Review VAT query Dec 2016

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments / Progress

H M

Assistant Director - Health & Environmental Services Empty Homes Sep

2013 Limited 6 5

(4) 1 Review the Private

Sector Housing Enforcement Strategy

Extended to March 17 30 September 2016 (Prev June 2016) Implementation affected by work on the Landlord Accreditation Scheme and the Rogue Landlord Project and Housing and Planning Act 2016.

Bereavement Nov Some 5 5 Use the corporate Completed


37

Services

2014 Improvement (4)

debtors system

Leisure Contract Management

Nov 2015

High 2 1 1 Update the risk register following the renegotiation of the Birchwood contract and document quarterly reviews.

31 Oct 2016 (previously Aug 16) Update requested

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments / Progress

H M

Strategic Director – Communities and Environment Development management

May 15

Some Improvement

6 5 (4)

1 (2)

Guidance for commenting on planning applications should be updated, approved and republished on the website Determine record retention requirements & introduce an active retention & disposal process.

Extended to 30th September 2016. On track Extension linked to implementation of new system – target August 16 Retention requirements completed working with information governance officer

internal audit - progress report 2016 / 17 a inte… · internal audit - progress report 2016 / 17...

Documents