CONTENTS

3 Background

3 Internal audit progress

4 Follow up of agreed actions

5 Appendix A: Internal audit work in 2025/26

8 Appendix B: Summary of key issues from audits finalised since the last report to the Committee

14 Appendix C: Audit opinions and priorities for actions

15 Appendix D: Current priorities for internal audit work

18 Appendix E: Follow up of agreed actions

Appendix E: Follow up of agreed audit actions

A blue and white triangle pattern Description automatically generated

Background

1 Internal audit provides independent and objective assurance and advice about the council’s operations. It helps the organisation to achieve its overall objectives by bringing a systematic, disciplined approach to the evaluation and improvement of the effectiveness of risk management, control and governance processes.

2 The work of internal audit is governed by the Accounts and Audit Regulations 2015 and relevant professional standards. These include the Global Internal Audit Standards and the Application Note: Global Internal Audit Standards in the UK Public Sector.

3 In accordance with the Global Internal Audit Standards (UK Public Sector) the Head of Internal Audit is required to report progress against the internal audit plan (the work programme) agreed by the Audit Committee, and to identify any emerging issues which need to be brought to the attention of the Committee.

4 The internal audit work programme for 2025/26 was agreed by this committee on 17 March 2025.

5 Veritau adopts a flexible approach to work programme development and delivery. Work to be undertaken during the year is kept under review to ensure that audit resources are deployed to the areas of greatest risk and importance to the council.

6 The purpose of this report is to update the Committee on internal audit activity up to 28 November 2025.

Internal audit progress

7 A summary of internal audit reviews currently underway, as well as work finalised in the year to date is included in appendix A. The details of other work completed in the period, including the provision of consultative support and grant certifications has also been included.

8 Five audits have been finalised since the last report to this committee in September 2025. Further information on these audits is included in appendix B. The appendix summarises the key findings from these audits and includes details of the actions agreed with officers to address identified control weaknesses. A further two audits are currently at draft report stage.

9 Seventeen audits are currently in progress with a number nearing the final stages of fieldwork. We expect to report on the outcomes of this work to the next meeting of the Committee. We have also started planning for a further thirteen assignments.

10 Our definitions for action priorities and overall assurance levels are included in Appendix C.

11 Our current priorities for audit are included in Appendix D. Those audits identified either as ‘do now’ or ‘do next’ are currently prioritised for completion during the 2025/26 year. A full review of possible areas for audit will also be completed as part of planning for the 2026/27 work programme. This will help inform the list of ‘do later’ audits.

Follow up of agreed actions

12 All actions agreed with services as a result of internal audit work are followed up to ensure that issues are addressed. As a result of this work, we are generally satisfied that sufficient progress is being made to address the control weaknesses identified in previous audits.

13 Full details of our follow up activity for the last 12 months can be found at appendix E.

APPENDIX A: Internal audit work in 2025/26

Final reports issued

Audit	Reported to Committee	Opinion
Purchase to Pay	December 2025	No opinion given
Early Years Provider Checks (Summer Term)	December 2025	No opinion given
Housing Rents	December 2025	Substantial Assurance
Debtors	December 2025	Reasonable Assurance
Corporate Complaints	December 2025	Reasonable Assurance
Bank reconciliations and suspense accounts	September 2025	Substantial Assurance
Revenues (Council tax and NNDR)	September 2025	Reasonable Assurance
Adult direct payments	September 2025	Reasonable Assurance
Creditors	September 2025	Reasonable Assurance
Killinghall primary school	September 2025	Reasonable Assurance
Financial assessments	September 2025	Substantial Assurance
Liberty protection safeguards	September 2025	Reasonable Assurance
Schools themed audit - Purchasing	September 2025	Reasonable Assurance
Council companies	September 2025	No opinion given
Scarborough Waterpark	September 2025	No opinion given
Performance management	September 2025	Substantial Assurance
Mandatory training	September 2025	Reasonable Assurance

Audits in progress

Audit	Status
Asset management	Draft report issued
Children’s direct payments (Education)	Draft report issued
Human Resources (Community Development)	Fieldwork complete
Management of external funding	Fieldwork complete
VAT accounting	Fieldwork complete
Arrangements for social care	Fieldwork close to completion
Kex Gill (lessons learnt)	Fieldwork close to completion
Allerton Waste Recovery Park	Fieldwork in progress
Adult safeguarding	Fieldwork in progress
Bereavement services	Fieldwork in progress
CCTV	Fieldwork in progress
Contract management (extensions and variations)	Fieldwork in progress
Council Tax & NNDR	Fieldwork in progress
Emergency planning	Fieldwork in progress
Housing benefits	Fieldwork in progress
Housing stock	Fieldwork in progress
Locality working	Fieldwork in progress
Procurement – social value	Fieldwork in progress
Transitions (children to adults)	Fieldwork in progress
Artificial intelligence framework review	Planning
Continuing Healthcare	Planning
Customers Data Management	Planning
Democratic services – Modern.gov system	Planning
Education other than at school (post-16)	Planning
Home to school transport	Planning
Housing adaptations	Planning
Leisure Centres - Lifeguard Training	Planning
Licensing	Planning
Tree and Woodland Policy	Planning
School themed: chargeable activities	Planning
School themed: recruitment and staff pay	Planning
Waste Services	Planning

Other work completed or in progress in 2025/2026

Internal audit work has been undertaken in a range of other areas during the year, including those listed below.
· Follow up of agreed management actions · Consultative engagements, including: Financial management system replacement project – support, advice and data analysis ContrOCC project – support and advice Registration Services income and banking procedures – support and advice · Grant certification work: Delivering Better Values in SEND Multiply Bus Subsidy Operators Grant Homes England Home Upgrade Grant Phase 2 Local Transport Plan Pooling of Housing Capital Receipts Transforming Cities Fund Provision of general support and advice · Completing financial appraisals · Certifying Scarborough and Harrogate Charter Trustee annual returns · Obtaining updates on the control and risk management arrangements of the council within the 11 key areas for our annual opinion.

Internal audit work has been undertaken in a range of other areas during the year, including those listed below.

· Follow up of agreed management actions

· Consultative engagements, including:

Financial management system replacement project – support, advice and data analysis

ContrOCC project – support and advice

Registration Services income and banking procedures – support and advice

· Grant certification work:

Delivering Better Values in SEND

Multiply

Bus Subsidy Operators Grant

Homes England

Home Upgrade Grant Phase 2

Local Transport Plan

Pooling of Housing Capital Receipts

Transforming Cities Fund

Provision of general support and advice

· Completing financial appraisals

· Certifying Scarborough and Harrogate Charter Trustee annual returns

· Obtaining updates on the control and risk management arrangements of the council within the 11 key areas for our annual opinion.

APPENDIX B: Summary of key issues from audits finalised since the previous committee

System /area	Opinion	Area reviewed	Date issued	Comments	Management actions agreed
Purchase to Pay	No opinion given	The Council has introduced P2P procedures which are intended to improve the quality and efficiency of purchase to pay processes in advance of the introduction of the new financial management system planned for April 2026. We reviewed the Council’s Procure to Pay process to: · confirm processes and controls were adequate and effective · assess training provision, supporting documentation and guidance for the new process · assess compliance with the new process and any issues arising from its implementation	September 2025	Initial adoption of the P2P process was slow so a change of focus to high-spend areas was implemented. The change helped to increase uptake, with overall compliance at 37.1% of spend in Q1 2025/26. Processes and controls were generally adequate. However, some improvements were identified in relation to above tolerance invoice approvals and budget manager self-approval of orders. Although training, guidance, and initial communications were in place, key elements, such as expectations around invoice approvals above tolerance, were not documented. The introduction of a system commitment report for budget managers will support budget manager oversight. System and process changes were limited to those that will not be changed as a result of the introduction of the new finance system (SAP) in 2026. Effective design and implementation of the new system is key to provide strong controls.	3 moderate findings were agreed. Responsible officer: Business Support Manager Guidance is to be updated for payment above tolerance invoices. A report will be run monthly to identify and review orders with the same requisitioner and approver. Budget managers to be copied into approvals for the payment of invoices above tolerance. All the actions were due to be implemented by 30 September 2025. Officers confirmed that they have been completed.
Early Years Provider Checks (Summer Term 2025 Headcount)	No opinion given	The purpose of this engagement was to provide assurance that: · completed parental agreement forms are in place for each child · attendance information held by providers aligns with the hours claimed from the council	November 2025	All the sampled providers were found to retain parental agreement forms that reflected the attendance pattern reported to the council. All providers kept suitable attendance records that clearly showed the number of hours attended by each child per session. One third of the parental agreement forms had been signed after the start of the summer 2025 term, which contravenes council guidance. Some providers showed slight inconsistencies in the way in which stretched provision had been recorded in the parental agreement forms.	1 significant and 1 opportunity findings were agreed. Responsible officer: Head of Finance – Schools, Early Years and High Needs The agreement forms will be communicated to providers in a number of ways, including at the Provider Briefing session in November 2025, in key messages, and in the provider portal information, to remind providers when submitting future headcount information. Actions are planned to be completed by 31 January 2026.
Housing Rents	Substantial Assurance	We reviewed the systems and controls to ensure: · rents are in accordance with the Government’s Policy Statement on Rents for Social Housing · NYC is compliant with the Rent Standard	November 2025	Our sample testing of rents with the relevant government guidance did not identify any issues. Stock reconciliations showing all changes in dwellings stock were undertaken weekly at Harrogate and Richmondshire, with Selby currently developing a new stock report for this purpose. Recent right to buy sales had supporting documentation and had been removed from the relevant rents system. The audit did not identify any areas not compliant with the Rent Standard. However pre-LGR systems and processes for administering rents, the annual rent increase and the method of charging rent, inherited from the former district councils, are continuing to be used. From 1 April 2026, NYC is planning to introduce a new method of charging which will standardise the approach across all areas. Further consultation with tenants is required before a new NYC charging policy can be formally introduced. The current plan is for the Council to have one single rents system in operation by mid-2027.	2 moderate findings agreed. Responsible officer: Head of Housing Management and Landlord Services The service is consulting and plans to produce a standard charging policy, to be presented to members in January 2026 for implementation in April 2026. A Project Initiation Document will be produced to support the process of moving from the three legacy housing rents systems to a single system. The project is at the options appraisal stage, which is due to be complete in December 2025. The lack of Selby Housing Stock reconciliations will be discussed between the Housing Rents service and the IT service provider with a deadline of 31 December 2025 for completion.
Sundry Debtors	Reasonable Assurance	The audit reviewed the arrangements the Council has in place to ensure: · debtor invoices are accurate, complete, and raised in a timely manner · outstanding debt is actively monitored and pursued, with appropriate recovery action taken · write-offs are legitimate, correctly processed and authorised.	November 2025	Since LGR, the Council has been working to progress known weaknesses and introduce improvements to accounts receivable systems and processes. A key next step is the project to migrate to a new finance system (SAP) which is in the configuration and build stage. This has involved input from the accounts receivable team and workshops to discuss improving current processes. In the main, requests to raise invoices were found to be processed in a timely manner. However, we found significant delays in raising some HAS customer invoices after a service was received. We also found instances of invoices lacking sufficient detail to allow officers to deal with queries about debts, and invoices raised below the £10 de minimis value. Established processes are in place to pursue outstanding debt. However, the Debt Recovery Policy has not been reviewed since 2023. We also found some differences between the policy and the accounts receivable processes in services. Appropriate recovery action was being taken, although some debts had not progressed as expected. Manual intervention had started. There was also a significant value of receipts not yet applied to invoices to clear debt. There is no reporting of the volume and value of outstanding debt to Directors and/or Assistant Director(s) - Resources. Procedures are in place for writing off debt owed to the Council. Appropriate officers are detailed for approval and processing within documents. Supporting information supplied for the audit confirmed processes were followed when write-offs had been authorised and processed. However, we found significant delays in the authorisation process to enable some items to be written off.	4 significant and 3 moderate findings were agreed. Responsible officer: Accounts Receivable Manager and Business Support Manager, Finance. The Corporate Debt Policy will be updated to align to the current reminder strategies. Monthly aged debt reports will be provided to Directors starting with the position at the end of July 2025. The Accounts Receivable Manager is working towards an established routine of reporting and expects this to be completed by the end of January 2026. Detailed procedures will be drafted and agreed to process unapplied receipts. The income collection working group will develop a plan to address the unapplied receipts. The backlog of existing unapplied receipts will also be addressed. Write-off approvals will be chased up and the appropriate approvals secured to enable existing write-offs to be processed. Invoices for adult social care can only be raised by business support once a contract is in place. That contract is supplied by Care and Support. Improvements to the speed of provision of this contract information, and ways of working are to be introduced. Actions are planned to be completed by 31 March 2026.
Corporate Complaints	Reasonable Assurance	A project to review and consolidate the Council’s complaints systems and processes was initiated in March 2024. A new system (Netcall) is in the process of being introduced. Prior to introduction, we reviewed the arrangements in place to ensure: · suitable governance and project management structures were in place to oversee and support the delivery of the Netcall implementation · the Council's complaints processes, procedures and policies comply with statutory and best practices.	November 2025	Roles and responsibilities were defined for the project. These were set out in the terms of reference alongside governance and reporting arrangements. Key project documents, approvals and processes were in line with project guidance. In some cases, documentation lacked detail, contained gaps or it was not possible to confirm processes had been fully followed. The project manager changed during the course of the project. It was not always possible to confirm all actions had been taken prior to the change. Reporting to project boards did not always contain all key project details or clearly represent the project position. The action log also had inconsistencies and omissions. The project risk register had not always been kept up to date. The Council has complaints policies in place for corporate, housing and adult social care statutory complaints. Council policies appear to be in line with best practice guidance/legislation. However, the Council have been unable to meet all performance monitoring and annual report requirements (except for housing) due to the current system being unable to collate the required information. This issue is planned to be addressed with the introduction of Netcall and is one of the reasons for its implementation.	1 significant and 3 moderate findings were agreed. Responsible officer: Head of Project and Programmes Lessons learned are being captured on an ongoing basis. Training has been commissioned on the importance of and use of lessons learnt. Training will be delivered to all Project and Programme Managers in the service ensuring consistency of understanding and best practice. The target date for delivery of this training is by the end of March 2026. Improvements to reporting are planned by the end of 2025.

APPENDIX C: Audit opinions and priorities for actions

Audit opinions
Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on four grades of opinion, as set out below.

Opinion	Assessment of internal control
Substantial assurance	Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified.
Reasonable assurance	Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made.
Limited assurance	Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation.
No assurance	Overall, there is a fundamental failure in control and risks are not being effectively

Priorities for findings
Critical	A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management.
Significant	A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management.
Moderate	The system objectives are not exposed to significant risk, but the issue merits attention by management.
Opportunity	There is an opportunity for improvement in efficiency or outcomes, but the system objectives are not exposed to risk.

*There are circumstances when it is not appropriate to give an opinion/assurance level on completed work, for example on project, investigations and other targeted support, consultancy, grant certification and follow up work. In these instances a ‘No opinion’ will be given.

APPENDIX D: Current priorities for Internal Audit work

Audit	Timing
	Do now	Do next	Do later
Strategic and Corporate risks
Council transformation plans and savings programme			ü
Revenue budget setting, monitoring and management			ü
Capital budget management	ü		ü
Governance	ü		ü
Information security reviews and support		ü	ü
Information asset management		ü	ü
Risk management			ü
Property asset management	ü		ü
Procurement – specific reviews	ü	ü	ü
Contract management – specific reviews	ü	ü	ü
Business continuity / Emergency planning	ü		ü
Climate change			ü
Health and safety			ü
Partnership working and governance			ü
Performance management		ü	ü
Data Quality	ü		ü
Project management arrangements			ü
Management of external funding	ü		ü
Council companies and other commercial operations			ü
Human Resources	ü		ü
Agency staff and consultants	ü		ü
Complaints			ü
Artificial Intelligence	ü	ü	ü
Technical / Project Risks
Support and advice for council and service transformation	ü	ü	ü
Involvement in specific service areas developments	ü	ü	ü
Project advice / implementation and support	ü	ü	ü
ICT disaster recovery and incident management		ü	ü
ICT cyber security		ü	ü
ICT asset management			ü
IT information security operations centres			ü
ICT applications	ü		ü
Financial Systems
Main accounting system	ü	ü	ü
Creditor payments			ü
Sundry debtors, including debt recovery			ü
Payroll			ü
Income collection and management			ü
VAT	ü		ü
Revenues	ü		ü
Benefits	ü		ü
Housing rents			ü
Service Area Related
Locality working	ü		ü
Community infrastructure levy and s106 agreements		ü	ü
Planning systems			ü
Housing adaptations	ü
Housing regulation	ü		ü
Homelessness		ü
Leisure	ü		ü
Museums and Galleries		ü	ü
Economic development			ü
Harbours			ü
Licensing		ü	ü
Car parking	ü		ü
Fleet management		ü	ü
Highways		ü	ü
Waste	ü		ü
Parks and Countryside	ü		ü
Bereavement Services	ü		ü
CCTV	ü		ü
Special educational needs	ü	ü	ü
Early years funding expansion		ü	ü
Maintained school’s visits	ü	ü	ü
Schools themed audits	ü	ü	ü
Schools financial value standard			ü
Home to school transport	ü		ü
Direct Payments	ü		ü
Transitions (children to adults)	ü		ü
Social care provider visits			ü
Social care financial assessments	ü		ü
Safeguarding	ü		ü
Section 117 (Mental Health Act)			ü
Waiting well			ü
Liberty protection safeguards			ü
Continuing Healthcare	ü		ü
Public health		ü	ü
Pensions Fund
Pensions expenditure			ü
Pensions income		ü	ü
Pensions investments			ü
Pensions ICT controls			ü
Pensions risk management	ü		ü
Effective systems of Governance (ESOG)		ü	ü
Attendance at pensions board	ü	ü	ü
Other assurance work
Follow-up of previously agreed management actions	ü	ü	ü
Gaining understanding on the evolving systems and processes at the new council	ü	ü	ü
Continuous audit planning and additional assurance gathering to help support our opinion on the framework of risk management, governance and internal control	ü	ü	ü
Continuous assurance work, including data analytics and data matching projects	ü	ü	ü
Attendance at, and contribution to, governance- and assurance-related working groups	ü	ü	ü

APPENDIX E: FOLLOW UP OF AGREED AUDIT ACTIONS

1 Follow up work is carried out through a combination of questionnaires completed by responsible managers, risk assessment, and by further detailed review by the auditors where necessary.

2 Where responsible officers have not taken the action they agreed to, issues are escalated to more senior officers. Ultimately, they may be referred to the Audit Committee in accordance with the follow-up and escalation procedure.

3 Figure 1, below, shows the status of agreed actions from follow-up activity undertaken in the year to 31 October 2025. In future progress reports, this information will be presented on a rolling twelve-month basis.

4 For clarity, the figure shows the results of follow up activity up to 31 October 2025, regardless of when actions were originally due (that is, it includes actions which were due prior to Q1 2025/26 but which are still being followed up).

5 For completeness, it also shows actions which have been agreed in finalised audits, but which have not yet fallen due and so have not been followed up.

Figure 1: Total agreed actions by current status at 31 October 2025

Status	Critical	Significant	Moderate	Opportunity	Total
Action completed	0	28	57	7	92
Action overdue	0	24	20	2	46
Revised date	1	24	11	0	36
Actions not yet due	0	20	19	2	41
Total	1	96	107	11	215

6 A total of 174 actions have been followed up. Of these, 92 have been satisfactorily implemented.

7 A total of 36 actions had their original implementation timescale extended, with revised implementation dates being agreed with the action owner. We agree revised dates where the delay in addressing an issue will not lead to unacceptable exposure to risk and where the delays may be unavoidable. However, the committee should be aware that lengthy or continued revised dates do inevitably lead to a degree of risk exposure to the council.

8 Figure 2, below, shows how long dates have been revised from the original implementation date.

Figure 2: Length of revised dates agreed for action implementation

9 A total of 36 actions have had a revised target date. Of these, 30 have an extension of six months or more. Explanations provided during follow up activities have indicated service restructures, system changes, and resource pressures to be driving factors of lengthy revised dates.

10 A critical action has an extension of over six months from the agreed date. This relates to a school audit, which has since had a change in leadership. The critical action will be included as part of a follow-up audit scheduled in Quarter 4 2025/26.

11 At the time of reporting, 46 actions are overdue. This is shown in figure 3, below. Included in figure 3 are 23 actions where we have received a response but have not yet been able to conclude whether the risk has been satisfactorily addressed.

Figure 3: Length of time actions have been overdue

12 There will usually be some instances like this at any point in time. It can be due to ongoing communication with the responsible officers to obtain evidence confirming completion of the action. It can also be due to instances where the action taken is not exactly as agreed and further work is being undertaken to assess whether the action taken does satisfactorily address the risk or because there are ongoing discussions about whether to agree revised dates for the action.

13 The remaining actions are overdue, and we have not yet received a response from the action owner; these continue to be followed up by auditors with the responsible officers.

14 Overdue actions are escalated according to the agreed escalation policy, firstly to relevant Assistant Directors, then to the Deputy S151 Officer via liaison meetings and quarterly reporting. They may subsequently be brought to the Audit Committee. At this stage, no overdue actions are being escalated to the Committee.