An Internal Audit View

Welcome to the eighth edition of ‘An Internal Audit View’

In this bulletin we focus on some of the risks and challenges facing the local government sector. Internal

audit remains well placed to help organisations to identify and manage those risks by acting as a critical

friend. Please contact your Head of Audit for further advice.

Contents: Bracing for Brexit 1 Adult Social Care 2 Risk Appetite 5 Managing Austerity 6

Collaborating to improve services

Preparing for Brexit

Whilst the UK’s membership of the EU has now been extend-

ed to 31 October, there is still a need to prepare for Brexit

and, in particular, the risk of a ‘no-deal’ exit. Most organisa-

tions will have completed their Brexit planning by now but the

following questions may help to highlight other areas to con-

sider:

1. Have you taken action to measure the potential impact

of Brexit on your suppliers, and your extended supply

chains? Do you have any suppliers in Ireland who may

be impacted by the proposed ‘backstop’? Will changes

in regulations and border controls slow down the exist-

ing flow of goods and/or services that your organisa-

tion needs? For example, IT equipment, food supplies,

medicines, commercial and confidential waste dispos-

al?

2. Do you have sufficient assurances on the continuity

and viability of your suppliers/partners after Brexit?

3. Do you foresee any procurement advantages/

opportunities arising from Brexit? Are you in a position

to maximise these?

4. Is your procurement activity significantly impacted by

exchange rate volatility? Have you performed any form

of analysis as to the additional costs associated with

potential tariffs and quotas resulting from Brexit – par-

ticularly in the event of a ‘no-deal’ situation?

5. How reliant are you on EU-based businesses or, local

businesses supported by EU funding (for example EU

Local Enterprise Partnership funded organisa-

tions/initiatives)?

6. Is your organisation a potential target for any

large-scale public disorder? Are your disaster

plans updated, and communicated to your em-

ployees at potential target sites?

7. Have you considered how your organisation’s

critical services may be affected by EU employ-

ees leaving their jobs/the UK? Have you con-

sidered the checks you will need to make to

ensure you can evidence your EU employees’

eligibility to work in the UK after Brexit?

8. Have you considered how potential changes in

exchange rates and/or stock market valuations

might affect your pension investments and

costs?

9. Have you considered the possible data protec-

tion implications if your suppliers are pro-

cessing data in the EU?

An Internal Audit View

Some wider implications of Brexit could include:

10. Have you performed any assessment on Brexit’s

potential impact on business rates income? For ex-

ample, do you understand the degree to which your

local economy relies on EU funding and income

from EU based companies to operate? This has

greater significance with the Revenue Support Grant

due to be withdrawn in 2020, with local authorities

being expected to rely on 100% business rate reten-

tion instead. Have you considered the potential in-

crease in customer debt arising from job losses?

11. Are you part of any Central Government Devolution

initiatives? If so, do you foresee this being impacted

by Brexit?

Preparing for Brexit (continued) 12. Have you set up a Brexit Steering Committee/

Steering Group/Panel/Task and Finish Group, or

do you intend to at some point in the future? If so,

to what extent do you foresee a role for Internal

Audit?

13. Have you undertaken scenario planning for Brexit,

including all potential outcomes – including a ‘no-

deal’ situation? Are your Business Continuity Plans

fully up to date?

14. To what extent have you liaised with Central Gov-

ernment and other local authorities in planning for

Brexit? Do you feel you have enough support?

15. Are the above implications identified and reported

to the right level? For example Senior Leadership

Team/Audit Committee? Are the risks captured in

your risk registers?

Complexities in Adult Social Care and Key Risks to Consider

Adult social care is part of a much larger, complex sys-

tem of interrelated public services. In July 2018, the Na-

tional Audit Office (NAO) published a report ‘Adult Social

Care at a glance’. The report helps to illustrate these

complexities (see Figure 1 below).

The provision of effective adult social care relies on how

well each part interacts with each other and the im-

portance of partnership working between adult social

care teams, health, housing, welfare benefit, children’s

and other services which impact on the wellbeing of indi-

viduals.

Some of the key areas of risk that audit teams

need to consider include the following:

Adult care needs are rising with a rapidly growing

ageing population whilst the resources available

to local authorities have been falling year on

year. There is a significant pressure on adult so-

cial care budgets and a continuing trend for local

authorities to overspend due to the volatility of

these demand led budgets;

There are increasing pressures on other parts of

the care and health systems including reductions

in benefits putting pressure on informal carers

and acute health services which may not be sus-

tainable longer term;

As a result of increased financial pressures, local

authorities have been looking at ways to trans-

form services by makings savings through effi-

ciencies and service redesign, including a shift to

prevention and re-ablement services, integrating

services with the NHS e.g. the Better Care Fund

An Internal Audit View 2

and increased digitalisation to improve the ways in

which services can be accessed and delivered.

Another way of delivering savings has been to move

away from providing in-house services. However, this

brings a different set of risks. Local authorities have

been negotiating lower fees and commissioning differ-

ent types of service but this has had an impact on the

financial sustainability of some private providers. This

increases the risk of key providers failing to deliver the

specified services or more significantly, going out of

business.

There are concerns that the market for adult social

care provision is not sufficiently developed to cope

with demand. This, coupled with cost pressures such

as the national minimum wage, pension changes and

National Insurance increases, plus the potential im-

pact that Brexit may have on the social care work-

force, could further impact on the sustainability of the

market.

The transfer of adults between health and social care

services is an area of concern where spending is de-

creasing. The NAO found that there is a link between

greater spending on social care and lower delayed

discharge rates and fewer emergency admissions.

This means a transfer of cost pressures away from the

NHS to local authorities.

The transition between children’s services and adults

also has a significant impact on financial sustainability.

The demand for statutory services is rising, particular-

ly with increasing numbers of young people with com-

plex disabilities transitioning from children’s to adult

services. Often these young adults require specialist

support which cannot be met from within the local

market and have to be procured out of area at high

cost. Transitional adult social services may not always

to suitable for 18-25 year olds. How councils manage

this is key as funding decisions made by children’s

services will impact on adult social care costs where

children transition into adult care.

Complexities in Adult Social Care (continued)

Safeguarding vulnerable adults remains a major

risk and will appear on most local authority corpo-

rate risk registers.

The Care Act makes integration and partnership a

legal requirement for local authorities and on all

agencies working in public care. This includes the

NHS, independent or private sector organisations,

housing and the Care Quality Commission (CQC).

There are many risks around integration but more

generally the overarching risk is that partners fail to

properly integrate and do not meet their statutory

duties. This relies on robust governance arrange-

ments with roles and responsibilities clearly de-

fined. For example, Health and Wellbeing boards

should have formal integrated governance struc-

tures around the commissioning process with joint

Health and Wellbeing Strategies, joint Commis-

sioning Strategies and Local Development plans.

Formally agreed budgets, defined budget respon-

sibilities and robust financial monitoring and con-

trols are also important. The Public Accounts

Committee has said that the success of integra-

tion has been inconsistent across the sector

largely due to legal, structural and cultural barri-

ers with adult social care services often being

excluded from discussions. It is hoped that the

introduction of Sustainability and Transformation

Plans (STPs) will help to ensure better integration

in the future.

STPs are local plans established to improve health

and care across England. The NHS and local councils An Internal Audit View 3

have come together in 44 areas covering all of England

to develop proposals and make improvements to health

and care. These proposals (STPs) are place-based and

are built around the needs of the local population. These

plans are key when looking at the delivery of integrated

services.

Figure 1 shows the complexities of the Adult Social

Care environment and the relationship with other parts of

public sector provision. It is important that audit teams

understand these relationships when considering risks

and scoping audit work.

Where NHS and local authority services are integrated it

can be difficult to determine where responsibility for in-

ternal audit sits. It may be appropriate for example, to

consider joint audit reviews or to procure audit re-

source from one or other of the partners. For example,

an Integrated Care Organisation managed by a Clinical

Commissioning Group (CCG) could request audit re-

source from a local authority team to undertake an au-

dit such as Direct Payments where they have more

knowledge and experience. This would need to be sub-

ject to local agreement and managed within existing

resources. Alternatively, assurance could be placed on

the work undertaken by partners. This relies on closer

working arrangements between the NHS and Councils,

something which has historically not been easy to de-

velop.

4 An Internal Audit View

Figure 1: Adult Care Services and Other Services

(Ref: National Audit Office)

5 An Internal Audit View

Local authorities are now being forced to deliver services

via a work force that is greatly reduced, and which is sub-

sequently comprised of individuals with widening spans of

responsibility. Therefore there is a need for management

to consider the resulting impact on the control environ-

ment and, if necessary, revise the authority’s risk appetite.

Risk appetite can be defined as ‘the amount and type of

risk that an organisation is willing to take in order to meet

its strategic objectives’. However, many authorities strug-

gle to define exactly what their risk appetite is. Many con-

sider it to be something that can change depending on the

nature of individual risks. However, the Institute of Risk

Management argues that an organisation cannot have

multiple risk appetites.

Certainly in the current climate there has been a need for

greater prioritisation, not just of the services that authori-

ties will deliver, but also the amount of resource that can

be utilised. These decisions bring with them the possibility

that controls (especially those that are resource intensive)

may not be operating as designed.

For auditors this situation presents a considerable prob-

lem for how they approach their work. Findings and rec-

ommendations from audit reviews have traditionally result-

ed in more controls being introduced but this approach

now just puts even more pressure on already stretched

systems and processes.

If, as previously stated, local authorities are not comforta-

ble with explicitly defining their risk appetite, then an alter-

native is for them to adopt a more dynamic approach. In

many cases it will fall to internal audit to guide the organi-

sation through this gradual change. This can be done by

promoting an approach to audit work that helps with the

prioritisation of not only coverage but also the outputs

from those reviews that are carried out.

This starts with the compilation of the annual audit plan.

In recent years, internal audit functions have themselves

been subject to budget cuts and this has resulted in au-

dit plans being reduced. Many audit plans now just focus

on the areas of most significant risk. Therefore presenta-

tion of the plan to the Section 151 Officer and the Audit

Committee will need to include a clear justification for

those areas being included and notes on those areas

that are not being covered due to a lack of available re-

sources.

Internal auditors will therefore be providing management

with a professional opinion on whether the decisions

made arising from these consultations effectively repre-

sent a change in the risk appetite; they can then confirm

that management are comfortable with the position.

There will be further adjustments throughout the year as

new areas for coverage are introduced and decisions

made around whether they represent a greater risk to

the achievement of the authority’s objectives than those

areas already featuring in the plan.

As internal audit become familiar with management’s

changing approach to risk in various parts of the organi-

sation, its own approach can align to what the organisa-

tion wants to do and ensure that the exercise of risk

management throughout the organisation is consistent

with the current risk appetite.

Dynamic Risk Appetite

6 An Internal Audit View

Managing Austerity — or playing Jenga?

I was playing Jenga with the family the other night. You

will all know the aim of the game; you need to carefully

remove blocks of wood from a solid stack and then, ever

so carefully, place them on the top of the pile making the

tower ever bigger.

For some reason the stack of blocks started to appear to

me as a visual interpretation of local government before

the financial crisis; it was solid, well built, able to with-

stand a few knocks, but certainly not carrying any excess

fat.

At home we started to remove various blocks. It was my

turn; I looked for a block that I could ‘safely’ remove, and

used this ‘freed resource’ to build our tower a little higher.

As we started to remove various blocks I could not help

but think that there were further parallels with what we in

local government have done; we have been charged with

making savings and have looked for the blocks that we

could ‘safely’ remove. However, any ‘freed up funding’

has been used to meet the growing demands placed on

services (in particularly with regards social care) and so

the money is used to provide extra resource and build the

local authority tower ‘that little bit higher’.

As the game progressed it became harder and harder to

find a block that was easy to move; you could see that

just by very carefully nudging some blocks the effect was

to wobble the whole tower. It was my go and I finally

found a block that looked like it would come out; I eased it

out with a sense of relief and then, oh so carefully, I

placed it on the top of the tower, which was now leaning

at quite an alarming angle. I had succeeded in what I had

to do… but now it was someone else’s turn.

With local government we all know that the ‘easy blocks’,

the ‘low hanging fruit’ whatever you like to call it, has

gone, and have been used to build our towers higher.

We now need to look at the harder blocks, but I think we

can all start to see that this tower is not as solid or sturdy

as it used to be. Additionally, the new bits we have built

do not look as sound as what we previously had

(investments in retail; creation of outsource models;

transformation projects that may not deliver as expected)

and these new bits are not underpinned by the same sol-

id structure (governance?) that we once had.

We have taken more and more resource from back office

functions (finance, HR, CT), resulting in some of these

are starting to look very wobbly; we have then placed

more on top of our tower and asked these slimmed down

functions to support the new initiatives as well as the old.

The new initiatives often require new skills and new ap-

proaches, but I am not sure we have fully invested and

trained our remaining staff to fully meet these new chal-

lenges. New challenges have come in (GDPR, Home-

lessness Act etc) but we have expected our teams to

pick these issues up with little additional capacity being

provided.

Our tower was now very wobbly, and at this point I acci-

dentally nudged the table on which the tower was stand-

ing with my knee – we all held our breath as the tower

visibly wobbled. Clearly this ‘outside influence’ would

have had little impact on our original structure, but now

that so many blocks had been removed, and so many

new things added, the impact was very noticeable. I

7 An Internal Audit View

Managing Austerity — or playing Jenga? (continued)

started to think how our local government tower reacts to

outside influences and can it withstand them? Such influ-

ences are difficult to manage (extreme weather, flu epi-

demic, fraud, Brexit, economic downturn, etc.) but in the

past out towers were resilient and could absorb a few

shocks – I am not so sure that is true today.

When playing Jenga it is inevitable that the tower will fall

at some stage – that is the aim of the game – has North-

amptonshire been the first local government tower to fall

to the ground?

I started to think about our own tower; could we fix it,

make it stronger? If someone new came in to ‘manage’

our tower, could they do it successfully? Our tower looked

really difficult to fix – adding in new blocks where the old

ones had been removed could cause a whole new set of

problems – possibly it was beyond repair!

If local government were to be given more resources

could the towers be made more stable?, I feel the expec-

tation will be to continue to build towers higher, providing

more front line services for the citizens in the area, rather

than support the foundations that appear to be creaking. If

that is the case then there is a risk that any new money

could actually cause more challenges, unless a suitable

element is added back in to the ‘core’ support services

(governance, finance, risk management, etc).

We all know that Northamptonshire’s tower could not be

fixed; core blocks, (governance, finance etc) were con-

sidered ‘too broken’ and that is why two new towers

(unitaries) are being built – but building new towers

takes time, and we must learn from what previously did

not go well.

When looking at the Jenga/local government tower

there are various ‘levels’. It feels as though there is an

‘assurance’ level, which is probably towards the bottom

of the tower and forms part of the solid base. This as-

surance level consists of risk management, internal au-

dit, external audit and a few other teams; the three origi-

nal blocks on this level are at least now down to two

and, in some organisations, down to one. We are being

asked to provide assurance that all the other levels in

the tower (service areas/directorates) are effective, effi-

cient, free from risk and error etc., but we know that this

is not always the case. Managers are expected to know

their risks, ensure that these are within the organisa-

tion’s appetite and to manage them effectively – but the

whole tower now feels so much more shaky. Added to

this is the thought that failure at any one level could

bring the whole tower down, with possible examples

being a poor Ofsted review, poor budgetary control, or a

cyber attack; failure in these ‘levels’ could result in total

collapse.

Internal audit cannot fix the local authority tower, but it

can help in identifying those areas under the most pres-

sure. It is not our role to ‘predict failure’ but we can help

managers identify, understand and manage risks and

help our wobbly towers stand for as long as possible.

By Robert Hutchins

Contact details

The group meets quarterly and we circulate periodic bulletins to our partner organisations with the aim of

sharing information and best practice.

We hope that you find the bulletins useful. If you have any comments or feedback on this bulletin or have

suggestions for future articles then please contact one of the individuals above.

Collaborating to improve services An Internal Audit View

Gerry Cox

Chief Executive

South West Audit Partnership

01935 848540

gerry.cox@swapaudit.co.uk

Neil Pitman

Head of Partnership

Southern Audit Partnership

01962 845139

neil.pitman@hants.gov.uk

Russell Banks

Chief Internal Auditor

Orbis

01273 481447

russell.banks@eastsussex.gov.uk

Robert Hutchins

Head of Partnership

Devon Audit Partnership

01392 383000

robert.hutchins@devonaudit.gov.uk

Max Thomas

Director and Head of Internal Audit

Veritau

01904 552940

max.thomas@veritau.co.uk

Richard Boneham

Head of Audit Partnership

Central Midlands Audit Partnership

01332 643280

richard.boneham@

centralmidlandsaudit.co.uk

Chris Wood

Head of Shared Internal Audit

Service, Hertfordshire Shared

Internal Audit Services

01438 845513

chrisp.wood@hertfordshire.gov.uk

Alix Wilson

Head of the South West London

Audit Partnership

020 8891 7291

alix.wilson@richmond.gov.uk