STATEMENT ON INTERNAL CONTROL INTERNAL AUDIT REPORTS 2008/09

STATEMENT ON INTERNAL CONTROL

Scope of Responsibility

As Accountable Officer, I have responsibility for maintaining a sound system of internal control that supports the achievement of Transport Scotland’s policies, aims and objectives set by Scottish Ministers, whilst safeguarding the public funds and assets for which I am personally responsible, in accordance with the responsibilities assigned. This is in accordance with the Scottish Public Finance Manual (SPFM) issued by Scottish Ministers to provide guidance on the handling of public funds.

The purpose of the system of internal control

The system of internal control is designed to manage rather than eliminate the risk of failure to achieve Transport Scotland’s policies, aims and objectives. I can therefore only provide reasonable and not absolute assurance of effectiveness. The system of internal control is based on an ongoing process designed to identify and prioritise these risks, to evaluate the likelihood of those risks being realised and the impact should they be realised, and to manage them efficiently, economically and effectively. This system of internal control has been in place in Transport Scotland for the year ended 31 March 2009 and up to the date of approval of the annual report and accounts. It is in accordance with the guidance from Scottish Ministers.

The risk and control framework

I have established a framework of responsibility for risk management, in accordance with the SPFM, with appropriate support, guidance and procedures from all parts of the agency’s business:

  • the Transport Scotland Executive Board reviews strategic and operational risks to the agency’s business and this is a regular agenda item at the monthly Executive Board meeting
  • managers identify and evaluate risks to successfully deliver the agency’s operation and control objectives when they prepare and monitor directorate and business management plans
  • I hold regular meetings with Ministers where both strategic and operational risks are discussed
  • my staff work closely with their counterparts in the Scottish Government’s Transport Directorate to ensure that risk management systems are compatible, there is clear accountability for managing risks, joint action is taken where appropriate to manage risks, and the Scottish Government is kept informed of risks as appropriate.

During 2008/09 a high level Risk Strategy has been put in place setting out a consistent approach to the implementation of risk management within Transport Scotland at strategic, programme and project levels. A Risk Management Committee has been set up, responsible for developing a Risk Framework, for maintaining the Corporate Risk Register, for facilitating the production and management of risk registers within project teams and Directorates and for enhancing the management of risk across all areas of the business.

Transport Scotland has established an Audit Committee which is chaired by one of the non-executive directors, Dr Jacqueline Redmond, and it is within the remit of the Transport Scotland Audit Committee to review the risk management and strategy adopted across the organisation.

Review of effectiveness

As Accountable Officer, I have responsibility for reviewing the effectiveness of the system of internal control. This is informed by the work of the internal auditors, the executive managers within the agency, the Audit Committee and the external auditors in their management letter and other reports.

Assurance on the maintenance and review of internal control systems is provided by each of the Directors within Transport Scotland who submit an annual certificate of assurance covering their areas of responsibility to myself as Accountable Officer.

Risks to information are being managed and controlled and the agency is working towards meeting the mandatory requirements set out in the Security Policy Framework developed by the Cabinet Office. A range of measures will be implemented over 2009/10 to ensure all key guidelines are met.

Transport Scotland’s Internal Auditors (whose work is undertaken to Government Internal Audit Standards) submit regular reports to the Audit Committee which provide an independent opinion on the adequacy and effectiveness of the organisation’s system of internal control together with recommendations for improvement. The three categories of assurance used in these reports are substantial, reasonable and limited assurance.

I will ensure that any follow up work will be carried out in the coming year to deal with the points raised in the audits where a rating of less than substantial assurance has been awarded.

The Performance Audit Group (Halcrow working in association with Pricewaterhouse Coopers and Scott Wilson Plc) perform an external assurance role for all trunk road maintenance work.

INTERNAL AUDIT REPORTS 2008/09

 

Audit Area & Scope

Outcome

1

Land acquisition and disposal

Assurance provided: Substantial
Risk, control and governance arrangements in place over Land Acquisition and disposal processes were found to be good.

2

Road scheme design

Assurance provided: Substantial
Risk, control and governance arrangements in place over Road Scheme Design processes were found to be good.

3

Business planning and risk management

Assurance provided: Reasonable
While the audit acknowledged that risk management is an area under development by Transport Scotland the current status is not uniform across the agency. Again while a new IT strategy has been identified, it will not be implemented until 2009/10. These areas will be scrutinised during 2009/10 to ensure that the required progress is made.

4

Bridge maintenance programme

Assurance provided: Substantial
Risk, control and governance arrangements in place over Bridge Maintenance and Data Migration were found to be good.

On 12th June 2009 the Parliamentary Audit Committee published a report reviewing the governance surrounding the three year extension of the First ScotRail Franchise. While welcoming the finding by Audit Scotland that the franchise is being managed effectively the report was critical of some controls not being fully adhered to during the negotiations to safeguard against any potential conflict of interest. Although these controls were already part of Transport Scotland’s control framework they have been subsequently reinforced and become standing agenda items at any decision-making forum.

I have set objectives for the executive Directors within Transport Scotland to undertake a regular review process to ensure that improvement to the assurance and control environment within Transport Scotland is monitored closely and, where appropriate, actions are in place to address any weaknesses identified to ensure the continuous improvement of the system.

David Middleton signature

David Middleton
Chief Executive
1 December 2009