Internal Audit - Progress Report 2015 / 16 Appendix A... · Audit Lincolnshire – Internal Audit Progress Report 2 Introduction 1 The purpose of this report is to: Advise of progress

1

Appendix A

Internal Audit - Progress Report 2015 / 16

January 2016

Audit Lincolnshire – Internal Audit Progress Report

1

Contents Introduction

2

Key Messages 2 Internal Audit Work Completed December - January 2 Other Significant Work 4 Audits in Progress 4

Performance Information 4 Other Matters of Interest 5 Appendices Appendix 1 – Assurance Definitions 7 Appendix 2 - Major Improvement Needed or Inadequate Internal Audit Reports 8 Appendix 3 – Internal Audit Plan & Schedule 2015/16 9 Appendix 4 - Outstanding Internal Audit Recommendations 13

Contact Details: John Scott Audit Manager

City Hall, Beaumont Fee, Lincoln, LN1 1DD : 01522 873321 [email protected]

mailto:[email protected]


2

Introduction 1 The purpose of this report is to:

Advise of progress being made with the Audit Plan

Provide details of the audit work during the period

Provide details of the current position with agreed management actions in respect of previously issued reports

Raise any other matters that may be relevant to the Audit Committee role

Key Messages

2 The Audit Plan is 63% complete at the end of December. Resources are available during February and March to complete the Plan.

Internal Audit Work Completed December - January

3 The following audits have been completed and final reports issued:

High

Substantial

Limited

Low

None

Parking Services

Strategic Planning & Priorities

None

None

Note The Audit Committee should note that the assurance expressed is at

the time of issue of the report but before the full implementation of the agreed management action plan. Definitions levels are shown in Appendix 1.

4 We are not reporting any Limited or Low assurance audits. 5 In the audits given High and Substantial Assurances we confirmed that the

Council has sound processes in place:

Strategic Planning & Priorities (Substantial) We examined the Council’s arrangements for monitoring its Strategic Plan (delivery plan) including reporting to officers and members. We also examined the completion of project management model and SPIT documentation from a compliance perspective. We found that Strategic Plan monitoring is comprehensive with a range of reports to officers and members.


3

There are only a few areas from the 2014/17 delivery plan (classed as “business as usual”) that appear to fall outside formal reporting arrangements to CMT, Performance Scrutiny Committee and the Executive. It was agreed that some these would in future be reported via the six monthly CMT/PSC/Exec report. Some of the 2014/17 delivery plan projects have stopped, been put on hold or changed in focus. Whilst these may have been reported individually to specific strategic groups, it was agreed that a current status report of all projects would be reported to CMT collectively for completeness. In terms of the completion of project management documentation we found some projects had a greater level of detail which would provide better information to the SPIT Board. We also made some recommendations around LPMM guidance and monitoring which could be improved and these were agreed. Parking Services (Substantial) The focus of this audit was the collection of income from the Council’s Pay and Display machines (payments can be made by cash, credit / debit card or text). Parking Services have effective processes in place to manage the collection of cash from the pay and display machines including:

Procedure notes are in place and include a division of duties for cash handling.

Frequent emptying of cash from Pay & Display machines and regular banking of income.

Cash handling controlled and monitored and subject to supervisory review

Income collection recorded and reconciled to supporting records

Faulty machines identified and time taken to repair is monitored

Regular monitoring and reporting of income budgets

Income is correctly posted to the ledger for parking income and PCN’s. We identified some areas of improvement which would strengthen the controls already in place:

Reduce access to the areas where cash is counted / held. Currently access controls are not sufficiently robust.

Ensure officers undertaking cash counting duties always sign to confirm accuracy of the count.

Extend procedure notes and amend metric control sheets to record the need to report all variances over £10.

Update the health and safety and fraud risk assessments on income collection to reflect recent changes


4

Examine the accounting treatment of overpayments Whilst examining access to the areas used by Parking Services we identified that the control of certain keys was not adequate and this has been brought to the attention of Property Services.

Other Significant Work 6 Counter Fraud

Work is ongoing on a detailed review of NFI (National Fraud Initiative) data

matches (see 6 month Counter Fraud report). We are commencing work to update the Fraud Risk Register, in liaison with

the Lincolnshire Counter Fraud Partnership. 7 Combined Assurance Map Refresh

Meetings with Assistant Directors have been arranged for January / February to obtain information on their service areas. Additional information will be gathered from the Council’s Performance and Risk Management systems and any third party reviews. The data gathered will be used to inform the 2016/17 Audit Plan and the Annual Internal Audit Report and a summary Combined Assurance Report will be presented to this Committee once the work is complete.

Audits in Progress 8 The following 2015/16 work is in progress;

Debtors

Fraud Risk Register refresh

Housing Benefits

ICT – Mobile devices and Back-up

Safeguarding (Safer Recruitment)

Payroll

Combined Assurance Map refresh

Prevent (IT compliance)*

*Prevent audit is funded separately.

Performance Information 9 Our performance against targets for 2015/16 audit work is shown below:


5

Performance Indicator

Target

Actual

Percentage of plan completed 100% (75% at 31 December)

63%

Percentage of recommendations agreed.

100% 100% (21 out of 21)

Percentage of recommendations implemented (of those due)

100% or escalated

84% (11 out of 13) The two not yet implemented will be monitored.

Timescales Draft report issued within 10 working days of completing audit.

Final report issued within 10 working days of closure meeting / receipt of management responses.

Completion of audit within two months of fieldwork starting

100% (4 out of 4) 100% (4 out of 4) 66% (4 out of 4)

Client Feedback on Audit (average)

Good to excellent Excellent (4 received back out of 4 issued)

Other Matters of Interest 10 Lincolnshire Audit Committee Forum The Lincolnshire Audit Committee Forum is an Audit Committee networking

group to enable sharing of good practice, emerging governance and risk issues and hot topics for public sector audit committees. It is designed to help and support audit committee effectiveness.

Audit Lincolnshire are hosting an all-day forum event on 17th March 2016 at

North Kesteven District Council (supported by KPMG). The indicative agenda is;

Morning (Chairman and Vice-Chairman)

What makes an effective audit committee

Information sharing

Hot topics


6

Networking lunch Afternoon (open to all members of the Audit Committee)

Cyber risk

Thinking about risk


7

Appendix 1 - Assurance Definitions1

High

Our critical review or assessment on the activity gives us a high level of confidence on service delivery arrangements, management of risks, and the operation of controls and / or performance. The risk of the activity not achieving its objectives or outcomes is low. Controls have been evaluated as adequate, appropriate and are operating effectively.

Substantial

Our critical review or assessment on the activity gives us a substantial level of confidence (assurance) on service delivery arrangements, management of risks, and operation of controls and / or performance. There are some improvements needed in the application of controls to manage risks. However, the controls have been evaluated as adequate, appropriate and operating sufficiently so that the risk of the activity not achieving its objectives is medium to low.

Limited

Our critical review or assessment on the activity gives us a limited level of confidence on service delivery arrangements, management of risks, and operation of controls and / or performance. The controls to manage the key risks were found not always to be operating or are inadequate. Therefore, the controls evaluated are unlikely to give a reasonable level of confidence (assurance) that the risks are being managed effectively. It is unlikely that the activity will achieve its objectives.

Low

Our critical review or assessment on the activity identified significant concerns on service delivery arrangements, management of risks, and operation of controls and / or performance. There are either gaps in the control framework managing the key risks or the controls have been evaluated as not adequate, appropriate or are not being effectively operated. Therefore the risk of the activity not achieving its objectives is high.

These definitions are used as a means of measuring or judging the results and impact of matters identified in the audit. The assurance opinion is based on information and evidence which came to our attention during the audit. Our work cannot provide absolute assurance that material errors, loss or fraud do not exist.


8

Appendix 2 – Audits where assurance is assessed as ‘Limited’ or ‘Low’ (Executive Summaries only) There are none.

Audit Lincolnshire – Internal Audit Report

9

Appendix 3 – Internal Audit Plan & Schedule 2015/16

Area

Days Indicative Scope Planned Start

Actual Start

Final Report

Status / Assurance Level

CHIEF EXECUTIVE

CRITICAL SERVICE ACTIVITIES

Strategic Planning & Priorities

11

Strategic Plan – Key Project assurance

Q3 October 17 Dec Substantial

DIRECTOR OF RESOURCES

DUE DILIGENCE AREAS 75

Cash & Bank Systems audit Q4

NNDR Systems audit Q4

Creditors Systems audit Q4

Housing Benefits Systems audit Q3/4 Dec Fieldwork in progress

Debtors Systems audit Q3 Nov Fieldwork in progress

Payroll Systems audit Q4 Dec Fieldwork in progress

Key Control testing

General Ledger / Budget management & reporting

Q4

CRITICAL ACTIVITIES

Elections

8

Audit of election expenses prior to claim submission to the Govt

Q2 August 28 Sept Audit completed

Business Continuity & Emergency Planning

Disaster Recovery Plan

Audit postponed to 16/17. Update report provided to Audit Committee Dec 15.

Property Services

5

Follow on work from 14/15 Facilities audit on Gas / Electric servicing & safety

Q4


10

Area


Actual Start

Final Report


DIRECTOR OF DEVELOPMENT AND ENVIRONMENTAL SERVICES

CRITICAL ACTIVITIES

Sport, Recreation & Leisure

10

Leisure centre contracts monitoring arrangements

Q1 June 2 Nov High

Housing Strategy, incl Affordable Housing

Action Plan monitoring & progress

Audit Postponed to 16/17 due to timing of new strategy in 2016.

Economic Regeneration / Major Projects

15

Western Growth Corridor / Transport Hub

As required

Some work ongoing on the Transport Hub and update on Western Growth

DIRECTORATE OF HOUSING AND COMMUNITY SERVICES

CRITICAL ACTIVITIES

Waste collection, street cleansing & ground maintenance

12

Contract management & monitoring

Q2 August 14 Oct High

Due Diligence – Car Park Income 10 Cash & electronic income Q3 October 10 Dec Substantial

Safeguarding 10 Safer recruitment Q4 Dec Fieldwork in progress

Investment 15 New Build Programme Q4 Being prepared

Maintenance

20

Select from Responsive Repairs / Stores / Back office systems / Fleet.

Q4

Strategic & Emerging Risks

Risk Management 5 Assurance for annual opinion April April 15 June Substantial

DWP move into City Hall

10

Building contract & project management

Q2-3 June 5 Nov Substantial

Universal Credit Implications of introduction of UC Audit Postponed to


11

Area


Actual Start

Final Report


16/17 following discussions with officers

Other Due Diligence

Contract Management

7

Key projects, i.e. Boultham Park

As required

Work commenced on Boultham Park project

Corporate Governance 5 Assurance for annual opinion April April 15 June Substantial

ICT

20

Mobile devices Policy review

Q3/4 Dec Fieldwork complete

Counter Fraud

30

Fraud risks, NFI, Strategy, Counter Fraud Assessment

As required

Significant work completed on NFI & Lincs CF Partnership (see 6 month Counter Fraud report). Fraud Risk register and CIPFA Code assessment to complete.

Other Relevant Areas

Contingency

30

Used on brought forward audits, benefit subsidy & reactive fraud

Reactive fraud, error, complaint

10

Used on investigations

HB Subsidy 57 Q1/2 June August Testing completed

Combined Assurance Map 15 Q4 Jan In progress

Risk Advisory Group 3


12

Area


Actual Start

Final Report


Annual Governance Statement 1 Q1 May June

Advice 8

Recommendation Follow Up 13 IMPS migration

Audit Management / Liaison 15 Ongoing

Audit Planning 5

Audit Committee 20 Ongoing

Annual Audit Report 3 May May June

Total Time for 2014/15 450


13

Appendix 4 - Outstanding recommendations as at 20 January 2016

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments / Progress

H M

Assistant Director Corporate Review & Development Corporate Governance

Jan 2011

Substantial 5 4

1

Update Communication Strategy

31 March 2016 Delayed due to other work priorities.

Strategic Priorities Dec 15

Substantial 5 5 All by end June 2016

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments / Progress

H M

Assistant Director Legal & Corporate Support Services

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments / Progress


14

H M

Assistant Director Business Development & Finance IT Security May

2013 Limited 23 21

1

1

IT Disaster recovery plan (High)

Event logging, monitoring and audit policy

31/10/16 See Audit Cttee December report 31/03/16 Work in progress.

Corporate Property

Feb 2015

Effective 1 1 Gas & Electrical Safety training

Extended to 31 Mar 16 (previously 31 Dec 15) Being progressed with suppliers.

Creditors 2014/15 May 2015

Some Improvement

3 2

1 Increase use of purchase orders

Extended 30 Sept 16 (prev March 2016). Part of a wide ranging project.

Treasury Management

Feb 15

Some Improvement

2 1 1

Code of Practice for Treasury Management and accompanying Treasury Management Practices should be reviewed and updated.

Extended to 31 Mar 16 (prev 31 Dec 15) due to budget work taking priority


15

Accountancy June 15

Effective 3 1 2 (Med) Review Financial Procedure Rules & update budget holder manual.

Extended to 30 Apr 16 (prev 31 Dec 15). Documents will be then require formal approval. Delayed due to resources / restructure

Property plant and equipment

May 15

Effective 1 1 Review inventories in line with FPR

31 March 2016

NNDR Aug 15

Effective 3 2 1 (Med) Evidence (signature/date) the sample checking completed on start of year NNDR billing

31 March 2016

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments / Progress

H M

Head of Shared Revenues and Benefits Revs and Bens Shared service

July 2015

Substantial 2 1 1 Create data sharing protocol

Extended to 28 Feb 16 (previously 31 Dec 2015) Work is underway between legal services and the districts to create and maintain a county wide Data Sharing Protocol.

http://colc-ten/tenweb/tenweb.dll?model%3D%7B4D7791D4-15A4-4D10-95B4-E91D301E010F%7D%26object%3DO14%3A139%26type%3DOBJPAGE






16

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments /

Progress

H M

Assistant Director Housing Vehicle Fuel Management

Feb 2013

Limited 8 6

1 1

Increase analysis of fuel data (High) Introduce instructions for fuel cards & update the Driver and Vehicle Codes of Practice.

31 July 2016 In progress. 31 March 2016 Both recs have been delayed due Fleet Officer absence.

Reactive Repairs – Stores Contract

April 2013

Limited 7 6

1

Make a decision on the disposal of old stock (High)

Extended to 31 Mar 16 (previously 31 Dec 15) Progress is being made. The items have been catalogued and prepared for sale and disposal methods are being considered.

Housing Benefits Nov 2013

Substantial 3 2 1 Identify and address the reasons for the Benefits – Rents interface not working properly

31 December 2015 A revised interface is awaiting testing.


17

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments / Progress

H M

Assistant Director Communities & Street Scene Boultham Park Restoration

April 2014

N/A 2 1 1 Complete Project Management Checklist B

31 December 2015 (on track)

Waste Collection, Recycling, Street Cleansing & Grounds Maintenance contract management

Oct 2015

High 3 2 1 Monitor action on complaints quarterly

31/03/2016 Being set up now To implement for Q4 2015/16

Parking Services Dec 15

Substantial 11 7 4 (2H2M)

Residual recommendations around physical security

31/3/16

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments / Progress

H M

Assistant Director Health & Environmental Services Empty Homes Sep

2013 Limited 6 5

(4) 1 Review the Private

Sector Housing Enforcement Strategy

Extended to 31 March 2016

Procurement £10,000 - £75,000

Feb 2015

Some Improvement

3 2 1 Seek retrospective approval for non-compliance with CPR

31 January 2016


18

Bereavement Services

Nov 2014

Some Improvement

5 3 2 Use the corporate debtors system Update procedure notes and include all income collection duties

28 Feb 2016 (Prev 31 December 2015) 31/03/2016 Commenced

Leisure Contract Management

Nov 2015

High 2 1 1 (Med) Update the current risk register and action plan following the renegotiation of the Birchwood contract and document the quarterly reviews.

31 January 2016

Audit Area

Date

Assurance

Number of Recs

Implem’d

Outstanding

Not Yet

Due

Recommendation /

Agreed Action

Comments /

Progress

H M

Assistant Director Planning and Regeneration Development management

May 15

Some Improvement

6 4 1 1 Guidance for commenting on planning applications should be updated, approved and republished on the website Determine record retention requirements & introduce an active retention & disposal process.

Extended to 31 Jan 2016 (previously 30 Oct 2015). 28 Feb 16


19