Chamber and committees

FY 21/22

Audit Title

Recommendation(s)

Firearms Policy and Practice

(Limited Assurance)

1. Given the potential risks i.e. inequality across staff members, health and associated safety concerns, we would recommend that the use of firearms is subject to the full requirements of the Firearms Act 1968 (i.e. requirement of a Police Firearms Licence which will be subject to renewal in line with the Act, currently every five years, requiring their access to GP records) for all current and future firearm holders.

2. A formal delegation should be in place from the CEO to any officers responsible for authorising the use of firearms within the organisation.

3. Management should create and implement a robust mechanism for recording home security inspection outcomes (e.g. a checklist outlining all storage and safety requirements). This would ensure all storage provisions have been consistently reviewed and provide a higher level of assurance to Management that firearms are being stored appropriately.

4. Management should implement a system for the monitoring of shotguns held within local offices i.e. sign in/out. This would ensure that possession of shotguns is documented and a transparent audit trail in place.

5. Management should implement risk assessments for all current and future firearm holders. These should be conducted on an annual basis, requiring input from Line Managers as well as third party assurance (i.e. from HR professionals), review of intelligence gathered over past year i.e. proficiency tests, accidents, near misses, home security checks, audit results etc. This would ensure that authority to use firearms is regularly reviewed and only continues after a robust risk-based assessment.

6. Any checks carried out in regard to reasonable equipment use (i.e. ammunition use) should be evidenced and reported. This should be outlined within the new SOP or related guidance.

7. Management should improve the guidance and monitoring surrounding mandatory checks, for example:

(a) Documentation requirements should be clear to all staff i.e. a checklist tool requiring sign off for different responsibilities. Subject to implementation of Recommendation 1, inclusion of Police Firearm/Shotgun Licence renewals.

(b) Possession and transfer of firearms should be documented and transparent at all times, including when being disposed of.

(c) Evidenced assurance should be sought that each staff member using a firearm has up-to-date proficiency checks and that these are retained in the correct files with the correct documentation going forward.

(d) Consideration of development of the National Firearms Register should be explored to enhance monitoring and allow periodic checks.

Self-billing

(Limited Assurance)

1. To ensure there is clear, consistent policies and processes in place, Management should:

• Establish a formal plan, timescales, and related training to finalise draft policies and guidance.
• Ensure that the new Policy provides a robust overview of roles, responsibilities, and accountabilities.
• Establish robust procedure or guidance related to debt management, monitoring, escalation routes and write off procedures. These should align to Scottish Public Finance Manual (SPFM) guidance and the FLS Framework Document (i.e. organisational write-off delegations of up to £300,000 and any further internal delegations).
• Document procedures/criteria for new and existing customers wishing to enter into a self-billing arrangement. This should be communicated to all existing and potential future timber customers to ensure equality of opportunity.
• Ensure all current and future guidance is subject to a regular review schedule to ensure they remain up to date.

2. In order to improve communications and understanding between the M&S Team and Finance i.e.:

• When the new policy and related guidance is issued, joint training should be held between M&S and Finance colleagues.
• M&S and Finance Management should meet on a regular basis (e.g. bi-annual) to discuss any existing or emerging issues, reconciliations between SRP and eFin and lessons learned.

3. Management should review all Self-Billing Protocols to ensure consistency in approach for all relevant customers and promote transparency, equality, and ease of monitoring.

4. To ensure systems and processes are effective and efficient, management should carry out a thorough review, including a cost-benefit analysis, on the self-billing processes and its supporting systems. This should provide a basis for short-, medium- and long-term improvement options.

5. Management should develop the current audit checks carried out to ensure they are undertaken objectively, regularly and outcomes documented, reported, and scrutinised appropriately.

6. To improve current debt and customer management, Management should:

• implement ongoing, documented monitoring for both performance against credit limits and payments due, ensuring reminders and resolution procedures are applied and adhered to
• statements should be issued i.e. on a quarterly basis to each customer with a credit arrangement, outlining their current balance.

7. Management should implement a regular review of ongoing credit arrangements for all customers (at least annually) i.e.:

• A credit limit review for all customers with an agreed credit limit, taking into account credit worthiness, current timber price against agreed customer volume needs and past payment performance, including any action needed regarding exceeded credit limits.
• A performance review for all self-billing customers which takes into account performance information and statistics (i.e. transactional errors; un-invoiced despatches; mismatch transactions and despatch cancellations) to determine continued efficiency of using the self-billing arrangement for each individual customer.

Business Continuity Planning

(Limited Assurance)

1. Management should establish a high-level strategy and related policy which outlines purpose, priorities and high-level guidance related to the BCPs.

2. Management should take the opportunity of the planned consolidation of all BCPs to ensure that all information included is accurate, up-to-date and includes key information such as stakeholder contact details, business critical activities, and provisions for all potential major disruptions (i.e. reduced access to offices). Arrangements should be reviewed regularly to ensure accuracy. Currently we understand that completion of BCP reviews for the consolidation is March 2023. If it is envisioned that there will be a delay to the update of Regional Plans, these should be updated to ensure accuracy in the interim.

3. Management should ensure that testing schedules are established and implemented as business as usual across all BCPs, using proportionate techniques (i.e. paper tests, full scenario testing etc). Results and lessons learned should be recorded and reported appropriately to ensure a cohesive approach, escalation of any issues and encourage information sharing.

4. Management should implement a periodic exercise in which the current list of BCPs is reviewed against internal and external risks. As part of this, a gap analysis should be performed to ensure the appropriateness of BCP coverage and communicated to the Head of Services Delivery and Continuity to facilitate information dissemination to BCP owners for action.

5. A full training and awareness plan should be established prior to issue of the revised BCP arrangements to ensure training is delivered, communicated, and periodically refreshed to all relevant stakeholders. In our opinion, this should include, but not be limited to roles and responsibilities, and management of interdependencies.

6. Management should establish a communication plan to ensure that there is ongoing communication to key stakeholders and staff regarding BCP updates. In our opinion, this should include:

• General BCP guidance/communication (e.g. storage provisions)
• Planned updates and testing.
• Testing results and lessons learned