REPORT for Scottish Government Internal Audit
Total Page:16
File Type:pdf, Size:1020Kb
Agenda No. 10a Annual Assurance Report Scottish Fire and Rescue Service 2018-19 Audit and Risk Assurance Committee - 26/06/2019 Internal Audit Report Issue Date: 14-06-2019 NOT PROTECTIVELY MARKED Paper no: C/ARAC/22-19 Meeting date: 26 June 2018 Agenda item: 10a Title: SCOTTISH FIRE AND RESCUE SERVICE (SFRS): ANNUAL ASSURANCE REPORT 2018/19 1. Purpose 1.1. For information and comment. 2. Key Messages 2.1. Reasonable assurance provided on risk management, control and governance arrangements. 2.2. Six of seven assignments in revised 2018-19 Internal Audit Plan completed. 2.3. 100% of recommendations accepted. 2.4. External Quality Assessment of IA by Institute of Internal Auditors confirms IA conforms to the Institute’s professional standards. 2.5. Overview of IA by Audit Scotland confirms no areas of significant non-compliance against standards. 3. Action Required 3.1. Members are invited to comment on and note the 2018-19 assurance opinion and Internal Audit’s performance for that reporting period. Jim Montgomery Gary Gibb Senior Internal Audit Manager Internal Audit Manager Audit&RiskAssuranceCommittee/Report/ Page 2 of 13 Version: 1.0 14/06/2019 AnnualAssuranceReport2018-19 NOT PROTECTIVELY MARKED 4. Introduction 4.1. This report summarises internal audit work relating to SFRS during 2018-19 and provides our overall assurance opinion on its risk management, control and governance arrangements during the year. It also summarises Scottish Government Internal Audit’s (IA) performance during the period. The report helped form the basis of a general report on our work which will be considered by the Scottish Government Assurance and Audit Committee (SGAAC) on 24 June 2019. 5. Overall Opinion 5.1. Our work was undertaken in accordance with UK Public Sector Internal Audit Standards (PSIAS), the Institute of Internal Auditors (IIA) International Professional Practices Framework (IPPF) , and with the standards set out in the Scottish Public Finance Manual (SPFM). These standards require us to provide an objective opinion supported by sufficient, reliable and relevant evidence. 5.2. Our framework for assessing assignment and overall assurance opinions is set out at Annex 1. After carefully considering all of the evidence, we have provided “reasonable” assurance for 2018-19, which means in general terms that controls were adequate but require improvement. The opinion continues to reflect SFRS’s development and while there has been good progress in many areas, there is a continuing need to focus upon the efficient and effective implementation of the developed frameworks, policies and procedures. 6. Rationale for Opinion 6.1. In arriving at our opinion, we relied primarily on the results of our direct work, taking into consideration the nature of our main internal audit assignments (assurance and advisory), their significance to the risk environment and their significance relative to each other (Annex 2 refers). Our direct work also included follow-up of 26 recommendations from 2017-18 audit reviews, with the results of these detailed at Annex 3. We also continue to monitor and report to the ARAC upon progress with the implementation of other remaining recommendations. 6.2. In line with the principles of integrated assurance, we also took account of the following when arriving at our overall assurance opinion: • Competency, skill set and general approach of the Audit and Risk Assurance Committee in conducting its corporate governance role. • Attitude towards, and engagement of senior management in risk management, control and governance arrangements. • The risk maturity of the organisation. • Corporate governance documents. • Outcomes from thematic inspections by HM Fire Service Inspectorate: Operational Risk Information (Feb 2019) and Fleet and Equipment Management (May 2019). • External Audit reviews and management responses to these. • Approach to prevention, detection and management of fraud. 6.3. Finally, we framed our overall assurance opinion in the context of our cumulative knowledge of SFRS’s control environment. Audit&RiskAssuranceCommittee/Report/ Page 3 of 13 Version: 1.0 14/06/2019 AnnualAssuranceReport2018-19 NOT PROTECTIVELY MARKED Fraud 6.4. IA is a permanent member of the SG Counter Fraud Group (CFG), whose primary purpose is to lead on the implementation of effective counter fraud policy across SG. The CFG also monitors relevant cases of suspected internal and external fraud that are reported to the SG Fraud Response Team (FRT) though formal reporting lines. We are therefore party to information regarding instances of reported fraud and we are sometimes commissioned to carry out work on the CFG’s behalf. SFRS’s internal audit staff are responsible for monitoring the SFRS Fraud Response Plan. There were no instances of potential fraudulent activity during 2018-19. 7. IA Performance 7.1. IA’s performance is subject to monitoring in various ways. Our annual Internal Quality Assessment concluded that we generally conform to PSIAS. We commissioned the Chartered Institute of Internal Auditors (IIA) to undertake an External Quality Assessment (EQA) against PSIAS, which is required every five years. The report is attached and confirms that IA conforms to the IIA’s professional standards. Audit Scotland’s 2018-19 Overview Report of IA is also attached and confirms that Audit Scotland did not find any areas of significant non-compliance with PSIAS. Our 2018-19 Annual Report is due to be considered by the Scottish Government Audit and Assurance Committee on 24 June 2019 and will be issued via correspondence to the ARAC thereafter. 8. Conclusion 8.1. Members are invited to comment on and note the assurance opinion for 2018-19 and IA’s performance for that reporting period. Audit&RiskAssuranceCommittee/Report/ Page 4 of 13 Version: 1.0 14/06/2019 AnnualAssuranceReport2018-19 NOT PROTECTIVELY MARKED Annex 1 Definition of Assurance and Recommendation Categories Assurance Risk, governance and control procedures are effective in Substantial Assurance supporting the delivery of any related objectives. Any Controls are robust and exposure to potential weakness is low and the materiality well managed of any consequent risk is negligible. Reasonable Assurance Some improvements are required to enhance the adequacy and effectiveness of procedures. There are Controls are adequate but weaknesses in the risk, governance and/or control require improvement procedures in place but not of a significant nature. Limited Assurance There are weaknesses in the current risk, governance and/or control procedures that either do, or could, affect Controls are developing the delivery of any related objectives. Exposure to the but weak weaknesses identified is moderate and being mitigated. Insufficient Assurance There are significant weaknesses in the current risk, governance and/or control procedures, to the extent that Controls are not acceptable the delivery of objectives is at risk. Exposure to the and have notable weaknesses identified is sizeable and requires urgent weaknesses mitigating action. Recommendations High Serious risk exposure or weakness requiring urgent consideration. Medium Moderate risk exposure or weakness with need to improve related controls. Low Relatively minor or housekeeping issue. Audit&RiskAssuranceCommittee/Report/ Page 5 of 13 Version: 1.0 14/06/2019 AnnualAssuranceReport2018-19 NOT PROTECTIVELY MARKED Annex B Audit Area Comments Information Governance – GDPR We split this review into two parts, to enable us to assess the preparedness for and compliance with GDPR. Final Report Issued: 30/08/2018 Assurance: Reasonable We found that: Recommendations: 0 High, 6 Medium and 2 Low • Direct oversight of the progress of actions in relation to GDPR is by an Information Governance Group chaired by the Head of Corporate Governance and directly accountable to the Corporate Assurance Board. • A GDPR Working Group in place with an approved Terms of Reference. Information Governance – GDPR Implementation • Compliance with the legal requirement of privacy by design has required SFRS to undertake Privacy Impact Assessments and Data Protection Final Report Issued: 18/03/2019 Impact Assessments. Assurance: Substantial • There is an appropriate suite of policies, procedures and guidance notes in Recommendations: 0 High, 1 Medium and 1 Low place to ensure that SFRS is compliant with GDPR. • Appropriate data management processes are in place. • Revised terms based on the Scottish Government’s guidelines for public Responsible Director sector organisations, to bring contracts in accordance with GDPR have Strategic Planning, Performance and Communications been issued to contracted suppliers with a request to accept the terms. • A mandatory assessable e-learning module on Data Protection and Information Security for all SFRS personnel to raise awareness of GDPR and Information Security was launched in February 2019. • There is an overarching information security handbook for SFRS that all staff are required to confirm that they have read as part of the mandatory e-learning training. • A Data Protection Officer has been appointed • Ongoing ownership and updating of the Information Asset Register as a business as usual process requires to be agreed. Audit&RiskAssuranceCommittee/Report/ Page 6 of 13 Version: 1.0 14/06/2019 AnnualAssuranceReport2018-19 NOT PROTECTIVELY MARKED Audit Area Comments Corporate Governance –Committees and Executive We found: Boards • SFRS has an established formal governance route in place for executive Final Report Issued: