The meeting will receive updates on the progress of various internal audits and reviews. A report from SWAP Internal Audit Services on Health and Safety Governance, summarising an “all staff” survey conducted in 2023, will be discussed. An update on the 2023-24 IT Audit Report and a risk update on the Council's Improvement and Transformation Programme will also be provided. Lastly, the committee will be updated on the progress of the action plan developed in response to the Interim Auditor’s Annual Report for 2022-23.

Health and Safety Governance

The meeting will receive a report from SWAP Internal Audit Services on Health and Safety Governance at Somerset Council. This report follows a review conducted by SWAP in 2023 which involved an “all staff” survey and an assessment of health and safety governance arrangements. The report will include a summary of the actions taken in response to the findings and recommendations of that review.

The survey identified “Management Commitment and Style” and “Communication” as the themes requiring the most development. One of the key findings was that new health and safety governance arrangements were not fully embedded. To address this, a presentation was developed to outline the importance of workforce involvement in the council’s health and safety arrangements and highlight the requirements for effective governance. This presentation was delivered to the council’s Executive Leadership T eam (ELT) in March 2024 by Executive Director, Alyn Jones.

Until a H&S Strategy is in place, work with the Executive Director – Strategy, Workforce and Localities and wider CLT on ensuring there is a clear tone at the top on Health and Safety within the organisation including support for ensuring the objectives of the Health and Wellbeing Boards are overseen and delivered. Agree Standard Operating Principles and Terms of Reference through ELT for how Health and Safety is overseen and managed across Directorates within the organisation including escalation principles. – Timescale April 2024.

The report also identifies the development of a new Health and Safety Strategy for Somerset Council as a key outstanding action.

Review of Priority 1 Internal Audit Management Actions

This item focuses on a review of high-priority actions from internal audit reports concerning Adults and Children’s Services. The review considers actions identified before and after the establishment of the new Somerset Council on 1 April 2023.

One of the actions relates to the Athena Contract. The report states that a review in January 2024 revealed “overall good compliance” with the requirement for all Adult Social Care Contract Officers to complete the required training in the Contract Management Capability Programme and the Passport to Procure training. Work is also underway to ensure all current ASC contracts have a Purchase Order.

Another action concerns Education, Health and Care Plans (EHCPs)¹. The report says progress has been made, but further work is on hold pending the implementation of the new team structure planned for April 2025.

Update on 2023-24 IT Audit Report

This agenda item provides an update on the 2023-24 IT Audit Report. The report provides updates on findings and recommendations relating to the council’s use of various IT systems, including SAP², D365³, NEC⁴, Civica⁵, Capita⁶, and Active Directory⁷.

In relation to SAP, the report notes that, “users with inappropriate access to critical privileges on SAP” have now been removed from the production environment. It also states that an excessive number of accounts with access to schedule batch jobs via SM37⁸ is being addressed and a change request has been created with SAP support partner HCL⁹.

The report acknowledges that D365 is a new system and support arrangements are being developed. Full administrator access has now been removed from all support staff, and generic accounts have been removed. The report notes that a matrix for privileged access is currently being produced.

Regarding the NEC Revenue & Benefits application, the report states that all non-essential generic accounts are being decommissioned. In the longer term, Single Sign On will be implemented as part of the consolidation of all revenue and benefits systems into a single NEC system.

In terms of Active Directory, the report notes that much work has been done “to improve and automate the process of allowing staff to access the highest level of admin access.” It states that all access is now time limited, recorded, and monitored in real time.

Overall, the update suggests that progress is being made to address the recommendations arising from the IT audit report, but some areas, such as user access amendments and the management of starters, movers, and leavers, still require further work.

Interim Auditor’s Annual Report 2022-23 - Action Plan Progress Update

The final item on the agenda is an update on the progress of the action plan developed in response to the Key Recommendations and Improvement Recommendations in the Interim Auditor’s Annual Report for 2022-23.

The report indicates that 29 actions out of 41 have been completed, with the remaining 11 actions on track to be completed by their due date. One action has been cancelled following the council’s decision to dispose of its commercial investment properties to help address its budget deficit. The action plan is being monitored via the Ideagen system.

One of the completed actions under Key Recommendation 2 (Implementing the transformation programme at scale and pace), relates to the development of detailed business cases. The report states that detailed business cases have now been developed for Member and officer scrutiny and approval.

Another completed action relates to the alignment of the Housing Revenue Account (HRA)¹⁰ business plans inherited from predecessor councils.

The report indicates that progress is being made on a number of other actions, including the development of a DSG Deficit Management Plan (Key Recommendation 5) and the implementation of robust arrangements for preventing and detecting fraud and corruption (Improvement Recommendation 4).