CONTENTS

3           Background

3           Internal audit progress

4           Follow up 

4           GIAS UK Public Sector self-assessment outcome

6           Appendix A: Internal audit work in 2026/27

8           Appendix B: Current priorities for internal audit work

12         Appendix C: Summary of key issues from finalised audits

15         Appendix D: Assurance audit opinions and finding priorities

16         Appendix E: Follow up of agreed actions

 

 

 

 

 

 

 

 

 

 

 

            

 

 

BACKGROUND

1            Internal audit provides independent and objective assurance and advice about the council’s operations. It helps the organisation to achieve its overall objectives by bringing a systematic, disciplined approach to the evaluation and improvement of the effectiveness of risk management, control, and governance processes.

2            The work of internal audit is governed by the Accounts and Audit Regulations 2015 and relevant professional standards. These include the Global Internal Audit Standards and the Application Note: Global Internal Audit Standards in the UK Public Sector.  

3            In accordance with the Global Internal Audit Standards (UK Public Sector) the Head of Internal Audit is required to report progress against the internal audit plan (the work programme) agreed by the Audit & Governance Committee, and to identify any emerging issues which need to be brought to the attention of the committee. 

4            The internal audit work programme was agreed by this committee in March 2026.

5            Veritau adopts a flexible approach to work programme development and delivery. Work to be undertaken during the year is kept under review to ensure that audit resources are deployed to the areas of greatest risk and importance to the council.

6            The purpose of this report is to update the committee on internal activity up to 16 June 2026, and to outline current plans for delivery over the remainder of the year.

7            Another purpose of this report is to provide the committee with the final outcome from Veritau’s Global Internal Audit Standards (UK Public Sector) conformance self-assessment for 2026, undertaken using CIPFA’s conformance assessment toolkit. 

 

INTERNAL AUDIT PROGRESS

8            A summary of internal audit work currently underway, as well as work finalised in the year to date, is included in appendix A. Appendix A also details other work completed by internal audit during the year.

9            Since our last report to this committee, three audits have been finalised. A further three internal audit engagements have reached draft report stage. These will be finalised over the coming weeks.

10        A total of nine audits are in progress at the time of reporting. A further four audits are at the background planning stage and will be commencing shortly.

11        The 2026/27 work programme, showing current priorities for internal audit work, is shown in appendix B.

12        The three audits that have been finalised since the last report to this committee are included in appendix C. The appendix summarises the key findings from these audits, and includes actions agreed with officers to address identified control weaknesses. The finalised reports in appendix C are also included as exempt annexes to this report.

13        Appendix D provides the definitions for our audit opinions and finding ratings.

 

FOLLOW UP

14        All actions agreed with services as a result of internal audit work are followed up to ensure that issues are addressed. As a result of this work, we are generally satisfied that sufficient progress is being made to address the control weaknesses identified in previous audits.

15        A summary of the current status of follow up activity is included at appendix E.

 

GIAS UK PUBLIC SECTOR: SELF-ASSESSMENT OUTCOME

16        In order to conform to professional standards, the Head of Internal Audit is required to develop and maintain a quality assurance and improvement programme (QAIP). Veritau maintains a QAIP designed to ensure that internal audit work is undertaken in accordance with the Global Internal Audit Standards in the UK Public Sector (GIAS UK Public Sector).

17        In accordance with professional standards, Veritau presented the outcomes from its QAIP as part of the Head of Internal Audit annual report in May 2026. However, at that time, the self-assessment part of the QAIP had not been finalised.

18        The 2026 self-assessment, undertaken using CIPFA’s recently launched conformance assessment toolkit, has now been completed. As anticipated, no areas of non‑conformance were identified.

19        Across the 91 assertions made using the toolkit, only two indicate that Veritau is achieving partial conformance[1]. Both arise from requirements in the Application Note: Global Internal Audit Standards in the UK Public Sector. Specifically, these are the requirements to:

p  promote awareness and support understanding of value for money, including development of evaluation criteria

p  have a methodology in place to risk-assess areas covered by a Topical Requirement[2] and, where required, to perform work in accordance with it.

 

20        Three ‘conformance actions’ have been developed to address the partial conformance identified, as follows:

 

Ref.	Title	Action	Timescale
CA01	Auditing value for money: definition and evaluation criteria	Update the audit manual and create a new appendix which defines value for money, provides example evaluation criteria, and documents an approach to evaluation.	December 2026
CA02	Auditing value for money: training	Develop and provide training to the internal audit service on value for money in the public sector, and on suggested approaches for evaluation.	December 2026
CA03	Managing Topical Requirements	Update the audit manual to include a methodology for how Topical Requirements will be managed, including the rationale for inclusion or exclusion of relevant audits based on an assessment of risk (using the IIA's Topical Requirements Application Guidance to support with design and implementation).	December 2026

 

21        These three actions will be brought into Veritau’s QAIP via the ‘conformance and continuous improvement action plan’.

22        The action plan will also contain a further 24 ‘continuous improvement actions’ arising from domains 2-5 of the Global Internal Audit Standards and the Code of Practice for the Governance of Internal Audit in UK Local Government. All 24 actions are designed to support Veritau’s ability to evidence conformance in areas already assessed as ‘generally conforms’.

23        The conformance and continuous improvement action plan will be owned and delivered by Veritau’s audit management team. We expect that all actions will be completed in time for the 2027 self-assessment.

 

 

 

 

APPENDIX A: INTERNAL AUDIT WORK IN 2026/27

Final reports issued

Audit	Reported to Committee	Opinion
Children and Education local scheme of delegation	May 2026	Reasonable Assurance
Children’s residential care: overtime and procurement cards	May 2026	Reasonable Assurance
Key financials: Westfield Primary	May 2026	Substantial Assurance
Information access request management	May 2026	Reasonable Assurance
Absence management	May 2026	Reasonable Assurance
Travel and subsistence	May 2026	Reasonable Assurance
Home to school transport	July 2026	Substantial Assurance
Flexitime and annual leave	July 2026	Reasonable Assurance
St Mary’s CE Primary School	July 2026	Reasonable Assurance

 

Audits in progress

Audit	Status
Unaccompanied asylum seeker children	In draft
Data quality and security: applications	In draft
Payroll	In draft
Cybersecurity: user account management	In progress
Children’s direct payments	In progress
Section 106 agreements	In progress
Blue Badge applications	In progress
Ordering and creditor payments	In progress
Right to Buy	In progress
All-age commissioning	In progress
Early years provider checks	In progress
School attendance and fixed penalty notices	In progress
Highways maintenance	Planning
Procurement compliance	Planning
Housing management system: data integrity	Planning
Housing safety compliance (fire safety)	Planning

 

Other work completed in 2026/27

Internal audit work has been undertaken in a range of other areas during the year, including those listed below.
Follow up of agreed actions

APPENDIX B: CURRENT AUDIT PRIORITIES
Audit / Engagement		Rationale
Strategic / corporate & cross cutting
Do now
Data quality and security: applications		Provides coverage of more than one key assurance area.
Procurement compliance		Risks / controls are changing. Changes to government policy.
Do next
Contract management: major project delivery (follow-up)		To verify whether issues identified in the previous audit have been resolved.
Savings delivery		Provides coverage of more than one key assurance area.
Purchase cards, online accounts, and petty cash		No recent coverage. Provides broader assurance.
Do later
Procurement forward planning
Contract management
Health surveillance
Corporate complaints
Incident management and business continuity
Building security (West Offices and Hazel Court)
Data quality
Performance management framework
Financial maturity and culture
Financial systems
Do now
Payroll		Key financial system.  Risks / controls are changing.
Ordering and creditor payments		To verify progress made in implementing improvements to control.
Right to Buy		Risks / controls are changing. Changes to government policy.
Do next
Housing rents		Risks / controls are changing.
Do later
Sundry debtors
Council tax and NNDR
Service areas
Do now
Section 106 agreements		Being undertaken at the request of the committee.
Blue Badge applications		Identified in consultation with officers.
Highways maintenance		Risks / controls are changing.
Housing management system: data integrity		Emerging risk area. Provides broader assurance.
Housing safety compliance (fire safety)		No recent coverage. Provides broader assurance.
All-age commissioning		Risks / controls are changing. Provides coverage of a key assurance area.
School attendance and fixed penalty notices		Identified in consultation with officers.
Early years provider checks		Risks / controls are changing due to changes being implemented by the DfE.
Children’s direct payments		Risks / controls are changing.
Unaccompanied asylum seeker children		Emerging risk area.
Do next
Housing safety compliance (gas safety)		Identified in consultation with officers.
Foster carer payments (follow-up)		To verify whether issues identified in the previous audit have been resolved.
Children’s continuing care		Risks / controls are changing. Known area of pressure.
Do later
Building control
Environmental health
Licensing
Homelessness and housing options
Housing allocations
Housing repairs
YorHome (phase 3)
Adult social care strategies
Front door service (adult social care)
Telecare service
High-cost placements
School themed audit: procurement
Huntington School
St Oswald’s CE Primary School
Technical / projects
Do now
Cybersecurity: user account management		Key attack vector. Provides coverage of a key assurance area.
Do next
Cybersecurity: user awareness		Key attack vector. Provides coverage of a key assurance area.
Transformation programme governance		Relates to council priority. Provides broader assurance.
Do later
Database and application security
Cloud and third-party security
Capital programme governance
Highways and transportation capital programme management
Local Net Zero Accelerator (LNZA): City Leap Accelerator Project

 

APPENDIX C: SUMMARY OF KEY ISSUES FROM AUDITS FINALISED SINCE THE LAST REPORT TO THE COMMITTEE

System/area (month issued)	Opinion	Area reviewed	Comments / Issues identified	Management actions agreed
Home to school transport (June 2026)	Substantial Assurance	This audit reviewed the council’s arrangements for coordinating its home to school transport offer.	The council’s home to school transport arrangements are mostly consistent with statutory guidance, with sound policies, procedures, and fair, well-documented decision-making. The service applies policies consistently while considering individual circumstances, and makes effective, value-for-money use of personal travel budgets and travel training services. Some issues were identified, including there being no sustainable travel strategy, a lack of clarity in provider contracts, and weaknesses in the monitoring of passenger journey information.	A sustainable modes of transport strategy will be produced for the academic year 2026-27, in line with statutory requirements. A number of minor amendments will also be made to existing policies. When provider contracts are next due for review/renewal, the service will work with Legal to ensure that contradictory clauses are amended and that monitoring arrangements reflect actual practice. The service will introduce regular route reasonableness testing to limit the risk of larger discrepancies going unnoticed.
Flexitime and annual leave (June 2026)	No Opinion Given	The purpose of this audit was to review the council’s arrangements for managing annual leave and flexitime entitlements.	Annual leave records were consistently available and the correct entitlement had been calculated. However, errors in the recording and calculation of annual leave requests were found in most of the leave cards reviewed. Available guidance lacks clarity on how line managers are expected to demonstrate approval of leave requests and on how to confirm correct utilisation of annual leave entitlement. There is no consistent mechanism in place to ensure flexi sheet records are routinely reviewed and to confirm that flexi leave taken has been approved by the employee’s line manager.	The HR advisory note on annual leave will be updated and reissued to managers, making clear the duty to keep holiday records as per the employment law changes which came into effect from April 2026. Induction materials will be reviewed to guide both employees and line managers to annual leave pages on the intranet and to encourage use of the annual leave calculator to calculate entitlement. The flexi sheet template will be reviewed. This will include ensuring that macros are accurate and work. A HR advisory bulletin will be issued, reminding managers where the flexi time guidance can be found and the need to ensure accurate records are kept, reviewed and authorised when flexi leave is taken which must then be recorded on the leave record sheet.
St Mary’s CE Primary School (June 2026)	Reasonable Assurance	This audit reviewed the governance and financial management arrangements at St Mary’s CE Primary School.	While there were several areas in which controls were in place and generally operating effectively, a number of weaknesses were also identified. These included inconsistent application of purchasing and expenditure controls, an incomplete contract register, lack of a formal asset inventory, inconsistencies in debt recovery processes, outdated policies, no staff register of interests, and incomplete records of governor training.	A number of actions were agreed with management to address the identified control weaknesses.

 

 

 

 

 

 

APPENDIX D: ASSURANCE AUDIT OPINIONS AND FINDING PRIORITIES

Audit opinions
Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on four grades of opinion, as set out below.
Opinion	Assessment of internal control
Substantial assurance	Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified.
Reasonable assurance	Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made.
Limited assurance	Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation.
No assurance	Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse.

 

Finding ratings
Critical	A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management.
Significant	A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management.
Moderate	The system objectives are not exposed to significant risk, but the issue merits attention by management.
Opportunity	There is an opportunity for improvement in efficiency or outcomes but the system objectives are not exposed to risk.

 

APPENDIX E: FOLLOW UP OF AGREED AUDIT ACTIONS

1          Follow up work is carried out through a combination of questionnaires completed by responsible managers, risk assessment, and by further detailed review by the auditors where necessary.

2          Where responsible officers have not taken the action they agreed to, issues are escalated to more senior officers. Ultimately, they may be referred to the Audit & Governance Committee in accordance with the follow-up and escalation procedure. 

3          In figure 1, below, the status of agreed actions from follow-up activity undertaken in the last twelve months is shown[3]. For clarity, the figure shows the results of follow up activity for this period, regardless of when actions were originally due (that is, it includes actions which were due over twelve months ago but which are still being followed up).

4          For completeness, it also shows actions which have been agreed in finalised audits, but which have not yet fallen due and so have not been followed up.

Figure 1: Total agreed actions by current status

5          A total of 116 actions have been followed up in the last twelve months. Of these, 91 have been satisfactorily implemented. 55 actions are not yet due for follow-up as their original implementation date has not passed at the time of reporting.

6          A total of 13 actions have had their original implementation timescale extended, with revised implementation dates being agreed with the action owner. We agree revised dates where the delay in addressing an issue will not lead to unacceptable exposure to risk and where the delays may be unavoidable. However, the committee should be aware that lengthy or continued revised dates do inevitably lead to a degree of risk exposure to the council.

7          Figure 2, below, shows how long dates have been revised from the original implementation date.

Figure 2: Length of revised dates agreed for action implementation

 

8          At the time of reporting, 10 actions are overdue. This is shown in figure 3, on the following page.

 

Figure 3: Length of time actions have been overdue

 

9          For nine of the 10 actions that are overdue we have received a response from officers. In these cases, the process of following up the action and drawing conclusions is ongoing.

10       There will usually be some instances like this at any point in time. It can be due to ongoing communication with the responsible officers to obtain evidence confirming completion of the action. It can also be due to instances where the action taken is not exactly as agreed and further work is being undertaken to assess whether the action taken does satisfactorily address the risk or because there are ongoing discussions about whether to agree revised dates for the action.

11       Four of the 10 overdue actions are currently being escalated with officers. Overdue actions are escalated according to the agreed escalation policy, firstly to relevant directors, then to senior officers via GRAG (Governance, Risk and Assurance Group). They may subsequently be brought to the Audit & Governance Committee. At this stage, no overdue actions are being escalated to the committee.