
![]() |
|||
![]() |
![]() |
![]()

CONTENTS
3 Background
3 Internal audit progress
4 Follow up of agreed actions
5 Appendix A: Internal audit work in 2025/26
7 Appendix B: Summary of key issues from audits finalised since the last report to the Committee
22 Appendix C: Audit opinions and priorities for actions
23 Appendix D: Current priorities for internal audit work

Background
1 Internal audit provides independent and objective assurance and advice about the council’s operations. It helps the organisation to achieve its overall objectives by bringing a systematic, disciplined approach to the evaluation and improvement of the effectiveness of risk management, control and governance processes.
2 The work of internal audit is governed by the Accounts and Audit Regulations 2015 and relevant professional standards. These include the Global Internal Audit Standards and the Application Note: Global Internal Audit Standards in the UK Public Sector.
3 In accordance with the Global Internal Audit Standards (UK Public Sector) the Head of Internal Audit is required to report progress against the internal audit plan (the work programme) agreed by the Audit Committee, and to identify any emerging issues which need to be brought to the attention of the committee.
4 The internal audit work programme for 2025/26 was agreed by this committee on 17 March 2025.
5 Veritau adopts a flexible approach to work programme development and delivery. Work to be undertaken during the year is kept under review to ensure that audit resources are deployed to the areas of greatest risk and importance to the council.
6 The purpose of this report is to update the Committee on internal audit activity up to 12 September 2025.
Internal audit progress
7 A summary of internal audit reviews currently underway, as well as work finalised in the year to date is included in appendix A. The details of other work completed in the period, including the provision of consultative support and grant certifications has also been included.
8 Twelve audits have been finalised since the last report to this committee in June 2025. Further information on these audits is included in appendix B. The appendix summarises the key findings from these audits and includes details of the actions agreed with officers to address identified control weaknesses. A further four audits are currently at the draft report stage.
9 Twelve audits are currently in progress of which a number are at, or nearing the final stages of fieldwork. We expect to report on the outcomes of this work to the next meeting of the Committee. We have also started planning for a further eleven assignments.
10 Our definitions for action priorities and overall assurance levels are included in Appendix C.
11 Our current priorities for audit are included in Appendix D. Those areas identified either as ‘do now’ or ‘do next’ are currently prioritised for work during the 2025/26 year.
Follow up of agreed actions
13 With the support of senior management, we have very recently refreshed the follow-up and escalation procedure. This sees any non-responses (or unsatisfactory responses) to requests for evidence of completion of agreed actions brought to the attention of more senior officers and, ultimately, if required, to this committee.
14 Alongside introducing these new processes, we have taken the opportunity to fully review and update the existing record of management actions.
15 We intend to provide greater detail on the current position on completed and outstanding actions to members as part of the December 2025 committee report, and as part of regular progress reporting thereafter.
APPENDIX A: Internal audit work in 2025/26
Final reports issued
|
Audit |
Reported to Committee |
Opinion |
|
Bank reconciliations and suspense accounts |
September 2025 |
Substantial Assurance |
|
Revenues (Council tax and NNDR) |
September 2025 |
Reasonable Assurance |
|
Adult direct payments |
September 2025 |
Reasonable Assurance |
|
Creditors |
September 2025 |
Reasonable Assurance |
|
Killinghall primary school |
September 2025 |
Reasonable Assurance |
|
Financial assessments |
September 2025 |
Substantial Assurance |
|
Liberty protection safeguards |
September 2025 |
Reasonable Assurance |
|
Schools themed audit - Purchasing |
September 2025 |
Reasonable Assurance |
|
Council companies |
September 2025 |
No opinion given |
|
Scarborough Waterpark |
September 2025 |
No opinion given |
|
Performance management |
September 2025 |
Substantial Assurance |
|
Mandatory training |
September 2025 |
Reasonable Assurance |
Audits in progress
|
Status |
|
|
Children’s direct payments (Education) |
Draft report issued |
|
Debtors |
Draft report issued |
|
Housing rents |
Draft report issued |
|
Purchase to Pay |
Draft report issued |
|
Corporate complaints |
Fieldwork completed |
|
Arrangements for social care |
Fieldwork close to completion |
|
Asset management |
Fieldwork in progress |
|
Adult safeguarding |
Fieldwork in progress |
|
Bereavement services |
Fieldwork in progress |
|
Home to school transport |
Fieldwork in progress |
|
Housing stock |
Fieldwork in progress |
|
Human resources (Community Development) |
Fieldwork in progress |
|
Kex Gill (lessons learnt) |
Fieldwork in progress |
|
Management of external funding |
Fieldwork in progress |
|
Procurement – social value |
Fieldwork in progress |
|
VAT accounting |
Fieldwork in progress |
|
Agency workers (Matrix system) |
Planning |
|
Allerton Waste Recovery Park |
Planning |
|
Artificial intelligence framework review |
Planning |
|
CCTV |
Planning |
|
Contract management |
Planning |
|
Democratic services – Modern.gov system |
Planning |
|
Emergency planning |
Planning |
|
Housing adaptations |
Planning |
|
Locality working |
Planning |
|
Procurement act – follow up |
Planning |
|
Transitions (children to adults) |
Planning |
Other work completed in 2025/2026
|
Internal audit work has been undertaken in a range of other areas during the year, including those listed below. |
|
· Follow up of agreed management actions · Consultative engagements, including:
· Grant certification work:
· Completing financial appraisals · Certifying Scarborough and Harrogate Charter Trustee annual returns · Obtaining updates on the control and risk management arrangements of the council within the 11 key areas for our annual opinion. |
APPENDIX B: Summary of key issues from audits finalised since the previous committee
|
Opinion |
Area reviewed |
Date issued |
Comments |
Management actions agreed |
|
|
Substantial Assurance |
We reviewed the arrangements in place to ensure: · bank reconciliations are prepared and reviewed on a regular basis. · suspense accounts are reviewed regularly. · processes for bank reconciliations following LGR have been fully documented and communicated. · issues with bank reconciliation and suspense account processes following LGR have been resolved
|
June 2025 |
All bank and suspense accounts have named officers responsible. Bank reconciliations are being completed regularly and have suitable oversight by Finance. Suspense accounts are monitored frequently. Adequate controls are in place to ensure that all bank reconciliations are being submitted, and processes exist to investigate any identified variances. There are no documented procedure or guidance notes which would guide officers with details of best practice and responsibilities. Training has also not been provided to officers on reconciling bank accounts or suspense accounts. There is no standard template for bank reconciliations. A small number of issues with the bank reconciliations remain unresolved since LGR vesting day. The bank reconciliations are not consistently signed by the responsible officer who completed the reconciliation or by the responsible senior accountant. |
4 x moderate findings, Responsible officer: Senior Accountant – Corporate and Technical Bank reconciliation and holding/suspense account guidance will be documented. A standard bank reconciliation template will also be developed. These will be completed by 31 March 2026. Brought forward (pre LGR) timing differences (net £97k) will be investigated and resolved. Bank reconciliations will be monitored to ensure appropriate review and sign off is undertaken. These final two actions will be completed by the end of 2025. |
|
|
Revenues |
Reasonable Assurance |
The audit reviewed the arrangements the Council had in place to ensure the systems were: · effectively collecting council tax and NNDR · correctly applying discounts, exemptions, reliefs, and disregards · ensuring accurate and timely billing · pursuing arrears; and processing refunds and write-offs correctly. The work focused on the arrangements in place in 2024/25 when the council was operating a number of separate systems linked to the legacy arrangements inherited from LGR. Alongside these existing systems, officers were working towards implementing a new single system by June 2025. |
June 2025 |
The Revenues Team management had received assurances that council tax and NNDR was being collected correctly across the seven former district areas. Collection rates were also being regularly monitored and reported. In 2024, the Council used a third-party company to review council tax single person discounts (the largest discount by value), to check that the discounts had been correctly applied. In other areas (discounts, exemptions, reliefs, and disregards), the service was able to evidence 10% checking was taking place in every instance. Our sample testing on individual systems highlighted no issues with billing, refunds and write-offs. Arrears were being managed and collected via a monitoring spreadsheet and there was evidence of ongoing review. However, management was not receiving regular information to provide assurance that all council tax and NNDR processes were operating as expected.
|
2 x significant findings were agreed. Responsible officer: Head of Revenues and Operational Services Manager A new single council tax and NNDR system was introduced in June 2025. Procedures for the new system should ensure management are receiving and reviewing sufficient information to provide assurance that processes are working. The service has recruited five new inspectors who will all be in post by the end of October. A significant part of their role being to review discounts and exemptions. External review providers will also be assessed and used as appropriate.
|
|
Adult direct payments |
Reasonable Assurance |
We reviewed the arrangements in place to ensure: · internal and public-facing policies and procedures are in place, accessible, and aligned with relevant legislation. · Robust checks are performed at assessment stage, and on an ongoing basis, to verify the arrangement is suitable. · An appropriate escalation process is documented and followed in practice. · Exception applications are correctly authorised, contain a suitable level of scrutiny, and can be monitored. · High-cost packages are appropriate and monitored for cost effectiveness. |
June 2025 |
Procedural documents were in place but some were outdated and did not reflect current practice. The documents have since been revised and appear to be more in line with current practice. Essential guidance on direct payments is accessible on the website. Robust checks are in place before and during a direct payment arrangement, to ensure compliance and effective use of funds. Ongoing monitoring is carried out monthly or quarterly based on case complexity. While the escalation process is clearly documented and accessible to staff, it appears to be limited regarding senior management involvement. However, our testing showed processes are not always applied effectively. There is a clear and well-documented exceptions process in place, supported by accessible guidance, formal risk assessments, and appropriate senior management-level approval. Sampled cases generally demonstrated appropriate scrutiny and compliance. High cost payments had been appropriately assessed, authorised, and monitored in line with established procedures. |
2 x significant and 2 x moderate findings were agreed. Responsible officer: Direct Payment Team Leaders Changes to Direct Payment forms will help to escalate matters directly to the relevant manager. Further work on escalation including training, presentations to Area Management Teams and review and updating of guidance will be undertaken. Improvements to the reporting of cases, using Power BI will be made. All actions have now been completed. |
|
Creditors |
Reasonable Assurance |
We reviewed the Council’s arrangements to ensure: · there is a robust payrun process, with suitable checks, authorisations and supporting documentation in place. · feeder file interfaces are accurate, complete and receive appropriate authorisation during the loading and balancing process. · suitable procedures are in place for setting up new suppliers and amending supplier details, and these are followed correctly. · Purchase orders, invoices and non-standard payments receive appropriate authorisations and there is suitable segregation of duties in place. |
July 2025 |
Payrun processes were robust and contained suitable checks and authorisations. Appropriate documentation was completed and retained to evidence the correct application of the procedures. File interfaces to the creditors system are controlled, and control totals checked to ensure uploads are complete and accurate. There was suitable guidance in place for setting up suppliers and making amendments to supplier details. Procedures for setting up suppliers are sound, and testing showed that these are followed. Appropriate procedures are in place for making supplier bank account changes. However, testing found in two cases that not all evidence was in place to show the process had been followed correctly. Purchase orders had been completed appropriately for orders, but segregation of duties between the requestor and authoriser was not always present. It was not possible to confirm that all orders and non-standard payments had been authorised by the correct budget manager. In addition, evidence had not always been retained of an officer’s authority to approve an order. |
2x significant and 3x moderate findings Responsible Officer: Assistant Director Resources (deputy s.151) and Business Support Manager
Refresher training on supplier bank detail amendments has been provided to the team.
Service areas will be asked to document the details of local delegations from the budget manager.
Communications have been sent out to budget managers to remind they should not self-authorise purchase orders. |
|
School audit (Killinghall School) |
Reasonable Assurance |
A follow up review of financial, governance and business processes within the school.
|
July 2025 |
A number of findings had been previously raised relating to the business, governance and financial management arrangements of the school. We found good progress had been made to address those areas. Some further improvements were agreed. |
3 x moderate and 1 x opportunity findings were agreed. Responsible officer: Headteacher Policies and procedures relevant to the improvement areas will be reviewed and updated. The deadline for completion is 31 December 2025.
|
|
Financial Assessments |
Substantial Assurance |
A financial assessment is required to determine whether an individual has the means to pay for their care needs and if a contribution is required. The purpose of this audit was to ensure · internal and public-facing policies and procedures relating to financial assessments are in place, up-to-date and aligned with relevant legislation. · financial assessments are completed in a timely manner with supporting evidence retained and recorded appropriately. · reviews of financial assessments and contribution amounts are undertaken in a timely manner. |
July 2025 |
Internal policies for charging for residential and community-based services are in place, and up to date. Sufficient public-facing information is available via the website. A review of a sample of financial assessments found a majority are being completed within the target timeframe of 10 working days. Although some did exceed the target, reasonable explanations were provided in all cases. There was generally sufficient evidence to support charging calculations. Clients are not always returning financial declarations for non-online financial assessment cases. The process and requirements for obtaining and, if necessary, pursuing clients’ declarations is not fully clear in internal policies. Some improvements were also suggested to the wording in the financial declaration form. LLA files indicate that the processes for issuing guidance to service users and directing them to the OFA tool are not being followed consistently. |
1 x significant and 2 x moderate findings were agreed. Responsible officers: Interim Head of Financial Assessments, Benefits and Court of Protection and Benefits and Charging Managers. Declaration processes will be reviewed and consideration given to obtaining declarations on submission of the client’s information where the assessments are completed via a non-OFA route. These actions will be completed by 30 September. The new form will be fully rolled out by 31 October. HAS Care & Support Teams will be supplied with the 2025/2026 version of the ‘What you should expect to pay for care services’ leaflet in PDF and paper format for issuing to clients.
|
|
Deprivation of Liberty Safeguards |
Reasonable Assurance |
The Deprivation of Liberty Safeguards (DoLS) is designed to protect a person's rights if the care or treatment received in a hospital or care home means they are, or may become, deprived of their liberty and they lack mental capacity to consent to those arrangements. We reviewed the Council’s arrangements to ensure: · suitable governance arrangements are in place, · appropriate KPIs are in place and performance monitoring carried out. · applications are processed in line with policy and legislation. · application renewals are carried out within the expected timescales · appropriate training is being provided
|
July 2025 |
Suitable internal policies and procedure notes are in place which support staff in accurately carrying out the process through the council's adult social care system. Key performance indicators (KPIs) are guided by the Mental Capacity Act, which requires monitoring of applications completed against the twenty-one-calendar day timescale. Other relevant KPIs are manually produced weekly. Data is regularly shared with and reviewed by senior leadership. The council is not completing DOLs within the statutory timescales. Our testing found: · only a small number of applications sampled were completed within the twenty-one-day timeframe · internal timescales for completion of best interest assessments and mental health assessments were not being followed · timescales for panel members approving applications were not being met. Checks are carried out to ensure staff involved with the application process have the necessary qualifications and training to perform their roles. |
3 x significant and 2 x moderate findings were agreed. Responsible officer: Head of Older Adults Additional funding of £800k was provided in the 2025/26 budget, which will assist in preventing a further increase in outstanding applications. Officers will also develop a plan for addressing the key issues outlined to improve efficiencies Further discussions to progress the implementation of performance dashboards are planned. All agreed actions are planned to be completed by 31 December 2025. |
|
Schools Themed Audit - Purchasing |
Reasonable Assurance |
North Yorkshire Council’s school finance manual sets out the expectations on purchasing for local authority-maintained schools. We reviewed the arrangements in place at a sample of schools that ensure: · purchases are made using appropriately authorised purchase order forms · purchasing cards are used appropriately, and usage is recorded and independently reconciled · VAT is appropriately managed and or recovered · purchases made by staff using personal funds, for later reimbursement, are restricted and managed appropriately. |
August 2025 |
In the majority of transactions tested, schools did not provide evidence of purchase orders being completed. There was insufficient evidence that purchase orders are being raised before the spend is committed to the transaction. Schools are maintaining sufficient contract registers but could benefit from a standardised template. Additionally, schools did not demonstrate they are always obtaining details of supplier public liability insurance cover for on-site services. There was insufficient evidence to demonstrate schools are maintaining a record of purchase card transactions, retaining proof of purchases, and independently reconciling them. VAT had been appropriately managed. However, we saw schools are not consistently paying for invoiced charges within 30 days. Schools provided evidence that reimbursement requests for staff expenditure were being authorised by appropriate officers, however, the justification for this expenditure was not always clear. |
3 x significant and 2 x moderate findings, Responsible officer: Head of Revenues and Operational Services Manager The Local Authority will develop good practice guidance for schools on the use of purchase orders. The Schools Finance Team will undertake this development in conjunction with Veritau and the FMS Team. Guidance will be shared with schools through the School Admin & Finance Conference, the Red Bag and CYPS website. Schools will be reminded of the financial control requirements with the use of purchasing cards and prompt payment of invoices at the Autumn 2025 School Admin & Finance Conference The deadline for completing all actions is 28 February 2026.
|
|
Council Companies |
No opinion given |
Following LGR, officers reviewed the governance arrangements of council companies and in March 2024 reported to both the Shareholder Committee and Audit Committee. The review concluded that governance and reporting structures were largely compliant. Some areas for improvement were also identified. We reviewed whether: · all the planned recommendations made in March 2024 reporting had been completed, providing any feedback required · governance arrangements in place through the Brierley Group Board, provide the Council with the required level of assurance We obtained information directly from the council companies to assess the progress made against the recommendations. |
August 2025 |
Council internal arrangements need to be further developed to help provide the necessary ongoing assurances on governance at the council’s companies. None of the March 2024 report recommendations had been fully completed at nine of the companies reviewed. There were different levels of compliance and progress. The main omissions related to: · conflicts of interest as standing agenda items at board meetings and the proper recording of this information · the existence of Conflicts of Interest policies for Directors · Annual Declarations of Interests for Directors and the maintenance of appropriate registers · training for Directors, refresher or specific to the role they have for the respective companies · the contents of annual business plans · evidence that risk registers are treated as an active document and that risks are properly monitored. Further improvements were also required in respect of governance arrangements through the Brierley Group Board and at the Shareholder Committee meetings. |
Several staffing changes had led to delays in taking the next steps from the March 2024 report. With appointments now in post, we have setup an internal working group consisting of members from the commercial, finance and legal teams. This group has met twice and is already taking forward the improvement areas referred to in this audit. The responsibilities of this officer’s group will include monitoring companies’ performance against the recommendations set out in this report and supporting good company governance. Officers expect to have completed all necessary work to address all but one of the recommendations by 31 December 2025. Work on SLAs has an end of March 2026 deadline. |
|
Scarborough Waterpark |
No opinion given |
The former Scarborough Borough Council approved the granting of a loan of £9m to Benchmark Leisure Limited in 2013 to help finance the construction of a new Waterpark. The purpose of the audit was to undertake a fact-finding review to establish the adequacy of the decision-making process followed to approve the loan and, if possible, the reasons why the risks relating to the loan were not properly identified and mitigated. |
August 2025 |
The council published the report in full here The report included the following conclusions: The proposal considered by Councillors on 9 September 2013 was both risky and complex in nature. The decision taken by Councillors was taken in the knowledge there were risks, but in the interests of Scarborough and its residents, and to ensure the Waterpark and wider Sands regeneration could be completed. The decision was also taken at a time when Councils were being encouraged to adopt a more commercial approach at a time of austerity. The Council recognised there were a number of risks in granting the loan to Benchmark Leisure Limited and therefore put in place various mitigations. These included only permitting the funding to be drawn down in stages linked to the construction of the Waterpark, ensuring the risk of any cost overruns would be met by Benchmark, requiring parent company guarantees and limiting the ability of Benchmark to develop other parts of the Sands until the loan was repaid. External legal advice was obtained on the proposed agreement and associated governance measures. Importantly the Council also ensured that it retained the freehold interest in the site which safeguarded the Waterpark as an asset. Officers involved the Leader, Cabinet Members and other Councillors in working groups and briefing meetings throughout the period prior to the decision being taken. The reports prepared by officers also contained sufficient information for Councillors to make a considered decision but there was a lack of clarity about key aspects of the proposed agreement with Benchmark Leisure Limited. In particular, it was not clear whether the Council was borrowing funds to part-finance the construction of the Waterpark or whether it was to enable the Council to provide a commercial loan to the company. Officers also failed to provide a recommendation to Full Council based on their professional knowledge and assessment of the risks. This was a particular omission given the complexity of the proposed agreement with Benchmark. The reports to Full Council contained details of the potential risks of the agreement but in some cases these risks were not fully and properly articulated. Insufficient attention was also given to the actions which could be taken to mitigate those risks. The key risk that the Waterpark might not be commercially viable was recognised by Councillors and officers but not adequately addressed. The projections for visitor numbers prepared by Benchmark Leisure Limited and Alpamare UK Limited were overly optimistic, but these were not properly challenged. Instead, the Council appears to have placed too much reliance on the findings of the feasibility study undertaken by Leisure Development Partners LLP but commissioned by Benchmark. This is despite the concerns expressed by GVA about the assumptions and projections used in the study. Alpamare also had no experience of operating Waterparks in the region and therefore limited knowledge of the local visitor economy. Inadequate due diligence was carried out on Alpamare to determine whether the company was a suitable operator for the Waterpark. The problems being experienced at the existing Alpamare waterpark in Bavaria were therefore not identified. Despite the obvious risk that the Waterpark might not be profitable, the Council failed to develop any contingency plans until after Alpamare entered into a company voluntary agreement in 2019. With hindsight it is apparent that the decision to approve the loan to Benchmark Leisure Limited was based on incomplete information and therefore put the Council at increased risk. Councillors understood that there were risks with the proposed agreement, but the report should have set these out more clearly. In the circumstances, it is not possible to know whether the decision by Full Council would have been different, but at least Councillors could have been better informed. No evidence has been found to suggest that Councillors or officers accepted gifts or hospitality from any third parties. The lessons from this review should inform the decision-making processes for any future regeneration projects. In particular, the need to effectively identify, report and mitigate potential risks to the achievement of project objectives, and to adequately balance potential risks and rewards. |
There were no NYC management actions. |
|
Performance Management |
Substantial Assurance |
We reviewed whether: · the performance management system and accompanying targets and measures adequately supports the achievement of the council’s strategic priorities. · sound systems and controls are in place to support performance management and the validation of outputs. · data produced by the performance management system is reliable, accurate and timely. |
September 2025 |
Most elements of the performance management framework are already operational, but the Head of Strategy and Performance recognises that there is still some way to go to achieve compliance with performance targets at all levels across the organisation KPIs for corporate reporting are outlined in the Performance Management Framework (PMF) and are aligned with the councils’ plan outcomes and strategic priorities. No set schedule is in place for the procurement and implementation of a performance management system across the council. KPI’s and actions are not held in one place. Generally, performance management information is reliable, timely and accurate. However, we found that the utilisation of performance management across the council is at varying levels, and it is currently an ongoing process to bring all areas into line and under similar processes to meet expectations. KPIs have always been in place at corporate level and for most former county services and these are reported quarterly throughout the year. |
1 x significant and 1 x moderate findings were agreed. Responsible officers: Head of Strategic Performance The system is being considered as part of a project also sourcing a PPM system. Performance management functionality will be prioritised within this project. An overview of team level performance across the council will be completed by December 2025 and the council will continue to implement the foundations of performance management in areas/teams where they are currently not in place. |
|
Reasonable Assurance |
Mandatory and statutory training for non-digitally enabled staff should be monitored by each service area using a training matrix. The purpose of this audit was to provide assurance to management that · Statutory and mandatory training is identified, monitored, and recorded accurately across service areas, whether delivered digitally or non-digitally. · All statutory and mandatory training has been completed and is up to date. We reviewed arrangements in four service areas agreed with the Head of Learning and Development. |
September 2025 |
All services reported appropriate consultation with external bodies to ensure they are aware of updates to legislation that should inform training needs. Two services do not have operational role-based training matrices in place. None of the services accurately recorded corporate mandatory training requirements in their matrices. Two services could not show they have a monitoring system in place, and so we were unable to establish the completion status of service specific mandatory training. None of the services accurately recorded corporate mandatory training requirements in their matrices. All services record corporate mandatory training on the Learning Zone. This training is monitored centrally by Learning and Development. This central process was effective, although the escalation procedures for non-compliance are not formalised or documented. One of the four areas reviewed had poor compliance with corporate mandatory training. The ‘Training, learning and development’ policy does not comprehensively reflect training practices. Staff have a clear understanding of the responsibilities within teams. However, there are no documents which formalise responsibilities.
|
4 x significant and 2 x moderate findings were agreed. Responsible officers: Head of Learning and Development. Learning and Development (L&D) will remind services of their responsibilities for training matrices. All services will develop a complete and updated training matrix. A schedule for reviewing training matrices will be implemented. L&D will work with services to review and improve processes for monitoring training completion. Relevant documents will be updated and/or written. A paper will be prepared for management board to review the decision to remove the requirement for refresher training. Deadlines for completion range from November 2025 to April 2026. |
APPENDIX C: Audit opinions and priorities for actions
|
Audit opinions |
|
|
Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on four grades of opinion, as set out below. |
|
|
|
|
|
Opinion |
Assessment of internal control |
|
Substantial assurance |
Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. |
|
Reasonable assurance |
Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. |
|
Limited assurance |
Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. |
|
No assurance |
Overall, there is a fundamental failure in control and risks are not being effectively |
|
Priorities for findings |
|
|
Critical |
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. |
|
Significant |
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. |
|
Moderate |
The system objectives are not exposed to significant risk, but the issue merits attention by management. |
|
Opportunity |
There is an opportunity for improvement in efficiency or outcomes, but the system objectives are not exposed to risk. |
*There are circumstances when it is not appropriate to give an opinion/assurance level on completed work, for example on project, investigations and other targeted support, consultancy, grant certification and follow up work. In these instances a ‘No opinion’ will be given.
APPENDIX D: Current priorities for Internal Audit work
|
Timing |
|||
|
|
Do now |
Do next |
Do later |
|
Strategic and Corporate risks |
|
|
|
|
Council transformation plans and savings programme |
|
ü |
ü |
|
Revenue budget setting, monitoring and management |
|
|
ü |
|
Capital budget management |
ü |
|
|
|
Governance |
|
ü |
|
|
Information security incident reviews and support |
|
ü |
ü |
|
Records management |
|
ü |
|
|
Risk management |
|
|
ü |
|
Property asset management |
ü |
|
ü |
|
Procurement – specific reviews |
ü |
ü |
ü |
|
Contract management – specific reviews |
ü |
ü |
ü |
|
Business continuity / Emergency planning |
ü |
|
ü |
|
Climate change |
|
|
ü |
|
Health and safety |
|
ü |
|
|
Partnership working and governance |
|
ü |
|
|
Performance management framework |
|
|
ü |
|
Project management arrangements |
|
ü |
|
|
Management of external funding |
ü |
|
|
|
Council companies and other commercial operations |
|
|
ü |
|
Human Resources |
ü |
|
ü |
|
Agency staff and consultants |
ü |
|
ü |
|
Complaints |
ü |
|
|
|
Artificial Intelligence |
ü |
ü |
ü |
|
Technical / Project Risks |
|
|
|
|
Support and advice for council and service transformation |
ü |
ü |
ü |
|
Involvement in specific service areas developments |
ü |
ü |
ü |
|
Project advice / implementation and support |
ü |
ü |
ü |
|
ICT disaster recovery and incident management |
|
ü |
|
|
ICT cyber security |
|
ü |
|
|
ICT asset management |
|
|
ü |
|
IT information security operations centres |
|
|
ü |
|
ICT applications |
ü |
|
|
|
Financial Systems |
|
|
|
|
Main accounting system |
ü |
ü |
ü |
|
Creditor payments |
ü |
ü |
ü |
|
Sundry debtors, including debt recovery |
ü |
|
ü |
|
Payroll |
|
ü |
|
|
Income collection and management |
|
|
ü |
|
VAT |
ü |
|
|
|
Revenues |
ü |
|
ü |
|
ü |
|
ü |
|
|
Housing rents |
ü |
|
ü |
|
Service Area Related |
|
|
|
|
Locality working |
ü |
|
ü |
|
Community infrastructure levy and s106 agreements |
|
ü |
|
|
Planning systems |
|
ü |
ü |
|
Housing regulation |
ü |
|
ü |
|
Homelessness |
|
|
ü |
|
Leisure |
|
ü |
ü |
|
Economic development |
|
|
ü |
|
Harbours |
|
|
|
|
Licensing |
|
ü |
|
|
Car Parking |
ü |
|
ü |
|
Highways |
|
ü |
|
|
Waste |
|
ü |
|
|
Parks and Countryside |
|
ü |
|
|
Bereavement Services |
ü |
|
|
|
CCTV |
ü |
|
|
|
Special educational needs |
ü |
ü |
|
|
Early years funding expansion |
|
ü |
ü |
|
Maintained school’s visits |
ü |
ü |
ü |
|
Schools themed audits |
ü |
ü |
ü |
|
Schools financial value standard |
|
|
ü |
|
Home to school transport |
ü |
|
|
|
Direct Payments |
ü |
|
ü |
|
Transitions (children to adults) |
ü |
|
|
|
Social care provider visits |
|
|
ü |
|
Social care financial assessments |
ü |
|
|
|
Safeguarding |
ü |
|
|
|
Section 117 (Mental Health Act) |
|
|
ü |
|
Waiting well |
|
|
ü |
|
Payment to care providers (Provider Portal) |
ü |
|
|
|
Liberty protection safeguards |
|
|
ü |
|
Continuing Healthcare |
ü |
|
ü |
|
Public health |
|
ü |
|
|
Pensions Fund |
|
|
|
|
Pensions expenditure |
|
|
ü |
|
Pensions income |
|
ü |
ü |
|
Pensions investments |
|
|
ü |
|
Pensions ICT controls |
ü |
|
|
|
Pensions risk management |
ü |
|
|
|
Effective systems of Governance (ESOG) |
|
ü |
|
|
Attendance at pensions board |
ü |
ü |
ü |
|
Other assurance work |
|
|
|
|
Follow-up of previously agreed management actions |
ü |
ü |
ü |
|
Gaining understanding on the evolving systems and processes at the new council |
ü |
ü |
ü |
|
Continuous audit planning and additional assurance gathering to help support our opinion on the framework of risk management, governance and internal control |
ü |
ü |
ü |
|
Continuous assurance work, including data analytics and data matching projects |
ü |
ü |
ü |
|
Attendance at, and contribution to, governance- and assurance-related working groups |
ü |
ü |
ü |