1.1 This report summarises the work undertaken by the Internal Audit Service during 2025-26 and highlights the key themes related to risk management, governance, and internal control.
1.2 The Internal Audit Service is an assurance function designed to evaluate and improve the effectiveness of risk management, control and governance processes. Global Internal Audit Standards(GIAS) replaced Public Sector Internal Audit Standards from 1 April 2025 strengthening expectations for internal audit independence, governance and oversight.
1.3 GIAS require the head of internal audit to provide an opinion on the frameworks of governance, risk management and control of Lancashire Combined Fire Authority and a written report to those charged with governance, timed to support the annual governance statement.
1.4 This report is based upon the work the Internal Audit Service performed during 2025-26 in relation to the 2025-26 audit plan, approved by the Audit Committee in March 2025.
1.5 The scope of our work, management and audit’s responsibilities, the basis of my assessment, and access to this report are set out in Annex 1. The levels of assurance the Internal Audit Service provides are set out in Annex 2.
1.6 The Internal Audit Service plan is delivered and developed in accordance with its Internal Audit Charter and Mandate. A revised charter and mandate which reflects the GIAS, accompanies this report.
1.7 I am grateful for the assistance that has been provided to the Internal Audit Service by the staff of Lancashire Fire and Rescue Service in the course of our work during the year.
Andrew Dalecki
Head of Internal Audit, Lancashire County Council
June 2026
2.1 Overall, I can provide substantial assurance regarding the adequacy of design and effectiveness in operation of the organisation's framework of governance, risk management and control.
2.2 The framework of control is adequately designed or effectively operated overall. We have discussed the issues we raised during the year with senior managers and agreed action plans. The table in section 3 details the audit assignments completed with the relevant assurance levels.
2.3 In forming my opinion, I have considered the work undertaken by the Internal Audit Service throughout the year, together with information available from less formal sources than planned audit engagements. This includes assurance obtained from external sources such as regulators, peer reviews, inspections, and other independent assessments.
2.4 Whilst there have been three reasonable and two substantial audits this year, I have concluded that a substantial assurance opinion is appropriate based on the low number of actions overall, the fact there are no significant actions and the commitment by Lancashire Fire and Rescue Service (LFRS) to implementing agreed actions. A summary of the actions is provided in the table below:
Audit |
Assurance Opinion |
High |
Medium |
Low |
|
Risk Management |
Reasonable |
0 |
2 |
1 |
|
Business Continuity |
Substantial |
0 |
0 |
1 |
|
VAT |
Substantial |
0 |
0 |
3 |
|
Treasury Management |
Reasonable |
0 |
1 |
1 |
|
Procurement |
Reasonable |
0 |
2 |
1 |
|
Total |
0 |
5 |
7 |
|
Table 1 – Summary of actions
2.5 Assurance is provided by Grant Thornton as the Authority's external auditor. Grant Thornton issued an unqualified opinion on the 2024-25 financial statements on 17 December 2025. They also confirmed that there were no significant weaknesses in the arrangements for financial sustainability, governance and economy, efficiency and effectiveness in the use of resources.
2.6 His Majesty’s Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS) reviewed Lancashire Fire and Rescue Service's effectiveness, efficiency, and staff welfare, publishing the report in August 2025. The HMICFRS Inspection (2023–2025) rated all areas as Good or Outstanding (6 Outstanding, 5 Good), confirming the service as a national leader in effectiveness, efficiency, and governance.
2.7 Assurance over the operation of the Pension Fund has been obtained from work conducted directly by Lancashire County Council's Internal Audit Service. Additionally, assurance has been obtained from the Local Pension Partnership (Administration) Limited and Local Pension Partnership (Investments) Limited, who both received an independent auditor's view of their controls through Audit and Assurance Faculty assurance reviews conducted by KPMG.
3.1 The table below shows the status of each audit completed during the year along with the corresponding assurance opinion. It shows that all 70 of the budgeted days have been used to deliver the internal audit plan. All 2025-26 work has been completed.
3.2 During the year, no matters have arisen that impacted on the independence of the Internal Audit service and there have been no inappropriate scope or resource limitations on internal audit work.
Audit review |
Audit days |
Status |
Assurance opinion |
||
Planned |
Actual |
Variation |
|||
Governance and business effectiveness |
|||||
|
Overall governance, risk management and control arrangements |
3 |
3 |
0 |
Completed |
|
Service delivery and support |
|||||
|
Risk Management |
12 |
12 |
0 |
Final |
˜ Reasonable October 2025 |
|
Business Continuity |
10 |
10 |
0 |
Final
|
˜ Substantial November 2025 |
Business processes |
|||||
|
VAT |
8 |
8 |
0 |
Final |
˜ Substantial April 2026 |
|
Treasury Management |
10 |
10 |
0 |
Final |
˜ Reasonable May 2026 |
|
Procurement |
12 |
14 |
(2) |
Final |
˜ Reasonable April 2026 |
Follow up audit activity |
|||||
|
Follow up audits |
4 |
2 |
2 |
Final |
Some actions implemented |
Other components of the audit plan |
|||||
|
Audit programme management activity |
10 |
10 |
0 |
Ongoing |
|
|
National Fraud Initiative |
1 |
1 |
0 |
||
Total |
70 |
70 |
0 |
|
|
Table 2- Audit status
3.3 In line with GIAS, management must implement agreed audit actions and Internal Audit should confirm implementation or verify that senior management has accepted any risks from not acting.
3.4 Therefore, the annually agreed audit plan includes time for follow up work and the position on the actions for the 2024-25 audit plan is shown in the table below:
Audit Review |
Assurance Opinion |
Action level |
Position |
||
High |
Medium |
Low |
|
||
|
Cyber security |
˜ Moderate March 2025 |
0 |
2 |
2 |
All implemented |
|
Implementation of learning from national incidents |
˜ Substantial November 2024 |
0 |
1 |
1 |
Awaiting an updated response |
|
Accounts payable |
˜ Substantial April 2025 |
0 |
0 |
1 |
Review of the debt management policy is currently on hold pending completion of the Authority’s review of the Financial Regulations and Scheme of Delegation. |
|
Accounts receivable |
˜ Substantial April 2025 |
0 |
0 |
1 |
|
|
General ledger |
˜ Substantial April 2025 |
0 |
0 |
0 |
N/A |
|
Total |
0 |
3 |
5 |
|
|
Table 3 – Agreed audit plan
4.1 Extracts of assurance summaries agreed since the March 2026 Audit Committee are shown in Appendix A.
5.1 There have been no incidences of fraud or irregularity brought to our attention that resulted from weakness in the control environment.
6.1 In making its Annual Governance Statement the Combined Fire Authority should consider this report in relation to internal control, risk management and corporate governance.
6.2 We do not consider there are any matters arising from the audit work conducted during 2025-26 that require specific identification in the annual governance statement.
7 Internal audit quality assurance and improvement
7.1 Internal Audit invites feedback on the quality of service provided by issuing a ‘satisfaction questionnaire’ at the end of each audit. This is an important process for understanding how the audit was received and identifying areas of the audit process that can be improved. Due to the timing of the finalisation of some of the reports we have not yet received any responses to the feedback.
7.2 In every case, our auditees have told us in closure meetings that they were satisfied overall with how we conducted our work. We also seek more detailed feedback on our audit planning, the audit process and reporting, our conduct, and the management and delivery of our service.
7.3 In accordance with the Global Internal Audit Standards the Council’s Internal Audit function is required to have an external quality assessment (EQA) undertaken at least once every 5 years as part of its Quality Assurance Framework.
7.4 The last external quality assessment was in February 2023 and the overall opinion was that the Internal Audit team “generally conforms” to the IIA Standards. This is the same overall rating that the service achieved at the last assessment completed in November 2017 and is the highest of the three global grading definitions used in an EQA.
7.5 The Internal Audit Service has designed procedures and an audit methodology that conform to GIAS and are regularly reviewed. Every auditor in the team is required to comply with these or document the reasons why not, and to demonstrate this compliance on every audit assignment. The audit managers assess the quality of each audit concurrently as it progresses, and a post-audit file review process has been undertaken. These reviews indicate that there is good evidence of compliance with our audit methodology and input from the audit managers to support the work of the auditors.
7.6 In addition, the service's methodology includes a step which requires the head of internal audit to read each report as it is finalised. This does not entail an additional detailed review and the auditors' reports remain theirs, using their own style and wording, but is intended to ensure that each assignment can be adequately understood and is effectively communicated.
7.7 The Internal Audit Service operates a hybrid working model; with staff primarily home-based but undertaking client site visits as required by the audit. Performance management and support arrangements are in place to facilitate this including agreeing delivery timescales with clients and identifying audits to be completed for each Committee meeting.
.
|
Overall assurance rating |
Audit findings requiring action |
|
|||
|
˜ |
Extreme |
High |
Medium |
Low |
|
|
Substantial assurance |
0 |
0 |
0 |
3 |
|
|
See Appendix A for Rating Definitions |
|
||||
|
Lancashire Fire and Rescue Service (LFRS) have an established and well‑structured process for the administration of the VAT return, supported by experienced finance staff and comprehensive procedure documentation. Since assuming responsibility for VAT return submissions from Lancashire County Council (LCC) in August 2024, the LFRS Finance team has developed its own reconciliation processes, with procedure notes now covering all key stages, including Oracle Fusion reporting and online submission. Responsibilities for these processes and approvals are defined in task lists.
Staff involved in the VAT reconciliation and return process were found to have appropriate experience, qualifications, and system permissions to complete their duties effectively. Oracle Fusion is being used correctly to process invoices with appropriate VAT rates, although our testing identified areas where access permissions could be reviewed. Lancashire County Council (LCC) staff retained wide access due to handover arrangements requiring permissions until January 2026. Once handover is completed, these permissions should be reviewed in consultation with LCC.
Testing confirmed that VAT rates were consistently and accurately applied across Accounts Payable and Accounts Receivable, with only one exception identified and subsequently corrected. Monthly compliance checks were carried out in line with documented procedures, including checks on zero‑rated and reduced‑rate suppliers and validation of high‑value invoices. Reconciliation evidence was robust. Although one month lacked documentation of invoice validation checks, these were present for all other reconciliations sampled. All VAT returns reviewed had been accurately reconciled and submitted on time. However, approvals were provided verbally and therefore were not independently verifiable.
Monitoring of the VAT suspense account was taking place, and a separate balancing tool had been introduced to confirm that VAT codes aligned correctly following each return, providing an effective additional control. Comprehensive reconciliation documentation, supported by Oracle Fusion reports, demonstrated that returns were being prepared accurately and that discrepancies were investigated and resolved. The partial exempt input VAT position is not currently monitored by LFRS, which could result in them exceeding the HM Revenue and Customs (HMRC) 5% de minimis threshold and incurring an unexpected VAT liability. Although there is a minimal risk of this threshold being reached under current organisational strategy, a process for monitoring this would provide assurance for any future changes. |
|||||
|
Overall assurance rating |
|
|
|||
|
˜ |
Extreme |
High |
Medium |
Low |
|
|
Reasonable |
0 |
0 |
1 |
1 |
|
|
See Appendix A for Rating Definitions |
|
||||
|
Lancashire Fire and Rescue Service (LFRS) demonstrates strong strategic oversight of treasury management through the annual approval of its Treasury Management Strategy, which is presented to and approved by the Full Fire Authority ahead of the new financial year. Reporting arrangements are operating effectively, with the mid-year update, Treasury Management Policy Statement and Statement of Accounts all fully aligned with the strategy and the CIPFA Treasury Management Code. Investment and cash flow activity is low risk and compliant with the approved strategy. While LFRS receives general market advice from external advisors (Link Treasury Services (MUFG)), current day to day investment decisions is managed internally using fixed term deposits and a Debt Management Office (DMO) Call Account, a UK Government backed deposit facility that provides same day, low risk access to funds, which is appropriate for the scale and risk profile of LFRS's operations.
Since August 2024, the finance team has administered treasury management, making 2025-26 the first full year under these arrangements and surplus cash is invested through secure instruments including the DMO Call Account. As at 31 January 2026, £1.8 million of interest income had been generated, compared with £1.566 million in the full 2023-24 financial year when treasury management was administered by LCC. Thirty million is currently held in low-risk fixed term deposits, all maturing in 2026-27.
However, the review identified a gap in the operational framework as LFRS does not yet have an approved Treasury Management Practices (TMPs) document. TMPs are a mandatory requirement of the CIPFA Treasury Management Code and provide the detailed procedures, controls and delegated authorities necessary to ensure treasury activity is undertaken consistently and within defined parameters. Their absence impacts several themes, including roles and responsibilities, operational practices, training expectations, and the formal documentation of reporting and control processes. Management is now developing an LFRS specific TMP document using the previous Lancashire County Council (LCC) template which were adhered with prior to the transfer of the treasury management function to LFRS in August 2024.
For investment, interest and cash-flow activity the records are accurate, transactions are appropriately authorised, and activities are proportionate to the scale of LFRS's treasury operations. LFRS also has access to external professional advice to support decision making and market awareness. While these factors mitigate operational risks and provide assurances, the lack of TMPs may affect resilience, and consistency should staffing or governance arrangements change or needs to be addressed.
While LFRS has a clear strategic framework, appropriate oversight and effective reporting, the absence of approved TMPs, which was discussed with the Deputy Finance Manager during the audit and is now being addressed. Remains a material control gap that must be resolved to ensure full compliance with the CIPFA Treasury Management Code and strengthen operational resilience. |
|
Overall assurance rating |
Audit findings requiring action |
|
|||
|
˜ |
Extreme |
High |
Medium |
Low |
|
|
Reasonable assurance |
0 |
0 |
2 |
1 |
|
|
See Appendix A for Rating Definitions |
|
||||
|
Lancashire Fire and Rescue Service (LFRS) have made significant progress in strengthening its procurement governance, supported by an increasingly structured framework, improved tools, and a growing alignment with the Procurement Act 2023 (the 2023 Act). The foundations for effective, well‑governed procurement activity are in place, and ongoing improvements demonstrate a proactive commitment to enhancing consistency, transparency, and assurance across procurement processes.
LFRS has established a strong governance base, with Contract Standing Orders already updated to align fully with the 2023 Act and procurement staff completing training on the 2023 Act. Several supporting documents and tools, such as the newly introduced Process Workflow Guide, revised procurement initiation templates and the implementation of the Chest e-procurement system (the Chest platform), show a clear direction of travel toward stronger compliance. Work is already underway to refresh remaining documents, including Terms and Conditions, and to update website information so it accurately reflects current practice. These initiatives demonstrate a positive and forward‑looking approach that will further strengthen organisational clarity, compliance, and governance.
The Procurement Team has taken important steps to modernise its transparency arrangements, with The Chest now established as the primary platform for tendering and publication. This transition represents a significant improvement, with built‑in safeguards that support compliance and consistency. While some gaps were noted during the review, such as delays in publishing contract awards and updating the contracts register, staff are already embedding new processes and strengthening record retention practices. Continued adoption of the Chest platform, together with the ongoing population of the live contracts register, will further enhance transparency, assurance, and public confidence. Procurement routes, evaluation approaches, and tender processes were generally sound and aligned to good practice, and recent improvements (including updated templates and workflow guidance) reflect a positive shift toward greater standardisation and quality across documentation. However, a small number of procurements, particularly older files, contained gaps in the supporting audit trail, including unsigned initiation documentation, limited evidence to demonstrate evaluator training/selection, and incomplete conflict of interest records. In addition, the review identified one instance where services commenced before a signed contract had been received from the supplier. Ensuring that key documents and approvals are consistently finalised, signed and retained, and that contracts are executed before commencement, will provide assurance that procurements are delivered in line with internal procedures and legislative requirements. |
|||||
1 The Internal Audit Service operates in accordance with the GIAS. The scope of internal audit encompasses all the governance, risk management and control processes of the Combined Fire Authority including where they are provided by other organisations on their behalf.
2 It is management’s responsibility to maintain systems of risk management, internal control and governance. Internal audit is an element of the internal control framework assisting management in the effective discharge of its responsibilities and functions by examining and evaluating controls.
3 Lancashire Combined Fire Authority has taken the decision to outsource their internal audit provision, and Lancashire County Council's Internal Audit Service was the appointed service provider for 2025-26.
4 It is the role of the Internal Audit Service to provide independent assurance that these risk management, control and governance processes are adequately designed and effectively operated. The GIAS makes clear that the provision of this assurance is internal audit's primary role and that this requires the head of internal audit to provide an annual opinion based on an objective assessment of the framework of governance, risk management and control.
5 This assessment will be supported by the identification, analysis, evaluation and documentation of sufficient information on each individual audit assignment, and the completion of sufficient assignments to support an overall opinion for the organisation as a whole.
6 Internal auditors cannot be held responsible for internal control failures. However, we have planned our work so that we have a reasonable expectation of detecting significant control weaknesses. We have reported all such weaknesses to you as they have become known to us, without undue delay, and have worked with you to develop proposals for remedial action.
7 The requirement to be independent and objective means that the Internal Audit Service cannot assume management responsibility for risk management, control or governance processes. However, the Internal Audit Service may support management by providing consultancy services. These are advisory in nature and are generally performed at the specific request of the organisation, with the aim of improving governance, risk management and control and will also contribute to the overall assurance opinion.
8 Accountability for responses to the Internal Audit Service’s advice and recommendations for action lies with the Senior Management Team, which either accepts and implements the advice or accepts the risks associated with not taking action. Audit advice, including where the Internal Audit Service has been consulted about significant changes to internal control systems, is given without prejudice to the right of the Internal Audit Service to review and recommend further action on the relevant policies, procedures, controls and operations at a later date.
9 The head of internal audit will provide an annual report incorporating an overall opinion, a summary of the work that supports that opinion, and a statement of conformity with the (GIAS) and the results of the quality assurance and improvement programme.
10 The Internal Audit Service is not responsible for the prevention or detection of fraud and corruption. Managing the risk of fraud and corruption is the responsibility of management. Internal auditors will, however, be alert in all their work to risks and exposures that could allow fraud or corruption and to any indications that fraud and corruption may have occurred. Internal audit procedures alone, even when performed with due professional care, cannot guarantee that fraud or corruption will be detected.
11 Our opinion on the adequacy of control arrangements is based upon the result of internal audit reviews undertaken and completed during the period in accordance with the plan approved by the Audit Committee. We have obtained sufficient, reliable and relevant evidence to support the improvements that we proposed and that have been accepted by management.
12 There have been no limitations to the scope of our audit work.
13 There are inherent limitations as to what can be achieved by internal control and consequently limitations to the conclusions that can be drawn from our work as internal auditors. These limitations include the possibility of faulty judgement in decision making, of breakdowns because of human error, of control activities being circumvented by the collusion of two or more people and of management overriding controls. Also, there is no certainty that internal controls will continue to operate effectively in future periods or that the controls will be adequate to mitigate all significant risks which may arise in future.
14 Decisions made in designing internal controls inevitably involve the acceptance of some degree of risk. As the outcome of the operation of internal controls cannot be predicted with absolute assurance any assessment of internal control is judgmental.
15 This report has been prepared solely for the Combined Fire Authority. This report forms part of a continuing dialogue between the Internal Audit Service, senior officers within Lancashire Fire and Rescue Service and the Audit Committee. It is not therefore intended to include every matter that came to our attention during each internal audit review.
16 We acknowledge that this report may be made available to other parties, such as the external auditors. We accept no responsibility to any third party who may receive this report for any reliance that they may place on it and, in particular, we expect the external auditors to determine for themselves the extent to which they choose to utilise our work.
Note that our assurance may address the adequacy of the control framework's design, the effectiveness of the controls in operation, or both. The wording below addresses all of these options, and we will refer in our reports to the assurance applicable to the scope of the work we have undertaken.
˜ Substantial assurance: the framework of control is adequately designed and/ or effectively operated overall.
˜ Reasonable - assurance: the framework of control is adequately designed and/ or effectively operated overall, but some action is required to enhance aspects of it and/ or ensure that it is effectively operated throughout.
˜ Limited assurance: there are some significant weaknesses in the design and/ or operation of the framework of control that put the achievement of its objectives at risk.
˜ No assurance: there are some fundamental weaknesses in the design and/ or operation of the framework of control that could result in failure to achieve its objectives.
All actions agreed with management are stated in terms of the residual risk they are designed to mitigate.
|
|
Extreme residual risk: critical and urgent in that failure to address the risk could lead to one or more of the following: catastrophic loss of the LRFS services, loss of life, significant environmental damage or significant financial loss, with related national press coverage and substantial damage to the LRFS reputation. Remedial action must be taken immediately.
|
|
High residual risk: critical in that failure to address the issue or progress the work would lead to one or more of the following: failure to achieve organisational objectives, significant disruption to the LRFS business or to users of its services, significant financial loss, inefficient use of resources, failure to comply with law or regulations, or damage to the LRFS reputation. Remedial action must be taken urgently.
|
|
Medium residual risk: failure to address the issue or progress the work could impact on operational objectives and should be of concern to senior management. Prompt specific action should be taken.
|
|
Low residual risk matters that individually have no major impact on achieving the service's objectives, but when combined with others could give cause for concern. Specific remedial action is desirable