The Learning and Skills Councils Annual Report and Accounts for ...

implemented and that substantial
assurance could be provided.
There were three risks identified
that required management action
assessed at amber/green, with
implementation dates of mid to
late 2010.
Information assurance
72. The 2008–09 Statement on
Internal Control highlighted the
fact that due to late confirmation
of data requirements by DIUS,
little progress had been made
against a number of actions to
meet the minimum requirements
on data-handling outlined in the
Hannigan Report.
73. Internal Audit considered that
acceptable progress had been
made towards implementing
the audit recommendations
made from testing carried out in
2008–09. While there were some
systems of control operating,
these were only sufficient to give
a restricted assurance over the
level of control established in
relation to managing information
assurance risks. Full compliance
against the Security Policy
Framework by the end of 2009–10
continued to pose a significant
challenge.
74. The Annual Report on Information
Security produced by the LSC’s
Senior Information Risk Owner in
April 2010 reported that of the
126 controls, processes, policies
and procedures outlined within
the Security Policy Framework
and against which the LSC was
required to be compliant, all were
complete except for seven, which
were partially complete. Three
were non-compliant while the
rest were fully, mostly or generally
compliant, or were not applicable.
75. In February 2010, the LSC
undertook a self-assessment
against Level 1 of the Information
Assurance Maturity Model. The
LSC was between 81 per cent and
100 per cent compliant across
six headings.
76. In overview, the report concluded
that the LSC could identify its
information assets and assess the
level of business risk surrounding
them. An Information Security Risk
Register is now maintained.
Travel and expenses
77. In preparation for the publication
of details of Council members’ and
staff expenses, Internal Audit was
asked to provide assurance over
compliance with LSC systems.
78. The review gave no indication of
fraud, although many examples
of non-compliance and ignorance
of the policies were identified,
along with some errors. A
‘restricted assurance’ opinion was
appropriate, due to the extent
of non-compliance with systems
(mainly inconsistent use of
corporate procurement cards) and
the failure of the systems to meet
business need. A number of the
issues identified were addressed in
2009–10 and the expenses policy
is being reconsidered, as much
of the non-compliance was due
to policy not reflecting current
business conditions.
Business continuity
planning
79. Follow-up work on the
recommendations set out in the
improvement plan for the ‘BCP
Management Letter’ issued in
June 2008 was undertaken by
Internal Audit. Although there had
been progress in implementing
recommendations, the LSC still
lacked established arrangements
to co-ordinate business continuity
planning activities across the
organisation. The LSC had revised
its Business Continuity Policy in
August 2008 but had not yet
developed its approach, processes
and arrangements for business
continuity plans in line with
BS 25999.
80. There was a good response to
dealing with the threat of a swine
flu pandemic, where plans were
revised and advice was given to
regions about the actions they
should take.
81. Going forward, it was
recommended and agreed that
arrangements for business
continuity plans in line with BS
25999 will be developed; that
the Business Continuity Policy
will be revised in the light of the
new organisations; that roles and
responsibilities for both the Skills
Funding Agency and the YPLA will
be established to ensure that there
are effective arrangements for
business continuity management;
and that arrangements will be put
in place for formal and regular
reporting to senior management
on the overall management of
business continuity planning, its
delivery and its implementation in
both the Skills Funding Agency and
the YPLA.
Leadership and Governance
LSC Annual Report and Accounts 2009–10 41