Agenda item

To present the Internal Audit update report.

The report of the Head of Audit and Risk setting out the progress to the end of May, 2017 with regard to the Internal Audit reports issued since 1 April, 2017; follow up of previous Internal Audit reports; progress in delivering the Internal Audit Annual Plan 2017/18 and an update on specific areas as requested by the Committee was presented for consideration.

The Head of Audit and Risk reported on the following matters –

•           The Internal Audit reports recently issued which related to Energy Island (April, 2017 assessed as  providing Substantial assurance) Stock Check, Housing Maintenance Unit, Gaerwen (May, 2017 assessed as providing Limited Assurance); Housing Maintenance Unit (May, 2017 assessed as providing Limited Assurance) and the Main Accounting System (May, 2017 assessed as providing Substantial assurance).The Officer referred to the key findings in relation to each of the audits with particular reference to the shortcomings identified in the two Limited Assurance audits. She confirmed that Internal Audit would be keeping a watching brief over these two areas to ensure compliance with the recommendations made for improving the internal controls.

•           Follow up reviews completed in relation to Building Regulation Fees – Inspection and Enforcement and ICT Disaster Recovery. In the case of the former the first follow up in April, 2017 found that little progress had been made in implementing the actions agreed to address the internal audit recommendations. A further follow up review will be undertaken in August, 2017 and the outcome reported to the Committee’s September meeting. In the case of ICT Disaster recovery the third follow up review found that little progress had been made in implementing actions to address the internal audit recommendations outstanding from the previous two follow up reviews. A further follow up review will be undertaken in August, 2017. 

•           Progress on implementing audit recommendations. The service is currently compiling a report on the performance in implementing all outstanding recommendations which will be presented to the Audit and Governance Committee at its meeting in July, 2017.

•           Progress in delivering the Internal Audit Operational Plan 2017/18. Due to the slippage of the work from the 2016/17 Annual Plan, work on the 2017/18 Plan has been slow. However, work is currently ongoing in 14 areas as listed in paragraph 6.2 of the report.

•           Updates requested by the Audit and Governance Committee with regard to Corporate Safeguarding and the arrangements for implementing of CSSIW’s recommendation following its inspection of Children’s Services. With regard to the former, early indications are that reasonable progress has been made in implementing the agreed actions and a draft report was issued in 14 June, 2014. The outcome of the follow up review will be reported to the July meeting of this Committee. With regard to the CSSIW inspection report, the Head of Children’ s Services has reported and presented a Service Improvement Plan to the Corporate Scrutiny Committee and the Executive in March, 2017. Progress on implementing the Service Improvement Plan which incorporates the recommendations made by CSSIW was reported to the Corporate Scrutiny Committee in April, 2017 and this will be a standing item on that Committee’s agenda from June, 2017 onwards. Internal Audit is therefore able to provide assurance to the Audit and Governance Committee that Children’s Services have a process in place to ensure the monitoring of the Service Improvement Plan.

The Committee considered the information presented and it made the following points –

•           The Committee sought clarification of whether the Energy Island Programme as a major cross organisational project is linked to a risk register given that there could be consequential risk to the Council as a partner within the programme. The Internal Audit Manager confirmed that the Energy Island Programme project is included on the Council’s Corporate Risk Register.

•           The Committee noted that actions recommended by Internal Audit as necessary in order to remedy failings and weaknesses in controls as identified in audit reviews are not always being taken promptly by Management. The Committee noted the length of time which Management was given to implement actions including actions to address basic systemic shortcomings and/or housekeeping issues which should be actioned swiftly – the two audits in relation to the Housing Maintenance Unit in Gaerwen being cases in point. The Committee further noted that Management‘s  responsiveness to internal audit recommendation could be improved – the follow up audits of Building Regulation Fees and ICT Disaster Recovery were noted as examples where “little progress” had been made since the previous follow-up meaning that audit recommendations had not been acted upon fully or in a timely way.

•           The Committee, whilst acknowledging that services are often operating under pressure, and that this needs to be borne in mind in considering response times to audit recommendations, nevertheless noted that Management needs to be more robustly challenged for the non-implementation of internal audit recommendations or for inaction over an extended period of time, especially where the level of assurance has been assessed as Minimal or Limited. The Head of Audit and Risk confirmed with regard to the Limited Assurance audit of the Housing Maintenance Unit that the Head of Housing Services has committed to addressing the majority of recommendations immediately and that the Committee would be updated on progress at its July meeting.

•           The Committee proposed that the Head of Housing Services be called to the Committee’s meeting in July to explain how the weaknesses in internal control arose, how the service is delivering on the agreed actions to address the control issues identified in the two audits relating to the Housing Maintenance Unit in Gaerwen and how the service proposes to ensure that the system of control remains effective in future.

•           The Committee noted that a report on outstanding audit recommendations is being compiled by Internal Audit. The Committee sought clarification of the current position with regard to outstanding recommendations. The Head of Audit and Risk said that currently, there are 77 reports with outstanding recommendations; of those recommendations, 5 are Red (2 of which have not yet reached their implementation deadline), 30 Amber (14 of which have not reached their implementation deadline), 41 Yellow and 14 Green. From the previous rating system, 10 High recommendations are outstanding, 109 Medium and 115 Low.

•           In light of the above information and whilst mindful of the volume of information that it might entail the Committee proposed that as a one-off exercise and to provide it with an overview and context, it be given a schedule of all outstanding internal audit recommendations (including any from those reports where the assurance was assessed as Substantial) and that all those where the risks and/or issues are assessed as Catastrophic or Major be accompanied by a brief summary of  background, progress and status. It was suggested that consideration needs to be given to asking Heads of Service to explain unactioned audit recommendations where the risks are classed as Catastrophic or Major.

•           The Committee further proposed that in order to remain on top of the situation and to gain an appreciation of issues arising before they are considered in detail, internal audit review reports should be made available to the Committee outside the committee meetings cycle as and when  they are issued .To keep the information manageable, and to ensure that the focus remains on the key sources of risk only, the reports provided should be in a summary format and cover reviews where the assurance opinion is Minimal or Limited.

•           With regard to the CSSIW inspection report on Children’s Services, the Committee sought assurance that the 12 months which it was informed the service had been given to implement the recommendations arising from the inspection was not an overly long timeframe given the significant concerns identified and the high risk nature of the service area concerned. The Committee was informed that 7 recommendations are to be addressed as a matter of priority with the remaining recommendations to be actioned over 12 months. This is the timeframe laid down by the regulator which recognises that implementing some of the recommendations involves introducing new practices and processes which need to embed over a period of time. Monitoring the progress of implementation will be undertaken by Scrutiny.  

It was resolved to note the progress made by Internal Audit in terms of its service delivery, assurance provision, reviews completed, and performance and effectiveness and in driving improvement.

ACTIONS ENSUING:

•           Head of Audit and Risk on behalf of the Committee to ask the Head of Housing Services to attend the Committee’s next Committee in July, 2017 to give an account of the service’s response to the two Limited Assurance audit in relation to the Housing Maintenance Unit in Gaerwen and the issues arising.

•           Head of Audit and Risk to provide the Committee at its meeting in September, 2017 meeting with a schedule of all outstanding internal audit recommendations. Outstanding recommendations assessed as High priority or where the risks/issues arising are assessed as Catastrophic or Major to be accompanied by a summary of background, progress and status.

•           Head of Audit and Risk to make arrangements to provide the Committee with a summary of internal audit reviews resulting in a Minimal or Limited audit opinion as and when they are issued.