Audit - 20140304 - Agenda5 - Final KPMG Internal Audit Report - Regulatory Compliance Feb 2014
Audit - 20140304 - Agenda5 - Final KPMG Internal Audit Report - Regulatory Compliance Feb 2014
Both Authorities make full use of HMRC and Pension Fund information and guidance to ensure compliance with all relevant regulations. Recent
changes in regulation include real time information (“RTI”) payroll reporting to HMRC and auto-enrolment to the pension scheme. RTI reporting
to HMRC was successfully implemented from 1 April 2013, and auto-enrolment is due to be implemented from May 2014.
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 2
Use of this report is RESTRICTED - see Notice on contents page.
Introduction and background (continued)
Conservation
The Environmental Assessment (Scotland) Act (2005) requires all Scottish public bodies to assess, consult and monitor the likely impacts of their
plans, programmes and strategies on the environment. This is known as strategic environment assessment (“SEA”) and is in line with European
Directive 2001/42/EC (the “SEA directive”).
This requires the Authorities to assess whether there is an environmental impact of each of their plans or strategies. If an environmental impact
is likely then it is necessary to complete an SEA and to submit this to the Scottish Government. As part of this process the Authorities are
required to list all relevant legislation which has been considered through the SEA process.
Governance
Board members at both Authorities are required to complete an annual declaration of interests and this is a standing item at all board meetings.
Compliance with the Freedom of Information (Scotland) Act 2002 is monitored on a monthly basis and is reported to the board.
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 3
Use of this report is RESTRICTED - see Notice on contents page.
Key findings and recommendations
LL&TNPA The findings identified during the course of this internal audit are summarised below. A full list of the findings and recommendations are included
in the report. Management has accepted the findings and agreed reasonable actions to address the recommendation.
We identified a number of
areas of good practice Authority Critical High Moderate Low
through the course of our
Number of internal audit findings LL&TNPA - - - -
review but have not raised
CNPA - 1 2 1
any recommendations.
Number of recommendations accepted by LL&TNPA - - - -
CNPA
management
We identified four ‘high’
CNPA - 1 2 1
graded recommendations,
one ‘moderate’ graded
Classification of internal audit findings is provided in appendix two.
recommendation and two
‘low’ risk rated
recommendations .
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 4
Use of this report is RESTRICTED - see Notice on contents page.
Summary of internal audit findings - LL&TNPA
Health and safety (“H&S”) audits are carried out annually to consider all health and safety policies and practices. The audits also include site
visits to ensure practical compliance with policies and practices at all sites, including head office. Action plans for each site are developed and
distributed to communicate the results and recommendations from the audits. These are then followed up by the H&S officer to ensure that the
required actions have been addressed.
We reviewed the latest audit report which was carried out by GTG and the relevant site action plans. Five of the nine sites had addressed all of
the recommendations fully or were in the process of doing so. Three sites had actions outstanding. These included one medium-term action (1-
3 months), and one long-term action (3-6 months). We discussed the outstanding actions with the H&S officer to ensure that these would
continue to be monitored. The ninth site is due to close in 2014, therefore the audit actions are no longer applicable.
We found that there were processes to identify new or evolving regulations and good communication between staff to share this information
when identified. We performed a walkthrough to gain evidence that this process was operating effectively and viewed information received from
various news feeds received by the research and performance officer.
A walkthrough of a new area of case law was also performed. We viewed all email correspondence in relation to the case of Tracey Kennedy v
Cordia (Services) LLP and the resulting policy which was developed as a result of this case law. We found that the response to the change in
case law appeared timely, appropriate and adequately communicated to all staff.
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 5
Use of this report is RESTRICTED - see Notice on contents page.
Summary of internal audit findings - CNPA
The LL&TNPA H&S officer carries out a H&S audit of CNPA sites. We reviewed the most recent audit report carried out in May 2012 and
checked progress against these recommendations. The majority of the audit action points have been completed or are in progress; however
these should have been implemented within 12 months of the audit. These audits are not regularly scheduled, therefore, there is a risk that non-
compliance could develop and not be identified if regular audits are not carried out. There is also no follow-up process which adds to the risk of
non-compliance. CNPA should consider formalising the H&S audit process to ensure that it is completed annually, by either LL&TNPA or an
external party.
Recommendation one
Employees receive a copy of the H&S policy when commencing their employment with CNPA, which they are expected to read and understand.
To confirm this, and to protect CNPA from potential litigation issues, the employee should sign / date to confirm that they have read and
understood the H&S guidelines. This would also give them further opportunity to discuss any issues with HR.
Recommendation two
At present, CNPA are consulted by LL&TNPA on issues highlighted by the British Safety Council (“BSC”). CNPA should consider having their
own subscription to the BSC to ensure that they receive important updates and opportunities to purchase online training directly as their priorities
are different from those at LL&TNPA. Membership of the BSC may also develop the internal H&S staff, allowing them to provide more internal
training and to raise awareness of H&S issues.
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 6
Use of this report is RESTRICTED - see Notice on contents page.
Summary of internal audit findings - CNPA
Various news / information feeds are also received by the relevant departments at both LL&TNPA and CNPA, including the ‘newsdirect’ feed.
We discussed the case of Tracey Kennedy v Cordia (Services) LLP and found that CNPA had been alerted to this case law by LL&TNPA as
opposed to their internal processes. Furthermore, to date CNPA had not taken any action on this case law. There is a risk that new legislation /
case law is not being identified or actioned appropriately at CNPA creating a risk of non-compliance.
Recommendation three
There is no formal structure for regular review of policies and procedures across the organisation. There is a risk that policies and procedures
are not compliant with current legislation / regulations. An annual review of policies and procedures across the Authority would reduce the risk of
not complying with legislation and ensure that suitable policies were in place for each department.
Recommendation four
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 7
Use of this report is RESTRICTED - see Notice on contents page.
Action plan - CNPA
The action plan summarises Findings and risk Recommendations Agreed management actions
specific recommendations,
1 Health and safety audits High
together with related risks
and management’s Health and safety audits are carried out for CNPA Arrangements should be made to ensure that Agreed. We accept there has been some hiatus in
by the LL&TNPA H&S officer, however, these are H&S audits are carried out regularly. H&S audit arrangements over the last year as a
responses.
not regularly scheduled. The most recent audit result of a combination of an extended absence in
The results of the H&S audits should be
was carried out in May 2012 and there are still cover of the shared H&S advisor post and also
addressed within 12 months. A follow-up process
some recommendations which have not been fully pressures from internal structural change at
should be implemented to ensure that progress
addressed. CNPA. Agree that follow up on H&S matters will be
towards meeting audit recommendations is
undertaken as a matter of urgency, and implement
There is a risk that that audits are not carried out monitored.
arrangements to ensure regular H&S audits take
sufficiently regularly and that recommendations
place.
are not addressed in a timely manner.
Responsible officer: Director of Corporate
Services
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 8
Use of this report is RESTRICTED - see Notice on contents page.
Action plan – CNPA (continued)
New employees receive a copy of the H&S policy Management should implement a formal process To some extent, the requirement to have staff to
which they are expected to read. However, there for employees to confirm that they have read and sign off that they have read certain policies is
is no formal confirmation in place to confirm that understood the H&S policy. This could be somewhat counter to organisational culture of trust
the employee has read and understood this combined with other policies. and staff taking responsibility. We do accept that
policy. Implementing a formal sign off of the H&S having a formal sign off from staff does add an
policy would help to protect CNPA from risks of additional level of assurance - we will consider the
potential litigation. implementation of this sign off for key policies such
as H&S where there is clear dual benefit for both
staff and the organisation to confirm that there is
general awareness of policy.
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 9
Use of this report is RESTRICTED - see Notice on contents page.
Action plan – CNPA (continued)
We found a control deficiency in relation to the Management should review the process to identify Agreed.
identification and communication of new case law. and action new case law to ensure effectiveness
Responsible officer: Director of Corporate
and efficiency.
Furthermore, our walkthrough of the action taken Services
in relation to Tracey Kennedy v Cordia (Services)
Implementation date: March 2015
LLP found that no action had been taken to
ensure that CNPA were compliant with the new
legislation, despite this case being highlighted by
LL&TNPA as requiring action.
There is no formal structure in place for regular Policies and procedures should be subject to a Agreed.
review of policies and procedures across the formal annual review to ensure they remain
Responsible officer: Director of Corporate
Authority. compliant with current legislation.
Services
It is best practice to review policies and
Implementation date: March 2015
procedures in relation to compliance and
regulations annually to ensure that policies and
procedures remain up to date.
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 10
Use of this report is RESTRICTED - see Notice on contents page.
Appendices
Appendix one
Objective, scope and approach
In accordance with the 2011-12 to 2013-14 strategic internal audit plan for Loch Lomond & The Trossachs National Park Authority and
Cairngorms National Park Authority (“the Authorities”), we will undertake an internal audit review of regulatory compliance.
Objective
The Authorities must comply with various regulatory requirements which range from general health and safety regulations to impacting on
operational matters, such as various areas of legislation specific to the Authorities. There are a number of risks associated with regulatory
compliance including:
■ ensuring all relevant regulations (including changes to existing regulations) are identified; and
■ ensuring management and staff are aware of such regulations to ensure the Authority is able to comply with them.
Scope
■ review processes for disseminating information on regulatory requirements and any related training or certification; and
Approach
■ conduct interviews with staff to gain an understanding of the Authorities’ processes and procedures in relation to regulatory compliance;
■ review the adequacy and effectiveness of key processes through sample testing and discussion; and
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 12
Use of this report is RESTRICTED - see Notice on contents page.
Appendix two
Classification of internal audit findings
The following framework for internal audit ratings has been developed and agreed with management for prioritising internal audit findings
according to their relative significance depending on their impact to the process.
Critical Issue represents a ■ Potential financial impact of more than 1% of total ■ Requires immediate notification to the
control weakness, expenditure. Authority’s audit committee.
which could cause or
■ Detrimental impact on operations or functions. ■ Requires executive management attention.
is causing severe
disruption of the ■ Sustained, serious loss in brand value. ■ Requires interim action within 7-10 days,
process or severe followed by a detailed plan of action to be put in
■ Going concern of the organisation becomes an issue.
adverse effect on place within 30 days with an expected resolution
the ability to achieve ■ Decrease in the public’s confidence in the Authority. date and a substantial improvement within 90
process objectives. days.
■ Serious decline in service/product delivery, value and/or
quality recognised by stakeholders and customers. ■ Separately reported to chairman of the
Authority’s audit committee and executive
■ Contractual non-compliance or breach of legislation or
summary of report.
regulation with litigation or prosecution and/or penalty.
■ Life threatening.
High Issue represents a ■ Potential financial impact of 0.5% to 1% of total expenditure. ■ Requires prompt management action.
control weakness,
■ Major impact on operations or functions. ■ Requires executive management attention.
which could have or
is having major ■ Serious diminution in brand value. ■ Requires a detailed plan of action to be put in
adverse effect on place within 60 days with an expected resolution
■ Probable decrease in the public’s confidence in the Authority.
the ability to achieve date and a substantial improvement within 3-6
process objectives. ■ Major decline in service/product delivery, value and/or quality months.
recognised by stakeholders and customers.
■ Reported in executive summary of report.
■ Contractual non-compliance or breach of legislation or
regulation with probable litigation or prosecution and/or
penalty.
■ Extensive injuries.
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 13
Use of this report is RESTRICTED - see Notice on contents page.
Appendix two
Classification of internal audit findings (continued)
Moderate Issue represents a ■ Potential financial impact of 0.1% to 0.5% of total expenditure. ■ Requires short-term management action.
control weakness,
■ Moderate impact on operations or functions. ■ Requires general management attention.
which could have or
is having significant ■ Brand value will be affected in the short-term. ■ Requires a detailed plan of action to be put in
adverse effect on place within 90 days with an expected resolution
■ Possible decrease in the public’s confidence in the Authority.
the ability to achieve date and a substantial improvement within 6-9
process objectives. ■ Moderate decline in service/product delivery, value and/or months.
quality recognised by stakeholders and customers.
■ Reported in executive summary of report.
■ Contractual non-compliance or breach of legislation or
regulation with threat of litigation or prosecution and/or penalty.
Low Issue represents a ■ Potential financial impact of less than 0.1%*of total ■ Requires management action within a
minor control expenditure. reasonable time period.
weakness, with
■ Minor impact on internal business only. ■ Requires process manager attention.
minimal but
reportable impact on ■ Minor potential impact on brand value. ■ Timeframe for action is subject to competing
the ability to achieve priorities and cost/benefit analysis, eg. 9-12
■ Should not decrease the public’s confidence in the Authority.
process objectives. months.
■ Minimal decline in service/product delivery, value and/or
■ Reported in detailed findings in report.
quality recognised by stakeholders and customers.
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. 14
Use of this report is RESTRICTED - see Notice on contents page.
© 2014 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG
Europe LLP and a member firm of the KPMG network of independent member
firms affiliated with KPMG International Cooperative, a Swiss entity. All rights
reserved. Use of this report is RESTRICTED - see Notice on contents page.
The KPMG name, logo and “cutting through complexity” are registered
trademarks or trademarks of KPMG International.