Report detail

The Internal Audit plan for 2025/26 was approved by the ARAC in February 2025.

Internal audit undertook the following reviews to provide ARAC with assurance over the design and operating effectiveness of controls in these areas:

a. Health and Safety

b. Management of Recommendations

The audit of overtime was also planned to be reported to the August ARAC meeting. This audit will now be reported to the November ARAC meeting.

Appendix A – Health and Safety

Background:
The Health and Safety Executive (HSE) has detailed guidance on minimum safety standards to ensure employers compliance with legislation.

Policing has unique health and safety challenges due to the nature of the service and there must be robust H&S arrangement in place.

Internal Audit Findings:
Limited assurance on design of internal controls.

Limited assurance on effectiveness of procedures and controls.

BDO noted Police Scotland aims to enhance the safety and wellbeing of people, places, and communities across Scotland. This commitment is evident in the areas of good practice identified and the proactive attitudes of senior stakeholders towards fulfilling their Health and Safety responsibilities.

However, BDO highlighted several weaknesses in the design and effectiveness of internal controls, presenting opportunities for necessary improvement.

Failures in risk assessment, procurement, and corrective action implementation suggest that Health and Safety is not prioritised.

Low attendance at the Health and Safety Board by senior officers also indicates a lack of support for a robust Health and Safety culture within Police Scotland.
Summary of Findings of the Report:
SUMMARY OF FINDINGS/ OF AGREED ACTIONS
High 2/ 5
Medium 8/ 21
Low 0/ 0
TOTAL 10/ 26

SPA Considerations:

There a high number of findings and actions raised including five high risk actions. A robust response to the findings from this audit is required.

Most recommendation are expected to be completed during 2026 and two recommendations were not accepted by Police Scotland. The rational is explained in the management response.

Appendix B – Management of Recommendations

Police Scotland is subject to internal/ external audits and a wide range independent reviews. These reviews often result in a number of recommendations for improvement.

As reported to ARAC, the number of open recommendations and recommendations being delayed has increased significantly in recent years.

The scope for this audit does not include SPA (Corporate and Forensics).

Internal Audit Findings:

Moderate assurance on design of internal controls.

Limited assurance on effectiveness of procedures and controls.

BDO have highlighted several areas of good practice areas including roles and responsibilities, reporting, system access control and automated reminders.

They also highlighted areas for improvement including the volume of delayed recommendations and the potential to be overwhelmed with recommendations.

Summary of Findings of the Report:
SUMMARY OF FINDINGS/ OF AGREED ACTIONS
High -
Medium 2/ 3
Low 1/ 2
TOTAL 1/ 5

SPA Considerations:

All recommendations have been accepted with actions scheduled to be completed by June 2026.

Addressing the findings from this audit and the reparenting of the Audit Management Team to the wider Strategy and Analysis Directorate presents opportunities to enhance the management of recommendations within Police Scotland.