Internal Audit Progress Report - London Waste and ... · • Investment Infrastructure Programme – Evaluation & Award ... Our audit of the internal controls operating over the contract

Internal Audit

Progress Report

For the year ended 31st March 2015

Presented to the Audit Committee meeting of: 13th March 2015

Contents 01 Introduction

02 The Role of Internal Audit

03 Summary of internal audit activity since the last Audit Committee

meeting

04 Key issues arising from the internal audit programme to date

05 Comparison to detailed Audit Timetable for 2014/15

06 Contact Details

Status of our reports

This report and the work connected therewith are subject to the Terms and Conditions of the Engagement Letter dated 24 July 2014 between the

London Waste and Recycling Board and Mazars Public Sector Internal Audit Limited. This report is confidential and has been prepared for the

sole use of the London Waste and Recycling Board. This report must not be disclosed to any third party or reproduced in whole or in part without

our prior written consent. To the fullest extent permitted by law, we accept no responsibility or liability to any third party who purports to use or

rely, for any reason whatsoever, on this report, its contents or conclusions.

Page 1

01 Introduction 1.1 The purpose of this report is to update the Audit Committee as to the progress in respect of the Operational Plan for the year ended 31st March 2015.

The plan was considered and approved by the Audit Committee at its meeting on 10th September 2014.

02 The Role of Internal Audit 2.1 The Board of the London Waste and Recycling Board (LWARB) are responsible for ensuring that the organisation has proper internal control and

management systems in place. In order to do this, the Board must obtain assurance on the effectiveness of those systems throughout the year, and is required to make a statement on the effectiveness of internal control within its annual report and financial statements.

2.2 Internal audit provides the Board, through the Audit Committee, with an independent and objective opinion on governance, risk management and internal control and their effectiveness in achieving the organisation’s agreed objectives. Internal audit also has an independent and objective advisory role to help line managers improve governance, risk management and internal control. The work of internal audit, culminating in our annual opinion, forms a part of LWARB’s overall assurance framework and assists LWARB in preparing an informed statement on internal control.

2.3 Responsibility for a sound system of internal control rests with the Board and work performed by internal audit should not be relied upon to identify all

weaknesses which exist or all improvements which may be made. Effective implementation of our recommendations makes an important contribution to

the maintenance of reliable systems of internal control and governance.

2.4 Internal audit should not be relied upon to identify fraud or irregularity, although our procedures are designed so that any material irregularity has a

reasonable probability of discovery. Even sound systems of internal control will not necessarily be an effective safeguard against collusive fraud.

2.5 Our work is delivered is accordance with the Public Sector Internal Audit Standards (PSIAS).

Page 2

03 Summary of internal audit activity since the last Audit Committee meeting

3.1 We have issued five final reports since the last meeting of the Audit Committee. These relate to the following:

• Core Financial Systems

• Budget Control & Forecasting

• Investment Infrastructure Programme – Evaluation & Award

• Investment Infrastructure Programme – Contracting & Monitoring

• Efficiency Programme

3.2 At the time of writing, in respect of Data Security, we are in process of liaising with the London Fire Brigade Internal Audit Team with regards the provision of assurance they can provide over the IT systems that LWARB rely upon and this will be presented at the next meeting of the Audit Committee.

3.3 The final piece of work for 2014/15 will be the follow-up this years reports to ensure that agreed recommendations have been implemented.

3.4 As has been the case in previous years, we will be looking to facilitate a risk workshop with the Board with a view to refreshing the strategic risk register. We are hoping to hold the workshop in late Spring / early Summer, after which the 2015/16 Internal Audit Plan will be agreed.

Page 3

04 Key issues arising from the internal audit programme to date 4.1 The following table provides a summary of assurances and the number and categorisation of recommendations in reports issued to date.

Ref Auditable Area Report Status

Evaluation Assessment

Testing Assessment

Priority 1 (Fundamental)

Priority 2 (Significant)

Priority 3 (Housekeeping)

Total

01.14/15 Risk Management Final Full Substantial - - 2 2

02.14/15 Corporate Governance Final Substantial Substantial - 1 - 1

03.14/15 Core Financial Systems Final Substantial Substantial - 1 3 4

04.14/15 Budget Control & Forecasting Final Substantial Full - 1 - 1

05.14/15 Investment Infrastructure Programme: Evaluation & Award

Final Full Substantial - - 1 1

06.14/15 Investment Infrastructure Programme: Contracting & Monitoring

Final Substantial Substantial - 2 - 2

07.14/15 Efficiency Programme Final Full Full

Total 0 5 6 11

Page 4

4.2 We use the following levels of opinion and recommendation classifications within our audit reports:

Assurance Gradings

In order to provide management with an assessment of the adequacy and effectiveness of their systems of internal control, the following definitions are used:

Level Symbol Evaluation Assessment Testing Assessment

Full There is a sound system of internal control designed to achieve the system objectives.

The controls are being consistently applied.

Substantial Whilst there is a basically sound system of internal control design, there are weaknesses in design which may place some of the system objectives at risk.

There is evidence that the level of non-compliance with some of the controls may put some of the system objectives at risk.

Limited Weaknesses in the system of internal control design are such as to put the system objectives at risk.

The level of non-compliance puts the system objectives at risk.

Nil Control is generally weak leaving the system open to significant error or abuse.

Significant non-compliance with basic controls leaves the system open to error or abuse.

The assurance gradings provided above are not comparable with the International Standard on Assurance Engagements (ISAE 3000) issued by the International Audit and Assurance Standards Board and as such the grading of ‘Full Assurance’ does not imply that there are no risks to the stated objectives.

Page 5

Recommendation Gradings

In order to assist management in using our internal audit reports, we categorise our recommendations according to their level of priority as follows:

Level Definition

Priority 1 Recommendations which are fundamental to the system and upon which the organisation should take immediate action.

Priority 2 Recommendations which, although not fundamental to the system, provide scope for improvements to be made.

Priority 3 Recommendations concerning issues which are considered to be of a minor nature, but which nevertheless need to be addressed.

System Improvement Opportunity

Issues concerning potential opportunities for management to improve the operational efficiency and/or effectiveness of the system.

Page 6

05 Comparison to Detailed Audit Timetable for 2014/15

Auditable Area Planned Fieldwork Date

Draft Report Date

Final Report Date

Target Audit Committee

Comments

Risk Management October 2014 November 2014 November 2014 December 2014

Corporate Governance October 2014 November 2014 November 2014 December 2014

Investment Infrastructure

Programme: Evaluation & Award

January 2015 January 2015 February 2015 March 2015

Investment Infrastructure

Programme: Contracting &

Monitoring

January 2015 January 2015 February 2015 March 2015

Efficiency Programme February 2015 February 2015 March 2015 March 2015

Core Financial Systems November 2014 December 2014 December 2014 March 2015

Budget Control & Forecasting November 2014 December 2014 December 2014 March 2015

Data Security February 2015 June 2015 Fieldwork completed; being reviewed.

Follow-up March 2015 June 2015

06 Contact Details

Contact Details

Mark Towler 07710 811056

[email protected]

Brian Welch

07780 970200

[email protected]

London Waste and Recycling Board

Final Internal Audit Report

Efficiency Programme March 2015

This report has been prepared on the basis of the limitations set out on page 8.

CONFIDENTIAL

Distribution List:

Antony Buchan – Head of Programme – Local Authority Support

Adam Leibowitz – Governance and Secretariat Officer

Wayne Hubbard – Chief Operating Officer

Key Dates:

Date of fieldwork: 10–13 February 2015

Date of draft report: 24 February 2015

Receipt of responses: 2 March 2015

Date of final report: 2 March 2015

This report and the work connected therewith are subject to the Terms and Conditions of the Contract dated 24 July 2014 between the London Waste and Recycling Board and Mazars Public Sector Internal Audit Limited. This report is confidential and has been prepared for the sole use of the London Waste and Recycling Board. This report must not be disclosed to any third party or reproduced in whole or in part without our prior written consent. To the fullest extent permitted by law, we accept no responsibility or liability to any third party who purports to use or rely, for any reason whatsoever, on this report, its contents or conclusions.

London Waste and Recycling Board - Final Report

Confidential

Contents 1. Executive Summary ...................................................................................................................... 1

2. Scope of Assignment .................................................................................................................... 3

3. Assessment of Control Environment ............................................................................................. 4

4. Observations and Recommendations ........................................................................................... 5

Appendix A - Reporting Definitions ....................................................................................................... 6

Appendix B - Staff Interviewed .............................................................................................................. 7

Statement of Responsibility................................................................................................................... 8


Confidential 1

1. Executive Summary 1.1. Background

This audit forms part of the agreement between Mazars Public Sector Internal Audit and London Waste & Recycling Board (LWARB). It was carried out as part of the approved Internal Audit Plan for 2014/15.

In LWARB’s Business Plan, 2013-15, it sets out how it has considered the services it should provide in order to deliver the Plan. Amongst the three principal areas LWARB intends to pursue over the next two financial years is the Waste Efficiencies Programme. LWARB will work with the public sector and aligned organisations to deliver efficiency savings and improved performance across London through: Joint Procurement; Waste Management Services Framework; Efficiency Reviews; Framework Agreements; Sharing Services; Communications; provision of Good Practice tools including workshops.

The audit reviewed the overall arrangements in place for delivering the Efficiencies Programme as a whole. Testing was then focussed on two specific work streams; these being the Efficiency Reviews and Sharing Services / Partnership Working.

Risks in respect of the Efficiencies Programme were included within the Risk Register which was presented at the Audit Committee on 2nd December 2014. These included the following:

• External consultants / partners do not deliver on their contracts / Memorandum of Understanding’s (MOU’s). (ref. 10)

• Supported projects (including efficiencies programme) do not deliver their intended benefits. (ref. 15)

1.2. Audit Objective and Scope

The overall objective of this audit was to provide assurance that the Board have implemented adequate and effective controls over the Efficiencies Programme, in line with the control objectives listed in Section 2.

In summary, the scope covered the areas of legislation, policies and procedures; strategic objectives; governance arrangements; contract and arrangements; project monitoring routines; and budgets. Further detail on the scope of the audit is provided in Section 2 of the report.

1.3. Summary Assessment

Our audit of the internal controls operating over the contract and monitoring process found that there is a sound system of internal control designed to achieve the system objectives and the controls are being consistently applied.

Our assessment in terms of the design of, and compliance with, the system of internal control covered is set out below:

Evaluation Assessment Testing Assessment

Full Full

Management should be aware that our internal audit work was performed according to the Public Sector Internal Audit Standards which are different from audits performed in accordance with International Standards on Auditing (UK and Ireland) issued by the Auditing Practices Board.

Similarly, the assessment gradings provided in our internal audit report are not comparable with the International Standard on Assurance Engagements (ISAE 3000) issued by the International Audit and Assurance Standards Board. The classifications of our audit assessments and priority ratings definitions for our recommendations are set out in more detail in Appendix A, whilst further analysis of the control environment for the Efficiencies Programme is shown in Section 3.


Confidential 2

1.4. Key Findings

No recommendations have been raised as a result of this audit. The control environment was found to be adequate to manage the risks to the objectives of the Programme, and where testing was conducted, it was found that the controls were operating effectively.

1.5. Acknowledgement

We would like to take this opportunity to thank all staff involved for their time and co-operation during the course of this visit.


Confidential 3

2. Scope of Assignment 2.1. Objective

The overall objective of this audit was to provide assurance that the system of control in respect of the Efficiencies Programme, with regards the areas set out in section 2.3, are adequate and are being consistently applied.

2.2. Approach and Methodology

The following procedures were developed with reference to the Public Sector Internal Audit Standards, and by an assessment of risks and management controls operating within each area of the scope. The following procedures were adopted:

• Identification of the role and objectives of each area;

• Identification of risks within the systems, and controls in existence to allow the control objectives to be achieved; and

• Evaluation and testing of controls within the systems.

2.3. Areas Covered

In accordance with our agreed terms of reference, dated December 2014, our work was undertaken to cover the following system control objectives:

• Legislation, Policies and Procedures

All staff act consistently in compliance with legislative and management requirements and administration of the Efficiencies Programme is conducted in an economic, efficient and effective manner.

• Strategic Objectives

The Efficiencies Programme is aligned with the LWARB strategic objectives set out in the Business Plan.

• Governance Arrangements

There are robust governance arrangements that underpin the delivery of the Efficiencies Programme, including the roles and responsibilities of officers, the Efficiencies Committee and external bodies such as Local Partnership, Board over-sight, transparency and reporting.

• Contracts / Agreements

Contracts / agreements are in place with external bodies, for example local authorities and Local Partnership, which set out the respective roles of all parties, key performance indicators, reporting routines, funding agreements, etc.

• Project Monitoring Routines

There are robust project monitoring routines in place, including key milestones, key performance indicators, etc.

There are effective processes in place to ensure loan repayment, for example phase 2 efficiency review funding.

There are robust procedures in place to ensure that LWARB investments are used for the purposes for which the funding was awarded and that the expected benefits are realised.

There is continuous assessment of the viability of individual work streams.

• Budgets

There are effective budgetary control mechanisms in place to ensure that the Efficiency Programme remains within budget.


Confidential 4

3. Assessment of Control Environment The following table sets out in summary the control objectives we have covered as part of this audit, our assessment of risk based on the adequacy of controls in place, the effectiveness of the controls tested and any resultant recommendations.

Control Objectives Assessed Design of Controls

Operation of Controls

Recommendations Raised

Legislation, Policies and Procedures

Strategic Objectives

Governance Arrangements

Contracts / Agreements

Project Monitoring Routines

Budgets

The classifications of our assessment of risk for the design and operation of controls are set out in more detail in Appendix A.


Confidential 5

4. Observations and Recommendations As referred to in the Executive Summary, no recommendations have been raised in relation to this audit.


Confidential 6

Appendix A - Reporting Definitions Assurance Gradings



Full There is a sound system of internal

control designed to achieve the system objectives.


Substantial

Whilst there is a basically sound system of internal control design, there are weaknesses in design which may place some of the system objectives at risk.









Level Definition







Confidential 7

Appendix B - Staff Interviewed The following personnel were consulted:

Antony Buchan - Head of Programme – Local Authority Support

Beverley Simonson - Business Development Officer (Local Authority Support)

Adam Leibowitz - Governance and Secretariat Officer

We would like to thank the staff involved for their co-operation during the audit.


Confidential 8

Statement of Responsibility We take responsibility for this report which is prepared on the basis of the limitations set out below.

The matters raised in this report are only those which came to our attention during the course of our work and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by you for their full impact before they are implemented. The performance of our work is not and should not be taken as a substitute for management’s responsibilities for the application of sound management practices. We emphasise that the responsibility for a sound system of internal controls and the prevention and detection of fraud and other irregularities rests with management and work performed by us should not be relied upon to identify all strengths and weaknesses in internal controls, nor relied upon to identify all circumstances of fraud or irregularity. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. Our procedures are designed to focus on areas as identified by management as being of greatest risk and significance and as such we rely on management to provide us full access to their accounting records and transactions for the purposes of our work and to ensure the authenticity of such material. Effective and timely implementation of our recommendations by management is important for the maintenance of a reliable internal control system.

Mazars Public Sector Internal Audit Limited

London

March 2015

This document is confidential and prepared solely for your information. Therefore you should not, without our prior written consent, refer to or use our name or this document for any other purpose, disclose them or refer to them in any prospectus or other document, or make them available or communicate them to any other party. No other party is entitled to rely on our document for any purpose whatsoever and thus we accept no liability to any other party who is shown or gains access to this document.

In this document references to Mazars are references to Mazars Public Sector Internal Audit Limited.

Registered office: Tower Bridge House, St Katharine’s Way, London E1W 1DD, United Kingdom. Registered in England and Wales No 4585162.

Mazars Public Sector Internal Audit Limited is a subsidiary of Mazars LLP. Mazars LLP is the UK firm of Mazars, an international advisory and accountancy group. Mazars LLP is registered by the Institute of Chartered Accountants in England and Wales to carry out company audit work.



Investment Infrastructure Programme – Contracting & Monitoring February 2015


CONFIDENTIAL

Distribution List:

James Lanman – Head of Finance


Wayne Hubbard - Chief Operating Officer

Key Dates:

Date of fieldwork: 15th January 2015

Date of draft report: 21st January 2015

Receipt of responses: 11th February 2015

Date of final report: 16th February 2015



Confidential





Recommendation 1: Policy and Procedure review (Priority 2)…………………………………………. 5

Recommendation 2: Contract Monitoring (Priority 2)……………………………………………………..6



Statement of Responsibility................................................................................................................. 10


Confidential 1



The LWARB has broken down its delivery of its Business Plan into three principal areas, one of which is Tailored Infrastructure Investment. This entails the provision of funding to enable the development of projects that meet the strategic requirements of LWARB (geographically and technologically) to the extent that funding is not available from the private sector.

The Business Plan sets out how LWARB will tailor its financial support based upon an assessment of individual project propositions. The following elements underpin the LWARB approach:

• Flexibility: Tailored approach to the type of financial support provided by LWARB.

• Additionally: LWARB believes that it must lever-in significant private sector finance through its investments. However, given the urgent need to develop additional waste infrastructure in London, LWARB will not be setting any leverage targets, but will judge each project on its merits whilst reporting leverage achieved.

• Project Location: LWARB is particularly keen to support projects outside of East London during this plan period in order to support the development of localised solutions. LWARB will work closely with the London boroughs and waste disposal authorities, as well as utilising the gap analysis, to inform strategic decisions.

• Commerciality: LWARB is of the view that if a project is sustainable, it must be commercially viable and capable of taking on board investment at commercial rates. As such, LWARB will offer support to projects that can exhibit the ability to repay LWARB’s investment, albeit such investment will be structured in such a way that the project sustainability is not compromised.

• Public and Private Sector Support: LWARB will support projects that are being developed by the public or private sector (or a combination of both).


The overall objective of this audit was to provide assurance that the Board have implemented adequate and effective controls over the contracting and monitoring process of projects for its Investment Infrastructure Programme in line with the control objectives listed in Section 2.

In summary, the scope covered the areas of legislation, policies and procedures; loan agreements; project monitoring routines; and budgets. Further detail on the scope of the audit is provided in Section 2 of the report.


Our audit of the internal controls operating over the contract and monitoring process found that whilst there is a basically sound system of internal control design, there are weaknesses in design which may place some of the system objectives at risk. Also, there is evidence that the level of non-compliance with some of the controls may put some of the system objectives at risk.



Substantial Substantial


Confidential 2


Similarly, the assessment gradings provided in our internal audit report are not comparable with the International Standard on Assurance Engagements (ISAE 3000) issued by the International Audit and Assurance Standards Board. The classifications of our audit assessments and priority ratings definitions for our recommendations are set out in more detail in Appendix A, whilst further analysis of the control environment for the Investment Infrastructure programme - contracting and monitoring process is shown in Section 3.

1.4. Key Findings

We have raised two priority 2 recommendations where we believe there is scope for improvement within the control environment. These are set out below:

• Policies and Procedures regarding the contract and monitoring of projects should be reviewed and updated on a regular basis. Evidence of this should be retained and clearly recorded on the procedures. In addition, procedures should be adopted regarding the oversight of project monitoring and budget monitoring requirements of the investment infrastructure programme.

• Requirements set out in loan agreements should be adhered to by the borrower and LWARB in respect of the provision of key documentation throughout the duration of the agreement. Where documentation is not required to be provided, a clear record explaining why this is the case should be retained on file.

Full details of the audit findings and recommendations are shown in Section 4 of the report.

1.5. Management Response

We have included a summary of management’s response in Section 4 – Observations and Recommendations.




Confidential 3


The overall objective of this audit was to provide assurance that the system of control in respect of the Investment Infrastructure Programme – Contracting and Monitoring process, with regards the areas set out in section 2.3, are adequate and are being consistently applied.






2.3. Areas Covered



All staff act consistently in compliance with legislative and management requirements and administration of the Investment Infrastructure Programme is conducted in an economic, efficient and effective manner.

• Loan Agreements

Signed loan agreements are in place in respect of all IIP funding arrangements.

The loan agreements clearly set out the conditions under which the funding is provided.

The loan agreements set out the monitoring and reporting routines, including ‘step in’ rights should they be required.

• Project Monitoring Routines

There are robust project monitoring routines in place, including key milestones, key performance indicators, etc.

There are effective processes in place to ensure loan repayment, including escalation processes should the need arise.

There are robust procedures in place to ensure that LWARB investments are used for the purposes for which the funding was awarded and that the expected benefits are realised.

There is continuous assessment of the viability of individual projects.

• Budgets

There are effective budgetary control mechanisms in place to ensure that IIP funding remains within budget.


Confidential 4






Recommendation 1

Loan Agreements

Project Monitoring Routines

Recommendation 2

Budgets



Confidential 5

4. Observations and Recommendations Recommendation 1: Policy and Procedure Review (Priority 2)

Recommendation

Policies and Procedures regarding the contract and monitoring of projects should be reviewed and updated on a regular basis. Evidence of this should be retained and clearly recorded on the procedures. In addition, procedures should be adopted regarding the oversight of project monitoring and budget monitoring requirements of the investment infrastructure programme.

Risk

Where Policies and Procedures are not updated on a regular basis, there is a risk that out of date or inconsistent procedures are followed by staff.

Observation

Having detailed, up to date and regularly reviewed procedures will help to ensure that consistent and up to date procedures are followed by all staff. Examination of the procedures in place regarding Contract and Monitoring of projects identified the following exceptions: • procedures were last reviewed in February 2011;

• procedures are currently out of date and make reference to prior legal service organisations used by LWARB and prior monitoring actions undertaken;

• there are currently no procedures in place regarding the oversight of project monitoring actions undertaken, or budget monitoring requirements; and

• procedures do not include the name of the reviewer.

Responsibility

Head of Finance


Confidential 6

Management response / deadline

Agree that policies and procedures regarding contracting and monitoring of investment should be reviewed and updated if necessary on an annual basis, with evidence of this retained/recorded – to be reviewed annually by 31 March.

Agree that procedures should note the name of the reviewer. Ongoing

Re. oversight of project monitoring actions undertaken – to add some context to the above – I believe that this refers to the fact that currently individual officers are responsible for the monitoring of individual projects, and there is no requirement in place for a second pair of eyes to review the documentation submitted by these projects.

Loan facility agreements include requirements to submit regular information on project progress. Where projects are performing well/ to plan, the regular submission of this information is critical in order to flag potential issues early, and we therefore agree that while projects are performing well, and are therefore only submitting information in accordance with contractual requirements, this information should be reviewed by two officers in order to offer a measure of control around potential new risks arising being missed.

Where projects move into periods of distress this situation changes, as a) key risks have already materialised and management of resulting issues is ongoing, b) there is frequent contact with the project, including regular information submitted outside the scope of that required by the loan facility agreement (usually including weekly reports) and c) there is regular internal discussion within LWARB and with the IC. In this situation we do not feel it is practical to have a formal process in place whereby every piece of information submitted is reviewed by two officers (it is also worth noting that, per the management response to Recommendation 2 below, in situations where projects are in distress, more regular information received from projects can often supersede that required by the loan facility agreement).

Management therefore propose that the spreadsheet currently maintained to track the submission of information from projects shows that where projects are performing well and information is being submitted according to loan facility agreement requirements, this information is reviewed by two officers, with their names noted. However where projects are in distress as described above, this is flagged, and the requirement for review of all information submitted by two officers is removed. Monthly/ongoing

Re. budget monitoring requirements – there are currently no procedural requirements for the official monitoring of capital spend against budget, this simply being done informally.. Currently given the large underspend there has not been the need for close monitoring of spend against budget, however management propose that from 1st April 2015 (i.e. the new business plan period), capital spend against budget is monitored appropriately. Ongoing.


Confidential 7

Recommendation 2: Contract Monitoring (Priority 2)

Recommendation

Requirements set out in loan agreements should be adhered to by the borrower and LWARB in respect of the provision of key documentation throughout the duration of the agreement. Where documentation is not required to be provided, a clear record explaining why this is the case should be retained on file.

Risk

Where detailed records explaining why certain documentation is not required is not retained there is a risk that ineffective audit trails are in place with regards to the monitoring process. In addition, where reasons for actions undertaken are not recorded there is a risk that the LWARB will be unable to respond to third party challenge.

Observation

Retaining detailed records explaining why certain documentation is not required will help to ensure that a clear audit trail of the monitoring process is maintained and that actions can be clearly explained in the event of third party challenge. Testing of a sample of two loan agreements identified one instance where monthly construction reports were required to be completed by the borrower up to the completion date of the project. Examination of the reports retained by LWARB identified that two out of four required reports had not been submitted. Discussions with the Head of Finance identified these reports may not have been required, however there was no record of why these reports were not received on the file notes of the case.

Responsibility

Head of Finance


Loan facility agreements include requirements to submit regular information on project progress. When projects move into distress, however, these are in many cases superseded by the submission of much more regular/detailed information, and frequent dialogue with the project and LWARB’s investment committee.

A spreadsheet is currently maintained tracking the submission of information required by loan facility agreements. We agree that where this information is not submitted as a result of the project being in distress and more frequently submitted information/ongoing dialogue superseding it then a note should be made on the spreadsheet explaining why the information submissions was not required/why LWARB is in possession of the relevant information through other means. Monthly, ongoing.


Confidential 8







Substantial










Level Definition







Confidential 9


James Lanman - Head of Finance




Confidential 10




London

February 2015







Investment Infrastructure Programme – Evaluation & Award February 2015


CONFIDENTIAL

Distribution List:




Key Dates:

Date of fieldwork: 15th January 2015

Date of draft report: 21st January 2015

Receipt of responses: 11th February 2015

Date of final report: 16th February 2015



Confidential





Recommendation 1: Process Chart Review (Priority 3) 5





Confidential 1



The LWARB has broken down its delivery of its Business Plan into three principal areas, one of which is Tailored Infrastructure Investment. This entails the provision of funding to enable the development of projects that meet the strategic requirements of LWARB (geographically and technologically) to the extent that funding is not available from the private sector.

The Business Plan sets out how LWARB will tailor its financial support based upon an assessment of individual project propositions. The following elements underpin the LWARB approach:

• Flexibility: Tailored approach to the type of financial support provided by LWARB.

• Additionally: LWARB believes that it must lever-in significant private sector finance through its investments. However, given the urgent need to develop additional waste infrastructure in London, LWARB will not be setting any leverage targets, but will judge each project on its merits whilst reporting leverage achieved.

• Project Location: LWARB is particularly keen to support projects outside of East London during this plan period in order to support the development of localised solutions. LWARB will work closely with the London boroughs and waste disposal authorities, as well as utilising the gap analysis, to inform strategic decisions.

• Commerciality: LWARB is of the view that if a project is sustainable, it must be commercially viable and capable of taking on board investment at commercial rates. As such, LWARB will offer support to projects that can exhibit the ability to repay LWARB’s investment, albeit such investment will be structured in such a way that the project sustainability is not compromised.

• Public and Private Sector Support: LWARB will support projects that are being developed by the public or private sector (or a combination of both).


The overall objective of this audit was to provide assurance that the Board have implemented adequate and effective controls over the evaluation and award process of projects for its Investment Infrastructure Programme in line with the control objectives listed in Section 2.

In summary, the scope covered the areas of legislation, policies and procedures; strategic objectives; governance arrangements; evaluation; and award. Further detail on the scope of the audit is provided in Section 2 of the report.


Our audit of the internal controls operating over the evaluation and award process found that there is a sound system of internal control designed to achieve the system objectives. However, there is evidence that the level of non-compliance with some of the controls may put some of the system objectives at risk.



Full Substantial



Confidential 2

Similarly, the assessment gradings provided in our internal audit report are not comparable with the International Standard on Assurance Engagements (ISAE 3000) issued by the International Audit and Assurance Standards Board. The classifications of our audit assessments and priority ratings definitions for our recommendations are set out in more detail in Appendix A, whilst further analysis of the control environment for the Investment Infrastructure programme - evaluation and award process is shown in Section 3.

1.4. Key Findings

We have raised one priority 3 recommendation where we believe there is scope for improvement within the control environment. This is set out below:

• Process charts and procedure notes for the evaluation and awarding of projects should be reviewed on an annual basis and evidence of the review being undertaken should be retained.



We have included a summary of management’s response in Section 4 – Observations and Recommendations.




Confidential 3


The overall objective of this audit was to provide assurance that the system of control in respect of the Investment Infrastructure Programme – Evaluation and Award process, with regards the areas set out in section 2.3, are adequate and are being consistently applied.






2.3. Areas Covered



All staff act consistently in compliance with legislative and management requirements and administration of the Investment Infrastructure Programme is conducted in an economic, efficient and effective manner.

• Strategic Objectives

The Investment Infrastructure Programme is aligned with the LWARB strategic objectives set out in the Business Plan.

• Governance Arrangements

There are robust governance arrangements that underpin the evaluation and award of funding, including the roles and responsibilities of officers and the Investment Committee, Board over-sight, transparency and reporting.

• Evaluation

There is a robust and transparent evaluation process in place, including effective due diligence arrangements.

• Award

There is an approved criteria in place that underpins the evaluation and funding decision process that is able to stand up to third party scrutiny. Approval of funding decisions are in accordance with agreed procedures, whilst documentary evidence is provided to support all decisions made.


Confidential 4






Recommendation 1

Strategic Objectives

Governance Arrangements

Evaluation

Award



Confidential 5

4. Observations and Recommendations Recommendation 1: Process Chart and Procedure notes Review (Priority 3)

Recommendation

Process charts and procedure notes for the evaluation and awarding of projects should be reviewed on an annual basis and evidence of the review being undertaken is retained.

Risk

Where procedures are not reviewed and updated on an annual basis, there is a risk that inconsistent or out of date practices are followed by staff.

Observation

Having regularly reviewed procedures in place will help to ensure consistent and up to date practices are followed by all staff. Discussions with the Head of Finance identified that the process chart and procedure notes for the evaluation and awarding of projects was reviewed in Autumn 2014, however no evidence of the review being undertaken could be obtained. In addition, we were unable to confirm that procedures are reviewed on an annual basis.

Responsibility

Head of Finance


Agree that process charts/procedure notes should be reviewed on an annual basis with evidence of the review retained. By 31 March annually//ongoing.


Confidential 6







Substantial










Level Definition







Confidential 7






Confidential 8




London

February 2015







Budget Control and Forecasting

December 2014


CONFIDENTIAL

Distribution List:




Key Dates:

Date of fieldwork: November 2014

Date of draft report: December 2014

Receipt of responses: December 2014

Date of final report: December 2014



Confidential





Recommendation 1: Formal Annual Budget Approval (Priority 2) 5





Confidential 1


As part of the 2014/15 Internal Audit Plan, we carried out an audit of Budget Control and Forecasting.

Revenue budgeting, forecasting, monitoring and reporting are key financial processes in all organisations, and in the public sector, not only is the budget a vital control mechanism, it is also a statement of intent about the planned use of public monies. Without losing its control and accountability mechanisms, modern budgeting needs to better support performance management by integrating known financial outcomes with frequent re-forecasting of the budget and analysis of performance trends.

Risks in respect of Budget Control and Forecasting were included within the Risk Register which was presented at the Audit Committee on 2nd December 2014. This included the following:

• LWARB is not sustainable as an on-going concern due to inability to secure further government funding beyond current commitments (to April 2015) and/or failure of invested projects to deliver the returns anticipated. (ref. 24)


The overall objective of this audit was to provide assurance that the Board have implemented adequate and effective controls over Budget Control and Forecasting in line with the control objectives listed in Section 2.

In summary, the scope covered the areas of regulatory, organisational and management requirements; budget setting; budget upload; budget monitoring; alterations and virements and financial and performance management reporting. Further detail on the scope of the audit is provided in Section 2 of the report.


Our audit of the internal controls operating over the Budget Control and Forecasting process found that there is a basically sound system of internal control design, there are weaknesses in design which may place some of the system objectives at risk. However, the controls are being consistently applied.



Substantial Full


Similarly, the assessment gradings provided in our internal audit report are not comparable with the International Standard on Assurance Engagements (ISAE 3000) issued by the International Audit and Assurance Standards Board. The classifications of our audit assessments and priority ratings definitions for our recommendations are set out in more detail in Appendix A, whilst further analysis of the control environment for Budget Control and Forecasting is shown in Section 3.


Confidential 2

1.4. Key Findings

We have raised one priority 2 recommendation where we believe there is scope for improvement within the control environment. This is set out below:

• The budget should be presented to the Board on an annual basis to receive formal review and approval.



We have included management’s response in Section 4 – Observations and Recommendations.




Confidential 3


The overall objective of this audit was to provide assurance that the system of control in respect of Budget Control and Forecasting, with regards the areas set out in section 2.3, are adequate and are being consistently applied.






2.3. Areas Covered

In accordance with our agreed terms of reference, dated September 2014, our work was undertaken to cover the following system control objectives:

• Regulatory, organisational and management requirements

All staff act in compliance with appropriately documented management and regulatory requirements and duties are conducted in a consistent, economic, efficient and effective manner.

• Budget Setting

Budgets are set and funds allocated so as to achieve the LWARB’s strategic and operational objectives.

• Budget upload

Approved budgets are completely, accurately, validly and timely communicated and loaded onto the financial management system to allow effective monitoring by budget holders.

• Budget Monitoring

Budgets are regularly monitored and variances analysed and communicated so as to minimise the risk of budget under/overspend.

• Alterations and Virements

Budget alterations and virements are completely, accurately and validly processed in a timely manner.

• Financial and Performance Management Reporting

Budget information is completely, accurately, validly and timely produced and secured to allow for effective monitoring, decision making and reporting in line with management and regulatory requirements as part of a comprehensive performance management system.


Confidential 4





Regulatory, organisational and management requirements

Note 1

Budget setting

Recommendation 1

Budget upload

Budget monitoring

Alterations and virements

Financial and performance management reporting


Note 1: A recommendation has been raised in relation to regularly reviewing the budget setting procedure and version controlling this document within the Core Financial Systems audit.


Confidential 5

4. Observations and Recommendations Recommendation 1: Formal Annual Budget Approval (Priority 2)

Recommendation

The budget should be formally approved and minuted by the Board on an annual basis.

Risk

Where the budget is not formally approved by the Board on an annual basis, there is a risk that the budget does not reflect the current financial position of LWARB.

Observation

It was noted that the current budget for the 2014/15 financial year had been approved as part of the two-year Business Plan that had been approved in March 2013. It was further noted that it had been agreed at an informal Board meeting for the business plan to be used for the second year. However, the London Waste and Recycling Board Order (2008) states that ‘The Board must, by 31st March each year, prepare and publish a document setting out how it will meet its objectives in the following 12 month period.’ Whilst it is acknowledged that the Business Plan had been republished in line with the Order, it would be best practice for this to be subject to formal review and approval on an annual basis.

Responsibility

Governance and Secretariat Officer


Agreed / 31st March annually.


Confidential 6







Substantial










Level Definition







Confidential 7






Confidential 8




London

December 2014







Core Financial Systems

December 2014


CONFIDENTIAL

Distribution List:




Key Dates:

Date of fieldwork: November 2014

Date of draft report: December 2014

Receipt of responses: December 2014

Date of final report: December 2014



Confidential





Recommendation 1: Version Controlling Procedure Documents (Priority 3) 5

Recommendation 2: Procurement Policy update (Priority 3) 6

Recommendation 3: Purchase Orders (Priority 3) 7

Recommendation 4: Verification of Change of Supplier Bank Details (Priority 2) 8


Appendix B - Staff Interviewed ............................................................................................................ 10

Statement of Responsibility................................................................................................................. 11


Confidential 1


As part of the 2014/15 Internal Audit Plan, we carried out an audit of Core Financial Systems.

CIPFA defines Public Financial Management (PFM) as follows:

“Public Financial Management (PFM) is the system by which financial resources are planned, directed and controlled to enable and influence the efficient and effective delivery of public service goals.”

Risks in respect of the Core Financial Systems were included within the Risk Register which was presented at the Audit Committee on 2nd December 2014. This included the following:

• The Board does not have suitable internal financial procedures for the recording and reporting of expenditure. (ref. 3)

Robust core financial systems are essential to ensure that LWARB can operate effectively whilst maintaining a complete and accurate record of financial information. We undertook our review of Core Financial Systems in place at LWARB, including the following areas:

• Main accounting;

• Non-pay expenditure and creditors;

• Income and receivables; and

• Payroll


The overall objective of this audit was to provide assurance that the Board have implemented adequate and effective controls over Core Financial Systems in line with the control objectives listed in section 2.

In summary, the scope covered the areas of legislation, policies and procedures; financial transactions and records; standing data amendments; system access; management reporting; reconciliations. Further detail on the scope of the audit is provided in Section 2 of the report.


Our audit of the internal controls operating over the Core Financial Systems found that whilst there is a basically sound system of internal control design, there are weaknesses in design which may place some of the system objectives at risk. Also, there is evidence that the level of non-compliance with some of the controls may put some of the system objectives at risk.



Substantial Substantial


Similarly, the assessment gradings provided in our internal audit report are not comparable with the International Standard on Assurance Engagements (ISAE 3000) issued by the International Audit and Assurance Standards Board. The classifications of our audit assessments and priority ratings definitions for our recommendations are set out in more detail in Appendix A, whilst further analysis of the control environment for Core Financial Systems is shown in Section 3.


Confidential 2

1.4. Key Findings

We have raised one priority 2 recommendation and three priority 3 recommendations where we believe there is scope for improvement within the control environment. These are set out below:

• Polices and procedures in place should be version controlled evidencing when they were last reviewed and the date of the next review. (Priority 3)

• Consideration should be given as to whether the current policy of only raising purchase orders for values greater than £1,000 is commensurate with LWARB’s risk appetite and whether a lower figure should be agreed. (Priority 3)

• A purchase order should be raised in all instances above the financial limit set within the procurement policy. (Priority 3)

• LWARB should telephone suppliers, using a separate / independent source for the telephone number, to verify all requests to amend bank details. This should also include requests received via email. A record of the verification completed should be maintained. (Priority 2)



We have included management’s response in Section 4 – Observations and Recommendations.




Confidential 3


The overall objective of this audit was to provide assurance that the system of control in respect of the Core Financial Systems, with regards the areas set out in section 2.3, are adequate and are being consistently applied.






2.3. Areas Covered

In accordance with our agreed terms of reference, dated September 2014, our work was undertaken to cover the following system control objectives:


All staff act consistently in compliance with legislative and management requirements and administration of the core financial functions is conducted in an economic, efficient and effective manner.

• Financial Transactions and Records

Reliability, integrity, confidentiality and security of the core financial systems and records is maintained through the reliable operation of the system and its interfaces to the main accounting and feeder systems.

• Standing Data Amendments

Additions, deletions and amendments to standing data are completely, accurately and validly processed in a timely manner.

• System Access

Access to the core financial systems is secure, with systems access, including that to specific accounts, being appropriate and restricted to approved officers ensuring the integrity of data is maintained.

• Management Reporting

Information in respect core financial data is completely, accurately, validly and timely produced and secured to allow for effective monitoring of the current financial position and decision making in line with management and legislative requirements.

• Reconciliations

Control account reconciliations are undertaken within a timely manner at month end, with any balancing items investigated to ensure the integrity, reliability and accuracy of the core financial systems.


Confidential 4






Recommendation 1

Financial Transactions and Records Recommendation 2

and 3

Standing Data Amendments

Recommendation 4

System Access

Management Reporting

Reconciliations



Confidential 5

4. Observations and Recommendations Recommendation 1: Version Controlling Procedure Documents (Priority 3)

Recommendation

Polices and procedures in place should be version controlled evidencing when they were last reviewed and the date of the next review.

Risk

Where polices and procedures are not subject to regular review, with this being evidenced, there is a risk that policies and procedures are out of date and staff are not following current agreed processes.

Observation

Through discussion with the Governance and Secretariat Officer and Head of Finance, it was stated that the procedures are generally reviewed where recommendations have been raised as part of the internal audit process and many procedures had not been reviewed since the formation of LWARB. However, review of the procedures in place, including the Budget Setting Policy, Monthly Payroll Procedures, Banking and Cash, and Procurement Procedures, it was noted that they do not detail the date that they were last subject to review.

Responsibility



Agreed / ongoing.


Confidential 6

Recommendation 2: Procurement Policy update (Priority 3)

Recommendation

Consideration should be given as to whether the current policy of only raising purchase orders for values greater than £1,000 is commensurate with LWARB’s risk appetite and whether a lower figure should be agreed.

Risk

Where purchase orders are not required, there is a risk that the financial system does not provide an accurate outline of committed funds.

Observation

It was noted that currently purchase orders are only raised where the value of the transaction is £1,000 or greater.

Responsibility

Head of Finance


We have considered it and believe that £1,000 remains appropriate.


Confidential 7

Recommendation 3: Purchase Orders (Priority 3)

Recommendation

A purchase order should be raised in all instances above the financial limit set within the procurement policy.

Risk

Where a purchase order is not raised where required, there is a risk that commitments may not be reflected in the financial system, and the budget may be overspent.

Observation

From a sample of 25 purchases, in one instance a purchase order had not been completed. This was in relation to a payment made to CEDD where a call off contract is in place.

Responsibility

Head of Finance


As noted in your comments in the report, the work that the invoice in question relates to is undertaken under a call-off contract by the consultant who bills LWARB in arrears. The exact amount of the payment each month is not known in advance, so raising individual purchase orders each month is not practical.


Confidential 8

Recommendation 4: Verification of Change of Supplier Bank Details (Priority 2)

Recommendation

LWARB should telephone suppliers, using a separate / independent source for the telephone number, to verify all requests to amend bank details. This should also include requests received via email. A record of the verification completed should be maintained.

Risk

Where amendments are not verified for accuracy, there is a risk that LWARB may make payments to invalid accounts.

Observation

It was noted that there is currently no process in place to verify requests by suppliers to amend their bank details. At present amendments are made based on correspondence received by LWARB. There had been one instance of a change of supplier details identified for the current financial year, where a letter had been received from the supplier and there was no evidence of any verification checks carried out.

Responsibility



Agreed / ongoing.


Confidential 9







Substantial










Level Definition







Confidential 10







Confidential 11




London

December 2014



