Report to:			Audit Committee
Date:			10 March 2022
Title:			Update on Progress on the 2021-22 Internal Audit Plan
Portfolio Area:			Cllr J Pearce – Leader of Council
Wards Affected:			All
Urgent Decision:		N		Approval and clearance obtained:			Y
Date next steps can be taken:
Author:	Dominic Measures Robert Hutchins				Role:	Audit Manager Head of Partnership
Contact:	dominic.measures@swdevon.gov.uk   01392 380493 Robert.hutchins@devon.gov.uk      01392 383000

RECOMMENDATION:

It is RECOMMENDED that the progress made against the 2021/22 internal audit plan, and any key issues arising are noted and approved.

1. Executive summary

The purpose of this report is to inform members of the principal activities and findings of the Council’s Internal Audit team for 2021/22 to 4 February 2022, by:

· Showing the progress made by Internal Audit against the 2021/22 annual internal audit plan, as approved by the Audit Committee in April 2021; and

· Highlighting any revisions to the 2021/22 internal audit plan;

2. Background

The Audit Committee, under its Terms of Reference contained in South Hams Council’s Constitution, is required to consider the Chief Internal Auditor’s audit reports, to monitor and review the internal audit programme and findings, and to monitor the progress and performance of Internal Audit.

The Accounts and Audit (Amendment) (England) Regulations 2015 require that all Authorities need to carry out an annual review of the effectiveness of their internal audit system, and need to incorporate the results of that review into their Annual Governance Statement (AGS), published with the annual Statement of Accounts.

The Internal Audit plan for 2021/22 was presented to the Audit Committee on 8th April 2021.

Progress in the period up to 4 February has continued to be impacted by the pandemic with both the completion of the 2020/21 plan and, in turn, work on the current year plan.  Half of the Internal Audit resources has continued to assist officers in the payment of various grants to businesses, in particular the evaluation/reviewing of applications.  Out of 417 productive days so far across the Audit team, 194 days have been spent on COVID Business Grant processing.

At the Audit Committee meeting in July 2021, Members recommended to the Council’s Executive to procure an extra 0.5 Full Time Equivalent (FTE) of Internal Audit resource from Devon Audit Partnership for the 2021/22 Financial Year, to backfill for the loss of Internal Audit staff time.  The Executive approved this at a meeting on 16^th September 2021 and additional resources are now working alongside the existing Audit Team and will continue to do so over the next two or three months.

Areview of the plan has taken place with the Section 151 officer and Director of Governance and Assurance to decide on which audits should go ahead in the remainder of the audit year and those which can be either cancelled or deferred into 2022/23.

I can inform the Committee that there has been just one day reported sickness absence in the year to date. 

The Council, in association with several partner organisations receive funding from the Rural Development Programme for England (RDPE) – Local Action 2015-2020 programme, with £1.5m awarded to the South Devon Coastal Local Action Group (LAG) and £2.0m to the Greater Dartmoor Local Enterprise Action Fund (LEAF). The Council, as the Accountable Body, is responsible for the legal and financial management of the grants awarded to the programmes. Each project is required to submit regular grant claims to draw down funding. 20 days were allocated to this work for the year in the 2021/22 Audit Plan, of which 18 days had been used as at 4 February. Due to COVID pandemic restrictions, projects across the country could not meet their original deadlines and some had to withdraw resulting in additional funding becoming available.  LEAF and LAG were successful in winning some of this funding, which has been allocated to approved projects, who are required to submit their final claims by the end of September 2022, with the Council submitting its final running costs claim by 30^th November 2022. 

3. Outcomes/outputs

In carrying out systems and other reviews, Internal Audit assess whether key, and other controls are operating satisfactorily within the area under review, and an opinion on the adequacy of controls is provided to management as part of the audit report.

All final audit reports include an action plan which identifies responsible officers, and target dates to any address control issues or recommendations for efficiencies identified during each review. Implementation of action plans are reviewed during subsequent audits or as part of a specific follow-up process.

As already pointed out, progress against the agreed 2021/22 Internal Audit Plan has been impacted by the COVID-19 pandemic with the loss of half of the Internal Audit resources who continues to assist with the processing of Business grant applications throughout the year. However, as well as completing those audits that remained from the 2020/21 plan, work has continued on audits that were underway at the time of the last progress report, a number of which have been completed, with draft and final reports issued. For other audits, fieldwork is either in progress or has been completed and draft reports issued, and we await responses from management on the content of those reports and the recommendations made. Several audits are due to take place over the reminder of the audit year and planning for these reviews is underway. A summary of progress is attached at Appendix A, and this provides the detailed position for each audit as at 4 February 2022.

Overall, and based on work performed to date during 2021/22, Internal Audit is able to provide reasonable assurance on the adequacy and effectiveness of the Authority’s internal control environment. Risk management and the system of internal control are generally sound and designed to meet the organisation’s objectives. However, some weaknesses in design and / or inconsistent application of controls do not mitigate all risks identified, putting the achievement of particular objectives at risk. (please refer to Appendix B for definition).

The reporting of individual high and medium priority recommendations is set out at Appendix B.  This is an ongoing part of the report to advise the Audit Committee, in detail, of significant findings since the last report and confirm that the agreed action has been implemented or what progress has been made.

Appendix C provides a summary of work where the planned work is complete but no audit report produced.  This includes information with regards Non-Compliance with Contract or Financial Procedure Rules, and Fraud / Irregularity issues reported to Internal Audit during the reporting period.

4. Options available and consideration of risk

No alternative operation has been considered as the failure to maintain an adequate and effective system of internal audit would contravene the Accounts and Audit Regulations, 2003, 2006, 2011 and 2015.

5.  Proposed Way Forward

We continue to be flexible in our approach and with the timetabling of audits to ensure that resources are assigned to specific areas of the plan to enable our work to be delivered at the most effective time for the organisation.

6. Implications

Implications	Relevant to proposals Y/N	Details and proposed measures to address
Legal/Governance	Y	The Accounts and Audit Regulations 2015 issued by the Secretary of State require every local authority to undertake an effective internal audit to evaluate the effectiveness of its risk management, control and governance processes, taking into account public sector internal auditing standards. The work of the internal audit service assists the Council in maintaining high standards of public accountability and probity in the use of public funds. The service has a role in promoting robust service planning, performance monitoring and review throughout the organisation, together with ensuring compliance with the Council’s statutory obligations.
Financial	Y	There are no additional or new financial implications arising from this report. The cost of the internal audit team is in line with budget expectations.
Risk	Y	The work of the internal audit service is an intrinsic element of the Council’s overall corporate governance, risk management and internal control framework.
Supporting Corporate Strategy	Y	This Progress Report and the work of Internal Audit supports all of the Council’s corporate strategy themes.
Climate Change – Carbon / Biodiversity Impact	Y	None directly arising from this report.  However, the Internal Audit function, managed by Devon Audit Partnership is very mindful of the need to minimise travel in completing the internal audit plan.  Where possible, desk-top review of documents, and the use of electronic records, is used to obtain evidence to support the audit process, although it is inevitable that on-site verification may be required at times. The team use an audit management system (Mki) which enables managerial review to take place remotely, thus also saving on the need for travel.
Comprehensive Impact Assessment Implications
Equality and Diversity	N	There are no specific equality and diversity issues arising from this report.
Safeguarding	N	There are no specific safeguarding issues arising from this report.
Community Safety, Crime and Disorder	N	There are no specific community safety, crime and disorder issues arising from this report.
Health, Safety and Wellbeing	N	There are no specific health, safety and wellbeing issues arising from this report.
Other implications	N	There are no other specific implications arising from this report.

Supporting Information

Appendices:

There are three separate appendices to this report; Appendix A, B, and C.

Background Papers:

Internal Audit Plan 2021/22 as approved by Audit Committee on 8th April 2021.

Summary of progress against agreed internal audit plan 2021/22 for South Hams District Council & West Devon Borough Council

■ Status as reported in previous Progress Reports     üChange to Status between 5 November 2021 and 4 February 2022

Projects agreed in the Audit Plan	Fieldwork started		Report Issued in draft		Management comments received		Final Report Issued	Assurance Opinion							Comments
								Substantial		Reasonable		Limited		No
Work Carried forward from 2020/21
Housing Benefit 20/21		■		■		■	■				■					Summary presented to Audit Committee in December 2021
Business Rates 20/21		■		■		■	■						■			Summary presented to Audit Committee in December 2021
Council Tax 20/21		■		■		■	■						■			Summary presented to Audit Committee in December 2021
ICT Audit – Access Management 20/21		■		■		■	■				■					Summary presented to Audit Committee in December 2021
COVID-19 – Business Grants – Post Scheme Assurance		■		■		■	■		■							Summary presented to Audit Committee in December 2021
Development Control – Planning Enforcement 20/21		■		■												Awaiting Management Response to draft report

Projects agreed in the Audit Plan	Fieldwork started	Report Issued in draft	Management comments received	Final Report Issued	Assurance Opinion				Comments
					Substantial	Reasonable	Limited	No
2021/22 Plan
MAIN FINANCIAL SYSTEMS
Main Accounting System (inc budgetary control)	ü
Creditor (Payments)	ü
Debtors (Income Collection)	■	■	■	■			■		Final report issued. Extract provided at Appendix B.
Payroll	ü
Business Rates	ü
Council Tax	ü
Housing Benefits
Treasury Management	■	■	■	■	■				Final report issued. Extract provided at Appendix B.
Main Financial Systems

Projects agreed in the Audit Plan	Fieldwork started	Report Issued in draft	Management comments received	Final Report Issued	Assurance Opinion				Comments
					Substantial	Reasonable	Limited	No
PLACE & ENTERPRISE
COVID-19 – Business Grants – Post Scheme Assurance	■	■	-	■	■				Review of Covid 19 - MHCLG Lost Sales, Fees & Charges Compensation Scheme
Estates Property & Rents Follow Up	■	■	■	■			■		Summary presented to Audit Committee in December 2021
Salcombe Harbour (S.Hams)  (deferred from 2020-21)	■
Investment Strategy – (delegations, mgt of risk, project approach)	ü
Dartmouth Lower Ferry (S.Hams) (deferred from 2020-21)	■
Place & Enterprise

	Projects agreed in the Audit Plan	Fieldwork started		Report Issued in draft		Management comments received	Final Report Issued		Assurance Opinion							Comments
										Substantial		Reasonable		Limited	No
CUSTOMER SERVICE & DELIVERY
ICT Audit – Business Continuity & Disaster Recovery																	Defer in light of external consultations review
ICT Audit – Incident and Problem Management			■	■	■			■					■				Summary presented to Audit Committee in December 2021
ICT Audit – Change Management
Locality Officers – Management, roles & scheduling																	Defer to 2022-23 with agreement from Director of Governance and Assurance
Response and Recovery to COVID-19
Building Maintenance – Works Scheduling – Follow-Up																	Defer to Q1 of 22-23 to coincide with target dates for implementing agreed actions
Cash Collection & Online Payments			■	■	■			■			■						Summary presented to Audit Committee in December 2021
Customer Service & Delivery

	Projects agreed in the Audit Plan	Fieldwork started	Report Issued in draft	Management comments received	Final Report Issued	Assurance Opinion				Comments
						Substantial	Reasonable	Limited	No
GOVERNANCE & ASSURANCE
Project Management – Governance and Process										Maturity Assessment Exercise due to commence
Future IT Project		■
Contract Management – Leisure Management										Defer to 22/23 with agreement of Senior Leadership Team
Corporate Information Management (Data Protection, Filing System Housekeeping)		■
Change Control – Business Processes										Audit due to commence shortly
Climate Change		■	■	■	■		■			Summary presented to Audit Committee in December 2021
Risk Management Review (deferred from 2020-21)										Audit due to commence before year end.
	Projects agreed in the Audit Plan	Fieldwork started	Report Issued in draft	Management comments received	Final Report Issued	Assurance Opinion				Comments
						Substantial	Reasonable	Limited	No
GOVERNANCE & ASSURANCE CONTD
Performance Management (Data quality)  Follow Up		■	■	■	■			■		Final report issued. Extract provided at Appendix B.
Election Teams
New Payroll/HR system (Procurement, Project Mgt)		■								On-going monitoring of project progress. Attendance at Project Team meetings
Governance & Assurance

Projects agreed in the Audit Plan	Fieldwork started	Report Issued in draft	Management comments received	Final Report Issued	Assurance Opinion						Comments
							Substantial	Reasonable	Limited	No
OTHER ESSENTIAL ITEMS
Audit Management including:- - Audit planning, - Monitoring & reporting, - Audit Committee	■	-	-	-		-		-	-	-	Includes attendance at Audit Committee – Internal Audit Annual Report presented to Audit Committee on 1^st July 2021
Annual Governance Statement	-	-	-	-		-		-	-	-	Review of the Code of Corporate Governance presented to July & October 2021 Audit Committees under separate cover
Exemptions from Financial Regulations	■
Grants - Greater Dartmoor Local Enterprise Action Fund (LEAF) & South Devon Coastal Action Group (LAG)	■	-	-	-		-		-	-	-	18 days spent on claims to date. Scheme extended until 30^th November 2022
National Fraud Initiative (NFI)	■
Contingency & Advice	■	-	-	-		-		-	-	-
OTHER ESSENTIAL ITEMS

Summary of Internal Audit Findings 2021/22 – Final Reports

As at 4 February 2022, five final reports have been issued in respect of 2021/22 work with a further five final reports relating to audits that were part of the previous 2020/21 Audit Plan. The conclusions from final reports issued since the last Audit Committee in December, are summarised below.

Subject	Audit Findings	Management Response
2021/22 Audit Plan
Debtors	Limited Assurance Due to the impact of the Covid-19 pandemic, formal debt recovery was suspended from March 2020 to May 2021, although some 'soft' recovery took place during this period. Formal recovery procedures were fully reinstated in June 2021. This does mean that some debts that existed prior to the pandemic, have been subject to reduced recovery work for their age. In general, the raising and issuing of invoices to customers is satisfactory. However, issues remain around the timely and effective recovery of outstanding debts. Some of the matters we have noted were reported following our previous review of 2019/20, but it is acknowledged that many officers have experienced additional work pressures for much of the intervening period, as a result of the Covid pandemic. There are a number of areas which would benefit from improved controls and, quite often, this would appear to be linked to the available staff resource: 1. Where suppressions are required on recovery, these are routinely left open-ended, with reliance placed on them being monitored through the weekly Debt Recovery Exception reports. However, given the number of entries on some of these reports, it is likely that all are not examined in detail each week; 2. Invoices with an arrangement to pay by instalments that has not been adhered to, are not being identified promptly as we understand that there is insufficient staff resource to monitor the 'Broken Instalment' reports; 3. No sundry debts have recently been sent to the Councils' enforcement agents for recovery, although this is currently under review; 4. The opportunity to further recover debts through the courts or by means of other legal action, is not currently being utilised, due to a combination of insufficient experience in the Debtors team and insufficient staff resource within the Legal practice.  This is currently being reviewed by SLT; 5. The majority of Council employees with access to the Civica Financials system continue to use the old version which the software supplier has stated is to be no longer supported. Whilst access to the replacement web-version of the software has been available for some years, it has been found to be less user-friendly and so staff have not migrated to its use; and 6. The Councils could be in contravention of the General Data Protection Regulations, as well as their own Retention Policy, by holding a significant amount of aged and/or obsolete data on the debtors system (as well as other Civica Financial modules).	1. Agreed.  Officers will look into ways to manage the suspension of recovery action, for example the mandatory setting of an end date on all suppressions and developing a report that specifically identifies accounts or invoices with a recovery suspension, allowing them to be reviewed more readily. 2. Agreed.  Having lost a Case Manager – Finance role, to help backfill Development Management vacancies, the Case Management – Support Services Finance team are now carrying out a review of processes to see if any further efficiencies can be identified. 3. Agreed.  The Senior Specialist – Finance (CS) will be asked to lead on this, once other work priorities have been addressed, given that debt levels do not appear to be particularly high at present. There is a need to assess the number and value of debts for which such action would be appropriate, in order to be able to understand the task in hand, as well as the potential benefit of pursuing debt recovery by this means, when compared to the officer time required and associated costs. Best practice will be shared with the Revenue and Benefits team, allowing training to be provided to the Debtors team as necessary. 4. Agreed.  A meeting of all relevant staff, who feed into the debt recovery process, will be held. The aim will be to identify how the issues raised in the audit report can be addressed. The S151 Officer will raise the issue of timeliness of recovery action with the Senior Leadership Team and the Head of Legal, based around identifying further resource for debt recovery, to allow older debts to be taken through a legal process. The Senior Case Manager (MB) will be asked to extract data from the debtor system, in order to give some initial indication of the level of resource that would be required from the Legal team. This will allow the Head of Legal (DF) to consider whether or not the appropriate level of resource will be available for future assistance or whether there is a business case for engaging further resource. 5. Agreed.  Familiarisation sessions on the web-based system will be provided by Civica in early December 2021. These will be attended by the Finance COP, Case Managers and a small number of other officers. Training will then be rolled out to budget holders during the remainder of the financial year. 6. Agreed.  The Senior Specialist – Finance (CS) is to lead on ways of archiving aged and/or obsolete data being held within all the modules of the Civica Financials system but it has been delayed by other work pressures.
Treasury Management	Substantial Assurance Based on our review we can confirm that the Councils are adhering to legislative requirements and have appropriate and effective controls in place over the day-to-day treasury management operations. We noted two minor issues, one relating to the authorisation of new users within SunGard, the software used to manage Money Market Funds (MMFs), and one linked to the receipt of statements from one of the MMFs.
Performance Management Follow Up	Our assurance opinion, after completing follow up work in this area, remains Limited Assurance. However, the overall direction of travel for improvement is positive. Since November 2021, themed performance monitoring reports are being taken to each Overview and Scrutiny meeting, as well as annual updates, to allow delivery of the Corporate Strategy Action Plans to be monitored. Some principles are now in place with respect to performance management and the performance monitoring framework, by virtue of the Corporate Strategies approved in September 2021. However, at the time of our review, not all the actions associated with the framework have been delivered yet and so a number of weaknesses persist. Also, some of the issues we raised last year remain outstanding due to other work pressures: · The Data Quality Strategy has yet to be updated and re-published; · Awareness raising is required for all officers around data quality, with more in-depth training for those responsible for recording and maintaining data sets. This should include the need to minimise manual intervention and ensure that data is auditable and validated; and · There is still a need to review those KPIs which are already being recorded and monitored by business areas for continued relevance. The external auditor’s Annual Reports for 2020/21 for each Council (taken to the October/November 2021 Audit Committees) raised an improvement recommendation with regards performance management arrangements. Whilst data quality is an area that they also feel requires improvement, they did not make any further recommendations as they consider that this is being addressed through those that we raised last year.	1. Agreed.  The Data Quality Strategy will be updated, setting out requirements and responsibilities with respect to data quality, as well as those themes highlighted above, and promoted to all staff. 2. Agreed.  Efforts will be made to provide data quality training for those officers with key responsibilities for performance measures. In addition, consideration will be given to requiring all staff to complete a Learning Pool module on data quality, or to raise awareness through other channels. As far as having clear audit trails when producing any data set, previously data trails may have been held in emails etc., but in future will be stored in a central location, most likely on the corporate network. 3. Agreed.  It is intended to review all those performance measures that were being recorded prior to the adoption of the current Corporate Strategies. The focus should be on recording and reporting to members against measures that allow the Councils to benchmark themselves against other local authorities, for example, by using the LG Inform tool. It is planned to carry out a series of service reviews over the next few years and, as part of these, it will be considered how the various functions should be performing and what measures are appropriate.

Definition of Assignment and Overall Assurance Opinions

Audit Assignment Assurance Opinion Levels – as from May 2020

Substantial Assurance	A sound system of governance, risk management and control exists, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited.
Reasonable Assurance	There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited.
Limited Assurance	Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited.
No Assurance	Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited.

Overall / Annual Assurance Opinion Levels – As from May 2020

Substantial Assurance	A sound system of governance, risk management and control exists across the organisation, with internal controls operating effectively and being consistently applied to support the achievement of strategic and operational objectives.	Limited Assurance	Significant gaps, weaknesses or non-compliance were identified across the organisation. Improvement is required to the system of governance, risk management and control to effectively manage risks and ensure that strategic and operational objectives can be achieved.
Reasonable Assurance	There are generally sound systems of governance, risk management and control in place across the organisation. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of some of the strategic and operational objectives.	No Assurance	Immediate action is required to address fundamental control gaps, weaknesses or issues of non-compliance identified across the organisation. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of strategic and operational objectives.

Planned Audit 2021/22 – Work Complete (No Audit Report)

Subject	Comments
System of Internal Control (SIC), and Annual Governance Statement (AGS)	Included within the Internal Audit Annual Report presented to the June Audit Committee was the internal audit opinion providing assurance that the Council's systems contain a satisfactory level of internal control. In addition, there is a requirement for the Council to prepare an AGS statement. Internal Audit were available to provide support and challenge, as appropriate, to the Senior Leadership Team as they drafted the statement in respect of the 2020/21 financial year. The S151 Officer presented the 2020/21 AGS to the Audit Committee on 2 September & 28 October 2021.
Exemptions to Financial Procedure Rules	Five applications for Contract / Financial Procedure Rules have been received in the year to date, four were accepted and the remaining one was cancelled.
Fraud / Irregularity	There have been no irregularities to report regarding the day-to-day operation of the Councils.  However, there are four cases (3 South Hams, 1 West Devon) which relate to COVID-19 grants.  Three (2 SH, 1 WD) involve applications for the latest COVID-19 Additional Restrictions Grant, following the Omicron variant outbreak.  These have been reported to Devon Audit Partnership’s Counter Fraud Team and to the National Anti Fraud Network (NAFN). The fourth case, involving a business that made applications under previous COVID grant schemes, is being investigated by the National Investigation Service and the Council is supplying information to assist in this investigation.
Covid 19 - MHCLG Lost Sales, Fees & Charges Compensation Scheme	Internal Audit were asked to undertake review and challenge of the returns prepared by officers when claiming under the Govt scheme, the first in May 2021 and more recently, in October 2021.  In both cases, Internal Audit were able to confirm the accuracy of the claims and provide substantial assurance on the two submissions.