Background

1 Internal audit provides independent and objective assurance and advice about the council’s operations. It helps the organisation to achieve its overall objectives by bringing a systematic, disciplined approach to the evaluation and improvement of the effectiveness of risk management, control and governance processes.

2 The work of internal audit is governed by the Accounts and Audit Regulations 2015 and relevant professional standards. These include the Global Internal Audit Standards and the Application Note: Global Internal Audit Standards in the UK Public Sector.

3 In accordance with the Global Internal Audit Standards (UK Public Sector) the Head of Internal Audit is required to report progress against the internal audit plan (the work programme) agreed by the Audit Committee, and to identify any emerging issues which need to be brought to the attention of the Committee.

4 The internal audit work programme for 2025/26 was agreed by this committee on 17 March 2025.

5 Veritau adopts a flexible approach to work programme development and delivery. Work to be undertaken during the year is kept under review to ensure that audit resources are deployed to the areas of greatest risk and importance to the council.

6 The purpose of this report is to update the Committee on internal audit activity relating to 2025/26, completed in the period to 20 February 2026.

Internal audit progress

7 A summary of internal audit reviews currently underway, as well as work finalised in the year to date is included in appendix A. The details of other work completed in the period, including the provision of consultative support and grant certifications, has also been included.

8 Five audits have been finalised since the last report to this committee in December 2025. Further information on these audits is included in appendix B. The appendix summarises the key findings from these audits and includes details of the actions agreed with officers to address identified control weaknesses. A further two audits are currently at draft report stage, and the fieldwork has been completed for a further three audits.

9 Nineteen audits are currently in progress with a number nearing the final stages of fieldwork. We expect to report on the outcomes of this work to the next meeting of the Committee. We have also started planning for a further six assignments. We are on track for sufficient work to have be completed to give our opinion in June 2026.

10 Our definitions for action priorities and overall assurance levels are included in Appendix C.

Follow up of agreed actions

11 All actions agreed with services as a result of internal audit work are followed up to ensure that the issues are addressed. As a result of this work, we are generally satisfied that sufficient progress is being made to address the control weaknesses identified in previous audits.

12 Full details of our follow up activity for the last 12 months can be found at appendix D.

APPENDIX A: Internal audit work in 2025/26

Final reports issued

Audit	Reported to Committee	Opinion
Allerton Waste Recovery Park	March 2026	Substantial Assurance
Management of External Funding	March 2026	Substantial Assurance
VAT Accounting	March 2026	Substantial Assurance
Asset Management	March 2026	Reasonable Assurance
Human Resources (Community Development)	March 2026	Limited Assurance
Housing Rents	December 2025	Substantial Assurance
Debtors	December 2025	Reasonable Assurance
Corporate Complaints	December 2025	Reasonable Assurance
Early Years Provider Checks (Summer Term)	December 2025	No opinion given
Purchase to Pay	December 2025	No opinion given
Bank reconciliations and suspense accounts	September 2025	Substantial Assurance
Financial assessments	September 2025	Substantial Assurance
Performance management	September 2025	Substantial Assurance
Adult direct payments	September 2025	Reasonable Assurance
Creditors	September 2025	Reasonable Assurance
Killinghall primary school	September 2025	Reasonable Assurance
Liberty protection safeguards	September 2025	Reasonable Assurance
Mandatory training	September 2025	Reasonable Assurance
Revenues (Council tax and NNDR)	September 2025	Reasonable Assurance
Schools themed audit - Purchasing	September 2025	Reasonable Assurance
Council companies	September 2025	No opinion given
Scarborough Waterpark	September 2025	No opinion given

Audits in progress

Audit	Status
Children’s direct payments (Education)	Draft report issued
Arrangements for social care	Draft report issued
Democratic services – Modern.gov system	Fieldwork complete
Kex Gill (lessons learnt)	Fieldwork complete
Tree and Woodland Policy	Fieldwork complete
Benefits	Fieldwork close to completion
Bereavement services	Fieldwork close to completion
Contract management (extensions and variations)	Fieldwork close to completion
Council Tax & NNDR	Fieldwork close to completion
Transitions (children to adults)	Fieldwork close to completion
Adult safeguarding	Fieldwork in progress
Emergency planning	Fieldwork in progress
Harbours: Management of new starters and leavers	Fieldwork in progress
Housing stock	Fieldwork in progress
Leisure Centres - Lifeguard Training	Fieldwork in progress
Licensing	Fieldwork in progress
Locality working	Fieldwork in progress
Pensions: Income	Fieldwork in progress
Procurement Act: Follow - up	Fieldwork in progress
Review of payments to care providers	Fieldwork in progress
School themed: chargeable activities	Fieldwork in progress
School themed: recruitment and staff pay	Fieldwork in progress
School’s visits	Fieldwork in progress
Waste Services	Fieldwork in progress
Continuing Healthcare	Planning
Information Asset Management	Planning
Information Security Sweeps	Planning
Online referrals and care assessments	Planning
Performance Management	Planning
Section 106 agreements	Planning

Further explanation of audit progress status

Status	Further explanation
Planning	We are working with officers to define and agree the scope and timing of the internal audit work.
Fieldwork in progress	A specification has been issued and agreed with officers which includes target dates for key work deadlines. Fieldwork has started.
Fieldwork close to completion	Work is substantially complete. We expect (with appropriate client support on the remaining areas) for work to be completed within the next three weeks.
Fieldwork complete	Fieldwork has been completed. Closing meetings to discuss findings are taking place and/or the audit is subject to internal quality assurance review.
Draft report issued	A report with findings has been shared with officers. Appropriately focused actions with deadlines for completion need to be provided by officers before an agreed final report can be issued.

Other work completed or in progress in 2025/2026

Internal audit work has been undertaken in a range of other areas during the year, including those listed below.
· Follow up of agreed management actions · Consultative engagements, including: Financial management system replacement project – support, advice and data analysis ContrOCC project – support and advice Registration Services income and banking procedures – support and advice AI – supporting project governance · Grant certification work: Delivering Better Values in SEND Multiply Bus Subsidy Operators Grant Homes England Home Upgrade Grant Phase 2 Local Transport Plan Pooling of Housing Capital Receipts Provision of general support and advice · Completing financial appraisals · Certifying Scarborough and Harrogate Charter Trustee annual returns · Obtaining updates on the control and risk management arrangements of the council within the 11 key areas for our annual opinion.

Internal audit work has been undertaken in a range of other areas during the year, including those listed below.

· Follow up of agreed management actions

· Consultative engagements, including:

Financial management system replacement project – support, advice and data analysis

ContrOCC project – support and advice

Registration Services income and banking procedures – support and advice

AI – supporting project governance

· Grant certification work:

Delivering Better Values in SEND

Multiply

Bus Subsidy Operators Grant

Homes England

Home Upgrade Grant Phase 2

Local Transport Plan

Pooling of Housing Capital Receipts

Provision of general support and advice

· Completing financial appraisals

· Certifying Scarborough and Harrogate Charter Trustee annual returns

· Obtaining updates on the control and risk management arrangements of the council within the 11 key areas for our annual opinion.

APPENDIX B: Summary of key issues from audits finalised since the previous committee

System /area	Opinion	Area reviewed	Date issued	Comments	Management actions agreed
Allerton Waste Recovery Park	Substantial Assurance	We reviewed the governance arrangements, processes and Management Information System (MIS) to ensure: · sound governance arrangements are in place to ensure the contract is managed and monitored · the MIS provides accurate, complete and timely information that supports effective monitoring of the waste service and contract · the payment process is operating effectively and accurately in line with the contract terms, and the dispute process is effective	January 2026	There are sound governance arrangements in place within the main contract. The performance framework is well defined, with clear monitoring arrangements and named responsible officers. Oversight is supported through regular monthly and quarterly meetings, which review KPIs, contract performance, and operational issues. The MIS provides accurate, complete and timely information to support effective monitoring. Contract reporting and payment processes operate effectively. Management information is reviewed before payment, and monthly reports support accurate invoicing of certified amounts. There have been no issues requiring implementation of the disputes process. There has been no review or update of the performance indicators to ensure they remain relevant. Recycling targets are also being missed. The Contract Agreements have also not been updated to reflect changes due to LGR.	1 opportunity finding was agreed. Responsible officer: Contract manager (Waste) There have been no fundamental changes to the Project Agreement, as contract obligations remain unchanged post LGR. We are to appoint an advisor to appraise existing waste infrastructure and develop options for future needs. Findings will feed into an outline business case, alongside a new waste strategy setting priorities that reflect legislative changes and sustainability objectives. The deadline for the above action to be completed is the end of December 2026.
VAT accounting	Substantial Assurance	The purpose of this audit was to provide assurance that procedures and controls within the system ensure that: · VAT reconciliations are undertaken regularly, are appropriately authorised and discrepancies investigated · VAT is correctly charged on individual transactions when purchasing or supplying goods and services in all areas raising invoices · partial exemption arrangements are clear, accurate and effective · roles and responsibilities for staff members dealing with VAT are clearly defined	January 2026	VAT reconciliations are completed accurately and supported by appropriate records, with expected checks carried out on receivable and payable reports. However, the process for performing accuracy checks on the monthly VAT returns is not documented. Papers do not record the officer completing the reconciliation or the date undertaken. Archived data is being retained beyond the Council’s retention period and a process for accessing archived data from legacy systems is not well established. Testing confirmed VAT is generally applied correctly across transactions, with supporting documentation retained. Partial exemption calculations follow the required process, but the working paper lacks editing protections, creating a risk of unintended changes and potential errors or rework in the final calculation. Roles and responsibilities for VAT are clearly defined and supported by accessible, well‑labelled guidance. The Council has an effective process for sharing learning and a VAT error log is maintained to record issues, corrective actions and preventative advice.	4 moderate findings were agreed. Responsible officer: Senior Accountant – Corporate and Technical The process for completing accuracy checks on supporting reports for monthly VAT returns will be documented. Data beyond HMRC and NYCs retention requirements will be deleted, except Options to Tax records, which are kept indefinitely due to their 20‑year validity. The partial exemption working paper will be subject to editing restrictions and internal deadlines set for actual calculations and forecasts. All actions are planned to be completed by 30 September 2026.
Asset Management	Reasonable Assurance	We reviewed the asset management arrangements in place to ensure that: · there is comprehensive list of buildings with records that show when key safety checks were last performed and when they are next due · there is guidance in place for completing safety checks, and these checks are undertaken on a timely basis by suitably qualified professionals. Accurate records of these checks are also maintained · There is a timely follow-up of any remedial action arising from inspections	January 2026	There is a comprehensive list of buildings and safety check information. The Property Services Team has made good progress in consolidating legacy district and county assets onto Concerto. However, further work is needed before Concerto can be relied on as the single source for compliance oversight. In a number of areas, property management information in Concerto lacks sufficient detail. Some leased properties lacked compliance information, and several sites were still awaiting initial surveys. Testing confirmed compliance checks are completed at appropriate intervals and recorded properly in Concerto. Contractors are suitably qualified, but the Council currently lacks a centralised list of site‑responsible persons, limiting its ability to provide training and confirm accountability for each location. There is no formal guidance for monitoring remedial actions, though this gap is being addressed through the development of Service Level Agreements (SLAs) by the Property Services team. The SLAs should clearly set out roles and responsibilities of services in the management and oversight of health and safety checks of property assets.	1 significant and 1 moderate findings were agreed. Responsible officer: Head of Property Compliance Property Services will develop a monitoring policy covering condition surveys (by 31 March 2026), and a long-term strategy for planned preventive property asset maintenance (by 30 June 2026). Outstanding actions on water hygiene and fixed electrical equipment will be completed and monitored in Concerto (by 31 March 2026). An interim process to monitor remedial fire actions will be introduced (by 30 June 2026) while capacity to store this information in Concerto is being developed (by 31 December 2026) SLAs will be introduced by 31 March 2026.
Management of External Funding (Levelling Up)	Substantial Assurance	Catterick Garrison Town Centre is undergoing a significant redevelopment as part of the UK's Levelling Up initiative. We reviewed the project systems and controls to ensure: · budgetary controls exist to prevent possible overspending or financial mismanagement · robust procedures are in place for tracking the progress of the project and the achievement of agreed milestones · governance structures are functioning effectively	January 2026	Project governance arrangements are clearly defined and operating effectively. Funding from the Levelling Up Fund, council contributions and other match funding sources have been accurately recorded and were consistent with approved allocations. Budgetary controls are in place and operating effectively, supported by regular financial monitoring, structured governance, and documented approval processes. These arrangements should help to provide strong assurance against overspending or mismanagement throughout the project lifecycle. Procedures for tracking project progress and milestones appear robust and are supported by comprehensive project plans, tracking systems and regular governance oversight.	No areas for improvement were identified.
Human Resources (Community Development)	Limited Assurance	The audit reviewed the arrangements operating at the Council to ensure: · service managers are aware of their responsibilities and understand the role of Human Resources (HR) and related procedures, policy, processes and systems, and have completed relevant HR training · corporate and service specific inductions are completed, and probationary reviews are appropriately conducted and recorded · timely and accurate sickness absence information is recorded by managers. Aside from the Library Service, the services within this directorate transferred from the seven legacy councils as part of LGR on 1 April 2023. Since then, the workforce has undergone a significant transition and restructure to ensure the different functions are fully integrated.	January 2026	Manager responsibilities regarding HR processes are clearly set out in policy and guidance documents available on the Council intranet. HR support is provided via the HR helpdesk and the HR Advisory Team. Eleven non-mandatory HR training modules are available for completion on the Learning Zone. It is recommended all managers complete this training. However, managers were not aware of this. None of the modules had higher than 10% completion, and no manager had completed all of the modules. Completion of the training is not monitored by the HR service. The Council requires new employees complete service and corporate inductions where appropriate. A Corporate Induction Checklist should also be completed. Service and corporate inductions were not being completed by managers, who explained they were not aware of, or had completed the checklist. Probationary reviews should be completed within the required timescales, properly documented, and confirmed to the employee in writing. However, we found only limited evidence that these reviews had been carried out or written confirmation had been issued. All employees sampled had successfully completed their probation, with no extensions or terminations required. Nonetheless, due to the absence of records, we could not confirm that managers had followed the established procedure. We identified delays in recording the first day of absence, along with instances where neither self‑certification nor fit notes had been completed. There were also gaps in return‑to‑work documentation. In two cases, managers had completed the required self‑certification and return‑to‑work forms, but these had not been uploaded to the employee’s file, resulting in incomplete records. Where triggers for absence management had been met, only 12% of employees had absence management meetings with their manager, and none of the sample tested had records saved in the employee’s Wisdom file. The results of our testing evidenced that, in many cases, documents relating to inductions, probationary reviews and absence management are not being appropriately and securely saved in employees’ Wisdom files.	1 critical, 5 significant and 1 moderate findings were agreed. Responsible officers: Head of HR (Community Development) HR Business Partners (Community Development) Corporate Director Community Development On non-mandatory training We will: · clarify people management responsibilities and raise awareness · identify HR training for managers, roll out existing modules and develop further training where needed · require directorate managers to complete people management training On induction we will: · remind managers of induction responsibilities so all new starters and movers receive a planned, consistent induction. · monitor induction compliance, escalate issues, and act where needed · require directorate managers to complete induction training A directorate-based induction process will be developed to complement the corporate induction. When launched, we will ensure that managers are briefed and receive any relevant training. On the probationary processes we will: · remind managers of their probationary process responsibilities · monitor manager compliance with the probation process, escalate issues, and act where needed · mandate directorate managers to complete relevant probation related people manager training. On sickness absence we will: · remind managers of their sickness absence process responsibilities · monitor manager compliance with the sickness absence process, escalate issues, and act where needed · mandate directorate managers to complete relevant probation related sickness absence management training. Deadlines for completing the reminding and monitoring stages are by the end of April 2026. Deadlines for completion of training is by the end of October 2026.

APPENDIX C: Audit opinions and priorities for actions

Audit opinions
Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on four grades of opinion, as set out below.

Opinion	Assessment of internal control
Substantial assurance	Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified.
Reasonable assurance	Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made.
Limited assurance	Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation.
No assurance	Overall, there is a fundamental failure in control and risks are not being effectively

Priorities for findings
Critical	A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management.
Significant	A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management.
Moderate	The system objectives are not exposed to significant risk, but the issue merits attention by management.
Opportunity	There is an opportunity for improvement in efficiency or outcomes, but the system objectives are not exposed to risk.

*There are circumstances when it is not appropriate to give an opinion/assurance level on completed work, for example on project, investigations and other targeted support, consultancy, grant certification and follow up work. In these instances a ‘No opinion’ will be given.

APPENDIX D: FOLLOW UP OF AGREED AUDIT ACTIONS

1 Follow up work is carried out through a combination of questionnaires completed by responsible managers, risk assessment, and by further detailed review by the auditors where necessary.

2 Where responsible officers have not taken the agreed action, issues are escalated to more senior officers. Ultimately, they may be referred to the Audit Committee in accordance with the follow-up and escalation procedure.

3 Figure 1 below shows the status of agreed actions from follow-up activity undertaken in the year to 31 January 2026. This information is presented on a rolling twelve-month basis.

4 For clarity, the figure shows the results of follow up activity up to 31 January 2026, regardless of when actions were originally due (that is, it includes actions which were due prior to Q3 2025/26 but which are still being followed up).

5 For completeness, it also shows actions which have been agreed in finalised audits, but which have not yet fallen due and so have not been followed up.

Figure 1: Total agreed actions by current status as at 31 January 2026

Status	Critical	Significant	Moderate	Opportunity	Total
Action completed	0	51	78	9	138
Action overdue	0	36	22	2	60
Revised date	1	9	9	0	19
Actions not yet due	4	23	27	1	55
Total	5	119	136	12	272

6 A total of 217 actions have been followed up in the 12 months up to 31 January 2026. Of these, 138 have been satisfactorily implemented.

7 A total of 19 actions had their original implementation timescale extended, with revised implementation dates being agreed with the action owner. We agree revised dates where the delay in addressing an issue will not lead to unacceptable exposure to risk and where the delays may be unavoidable. However, the committee should be aware that lengthy or continued revised dates do inevitably lead to a degree of risk exposure to the council.

8 Figure 2 below shows how long dates have been revised from the original implementation date.

Figure 2: Length of revised dates agreed for action implementation

9 A total of 19 actions have a revised target date. Of these, 15 have an extension of six months or more. Explanations provided during follow up activities have indicated service restructure, system changes, and resource pressures to be driving factors in lengthy revised dates.

10 A critical action has an extension of over six months from the agreed date. This relates to a school audit, which has since had a change in leadership. The critical action will be included as part of a follow-up audit scheduled in Quarter 4 2025/26.

11 At the time of reporting, 60 actions are overdue. This is shown in figure 3, below. Included in figure 3 are 36 actions where we have received a response or a previously revised date but have not yet been able to conclude whether the risk has been satisfactorily addressed.

Figure 3: Length of time actions have been overdue

12 There will usually be some instances like this at any point in time. It can be due to ongoing communication with the responsible officers to obtain evidence confirming completion of the action. It can also be due to instances where the action taken is not exactly as agreed and further work is being undertaken to assess whether the action taken does satisfactorily address the risk or because there are ongoing discussions about whether to agree revised dates for the action.

13 The remaining actions are overdue, and we have not yet received a response from the action owner; these continue to be followed up by auditors with the responsible officers.

14 Overdue actions are escalated according to the agreed escalation policy, firstly to relevant Assistant Directors, then to the Deputy S151 Officer via liaison meetings and quarterly reporting. They may subsequently be brought to the Audit Committee. At this stage, no overdue actions are being escalated to the committee.