HBC Quarter 1 2026-27 Progress Report Appendix A

Noted · Received for information; no decision followed.

A follow-up audit of Payroll received a Reasonable Assurance opinion, an improvement on the Partial Assurance opinion given in the previous audit. p7p8

An audit of User Access Management for the Council's Unit4 system received a Partial Assurance opinion, citing control weaknesses including an inconsistent framework for requesting, approving and managing system access. p19p20

A follow-up audit of Officer Declarations of Interest and Gifts & Hospitality received a Reasonable Assurance opinion, up from a Minimal Assurance opinion issued in October 2025. p25p27

No amendments to the Internal Audit Plan were required during the reporting period. p35

Progress on the Internal Audit Plan stood at 9.1% completion to draft report stage against a 90% target, and 60% of high-risk management actions arising from audit findings had been implemented against a 95% target. p41p46

Show the 9 passages this is based on

• p71.3 An audit of Payroll was completed during the 2023/24 financial year, and we provided an audit opinion of Partial Assurance. As part of our planned work for 2025/26, we agreed with management to undertake a follow-up review. This audit sought to provide assurance on the progress made in implementing the agreed actions from the previous review.
• p81.4 We have been able to provide Reasonable Assurance in respect of the Payroll Follow-Up audit, due to several areas where actions have been implemented, and these have strengthened parts of the payroll process.
• p191.12 We have provided Partial Assurance because, although day-to-day ERP access management arrangements are generally operating and improvements are being developed, a number of important control weaknesses remain.
• p201.12 The Council has documented processes for creating new employee records. However, there is no clear and consistently applied framework for requesting, approving and managing system access. Roles and responsibilities are not always clearly defined, and access decisions can be reliant on individual judgement rather than a standardised process. This increases the risk of inconsistent access management and excessive permissions being granted.
• p251.16 Following the Minimal Assurance opinion issued in October 2025, this area was revisited as a follow-up audit. While commissioned as a follow-up review, the audit involved a full reassessment of the arrangements for managing officer declarations of interest and gifts and hospitality, providing an updated opinion on the adequacy and effectiveness of the control framework in place.
• p271.18 We were able to provide Reasonable Assurance in respect of Officer Declaration and Gifts & Hospitality.
• p352.2 No amendments to the plan have been required during the reporting period.
• p41Productivity and process efficiency Audit Plan – completion to draft report stage 90% R 9.1% Compliance with Global Internal Audit Standards complied with Conforms G April 2025 - Self Assessment against the Global Internal Audit Standards (GIAS) completed. No
• p463.4 The following Key Performance Indicators are not wholly owned by Internal Audit, but demonstrate improvement in the internal control framework, as influenced by Internal Audit: Aspect of Service Orbis IA KPI Target RAG* Score Actual Performance Outcome and degree of influence Implementation of management actions agreed in response to audit findings 95% for high risk agreed actions R 60%