View
4
Download
0
Category
Preview:
Citation preview
Purchase to Pay (Reporting) Internal audit report for London Legacy Development Corporation
Confidential Status – Final
October 2012
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 2 13
Document history Distribution
Draft V01 July 2012 Paul Hilton Interim Director of Finance
Draft V02 September 2012 Paul Hilton Interim Director of Finance
Final V01 15 October 2012 Jonathan Dutton
Paul Hilton
Audit Committee
Executive Director Finance and
Corporate Services
Interim Director of Finance
General Disclaimer
The content of this report is confidential and not for distribution to anyone other than the LLDC. Disclosure to third parties cannot
be made without the written consent of Moore Stephens LLP.
Freedom of Information Disclaimer
In the event that pursuant to a request which LLDC has received under the Freedom of Information Act 2000, it is required
to disclose any information contained in this report, it will notify Moore Stephens LLP promptly and consult with
Moore Stephens LLP prior to disclosing such report LLDC agrees to pay due regard to any representations which
Moore Stephens LLP may make in connection with such disclosure and LLDC shall apply any relevant exemptions which
may exist under the Act to such report. If, following consultation with Moore Stephens, LLDC discloses this report or any part
thereof, it shall ensure that any disclaimer which Moore Stephens LLP has included or may subsequently wish to include in the
information is reproduced in full in any copies disclosed.
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 3 13
Contents
Page
Contents 3
1 Introduction 4
2 Conclusion 4
3 Key findings 4
4 Follow up 6
5 Audit approach 7
6 Recommendations and management action plan 8
7 Follow up on Purchase to Pay (Phase 1) report recommendations 9
Appendices 11
A Audit objectives 11
B Audit definitions 12
C Staff consulted during review 13
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 4 13
1 Introduction
1.1 This audit was completed in accordance with the approved annual Internal Audit plan for 2012/13.
1.2 The overall objective of this audit was to review and assess the adequacy of the current arrangements for financial
reporting in relation to procurement, with an emphasis on reporting to budget heads; and to review the effectiveness of
management reporting and control processes operated at this level. The key risks addressed by this audit and the scope
of the audit are detailed in the extract from the assignment terms of reference at Appendix A.
1.3 As part of the review we have also reviewed with management the implementation of recommendations made in the
Purchase to Pay (Phase One) report presented to the Audit Committee in January 2012.
2 Conclusion
(Amber-Green) Minor weaknesses have been identified in the control framework or non-compliance which may
put achievement of system objectives at risk.
2.1 The LLDC use PS Financials as their financial accounting and management system. Within this is the purchase order
system, Sentinel, which went live on 1 September 2011. The reporting functionality of PS Financials and Sentinel has
been developed in recent months to enable the system to deliver real time financial reports on procurement spend to the
LLDC’s Workstream/ Budget Managers. An upgrade to the SQL report writing function of the server was completed at
the beginning of June and the Finance team have received training on building specific financial reports.
2.2 As the full reporting functionality of Sentinel has yet to be developed and implemented to support the needs of the LLDC,
and is therefore not yet being used within the organisation, we have not been able to fully assess the adequacy of
reporting to budget heads or the effectiveness of financial reporting in relation to procurement expenditure. We plan to
complete this review at a later date. We understand that different arrangements apply within the Transformation
Directorate and their delivery partner (Mace). The system and processes in operation in these areas were outside the
scope of this review.
2.3 The following table summarises the recommendations made across the key risks audited, grouped by priority ratings:
No. Key risk Priority rating
1 2 3
1 Inadequate or unclear reporting arrangements, as set out in the LLDC Financial
Regulations and Finance Manual
- - -
2 The provision of inadequate, inaccurate and/or timely financial reports and financial
management information for budget monitoring purposes
- 1 -
3 Ineffective review of financial reports and financial management information by budget
heads resulting in failure to identify errors, inconsistencies, discrepancies and budget
over/underspends on a timely basis.
- 2 -
4 Ineffective management of identified errors, inconsistencies, discrepancies and budget
over/underspends on a timely basis.
- - -
Total recommendations made - 3 -
2.4 The recommendations and associated management actions arising from the above are detailed in section 5.
3 Key findings
3.1 Key Risk 1: Inadequate or unclear reporting arrangements, as set out in the LLDC Financial Regulations and
Finance Manual
3.2 The Board is responsible for financial oversight of LLDC activities and is supported in this by the Executive Director of
Finance and Corporate Services who is in turn supported by the Interim Director of Finance and Financial Controller.
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 5 13
Since the establishment of the MDC, two Finance Business Partners roles have been introduced. A key purpose of
Finance Business Partners is to support Budget Managers within individual directorates by obtaining and developing
financial reports from PS Financials and Sentinel. Budget Managers remain responsible for reviewing expenditure for
their specific workstreams on a monthly basis and accounting for any significant under/overspends to their Budget
Heads (Executive Directors) as part of the month end process for preparation of the management accounts.
3.3 An upgrade to the SQL report writing function of the server was completed at the beginning of June. The Finance team
have received training on building financial reports but, at the time of this review, training had yet to be given to
Workstream/Budget managers on how to access reports within the system. Budget Managers cannot, therefore, directly
access or create reports on the Sentinel system. We understand that this restriction on the creation of reports will be
maintained in future. Budget Managers will have limited, read-only access to reports in future. We consider these
arrangements to be appropriate to the needs of the organisation.
3.4 We reviewed the current Financial Regulations and Finance Manual and noted that these remain in draft format and
have not been updated, for example, to reflect the change in the organisation’s name and the introduction of the new
Finance Business Partner role. Although The Financial Regulations specify arrangements and procedures for ordering
goods and services, arrangements for managing and reporting on procurement spend, for example, the role of Budget
Managers, is not specified.
3.5 We understand from discussions with the Interim Director of Finance that the need for the update of the Financial
Regulations and Finance Manual has been identified by management and is scheduled to take place during the Games
period, July and August 2012. We have, therefore, not made a recommendation in relation to the update of the
Financial Regulation and Finance Manual but draw management’s attention to our comments above.
3.6 Key Risk 2: The provision of inadequate, inaccurate and/or timely financial reports and financial management
information for budget monitoring purposes
3.7 At present, baseline budgets are loaded into PS Financial, from which financial reports are run which show actual spend
against budget. These financial reports are then used to populate spreadsheet-based reports which form part of the
management accounts pack. The Finance Department is in the process of developing a suite of automated reports to
reduce the use of spreadsheets in the reporting process. As well as making the reporting process more efficient, the
newly- developed reports should also improve the quality of financial reporting. We will review the new financial reports
at a later date.
3.8 We reviewed the types of standard financial management reports available within Sentinel. These include the following
reports: Orders by Workstreams, Outstanding accruals, Procurement Methods, Project Purchase orders, Purchase
Order outstanding commitments, Purchase order overview and Purchase Order statistics. We consider these reports to
provide an adequate level of basic procurement management information. The LLDC now needs to focus on developing
a suite of additional reports to meet the specific needs of the Budget Managers.
3.9 We understand that amendments can be made to the standard reports in Sentinel but that the existing version control
process is not rigorously complied with. It is important to ensure that any modifications made to standard or newly-
created reporting templates within the Sentinel are well controlled to avoid confusion among users. [Recommendation
1].
3.10 We reviewed the current month end management accounts and the process in place for their production. All figures
within the management accounts are agreed by the fourth day following the month end. These are reviewed by the
Financial Controller and Interim Director of Finance on the following day with the addition of appropriate commentary to
explain significant variances prior to review by the Executive Director of Finance and Corporate Services. We consider
these arrangements to be satisfactory. We understand from discussions with the Interim Director of Finance that work is
underway to make the production of the month end management accounts more efficient and effective via the use of the
newly implemented SQL Server report builder and by developing a report template that will better meet the needs of
those who use the management accounts including the Executive Directors and Budget Managers.
3.11 We reviewed the financial reports provided to LLDC Board meetings which now occur every two months. These are
public meetings and, consequently, the level of financial information provided to the meetings is very high level. We
reviewed the summary management accounts provided to the Board for the period ending 31st May 2012 and found
them to be satisfactory for informing strategic decision making. The procurement expenditure of the LLDC is also
reviewed by the Executive Management Team at the their monthly meetings.
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 6 13
3.12 Key Risk 3: Ineffective review of financial reports and financial management information by budget heads
resulting in failure to identify errors, inconsistencies, discrepancies and budget over/underspends on a timely
basis.
3.13 Budget Managers are responsible for raising purchase orders and posting Goods Received Notes to Sentinel. Individual
spreadsheets are maintained on a day-to-day basis to record all goods and services procured to enable Budget
Managers to manage their budgets and to monitor and reconcile expenditure incurred during the month prior to the
monthly management accounts being issued. The Finance Department then provide system-generated reports to
Budget Managers showing how much has been invoiced against each workstream. Budget Managers use this
information to calculate how much work has not been invoiced and therefore needs to be accrued. At present, Budget
Managers rely upon the Finance Department for these system-generated reports; they cannot access them
independently. In future, once appropriate training has been provided, Budget Managers will be able to access
information relating to their workstreams by running their own reports from PS Financial.
3.14 In order to further support the budget management function, we suggest that training is provided to Budget Managers to
enable them to obtain read-only access to real time reports from the system. This will reduce referrals to the Finance
Business Partners and ensure that errors and/or discrepancies are identified and corrected at the earliest opportunity
(Recommendation 2).
3.15 Due to delays in the full implementation of the reporting functionality offered within Sentinel, no post-implementation
review has yet been undertaken. We were informed that the delay was due to PS Financials ceasing to support the SQL
Server version used by LLDC. An upgrade was not available until the new server host, Civica, was fully operational in
June 2012. Once the reporting functionality has been in place and has had time to embed within the organisation, we
recommend that a post-implementation review of the implementation is performed. This will give Budget Managers,
Budget Holders and the Finance Team an opportunity to evaluate the implementation and the effectiveness of the new
reporting functionality of Sentinel (Recommendation 3).
3.16 Key Risk 4: Ineffective management of identified errors, inconsistencies, discrepancies and budget
over/underspends on a timely basis.
3.17 Budget heads and Budget Managers currently review their budget expenditure reports on a monthly basis and receive
detailed breakdowns of project expenditure on a budget versus actual basis as part of the reconciliation between
departmental records and the information provided from Finance as part of the preparation of the management
accounts. The Executive Management Team review the accounts in detail at their regular monthly meetings and an
analysis of the variances takes place at this level. Actions to address budget over/underspends are agreed at each
meeting with guidance from the Executive Director of Finance and Corporate Services.
3.18 We have been unable to assess the impact of the new reporting functionality on the management of identified errors,
inconsistencies, discrepancies and budget over/underspends as this is not yet fully implemented. We will follow up this
aspect of this review at a later date.
3.19 As part of the corporate process for managing project budgets, LLDC have implemented a Change Board, whereby
Budget Managers can put forward requests to vire budgets between projects to ensure that project under/overspends
are managed effectively. All virement requests are submitted to the Change Board in writing with full details of the
proposed budget transfer before any discussion takes place. The Change Board meets every month and is chaired by
the Executive Director of Finance and Corporate Services.
3.20 We briefly reviewed the documentation presented to the recent Change Board and found that this to be satisfactory. At
the time of our review, 25 change requests had been presented to the Change Board from April 2012, with 24 being
approved and one rejected. We will perform a separate internal audit review of change management during 2012/13.
4 Follow up
4.1 As part of this review, we undertook a follow up review on the implementation of recommendations made in Phase One
of the implementation of the Sentinel system. Six recommendations were made; five have been implemented with work
ongoing for the remaining recommendations. Our status update report is provided at section 7.
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 7 13
5 Audit approach
5.1 The audit was undertaken reviewing key documents and meeting with key personnel within LLDC.
5.2 A list of the LLDC staff consulted during the completion of this review is included at Appendix C.
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 8 13
6 Recommendations and management action plan
Finding and implication Recommendation Priority Management response, responsible officer and implementation date
The Finance team are able to
create and modify report
templates within Sentinel.
However, version control is not
robustly applied.
Implication: In the absence of
robust version control, staff may
not be sure of using the most up
to date version of a report
template.
1. Version control should be
introduced and enforced for all
report templates created and
modified within the Sentinel
system to ensure that staff are
able to identify and use the
most up-to-date versions.
2 Management Response: Recommendation accepted
Action to be taken: Implement version control within Sentinel
Responsible officer: Olu Ogunsanlu, Financial Controller
Date for implementation: 31st October 2012
Budget Managers have not yet
received training on how to use
the reporting functionality within
the Sentinel system.
Implication: Budget Managers
will not be able to access
financial reports that may
enhance their effectiveness.
2. Training should be provided to
Budget Managers to enable
them to access key financial
reports from the Sentinel
system. This access should
be limited to read-only.
2 Management Response: Recommendation accepted
Action to be taken: Roll out of training across the Corporation
Responsible officer: Mark Clarke and Louise Jeffery, Senior Finance Business Partners
Date for implementation: 31st December 2012
No post-implementation review
of the new reporting functionality
in Sentinel has been
undertaken.
Implication: The LLDC may fail
to identify lessons to be learned
from the implementation of the
Sentinel reporting functionality
for future reference.
3. A post-implementation review
should be undertaken to
evaluate the implementation of
the reporting functionality
within Sentinel. This should
identify what went well and
lessons to be learned.
3 Management Response: Recommendation accepted
Action to be taken: Carry out the review
Responsible officer: Paul Hilton, Interim Finance Director
Date for implementation: 31st March 2013
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 9 13
7 Follow up on Purchase to Pay (Phase 1) report recommendations
Ref Recommendation Priority Status update as at 26th June 2012
1 Management should investigate whether it is possible to enhance
the existing system-based controls within Sentinel to enforce
delegated authority limits when the value of a single PO has been
allocated across a number of work streams.
Agreed date for implementation: January 2012.
1 Implemented
A patch has been installed on the system whereby authorisation is required for
the total value of a Purchase Order rather than for the separate parts, if the PO
is split across a number of workstreams.
Ref: Interim Director of Finance
2 An audit report should be introduced to identify any instances where
a single PO number has been subject to multiple authorisation. This
report should be run on a monthly basis. Any instances identified
should be investigated to determine whether authorisation controls
had been breached.
Agreed date for implementation: Quarter 1 of 2012/13
2 Implemented
At the time of our review, an LLDC audit report had identified four instances,
prior to the installation of the patch, where a single PO number had been subject
to multiple authorisation. These were under investigation. LLDC have covered
off the multiple approvals issue.
Ref: Interim Director of Finance
3 Existing guidance should be enhanced to state that the allocation of
a single PO value across several work streams must not to be used
to circumvent delegated authority controls and that any such use will
be treated as a serious breach of OPLC financial regulations.
Agreed date for implementation: March 2012
1 On going
Guidance for staff is in the process of being updated. A comprehensive review
of all the financial procedures is due to take place during the Games period.
Revised date for implementation: End of October2012
Responsible officer: Interim Director of Finance
4 The Financial Accounting Manager should ensure that all inputs to
PS Financials are verified and evidence of these checks
documented at all times.
Agreed date for implementation: January 2012.
2 Implemented
All changes are checked and this is demonstrable before changes are made on
the finance system. Sufficient supporting documentation requesting any change
is received from the Budget manager in the form of email. The Finance team
undertake spot checks with the company to ensure that details are correct.
Ref: Financial Controller
5 Management should consider whether to review all purchase orders
since the use of the Sentinel system to identify all instances of
2 Implemented
The upgrade to the SQL server has taken place and a patch has been put in
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 10 13
Ref Recommendation Priority Status update as at 26th June 2012
authorisations above delegated limits. This may assist PS
Financials in their investigations.
Agreed date for implementation : 30th June 2012
place within PS Financials whereby PO authorisation is granted on the total
value of the PO rather than on individual lines where the purchase order has
been split across different workstreams. The only way to circumvent the
authorised schedule of delegated authority is to change the authorisation levels
within the PS Financials system.
Ref: Interim Director of Finance
6 Staff should be reminded that the procurement requirements under
each method must be appropriately satisfied before a purchase
order is raised.
Agreed date for implementation: March 2012
2 Implemented
Updates to the Procurement guidance have been completed and incorporated
into the Financial Regulations of LLDC. The updated Financial Regulations will
be circulated to all staff following approval.
Ref: Interim Director of Finance
Revised date for implementation: End of August 2012.
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 11 13
Appendices
A Audit objectives
Audit objective: Per the terms of reference
Key risks
Effective financial management may be compromised due to:
Inadequate or unclear financial reporting arrangements, as set out in the LLDC Financial
Regulations and Finance Manual;
The provision of inadequate, inaccurate and/or untimely financial reports and financial
management information for budget monitoring purposes;
Ineffective review of financial reports and financial management information by budget heads
resulting in failure to identify errors, inconsistencies, discrepancies and budget
over/underspends on a timely basis; and
Ineffective management of identified errors, inconsistencies, discrepancies and budget
over/underspends on a timely basis.
Scope
An assessment of the adequacy of the existing financial reporting arrangements including:
The clarity and allocation of roles and responsibilities for procurement budget management, in
particular between the Finance team and budget heads;
The availability, clarity and completeness of documentation re budget monitoring, review and
reporting procedures and internal controls;
The adequacy of existing financial management information and financial reports for budget
management purposes.
Testing the operational effectiveness of the budget management and control processes
operated at budget head level.
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 12 13
B Audit definitions
Opinion/conclusion
(Green)
Overall, there is a sound control framework in place to achieve system objectives and the
controls to manage the risks audited are being consistently applied. There may be some
weaknesses but these are relatively small or relate to attaining higher or best practice
standards.
(Amber-Green) Minor weaknesses have been identified in the control framework or non-compliance which may
put achievement of system objectives at risk.
(Amber) Weaknesses have been identified in the control framework or non-compliance which put
achievement of system objectives at risk. Some remedial action will be required.
(Amber-Red)
Significant weaknesses have been identified in the control framework or non-compliance with
controls which put achievement of system objectives at risk. Remedial action should be taken
promptly.
(Red) Fundamental weaknesses have been identified in the control framework or non-compliance with
controls leaving the systems open to error or abuse. Remedial action is required as a priority.
Risk and significance categories
Priority ranking 1:
There is potential for financial loss, damage to the LLDC reputation or loss of information. This
may have implications for the achievement of business objectives and the recommendation
should be actioned immediately.
Priority ranking 2: There is a need to strengthen internal control or enhance business efficiency.
Priority ranking 3: Internal control should be strengthened, but there is little risk of material loss.
London Legacy Development Corporation October 2012
INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting
Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 13 13
C Staff consulted during review
Name: Job title
Jonathan Dutton Executive Director Finance and Corporate Services
Paul Hilton Interim Finance Director
Olu Ogunsanlu Financial Controller
Louise Jeffrey Financial Business Partner
Budget Heads
We would like to thank these staff for their assistance provided during the completion of this review.
Recommended