internal audit report...jul 23, 2020 · 19 the internal audit work completed in 2019/20 was...

Annex A

Scarborough Borough Council

Annual Report of the

Head of Internal Audit 2019/20

Audit Manager: Connor Munro Head of Internal Audit: Max Thomas Date: 23 July 2020

Background 1 The work of internal audit is governed by the Accounts and Audit Regulations

2015 and the Public Sector Internal Audit Standards (PSIAS). In respect of reporting, the relevant PSIAS standard (2450) states that the Chief Audit Executive (CAE)1 should provide an annual report to the board2. The report should include:

(a) details of the scope of the work undertaken and the time period to which the opinion refers (together with disclosure of any restrictions in the scope of that work)

(b) a summary of the audit work from which the opinion is derived (including details of the reliance placed on the work of other assurance bodies)

(c) an opinion on the overall adequacy and effectiveness of the organisation’s governance, risk and control framework (i.e. the control environment)

(d) disclosure of any qualifications to that opinion, together with the reasons for that qualification

(e) details of any issues which the CAE judges are of particular relevance to the preparation of the Annual Governance Statement

(f) a statement on conformance with the PSIAS and the results of the internal audit Quality Assurance and Improvement Programme

2 The Audit Committee approved the annual internal audit plan for 2019/20 at its

25 April 2019 meeting. This report summarises the delivery of the agreed plan and the other information required for the annual report as set out in paragraph 1 above.

Internal audit work carried out 2019/20

3 A summary of the audit work completed in the year is attached as Annex 1 to this report.

4 An overall opinion was given for each of the specific systems reviewed. In addition to the standard reports shown in Annex 1, non-standard reports are also issued with ‘no opinion given’. These may be where the work is limited in scope or is not designed to provide assurance (for example, advisory work).

5 The opinions used by the Council’s in-house internal audit service during

2019/20 are provided below:

High Assurance Overall, very good management of risk. An effective control environment appears to be in operation.

1 The PSIAS refers to the Chief Audit Executive. This is taken to be the Head of Internal Audit. 2 The PSIAS refers to the board. This is taken to be the Audit Committee.

Substantial Assurance Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified.

Moderate Assurance Overall, satisfactory management of risk with a

number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made.

Limited Assurance Overall, poor management of risk with significant

control weaknesses in key areas and major improvements required before an effective control environment will be in operation.

No Assurance Overall, there is a fundamental failure in control and

risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse.

No Opinion Given An opinion is not provided when a piece of work is

non-assurance or limited in scope. This may include work such as grant claims, fact-finding work, projects, a review of follow-up implementation or consultancy work.

7 The following priorities were applied to individual recommendations made to

management in 2019/20:

Priority 1 (P1) – A fundamental system weakness, which represents unacceptable risk to the system objectives and requires urgent attention by management.

Priority 2 (P2) – A significant system weakness, whose impact or frequency presents risk to the system objectives, which needs to be addressed by management.

Priority 3 (P3) – The system objectives are not exposed to significant risk, but the issue merits attention by management. Priority 4 (P4) – The risk is being effectively managed through adequate controls, but system improvements were identified as part of the testing process.

Follow up of recommendations

8 It is important that recommendations are formally followed up to ensure that

they have been implemented. Where necessary, internal audit will undertake further detailed review to ensure that actions taken in response to

recommendations raised have resulted in the necessary improvement in control.

9 The table below covers recommendations with target completion dates up to 31 March 2020 and also those recommendations which have been completed in advance of target completion dates, as at the time this report was prepared (15 July 2020). Due to the pressures placed on the Council in responding to the Covid-19 emergency, the decision was taken to suspend follow-up work during the first quarter of 2020/21. Follow-up work will be begin to resume in areas less involved in the Council’s recovery efforts, alongside regular assurance work, during quarter two.

New 2018/19 plan (since 1 October 2019)

Estates Peer Review 1 recs, 1 complete, 0 outstanding

Members Development 3 recs, 3 complete, 0 outstanding

Local Taxation 3 recs, 1 complete, 0 outstanding 2 accepted

Open Air Theatre 1 recs, 1 complete, 0 outstanding

ICT Incident Management Trails

1 recs, 1 complete, 0 outstanding

Building Security 7 recs, 0 complete, 2 outstanding 5 accepted

Enforcement 7 recs, 7 complete, 0 outstanding

S106 Monies 3 recs, 3 complete, 0 outstanding

26 17 9 Inc. accepted

New 2019/20 plan

Capital Projects – Whitby Piers


Commercial Waste 3 recs, 0 complete, 3 outstanding

HR Recruitment Processes 2 recs, 2 complete, 0 outstanding

Peasholm Park 8 recs, 7 complete, 0 outstanding 1 accepted

Procurement – Tender Scores

5 recs, 2 complete, 0 outstanding 3 accepted

Making Tax Digital 1 recs, 1 complete, 0 outstanding

Corporate Investment – Commercial Property Investment Strategy


Safeguarding Training 6 recs, 4 complete, 0 outstanding 2 accepted

SIV Contract 3 recs, 1 complete, 2 outstanding

Private Water Supply 7 recs, 7 complete, 0 outstanding

Transparency Code 4 recs, 1 complete, 3 outstanding

Food and Occ. Safety 3 recs, 3 complete, 0 outstanding

Internal CCTV 5 recs, 4 complete, 1 outstanding

General Ledger 1 recs, 1 complete, 0 outstanding

Treasury Management 2 recs, 2 complete, 0 outstanding

Key Roles CPD 3 recs, 3 complete, 0 outstanding

Planning Enforcement 7 recs, 7 complete, 0 outstanding

Corporate Governance 1 recs, 0 complete, 1 outstanding

Tourism and Marketing 1 recs, 1 complete, 0 outstanding

Events Management 2 recs, 2 complete, 0 outstanding

66 50 16 Inc. accepted

10 A total of 92 recommendations have been followed up since the last report to

this committee in October 2019. Of these, 67 (73%) have been implemented and 25 (27%) remain outstanding. The number of outstanding recommendations includes those where the risk has been accepted, of which there are 13.

11 In the remaining 12 cases, the recommendation had not been implemented by the target date but a revised date has been agreed. This is agreed where the delay in addressing the issue will not lead to unacceptable exposure to risk, and where, for example, the delays are unavoidable (e.g. due to unexpected difficulties, or where actions are dependent on new systems being implemented). These recommendations will continue to be monitored and reported to this committee.

12 Follow up work carried out on recommendations previously reported to this committee is summarised in the table below:

R

ecom

mend

ed

Com

ple

te

Outs

tand

ing

Ris

k a

ccepte

d

Previously reported, outstanding from Q3, 31 January 2019

Print Plus – 3CLOSED 1 1 0

Procurement – CLOSED 3 3 0

Contracts Database – CLOSED 6 6 0

Previously reported, outstanding from Q4, 25 April 2019

Information Security (Hard Copy) 3 3 0

Previously reported Q1 – outstanding recommendations from Q3 follow up work

Museums Trust 1 0 0 1

Previously reported Q4 – outstanding recommendations from Q2 follow up work

2018/19 Plan

Museums Trust – CLOSED 2 2 0

Vehicle Operator Licence 3 2 1

Outstanding investigation into non-financial reporting via T1

Gypsies and Travellers – CLOSED 2 2 0

Other licences 1 0 1

Deadline amended

Information Security (Hard Copy) – CLOSED 1 1 0

Filey Brigg Caravan Park – CLOSED 1 0 0 1

Income – CLOSED 1 1 0

Open Air Theatre 3 3 0

Accounts Receivable – CLOSED 3 3 0

Enforcement 4 4 0

2019/20 Plan

3 Indicated ‘CLOSED’ where no further recommendations remain for the audit.

Management of Empty Properties 4 4 0

Apprenticeships and Levy – CLOSED 2 2 0

Property Valuations – CLOSED 1 1 0

Commercial Waste 1 1 0

HR Recruitment Processes 6 6 0

13 Of the recommendations previously reported to this committee as outstanding, 94% have been completed or the risk accepted.

14 The target completion date for one recommendation has been revised and one recommendation remains outstanding. Both of these recommendations will continue to be monitored and reported to this committee. The recommendations previously reported as outstanding for Procurement have been closed as completed or superseded and included in the most recent audit recommendations within the report for Tender Scoring and Allocation.

15 All outstanding recommendations raised in reports pre-dating the 2018-19 audit year have been followed up and 100% of these have been completed or the risk accepted.

Completion of audit plan

16 All 2019/20 audits have been completed. A total of 11 reports have been finalised since the last report to this committee.

17 Four audits have been deferred during the year. The scope of the Firmstep review was no longer considered appropriate due to the status of the system implementation and the pause on transformation work while the Council’s new vision is developed. The Ceremonies audit was deferred as the future of the service has been under review. The Procurement audit was not undertaken as the North Yorkshire Procurement Partnership ceased to operate and, instead, new internal processes are being developed. This was replaced with the Memorial Safety audit. The Property Maintenance audit was replaced with the South Cliff Lift review which was elevated in priority given the Health and Safety Executive’s involvement.

18 In addition, the Energy Management audit was cancelled as, since the previous audit was undertaken in 2015, there has been a significant reduction in the Council’s asset base and associated responsibilities in this area.

Audit opinion and assurance statement

19 The internal audit work completed in 2019/20 was undertaken by the Council’s in-house internal audit service. Responsibility for the internal audit service transferred to Veritau North Yorkshire Limited on 1 April 2020, although interim management support was provided for two months from 1 February 2020.

20 Based on the work undertaken by the previous in-house internal audit team the overall opinion of the Head of Internal Audit on the framework of risk management, governance and control operating within the Council is that it provides Substantial Assurance.

21 In reaching this opinion no reliance was placed on the work of other assurance bodies. However, there are two qualifications to this opinion. Firstly, the opinion is derived from the work of the Council’s previous in-house internal audit service. This work has not been subject to Veritau’s usual quality assurance processes and we are therefore unable to demonstrate that the work has conformed to PSIAS. Secondly, the opinion is qualified in light of the coronavirus pandemic and the impact of this on the Council. The opinion provided is based on internal audit work undertaken, and substantially completed, prior to emergency measures being implemented as a result of the pandemic. These measures have resulted in a significant level of strain being placed on normal procedures and control arrangements. The level of impact is also changing as the situation develops. It is therefore not possible to quantify the additional risk arising from the short term measures in place towards the end of the financial year or the overall impact on the framework of governance, risk management and control.

22 There are no significant control weaknesses which, in the opinion of the Head of Internal Audit, need to be considered for inclusion in the Council’s 2019/20 Annual Governance Statement.

Max Thomas Chief Executive and Head of Internal Audit Veritau Ltd 23 July 2020

Annex 1

2019/20 audits: overview

Audit Status Audit Committee

Planning Enforcement Moderate Assurance July 2020

Corporate Governance Substantial Assurance July 2020

Corporate Investment Strategy Substantial Assurance January 2020

Transparency Agenda Moderate Assurance January 2020

Statutory Roles (CPD) Substantial Assurance July 2020

CCTV (Internal Systems) Moderate Assurance January 2020

SIV Contract Moderate Assurance January 2020

Recruitment Process Moderate Assurance October 2019

Apprenticeships and Levy Substantial Assurance July 2019

Capital Projects (Dean Road Depot) No Opinion Given July 2020

Sea Defences (ECIF) Whitby Substantial Assurance January 2020

Firmstep Work Plan Deferred N/A

Ceremonies (Town Hall) Deferred N/A

Events Management Moderate Assurance July 2020

General Ledger High Assurance January 2020

Treasury Management High Assurance January 2020

Making Tax Digital High Assurance January 2020

Housing Benefit Moderate Assurance July 2020

Borough of Scarborough Community Fund Substantial Assurance October 2019

Commercial Waste Moderate Assurance October 2019

Elections (Expenses) High Assurance July 2020

Management of Empty Properties Substantial Assurance July 2019

Property Valuations Substantial Assurance October 2019

Energy Management Cancelled N/A

Property Maintenance (recharge works) Deferred N/A

South Clift Lift Review Substantial Assurance July 2020

Tendering Scoring and Allocation Moderate Assurance January 2020

Procurement Deferred N/A

Private Water Supplies Limited Assurance January 2020

Food and Occupational Safety Moderate Assurance January 2020

Homelessness (NPSS Review) High Assurance July 2020

Peasholm Summer Audit Moderate Assurance October 2019

Customer First Security Review Moderate Assurance January 2020

Safeguarding Training Moderate Assurance January 2020

Tourism and Marketing Substantial Assurance July 2020

Memorial Safety Limited Assurance July 2020

Annex 1 Summary of audits completed to 15 July 2020; not previously reported to the committee

Audit Opinion Date Issued

Recommendations by priority

Work done / significant weaknesses / issues identified

1 2 3 4

Statutory Roles (CPD)

Substantial Assurance

20 Dec 2020

0 0 3 0 An audit of key roles at the Council was undertaken to review legislated and business critical roles undertaken by officers. This was to provide an opinion on the current status of the workforce in being able to meet its obligations and discharge its functions, including whether a role requires a formal qualification and continuing professional development (CPD). The key findings from the audit were that statutory roles are listed within the Constitution, with detailed delegations to Officers. There is no central list of business critical and legislated roles but officers are aware of the qualifications required to perform the role they perform. Where appropriate, there is another appropriately qualified officer within services who can deputise. Each service is aware of its own obligations and most have arrangements in place to fulfil duties. There is, however, no formal succession planning within the Council.

Housing Benefits

Moderate Assurance

27 Jan 2020

0 0 5

1 The Housing Benefit team manages and administers the processing of applications for Housing Benefit payments and Council Tax Relief. The audit paid particular attention to the management of system access of the Northgate iWorld software. There were some weaknesses in the management of access, roles and permissions due to the complexity of the system, and recommendations were agreed to address these.




1 2 3 4

Planning Enforcement

Moderate Assurance

10 Feb 2020

0 1 7 0 The Council’s Planning Service is responsible for investigating complaints where building works or changes to the use of land and buildings are undertaken without planning permission. The service also investigates breaches of planning control. The Planning Enforcement Strategy is to be updated to the corporate format. There are multiple methods through which the public can report suspected planning breaches. The breaches are logged as enforcement cases. There is a defined timescale for sending acknowledgments to complainants which is not being consistently met, along with the requirement to share investigation outcomes with the complainant. Reported breaches are assessed by senior planning officers prior to being allocated for investigation, during which time enforcement notices are reviewed for action and compliance, all of which are recorded within the planning software. Paper files are held securely. Overall, the controls and management of Planning Enforcement are good. However, several minor gaps in the controls were identified and recommendations were made relating to these.

Electoral Expenses

High Assurance

18 Feb 2020

0 0 0 0 An audit of election expenses was undertaken. Testing in this audit was based on the European Union parliamentary election and the Parish and Town Council elections held in May 2019. Despite the short notice of the European Parliamentary Election 2019, the controls applied to the recruitment of election staff, payment of fees and expenses and general organisation remained high.




1 2 3 4

A fee structure for charging Parish and Town Councils for the administration costs associated with delivering their elections was approved, with this being the first election affected by the change. All fees were tested and found to be correct, and invoices had been paid in a timely manner.

Homelessness – NPSS review

High Assurance

24 Feb 2020

0 0 0

1 The Homelessness Reduction Act 2017 requires Housing Authorities to undertake a review of homelessness within their areas and to have strategies in place to tackle identified issues. A peer review was undertaken in 2019 from which a Continuous Improvement Plan was produced. The purpose of the review and plan was to provide specific action points following the introduction of the new Act. The Homelessness and Rough Sleeping Strategy 2019-23 was approved by Council in September 2019. Cross reference between the NPSS review report and the Strategy provided evidence of the findings of the review and recommendations being included. The objectives of the Strategy are supported by actions and targets within the service improvement plan. The plan evidenced recommendations from the review being included and prioritised, with 90% having been completed or undergoing current action. The recommendations remaining related to actions which could not be completed by the Housing Options team and required engagement with other Council services. The plan is a live




1 2 3 4

document, being updated with completed and new actions when appropriate.

Capital Project – Nurseries and Depot

No Opinion Given

24 Feb 2020

0 0 0 0 Capital investment in a project is made where long term investment is required to enhance the potential of an asset. The required investment in Dean Road Depot was identified during the review of the Parks Nursery by the Overview and Scrutiny Board. This advisory review has monitored the development and implementation of the project, and has provided areas for consideration for future projects.

Corporate Governance


28 Feb 2020

0 1 1

2 All local authorities are required to ensure there are robust and appropriate controls in place to ensure there is adequate governance surrounding all their activities. Some of the requirements are in response to legislation, and others are based on best practice. This audit provided assurance on the corporate governance controls in place in a range of areas. It was found that the Constitution was outdated in some areas (although this had been corrected at the time the report was issued) and that the policy framework referred to is not in place. Council performance management and reporting arrangements are in place and operating, the required statutory committees are in place, the AGS is produced in a timely manner, information governance procedures are adequate and corporate governance responsibilities are coordinated between appropriate officers.




1 2 3 4

Tourism and Marketing


9 March 2020

0 0 1 0 Marketing of the Borough as a destination is one of the roles of the Tourism team. This includes development of events, signposting of the Borough, supporting business and destination growth via the Discover Yorkshire Coast branding of Scarborough Borough Council. The Tourism and Marketing teams are managed by the Tourism Manager and the team provides varied services which include Sales, Tourism Bureau, Whitby Tourist Information Centre, Marketing and Destination Marketing. The purpose of the audit was to identify and test the controls in place, including giving special attention to ensuring that there is clear definition between the services provided by the team. The Marketing team has a clear function and responsibilities, external partnerships arrangements are in place and appropriate. The budget for the service is suitable and subject to annual review, external work is costed and expected income monitored, and procurement rules are followed. Performance is measured against relevant and meaningful targets and is reported on, by exception, on a regular basis in line with the Council’s Quarterly Performance Monitoring framework. One minor gap in the controls was identified and has been addressed, with the recommendation now closed.

Events Management

Moderate Assurance

2 April 2020

0 2 9 1 The Council’s Events Team is responsible for developing, arranging and coordinating events within the borough which promote community engagement and attract visitors. The team also assists delivery of events hosted by other service areas and processes third




1 2 3 4

party applications for proposed events, in collaboration with the Safety Advisory Group. The Event Delivery Officers are relatively new in post and it was found that processes and functions of the service are evolving. Events receive the appropriate approval and related financial controls are in place. However, event budget sheets are not always completing, hindering budget reviews, and there is a lack of consistency in the success of events is evaluated. In addition, there is currently no events strategy, policy or procedure in place. A number of other findings were raised relating to the administrative processes within the service.

South Cliff Lift Review


11 May 2020

0 0 0 1 The Health and Safety Executive (HSE) were contacted following a hard landing of the South Cliff Lift in October 2018. The Council took the decision to immediately close the lift from the point of the accident. Following their visit the HSE issued four Improvement Notices (INs) relating to material breaches, two further contraventions requiring action and four recommendations. To the extent possible during the restrictions relating to the coronavirus pandemic, the audit reviewed the Council’s response to the HSE’s INs and recommendations. It was found all INs and recommendations had been implemented. One minor gap in the recording of inspection information was identified during the review.

Memorial Safety

Limited Assurance

27 May 2020

2 5 2 0 The Council is the burial authority for its four cemeteries in Scarborough and Whitby. Under the Health and Safety at Work Act 1974 and Occupiers Liability Act 1957 overall responsibility for




1 2 3 4

health and safety lies with the burial authority as they have a duty to make sure sites are maintained in such a way that risks are properly managed.

No record of maintenance work completed by Interserve at Dean Road cemetery is produced by qualified personnel or provided to the Council.

No review or risk assessment of memorials is completed and only those memorials in Dean Road cemetery have been subject to inspection. Records made during a previous review exercise, undertaken approximately 5 years ago, were not able to be located during the audit. Although some limited information is recorded relating to plots and memorials on the CAS system, there is no condition survey and no guarantee that the information is accurate as there has been no reconciliation of cemetery plots and memorials against the records held in the system. There are also concerns about the fitness for purpose of the CAS system in recording the required memorial data.

internal audit report...jul 23, 2020 · 19 the internal audit work completed in 2019/20 was...

Documents