Agenda item

The purpose of this progress report is to inform Members of the work completed by Internal Audit between 1 April 2024 and 30 June 2024.

The current annual plan for Internal Audit is contained within the Internal Audit Strategy and Annual Plan 2024-25, which was approved by this Committee on 13 March 2024.

Speakers:

David John, Audit Manager

Russell Banks, Chief Internal Auditor

Nicola O’Connor, Strategic Finance Business Partner

David Mody, Head of Strategic Risk

Key points raised in the discussion:

1.    The Audit Manager noted that there were twenty-four completed assignments. There were audits of Reasonable or Substantial Assurance in key areas. Six audits were given Partial Assurance, the Transition of Children into Adults, and Community Equipment Services Contract Management audits were referred to Internal Audit by management as there were known issues. A deep dive was undertaken on the Fuel Cards audit, it was affected by MySurrey implementation whereby the controls had dropped off in year, management responded and the level of assurance increased. A follow-up to this audit was reported in the same quarter and is summarised in this report pack with an improved assurance level of Reasonable Assurance. He noted concern in the two follow-up audits around Tree Management, and Social Value In Procurement. The level of assurance had not risen from Partial Assurance, as whilst some progress had been made actions had not been fully implemented.

2.    The Audit Manager noted the opinion of Partial Assurance for Accounts Payable due to MySurrey implementation issues, Accounts Receivable in the last quarter was given Reasonable Assurance. He noted that other audits in progress relating to MySurrey were likely to be of lower assurance levels. Work was underway with management to rectify that through agreed actions, there was a new established MySurrey Stabilisation Board. The intention was to undertake as many follow-up audits in quarters three and four to try and raise the assurance levels, but that this depended on management having completed all of the agreed actions in the timeframe expected.

3.    A Committee Member referred to the many Partial Assurance opinions, particularly the two follow-up audits; asked what the Committee could do to express concern. The Chief Internal Auditor noted that the matter had been escalated with CLT which was committed to address the issues. He noted that it was unusual for the level of assurance to not increase from a follow-up audit, a follow-up would be rescheduled and the findings would be reported to the Committee. He noted that the Committee could request updates from management to review progress on the actions. The Committee agreed for management to provide a report on the actions being undertaken regarding the two follow-up audits on Tree Management, and Social Value In Procurement.

4.    A Committee member asked whether random sampling was undertaken to check whether actions were being completed. The Audit Manager noted that high priority actions were automatically tracked on the audit system and followed-up with the responsible officer, and audits of lower assurance were followed up and all the actions reviewed. Regarding medium and low priority actions in higher assurance reports, dip sampling was undertaken at the end of the year to seek assurance from the responsible officers that the actions were being addressed.

5.    The Audit Manager explained that dip sampling tended to prioritise audits that had a borderline opinion between Partial and Reasonable, or where there were more medium priority actions for lower assurance opinions. The Chief Internal Auditor referred to the KPI on ‘Implementation of management actions agreed in response to audit findings’ which was management’s responsibility but was included to give it visibility, it was below the 95% target due to the two follow-up audits not having completed their high-priority agreed actions.

6.    A Committee member referred to Accounts Payable and lateness of payments. She noted both the reputational damage to the Council and the impact on the receiver of the money having to wait to be paid. She queried whether the service would take the audit opinion seriously and asked how quickly Internal Audit would undertake its follow-up. The Audit Manager explained that the authority was taking the matter seriously, noting the collaborative work to resolve the issues. The Strategic Finance Business Partner noted that most findings by Internal Audit were already known to the service and three of the agreed actions had already been delivered. Progress against the remaining actions was monitored, system defects and the strengthening of MySurrey was a focus. 

7.    A Committee member asked whether the Committee could receive a six-month follow-up on the Accounts Payable audit. The Audit Manager noted that the follow-up audit was provisionally scheduled in quarter four.

8.    A Committee member welcomed the positive work undertaken by Internal Audit, highlighting the KPI whereby their staff that are ‘Professionally Qualified/Accredited’ surpassed the 80% target reaching 94%.

9.    A Committee member referred to Accounts Payable asking why the opinion was Partial as opposed to Minimal Assurance as some of the issues were fundamental, were there compensatory controls. The Audit Manager noted that there were manual workarounds and compensating controls that made the system operative but without built in control, the remaining value issue affected some purchase orders; most payments were made on time for the right amount. The Chief Internal Auditor noted that the opinions were a professional judgement, another factor considered for borderline opinions was the extent to which the organisation was responsive to the audit.

10.  A Committee member queried how many issues were declared by management prior to the audit starting, and whether those issues had a defined action plan in place before the audit began. The Audit Manager noted that most of the system issues in design and control would have been known and attempted to be rectified.

11.  A Committee member noted that one third of creditor payments were paid late, asking whether there was a target set on how many should be paid on time; and asked for the issue to be revisited to see if it has been resolved. The Strategic Finance Business Partner clarified that it was a KPI being measured, late payments were not solely due to invoices being held up in the accounts payable team, but in some cases it was due to invoices not being sent through by the services by the due date. The one third measurement related only to purchase order payments. The report from the system highlighting late payments and enabling a focus of specific areas of issue was not being generated on the new system. One of the agreed actions was to progress the development of this report to enable the service to better follow up on areas sending late invoices. The Chairman noted that Committee members could request to see the Internal Audit report.

12.  A Committee member asked how the Partial Assurance opinions were factored into risk management. The Head of Strategic Risk noted that he had access to the Internal Audit reports and could check if a risk needed to be added to the Corporate Risk Register.

13.  The Chairman asked whether CLT was aware of the December deadline to complete the actions regarding Accounts Payable. The Chief Internal Auditor was unsure whether they were aware of that specific date, however in response to the audit and previous audits, a programme board had been set up to focus on stabilising the MySurrey control environment and to implement the actions. A Committee member suggested an additional recommendation for CLT to formally address the Partial Assurance opinions - not specifically MySurrey as there was significant work on that elsewhere. The Chairman would write to CLT to express the Committee’s concerns, sharing that letter in advance, inviting a member of CLT to March’s Committee to provide an update on the actions being addressed.

14.  The Chief Internal Auditor noted that because of the materiality involved and commitment from management to address the issues, Internal Audit had flexed the annual plan and set time aside to follow-up the actions, to be reported back to the Committee before the end of the year. Responding to the Chairman, he noted that the opinion given on the follow-up audits had not improved which was concerning and the root cause related to MySurrey implementation, it was vital to understand the scale of the problems and to quickly address those.

15.  The Vice-Chairman queried whether anything could be done to improve the process of raising purchase orders. The Strategic Finance Business Partner explained that training and communications were crucial, a key action related to resolving the report not being generated enabling trends to be identified and relevant staff members to be contacted.

16.  The Cabinet Member for Finance and Resources noted that he was in regular contact with the Executive Director - Customer, Digital and Change, the chair of the programme board. Deadlines had been set for the work to be completed and there was a budget to enable the enhancements to MySurrey. In line with the recommendations from the Lessons Learned Review by the Task and Finish Group on the implementation of MySurrey, he would have oversight of the programme board’s papers; the agendas and minutes were non-public. He would receive fortnightly progress updates from the Executive Director, the deadline to complete the MySurrey work was March, the aim was by the end of the year.

RESOLVED:

Noted the report and considered two further actions required in its response to issues raised.

Actions/further information to be provided:

1.    A29/24 - Management will provide a report on the actions being undertaken regarding the two follow-up audits on Tree Management, and Social Value In Procurement.

2.    A30/24 - CLT will formally address the Partial Assurance opinions - not specifically MySurrey as there is significant work on that elsewhere. The Chairman will write to CLT to express the Committee’s concerns, sharing that letter in advance, inviting a member of CLT to March’s Committee to provide an update on the actions being addressed.