Agenda item

To inform Members of the overall adequacy and effectiveness of the system of internal control and risk management operating throughout 2024/25 and present a summary of the audit work undertaken to formulate the opinion, including reliance placed on work by other bodies.

This report also fulfils the relevant statutory requirements of the 2017 UK Public Sector Internal audit Standards (PSIAS); the 2017 Local Government Transparency Code; and the Audit Committee’s terms of reference.

Mr Minesh Jani, Head of Audit and Risk Management, introduced the report.

The Committee heard:

·         Implementation of recommendations was a key part of the work of Internal Audit. The final output had recommendations for improving the governance, the internal control and the risk management. When examinations had been made into the percentages of recommendations not implemented, the focus had gone into priority one recommendations, because they were the most important. The recommendations not implemented tended to lie in areas where it was clear that the Council was trying to make improvements, but would take time. There were other recommendations not yet implemented and to aid that process, the Council was planning to introduce a new software system capturing every single recommendation and required management to update the status of those on a regular basis. One of the things that the Council was doing was providing the Committee with assurances only when Audit carried out a follow-up. By increasing the oversight, there should be an improvement in the implementation status. This was not to say that all the key priority one recommendations would be implemented sooner, because the Council knew what they were, but there would be an improvement in priority two and priority three recommendations.

·         The Housing service had shown positive progress. From an audit perspective, there was focus on making sure that the internal controls were robust. It was possible to have a scenario where a service had poor internal controls, but was still delivering good service. However, this would not be sustainable over the long term. The need for a good way of doing things with the right checks and balances was key. There had been reports where the service had demonstrated that it had carried out an external review and those reviews had identified improvements. It was important to make sure the service implemented the right level of internal control so that the improvements were sustained and that they were embedded in the in the service.

·         In relation to recommendations that had not been implemented, what worked generally well was when the Audit Committee had sight of the key recommendations causing the limited or no assurance. The Audit Committee could then hold the officers to account on either the timeline or the lack of action. If it was not clear at each meeting what the key outstanding issues were, it would not be clear how effective the Committee would be in helping officers get to implementing improvements. It would be useful for the Committee to receive, at least, the priority one findings tabled at each meeting to see what the due dates were, what the progresses was and what the challenges were.

·         The performance from an internal audit perspective on the level of assurances assigned to schools had deteriorated. Last year, there was a marked improvement in the assurances with very few schools getting a low level of assurance. Unfortunately, in 2024/25 of the 12 schools audited, seven were assigned limited assurance. Three or four key actions had been put in place. Firstly, to reappraise the school business managers, the head teachers and the chair of governors on the requirement of the audit and the need for the right internal control environment. A number of seminars with key officers would be held. Officers needed to be aware of what good internal control should look like in key areas of their operations. Secondly, there would be expectations from internal audit. In talking to the school's forum, one of the things that came out was the possibility that the auditors were asking for information which did not feed back into the assurance. Checks needed to be made to ensure that the audit program was consistent with the school's finance manual and ensure that the Council was appraising schools for the right areas in the right way. Thirdly, regular bulletins would be made to schools to help them understand where there were key areas of weaknesses, what ‘good’ ought to look like. Many schools had been identified as struggling with maintaining an asset register. This was an easy control to put in place. It would be possible to develop a good format of a register, schools would save a lot of time having to reinvent one. Hopefully, there would be an improvement in the assurances for next year. In relation to the 129 recommendations relating to schools, the numbers for the system was about 205, so there was a higher proportion of recommendations. In relation to the two schools that were postponed, one school was closing and the other was postponed because the school business manager was not available.

·         The Council did not have an overarching system to capture all of the procurement activities in the Council. In terms of maintaining evidence to show that proper contract management was taking place, each procurement was done contract by contract on an individual service basis. The Procurement service had not been able to establish a system for capturing these, so the level of assurance needed that contract management was working as well as it could not yet be confirmed. This had been picked up on the Annual Governance Statement. An update would be provided to the Committee.

RESOLVED:

That the Committee notes the content of the Head of Audit and Risk Management’s annual audit report and assurance statement for 2024/25 and the accompanying appendices.