Minutes:
The HoA noted that the Council operated a risk-based internal audit plan and the plan was subject to amendment where the risks changed. Eight of the forty one audits were completed, defined as being at the draft report stage, and the rate of completion was 20%, which was less than the 25% target.
One report was rated ‘limited assurance’ and this related to CCTV operation as there were no contracts in place, meaning that it would not have been clear who, between the Council and the suppliers, would be liable if there was a dispute. This had since been addressed with a wider review of CCTV operations and a new contract was due to start in the summer.
In relation to the progress of the implementation of audit findings, the report highlighted incidences where this had not been completed by the due date. The HoA cited information security and explained this had been paused owing to the Government undertaking a consultation on GDPR and the Council would wait until the Government published its conclusions.
Regarding tenants and leaseholder payment requirements, these remained outstanding. There was a wider Council project around debt recovery and service charges, and this action was incorporated into that wider remit.
The Open Housing System was initially highlighted as ‘limited assurance,’; however, all required actions had been implemented and the HoA was awaiting corroborating evidence of the business continuity and disaster recovery testing.
In response to questioning from the Committee, the HoA confirmed that school audits were still being carried out by Mazars. However, the HoA disclosed that a review was being carried out on how to conduct such audits going forward and that there was a case for bringing School Audits in-house.
The HoA elaborated on the transition from a cyclical audit approach, where every school was audited on a three yearly basis, to a risk-based one. The HoA explained that the risk-based approach was more flexible since it was partly based on Ofsted reports. The HoA also noted that some schools had managerial stability in relation to staff turnover, whilst others did not. The HoA noted that, where there were teaching problems, these were usually accompanied by administration issues. The risk-based approach enabled auditors to focus on where there were issues. However, the HoA assured the Committee that schools would be audited at least once every three years, as the risk-based approach took into account the amount of time that had passed since a school had been audited.
The internal audit team was being expanded and the HoA noted that as school audits were an audit of a whole business area, since it involved audits of human resources, administration and finance etc., that this would assist the Internal Audit Team’s development of its own audit capabilities. However, the review was still ongoing and no proposals had been finalised.
Following further questioning, the HoA elaborated on how internal audit dealt with managers and directors when they requested extensions to deadlines. Extensions would be granted only if a good reason was given for the extension request and adequate compensatory controls were implemented during the extension period.
The Committee noted the report.