The report of the Head of Policy and Governance is attached.

Contact:  Barry Hanson 07990 086409

The Committee received the report of the Head of Policy and Governance - copy attached to the signed Minutes – which provided members with an update of the work undertaken by Internal Audit in the two months since the September 2023 Audit Committee.

The Head of Policy and Governance informed the Committee that 50% of the revised plan had been completed which was in line with previous delivery records and that they were on track to deliver a minimum of 90% of the revised annual plan by year end.  In total, nine final reports had been issued containing 85 recommendations (set out in paragraph 8.5 of the report).  Of the 85 recommendations, two were fundamental (one of which was set out at paragraph 8.11 and the other in the confidential part of the agenda).  The unsatisfactory and limited assurance opinions were set out in table 3 of Appendix A.

In response to concerns around the use of WhatsApp, the Head of Policy and Governance explained that it was an historic issue when WhatsApp was implemented on corporate devices and was very much used as a last resort.  From an information governance perspective, the report was welcomed, and he confirmed that the corporate information governance group (IGLOO) were due to sit the following Monday and the issue of WhatsApp use was on the agenda.  He reported that Senior Leaders charged with information governance and the delivery of sound information governance across the organisation sat on that Group and that the Executive Director of Resources (Section 151 Officer), who was the Senior Information Risk Officer (SIRO), was Chair of that Group.  The issues raised within the report in relation to the use of WhatsApp had been recognised and would be considered further at IGLOO and further work would be undertaken to understand how and why WhatsApp was currently being used and whether there were suitable alternatives available within the organisation.

Concern was raised at the reduction in days of planned activity from 1289 to 1228 and it was queried at what stage did this become a strategic risk.  The Head of Policy and Governance confirmed that it was a risk and that the service was at its minimum in terms of resources.  They were carrying vacancies within the team but they were due to go out for another recruitment round to address the issue.  The Internal Audit Manager reassured the Committee that this was recognised as a high risk on the Internal Audit operational risk register and she had regular conversations with the Executive Director of Resources (Section 151 Officer).  There has been no reduction in the number of posts within the Internal Audit team, however, there were no suitable applicants during the last recruitment exercise and they were looking to change the recruitment offer to make it more attractive to external applicants.  The Head of Policy and Governance confirmed that in the past they had supplemented the internal resource with external providers.

In response to a query about whether the internal audit posts were subject to the staff vacancy management process that the finance team were asking every department to lose 5% and delete any vacancies.  In response, the Executive Director of Resources (Section 151 Officer) explained that there were no exemptions to the 5% vacancy factor which was managed on the basis of turnover levels expected within the year within the organisation. He confirmed that the Resources Directorate had met its 5% vacancy turnover factor this year and he assured the Committee there were no implications for the Internal Audit team.  He explained that there was a shortage of Auditors which also extend into the private sector.

The Executive Director of Resources (Section 151 Officer) felt it was important to note the benefit to the organisation of bringing in external internal auditors who were a completely independent external resource who could look at certain parts of the organisation or certain particular audits and bring an additional level of independence.  So regardless of the position within the internal audit team in terms of recruitment, there would always be a best practice need for using external auditors as part of a clearly defined process.  He reassured the Committee that he had regular conversations with the Internal Audit Manager and the Head of Policy and Governance in relation to whether there was adequate coverage across the organisation to ensure an assessment could be made at the end of the year.  Although at the minimum level of coverage, there were opportunities to look at different methodologies that would deliver the required outcome.

The Committee welcomed the reassurance but requested further data so they could understand the gap between planned days and actual days along with which of those were delivered by external specialists and which were generic day-to-day business as usual in order for the Committee to understand the growing gap in business-as-usual planned audit activity and the difference in cost of an internal employee compared to that of an external auditor.  Assurance was sought that the current internal audit team would not be asked to save 5% of its staffing in the next financial year.  The Executive Director of Resources (Section 151 Officer) informed the Committee that this was a decision for himself as the Section 151 Officer, and he had provided assurance that it was something they were constantly discussing and working through.  In relation to the comparison of costs, he acknowledged that it was more costly to bring in external auditors but that was something that had been factored in due to the benefits it brought and was a separate issue to the number of audit days available in the plan however they were ensuring that there was adequate coverage over a period of time.  As Section 151 Officer he understood the importance to the organisation of the internal audit function.

In response to a query, the Executive Director of Resources (Section 151 Officer) confirmed that the requirement for an Internal Audit Function was a responsibility specifically within the role of the Section 151 Officer that there was nothing mandatory about the particular posts within the internal audit team.   It was requested that if the organisation wished to reduce the number of posts within the internal audit team that the Committee be informed.

RESOLVED:

To note performance against the 2023/24 Audit Plan.

It was agreed to take Agenda Items 15 (Statement of Accounts 2021/22) and 17 (External Audit: Shropshire Council Audit Findings (Information) 2021/22) together.