The report of the Head of Policy and Governance is attached.

Contact:  Barry Hanson 07990 086409

The Committee received the report of the Head of Policy and Governance which provided Members with an update on the work undertaken by Internal Audit since the September Audit Committee.

The Head of Policy and Governance informed the Committee that, in line with previous delivery records, 49% of the revised plan had been completed.  Revisions to the plan provided for a total of 1334 days and were targeted to provide enough activity to inform the year end opinion.  He explained that the number of days had been reduced slightly from 1347 days due to a member of the team undertaking an apprenticeship which included the requirement to allow for 20% of their time for training.

In total, 15 final reports had been issued (between 26 August and 20 October 2024) containing 110 recommendations (set out in paragraph 8.5 of the report) and two draft reports were awaiting management responses.  Five reports provided reasonable assurance (33%) which was a decrease in the higher levels of assurance for the period compared to last year (60%).  This was offset by a corresponding increase in the number of limited and unsatisfactory assurance opinions (67%) compared to 40% the previous year (set out in paragraphs 8.14 to 8.16).

Three fundamental recommendations had been made, detailed at paragraph 8.13 of the report and Members were asked whether they wished for any further updates to be provided from responsible officers to a future meeting of the Audit Committee.

The Head of Policy and Governance drew Members attention to the notable increases in repeated low assurances where follow-up audits indicated that action had not been taken to address the control weaknesses identified and Internal Audit had noticed that Management were suggesting longer implementation dates for significant recommendations (highlighted in table 3).  Therefore, evidence-based risks identified by Internal Audit were not being mitigated in a timely manner and could potentially increase the Council’s risk appetite as significant weaknesses and deficiencies identified from formal audit work were unaddressed for extended periods of time.  Members were therefore also asked whether they wished for any updates to be provided from responsible officers in relation to the unsatisfactory and limited assurances detailed in Table 3.

A discussion ensued in relation to the falling levels of assurance and possible reasons for them.  The Committee expressed their concerns, that the important role of audit was not well understood and was just seen as an ‘add-on’, and they were not comfortable with the longer implementation dates being suggested.  The Chairman stated that the Committee had tried, over many years to raise the profile of audit sufficiently that managers at all levels took it as seriously as they should. 

In response, the Head of Policy and Governance explained the procedure for following up a fundamental recommendation and for agreeing management responses and an implementation date.  If within three months of the audit, then a follow up audit would be undertaken but Internal Audit were seeing an increase in the time scale for implementation, which was very much symptomatic of where the organisation was, however, from a risk perspective, there was a risk in doing that, hence the reason for drawing it to the Committee’s attention.  As an organisation it was important particularly unsatisfactory areas with associated fundamental recommendations within them were taken seriously and were followed up in a timely manner.

A brief discussion ensued in relation to how much time Internal Audit should spend chasing up unsatisfactory audit opinions for relatively minor issues which would not appear to affect the viability of the Council or cause significant reputational damage.  In response the Internal Audit Manager explained that they did not simply look at the high-level financial risks but looked across the strategic risks to determine which to audit and she gave several examples which showed that although small discrete areas in some respects, there were risks that were applicable across the authority when looking at value for money and efficiencies, and if some of these areas were run more efficiently, more income would be generated or less resource expended trying to support them.  It was therefore agreed that management updates on all four areas would be presented to the February Audit Committee.

In response to a query the Internal Audit Manager agreed to circulate to Committee Members the total number of days delivered in each year along with an update on resources.  She reported that they worked within the resources available but that there were currently vacancies within the team, and she explained that the Council structure for 2025 had not yet been confirmed.  She stated that there were currently no plans to go out to recruit but they were comfortable that they had enough coverage to provide the year end opinion.  In response to a query whether there were adequate resources to ensure that the year-end opinion was not limited, the Head of Policy and Governance explained that an additional number of days would not result in a different opinion at year end and reiterated that there was enough cover to provide his opinion.

Members were concerned that unless there was a recruitment plan in place, they were committing themselves to another limited year end opinion and that resources would be pared down even more come April and the Committee sought assurance from senior managers that that was not the case.  The Chairman informed the Committee that he had received assurance from the Executive Director of Resources (Section 151 Officer) that the Audit team would be maintained at its current level. 

The Executive Director of Resources (Section 151 Officer) clarified that in terms of the budget for the Internal Audit team and the number of posts within the establishment, this had not changed, however they had been unable to recruit and also vacant posts across the Council were being held vacant for financial savings.  He explained that there would be changes to the audit budget going forward as the authority was resizing and that would be worked through when it was understood what the new authority would look like in terms of the new operating model and the internal control framework. 

He made it very clear that what the Audit Committee were seeing was that recommendations made by the Internal Audit team were not being followed up in a timely manner however, that would not be helped by recruiting more auditors to go out and ask the same questions. It was a fundamental problem that lay with the organisation.  So, in theory, you could have just a couple of auditors and still have a substantial opinion provided they were able to look at the key fundamental issues of the organisation in a way that allowed them to do the audit in a few days, for example.  So, it did not directly correlate that a small Internal Audit team would automatically lead to a limited assurance.  However, there was a risk that a smaller team would have to look at more problematic areas rather than having a lot more auditors finding lots of good practice which was not necessarily adding value.     

The Executive Director of Resources (Section 151 Officer) did not think that the problem lay in the Internal Audit function but was the fault of the organisation as a whole and whether it was addressing the issues that were being raised and he was more concerned about that than specifically the size of the team.  He explained that the right sizing that the Council was going through would ensure the Council was financially sustainable and that would be applied in the same way to Internal Audit and would provide an opportunity to look at the three levels of defence, the management assurance, the oversight and the independent assurance, and could reconfigure the way that worked across the organisation and if the Internal Audit team were confident that the management assurances and oversight provided good information that enabled the authority to understand its control environment without audit coming in and having to tell it, you would not need to spend 20 days doing the audit, you could do it in three. That was what the Council needed to get right as it was not acceptable that the Council had had limited assurances for the last 4 or 5 years.

The Committee wished the minutes to reflect that they had asked the question and that they had been reassured by the Executive Director of Resources (Section 151 Officer) and the Head of Policy and Governance around the whole issue especially around the issue of resizing, so should the Council ever get to the position where there was not enough coverage to provide the year end opinion at least it could be shown that the Audit Committee had raised a concern about it. 

Although reassured, there were still some concerns about the continued limited assurances and the way management were responding to Internal Audit.  A brief discussion ensued.  In response, the Executive Director of Resources (Section 151 Officer) explained that the organisational redesign would have the cultural changes that they would like to see built in however this would take time but, until then, the Audit Committee could ask questions to gain assurance that things were changing across the organisation.

It was agreed that an Action Plan would be brought to the February meeting setting out a clear indication of the plans around Internal Audit although it was reiterated that the structure for the Council would not be known by February.  In that case, it was suggested that a possible additional meeting be arranged prior to the pre-election period to provide an update to the Committee on the structure of Internal Audit, if deemed necessary.  The Executive Director of Resources (Section 151 Officer) reassured the Committee that the audits would not stop in the meantime.

RESOLVED:

To note the performance of Internal Audit against the 2024/25 Audit Plan.

To receive updates on all four unsatisfactory audits and an update on Audit resources at the February meeting.