To provide a progress report on the Internal Audit function for the period September 2024 – December 2024.

The Committee was provided with a periodic report on the Internal Audit function for the period September 2024 to December 2024.

 

That report was summarised as follows:-

 

·      A total of eight audits had been completed since the previous update in September 2024.

·      Seven out of eight audits in this period had received a satisfactory level of assurance. Disabled Facilities Grants and Council Adaptations had received an overall ‘Improvement Required’ opinion.

·      It was requested that the Careline Follow Up Audit be deferred as decisions were still to be made on the future of the service. This was a total of five audit days that the Internal Audit Manager wanted to reallocate to the Payroll audit as a brand new system had been implemented and it was believed that the audit could take longer than originally anticipated.

·      As the Internal Audit Manager was providing the updates on Risk Management whilst the Assurance and Resilience Manager remained on secondment it was requested that the related audit be deferred and the five allocated days be used towards current and future updates on Risk Management until the responsible officer returned.

·      During this period an issue had arisen relating to a substantial precept payment being paid incorrectly to the incorrect Parish Council. The funds had been recovered in full and the issue resolved, however it had identified a weakness in control that needed to be resolved.

 

INTERNAL AUDIT PROGRESS 2024/25

 

It was reported that a total number of eight audits had been completed during the period of September 2024 to December 2024. Seven out of the eight audits in this period had received a satisfactory level of assurance. The Disabled Facilities Grants and Council Adaptations had received an overall ‘Improvement Required’ opinion.

 

A further eight audits from the 2024/25 Internal Audit Plan were in the fieldwork phase. The final six audits from the plan had been allocated based on the available resource.

 

The Internal Audit Manager requested that the Careline Follow Up Audit be deferred as decisions were still to be made on the future of the service. This was a total of five audit days that he wanted to reallocate to the Payroll audit as a brand new system had been implemented and it was believed that the audit would take longer than originally anticipated. Many processes and controls had had to change during the implementation of the ITrent HR/Payroll system and some of those processes were now shared between both departments, therefore reallocating the five days from the Careline review would provide more time for the auditors to get a better understanding of the system.

 

As the Internal Audit Manager was still providing the updates on Risk Management whilst the Assurance and Resilience Manager remained on secondment it was requested that the related audit be deferred and the five allocated days be used towards current and future updates on Risk Management until the responsible officer returned.

 

Members were informed that the Team were currently at the same stage as last year in terms of audits completed, therefore it was anticipated that enough work would be completed in time to provide the Head of Internal Audit’s Annual Opinion in June 2025.

Quality Assurance

 

Members recalled that the Internal Audit Team issued satisfaction surveys for each audit completed. The Team had yet to receive completed surveys for the audits completed in this period.

 

Resourcing

 

The Committee was reminded that the Internal Audit Team currently had an establishment of 4 FTE posts with access to a third-party provider of Internal Audit Services for specialist audit days as and when required. An Audit Technician post remained vacant. However, a new apprentice who supported the Internal Audit, Fraud and Compliance teams had been appointed in November 2024.

 

Outcomes of Internal Audit Work

 

The Committee was aware that the Public Sector Internal Audit Standards (PSIAS) required the Internal Audit Manager to report to the Committee on significant risk exposures and control issues. Since the last report eight audits had been completed and the final report issued.

 

Assurance	Colour	Number this Period	Total for 2022/23Plan
Substantial		2	2
Adequate		7	11
Improvement Required		1	1
Significant Improvement Required		0	0
No Opinion Required		2	2	Two consultative engagements in 2024/25 to date

 

For the purpose of the colour coding approach, both the substantial and adequate opinions were shown in green as both were within acceptable tolerances.

 

Issues arising from audits completed in the period under review receiving an ‘Improvement Required’ opinion and requiring reporting to Committee were:-

 

No contract in place for Disabled Facilities Grants relating to Council Housing Stock

 

Issue

 

There were no contracts in place and each adaptation required the quotation process to be initiated and treated as individual jobs, unlike the building maintenance contracts. This specifically related to Council housing and was therefore limited to the HRA budget.

 

In some cases, those works could exceed tender limits when aggregated both overall and to individual companies. As one example, over the last two years, the Council had paid one external company just over £150,000 (£100k last year & £50k so far for this year) to undertake disabled adaptation works, none of which were obviously specialist.

The total spend by contractors for the financial year 2023-24, amounted to over £550,000.  

 

Risk

 

It was felt that a failure to source a contract, in adherence with the Council’s Constitution, was not only a risk of breaching the Council’s rules by disaggregating expenditure, but that the service could be paying higher prices for individual works as opposed to set fees within a contract.

 

There was also an associated risk of external companies carrying out works, without any formal checks to establish that they were suitable to undertake works for the Authority.

 

Agreed Action

 

As a short-term solution quotes would be obtained to the value of £30k-£50k in line with procurement rules. This would provide some resilience of not having to rely on one contractor to undertake the work. In the long term, a full tender process for the Housing Responsive Repairs contract would be carried out in May 2026, which would include the works of disabled council adaptations as part of that. For specialist work, procurement frameworks would be explored with a view to using them.

 

Payment made to the incorrect Council in error

 

It was reported that, although the Accounts Payable audit was yet to begin, an issue had been identified by the Payroll and Payments team whereby a payment of over £340k meant for a specific parish had been paid to another parish instead in error. The Payments Team had promptly reported the issue and had corrected the mistake. However, it had identified a weakness in the control environment that required an immediate remedy.

 

Members were informed that there were several payment methods that were used to pay suppliers, individuals, other Councils etc. The type of method used depended on the supplier and whether an invoice had been provided or not.

 

Payment requisition was a method that could be used when an invoice was not available, but payment needed to be made. Historically, this method had been used to make contract payments, grant payments, faster payments and some precept payments to Parish Councils. The service requiring the payment to be made were required to complete a specific form and send it to the Payroll and Payments Team for processing. This process was not to be used regularly as it was meant for organisations that could not provide an invoice or when there was a requirement to make a payment faster than usual. It was understood however that services had begun to use this method even when an invoice was available to be paid.

 

The Committee was advised that the responsibility of ensuring bank details were correct had usually been left to the service as they were the ones requesting the payment to be made. This was where the weakness within the control had been identified. If bank details were different on the form from the bank details held on the payment system, then the Payroll and Payments Team were required to contact the company (or Council Service Unit in this instance), via the contact details held on file to confirm the change. This had not occurred in this instance as the change of details had already occurred from an earlier request without anyone realising the error.

 

Therefore, going forward the Payroll and Payments Team would take a ‘no trust’ approach and would no longer make a payment via the requisition process unless the service had provided evidence of the bank details in an official format from the organisation / individual concerned. They would also check the duplicate bank details report regularly to ensure none of the details had been duplicated historically. This would only work if the Council had paid the supplier in the past, it was not a control for new payments.

 

Update on previous significant issues reported

 

All previous significant issues were now provided within Appendix B of the Internal Audit Manager’s report.

 

The Internal Audit Manager and the Director (Finance & IT) responded to the Committee’s questions on this report.

 

After discussion it was moved by Councillor Fairley, seconded by Councillor Sudra and unanimously:-

 

RESOLVED that –

 

(a)    the contents of the Internal Audit Manager’s report (A.1) be noted;

 

(b)    the Internal Audit Manager’s request that the Careline Follow Up Audit be deferred as decisions were still to be made on the future of the service and that the five audit days be reallocated to the Payroll audit be approved; and

 

(c)    a senior Officer from the Council’s new Project Delivery Unit be requested to attend the next ordinary meeting of the Committee in March 2025 to answer Members’ questions regarding the governance aspects of that team’s work.