1 Purpose of this report

1.1 The Internal Audit Plan for 2023/24 was approved by the Audit Committee in March 2023. This report details the progress to date in undertaking the agreed coverage.

2 Internal audit work undertaken

2.1 Work carried out during the period 1 April 2023 to 1 March 2024 was in accordance with the agreed audit plan. To date, 58.50 days have been spent this financial year on completion of the 2023/24 plan, equating to 73% of the total planned audit activity of 80 days. The table below shows the current status of all audit work.

2.2 No areas of concern have come to our attention in conducting our assurance work to date that requires bringing to the attention of committee members.

Audit review	Audit days			Status	Assurance Opinion
Audit review	Planned	Actual	Variation	Status	Assurance Opinion
Governance and business effectiveness
Overall governance, risk management and control arrangements	3	2.5	0.5	Ongoing This is ongoing by the Audit Manager within the year.
Service delivery and support
Equality impact assessments	10	9.5	0.5	Final	˜ Substantial January 2024
Management of change within LFRS	10	9	1	Final	˜ Substantial November 2023
District planning activity	10	13	-3	Final	˜ Limited January 2024
Business processes
Accounts payable	9	2	7	Testing Started	N/A
Accounts receivable	6	1	5	Testing Started	N/A
General ledger	6	1	5	Testing Started	N/A
HR/ Payroll	10	11	-1	Final	˜ Substantial December 2023
Treasury management	4	1.5	2.5	Testing Started	N/A
Follow up audit activity
Follow up activity	2	0	2	Not started There is only KFS actions which will be picked up in the main KFS audit.	N/A
Other components of the audit plan
Management activity	9	8	1	Ongoing: This is ongoing by the Audit Manager within the year.
National Fraud Initiative	1	0	1
Total	80	58.5	21.5

3 Extracts from AuditReports

3.1 Extracts of assurance summaries are shown below

Equality Impact Assessments

Overall assurance rating	Audit findings requiring action
˜	Extreme	High	Medium	Low
Substantial	0	0	0	0
See Appendix A for Rating Definitions
Overall, we can provide substantial assurance on the adequacy & effectiveness of how Equality Impact Assessments (EIA) are considered on all policies, practices, or decisions across Lancashire Fire and Rescue Service (LFRS). LFRS have several service orders, policies, processes, plans and strategies in place, all of which contributes to and explains the service’s approach to conducting and ensuring that EIA is considered. Additionally, the Annual Service Plan and the Community Risk Management Plan (CRMP) includes sections relating to promoting Equality, Diversity, and Inclusion (EDI) values within LFRS and within the communities it serves. LFRS provide representation on several strategic boards and groups to share information, intelligence and develop networks. A Code of Ethics is issued to potential suppliers as part of self-certification, the potential suppliers confirm that they have a current EDI Policy, and mechanisms for ensuring this is effectively monitored within their organisation and throughout their supply chain. The EIA we reviewed were all correctly completed within the standard templates whilst being objective and in line with the LFRS EIA guidance. Service orders that are reviewed or submitted for approval would automatically highlight if an EIA has not been completed. Completed EIAs are signed off by the relevant manager or board and periodically reviewed by the Assistant Director Human Resources and the Human Resources Business Partner. Additionally, LFRS are planning to implement an evaluation framework consisting of a policy, procedure, and toolkit. The EDI Steering Group populates an Annual EDI Report, the report is populated in consultation with the Workforce Development Programme Board and subject to scrutiny and approval by the Fire Authority. An Annual Service Report is also populated which includes a series of engagement activities and a service satisfaction survey is also conducted whereby the standard is achieved if the percentage of satisfied responses is greater than the 97.50%, LFRS had 98.77% satisfied during April 23 to June 23 quarter. In relation to training, 90% of employees have completed the mandatory e-learning EDI training module. There is also EIA training which is mandatory for the Middle Manager Development Programme and attendance is monitored by LFRS.

District Planning Activity

Overall assurance rating	Audit findings requiring action
˜	Extreme	High	Medium	Low
Limited	0	2	2	0
See Appendix A for Rating Definitions
The district planning activity is in its first year of rolling out and therefore a relatively new process. Our audit consisted of a hybrid approach of consultancy service and reviewing areas which are implemented or in the process of being implemented. Lancashire Fire and Rescue Service (LFRS) do not have any service orders, policies, guidance documents or procedures for the management of district planning. However, they plan to populate a standard operating document and/or guidance document by March 2024. This should assist and guide the service delivery Managers (SDM's) in completing more comprehensive district plans. A Risk Management Plan is in place and links through to the Annual Service Plan but does not give any details on the district plans and how they will be implemented. There is a "Strategic Assessment of Risks" which feeds into the district plans as it seeks to underpin the LFRS Community Risk Management Plan (CRMP), by ensuring that risk management drives decision-making within LFRS. The district plans are populated by using specific district data from the intelligence profiles, these were not created for 2023 due to the intelligence data not being received within the timeframe required to create district plans. For 2024 it is intended that the profiles will be completed by January 2024 which will allow the district plans to be populated with current data and in place by April 2024. The current district plans are complex and disjointed, they are not structured as plans but rather as LFRS ambitions and information. Therefore, it was difficult to identify in all cases where the plan correlated with the identified district risks. The district performance reports are more informative, risks in the plan cannot be easily linked to the performance of the plans. The content of quarterly performance information varied; therefore, we were unable to determine if there was any improvements or changes. There is no overarching performance or evaluation reporting which combines the areas of evaluation or performance into an overarching District Planning report. Although, the overarching "Prevention Strategy", includes a limited performance section on District Planning. A His Majesty's Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS) area of Improvement / recommendation, which is linked to District Planning, is included within the LRFS HMI Organisational Improvement Plan 2023/24. This has a completion date of March 2024.

Human Resources/Payroll

Overall assurance rating	Audit findings requiring action
˜	Extreme	High	Medium	Low
Substantial	0	0	0	0
See Appendix A for Rating Definitions
Overall, we did not identify any significant issues within the LFRS HR & payroll processes. A Service Level Agreement (SLA) is in place between Greater Manchester Fire and Rescue Service (GMFRS) and Lancashire Fire and Rescue Service (LFRS) for the provision of a managed payroll service and a good working relationship is also maintained between the two. Employees were occupying authorised posts, valid appointments had been correctly checked and established, and the right amount was being paid to individuals at the right time. Leavers were appropriately discharged, and our testing did not identify anyone being paid who no longer worked for the organisation. Additionally, monitoring arrangements are in place to prevent and detect any anomalies or errors that might arise, and only appropriate HR staff have access to the I-Trent HR & Payroll system, and to the payroll and personnel data which were held in electronic folders within the LFRS network. Changes or amendments to pay are appropriately authorised by an employees' manager and updated into i-Trent and correctly calculated, with revised calculations being checked by a second officer in all our selected sample cases. There were no overpayments made where LFRS has had to raise any invoices through the accounts receivables process and bank account changes were made on-line by the employee themselves except for the new starters.

Audit assurance levels and residual risks Appendix 1

Note that our assurance may address the adequacy of the control framework's design, the effectiveness of the controls in operation, or both. The wording below addresses all of these options and we will refer in our reports to the assurance applicable to the scope of the work we have undertaken.

˜ Substantial assurance: the framework of control is adequately designed and/ or effectively operated overall.

˜ Moderate assurance: the framework of control is adequately designed and/ or effectively operated overall, but some action is required to enhance aspects of it and/ or ensure that it is effectively operated throughout.

˜ Limited assurance: there are some significant weaknesses in the design and/ or operation of the framework of control that put the achievement of its objectives at risk.

˜ No assurance: there are some fundamental weaknesses in the design and/ or operation of the framework of control that could result in failure to achieve its objectives.

Classification of residual risks requiring management action

All actions agreed with management are stated in terms of the residual risk they are designed to mitigate.

Extreme residual risk: critical and urgent in that failure to address the risk could lead to one or more of the following: catastrophic loss of the LRFS services, loss of life, significant environmental damage or significant financial loss, with related national press coverage and substantial damage to the LRFS reputation. Remedial action must be taken immediately.

High residual risk: critical in that failure to address the issue or progress the work would lead to one or more of the following: failure to achieve organisational objectives, significant disruption to the LRFS business or to users of its services, significant financial loss, inefficient use of resources, failure to comply with law or regulations, or damage to the LRFS reputation. Remedial action must be taken urgently.

Medium residual risk: failure to address the issue or progress the work could impact on operational objectives and should be of concern to senior management. Prompt specific action should be taken.

Low residual risk: matters that individually have no major impact on achieving the service's objectives, but when combined with others could give cause for concern. Specific remedial action is desirable.