Purchase to Pay (Reporting)/media/lldc/committ… · Purchase to Pay (Phase One) report presented to the Audit Committee in January 2012. 2 Conclusion (Amber-Green) Minor weaknesses

Purchase to Pay (Reporting) Internal audit report for London Legacy Development Corporation

Confidential Status – Final

October 2012

London Legacy Development Corporation October 2012

INTERNAL AUDIT REPORT – Purchase to Pay (Phase 2) - Reporting

Moore Stephens LLP Internal Audit Report [CONFIDENTIAL] 2 13

Document history Distribution

Draft V01 July 2012 Paul Hilton Interim Director of Finance

Draft V02 September 2012 Paul Hilton Interim Director of Finance

Final V01 15 October 2012 Jonathan Dutton

Paul Hilton

Audit Committee

Executive Director Finance and

Corporate Services

Interim Director of Finance

General Disclaimer

The content of this report is confidential and not for distribution to anyone other than the LLDC. Disclosure to third parties cannot

be made without the written consent of Moore Stephens LLP.

Freedom of Information Disclaimer

In the event that pursuant to a request which LLDC has received under the Freedom of Information Act 2000, it is required

to disclose any information contained in this report, it will notify Moore Stephens LLP promptly and consult with

Moore Stephens LLP prior to disclosing such report LLDC agrees to pay due regard to any representations which

Moore Stephens LLP may make in connection with such disclosure and LLDC shall apply any relevant exemptions which

may exist under the Act to such report. If, following consultation with Moore Stephens, LLDC discloses this report or any part

thereof, it shall ensure that any disclaimer which Moore Stephens LLP has included or may subsequently wish to include in the

information is reproduced in full in any copies disclosed.




Contents

Page

Contents 3

1 Introduction 4

2 Conclusion 4

3 Key findings 4

4 Follow up 6

5 Audit approach 7

6 Recommendations and management action plan 8

7 Follow up on Purchase to Pay (Phase 1) report recommendations 9

Appendices 11

A Audit objectives 11

B Audit definitions 12

C Staff consulted during review 13




1 Introduction

1.1 This audit was completed in accordance with the approved annual Internal Audit plan for 2012/13.

1.2 The overall objective of this audit was to review and assess the adequacy of the current arrangements for financial

reporting in relation to procurement, with an emphasis on reporting to budget heads; and to review the effectiveness of

management reporting and control processes operated at this level. The key risks addressed by this audit and the scope

of the audit are detailed in the extract from the assignment terms of reference at Appendix A.

1.3 As part of the review we have also reviewed with management the implementation of recommendations made in the

Purchase to Pay (Phase One) report presented to the Audit Committee in January 2012.

2 Conclusion

(Amber-Green) Minor weaknesses have been identified in the control framework or non-compliance which may

put achievement of system objectives at risk.

2.1 The LLDC use PS Financials as their financial accounting and management system. Within this is the purchase order

system, Sentinel, which went live on 1 September 2011. The reporting functionality of PS Financials and Sentinel has

been developed in recent months to enable the system to deliver real time financial reports on procurement spend to the

LLDC’s Workstream/ Budget Managers. An upgrade to the SQL report writing function of the server was completed at

the beginning of June and the Finance team have received training on building specific financial reports.

2.2 As the full reporting functionality of Sentinel has yet to be developed and implemented to support the needs of the LLDC,

and is therefore not yet being used within the organisation, we have not been able to fully assess the adequacy of

reporting to budget heads or the effectiveness of financial reporting in relation to procurement expenditure. We plan to

complete this review at a later date. We understand that different arrangements apply within the Transformation

Directorate and their delivery partner (Mace). The system and processes in operation in these areas were outside the

scope of this review.

2.3 The following table summarises the recommendations made across the key risks audited, grouped by priority ratings:

No. Key risk Priority rating

1 2 3

1 Inadequate or unclear reporting arrangements, as set out in the LLDC Financial

Regulations and Finance Manual

- - -

2 The provision of inadequate, inaccurate and/or timely financial reports and financial

management information for budget monitoring purposes

- 1 -

3 Ineffective review of financial reports and financial management information by budget

heads resulting in failure to identify errors, inconsistencies, discrepancies and budget

over/underspends on a timely basis.

- 2 -

4 Ineffective management of identified errors, inconsistencies, discrepancies and budget


- - -

Total recommendations made - 3 -

2.4 The recommendations and associated management actions arising from the above are detailed in section 5.

3 Key findings

3.1 Key Risk 1: Inadequate or unclear reporting arrangements, as set out in the LLDC Financial Regulations and

Finance Manual

3.2 The Board is responsible for financial oversight of LLDC activities and is supported in this by the Executive Director of

Finance and Corporate Services who is in turn supported by the Interim Director of Finance and Financial Controller.




Since the establishment of the MDC, two Finance Business Partners roles have been introduced. A key purpose of

Finance Business Partners is to support Budget Managers within individual directorates by obtaining and developing

financial reports from PS Financials and Sentinel. Budget Managers remain responsible for reviewing expenditure for

their specific workstreams on a monthly basis and accounting for any significant under/overspends to their Budget

Heads (Executive Directors) as part of the month end process for preparation of the management accounts.

3.3 An upgrade to the SQL report writing function of the server was completed at the beginning of June. The Finance team

have received training on building financial reports but, at the time of this review, training had yet to be given to

Workstream/Budget managers on how to access reports within the system. Budget Managers cannot, therefore, directly

access or create reports on the Sentinel system. We understand that this restriction on the creation of reports will be

maintained in future. Budget Managers will have limited, read-only access to reports in future. We consider these

arrangements to be appropriate to the needs of the organisation.

3.4 We reviewed the current Financial Regulations and Finance Manual and noted that these remain in draft format and

have not been updated, for example, to reflect the change in the organisation’s name and the introduction of the new

Finance Business Partner role. Although The Financial Regulations specify arrangements and procedures for ordering

goods and services, arrangements for managing and reporting on procurement spend, for example, the role of Budget

Managers, is not specified.

3.5 We understand from discussions with the Interim Director of Finance that the need for the update of the Financial

Regulations and Finance Manual has been identified by management and is scheduled to take place during the Games

period, July and August 2012. We have, therefore, not made a recommendation in relation to the update of the

Financial Regulation and Finance Manual but draw management’s attention to our comments above.

3.6 Key Risk 2: The provision of inadequate, inaccurate and/or timely financial reports and financial management

information for budget monitoring purposes

3.7 At present, baseline budgets are loaded into PS Financial, from which financial reports are run which show actual spend

against budget. These financial reports are then used to populate spreadsheet-based reports which form part of the

management accounts pack. The Finance Department is in the process of developing a suite of automated reports to

reduce the use of spreadsheets in the reporting process. As well as making the reporting process more efficient, the

newly- developed reports should also improve the quality of financial reporting. We will review the new financial reports

at a later date.

3.8 We reviewed the types of standard financial management reports available within Sentinel. These include the following

reports: Orders by Workstreams, Outstanding accruals, Procurement Methods, Project Purchase orders, Purchase

Order outstanding commitments, Purchase order overview and Purchase Order statistics. We consider these reports to

provide an adequate level of basic procurement management information. The LLDC now needs to focus on developing

a suite of additional reports to meet the specific needs of the Budget Managers.

3.9 We understand that amendments can be made to the standard reports in Sentinel but that the existing version control

process is not rigorously complied with. It is important to ensure that any modifications made to standard or newly-

created reporting templates within the Sentinel are well controlled to avoid confusion among users. [Recommendation

1].

3.10 We reviewed the current month end management accounts and the process in place for their production. All figures

within the management accounts are agreed by the fourth day following the month end. These are reviewed by the

Financial Controller and Interim Director of Finance on the following day with the addition of appropriate commentary to

explain significant variances prior to review by the Executive Director of Finance and Corporate Services. We consider

these arrangements to be satisfactory. We understand from discussions with the Interim Director of Finance that work is

underway to make the production of the month end management accounts more efficient and effective via the use of the

newly implemented SQL Server report builder and by developing a report template that will better meet the needs of

those who use the management accounts including the Executive Directors and Budget Managers.

3.11 We reviewed the financial reports provided to LLDC Board meetings which now occur every two months. These are

public meetings and, consequently, the level of financial information provided to the meetings is very high level. We

reviewed the summary management accounts provided to the Board for the period ending 31st May 2012 and found

them to be satisfactory for informing strategic decision making. The procurement expenditure of the LLDC is also

reviewed by the Executive Management Team at the their monthly meetings.




3.12 Key Risk 3: Ineffective review of financial reports and financial management information by budget heads

resulting in failure to identify errors, inconsistencies, discrepancies and budget over/underspends on a timely

basis.

3.13 Budget Managers are responsible for raising purchase orders and posting Goods Received Notes to Sentinel. Individual

spreadsheets are maintained on a day-to-day basis to record all goods and services procured to enable Budget

Managers to manage their budgets and to monitor and reconcile expenditure incurred during the month prior to the

monthly management accounts being issued. The Finance Department then provide system-generated reports to

Budget Managers showing how much has been invoiced against each workstream. Budget Managers use this

information to calculate how much work has not been invoiced and therefore needs to be accrued. At present, Budget

Managers rely upon the Finance Department for these system-generated reports; they cannot access them

independently. In future, once appropriate training has been provided, Budget Managers will be able to access

information relating to their workstreams by running their own reports from PS Financial.

3.14 In order to further support the budget management function, we suggest that training is provided to Budget Managers to

enable them to obtain read-only access to real time reports from the system. This will reduce referrals to the Finance

Business Partners and ensure that errors and/or discrepancies are identified and corrected at the earliest opportunity

(Recommendation 2).

3.15 Due to delays in the full implementation of the reporting functionality offered within Sentinel, no post-implementation

review has yet been undertaken. We were informed that the delay was due to PS Financials ceasing to support the SQL

Server version used by LLDC. An upgrade was not available until the new server host, Civica, was fully operational in

June 2012. Once the reporting functionality has been in place and has had time to embed within the organisation, we

recommend that a post-implementation review of the implementation is performed. This will give Budget Managers,

Budget Holders and the Finance Team an opportunity to evaluate the implementation and the effectiveness of the new

reporting functionality of Sentinel (Recommendation 3).

3.16 Key Risk 4: Ineffective management of identified errors, inconsistencies, discrepancies and budget


3.17 Budget heads and Budget Managers currently review their budget expenditure reports on a monthly basis and receive

detailed breakdowns of project expenditure on a budget versus actual basis as part of the reconciliation between

departmental records and the information provided from Finance as part of the preparation of the management

accounts. The Executive Management Team review the accounts in detail at their regular monthly meetings and an

analysis of the variances takes place at this level. Actions to address budget over/underspends are agreed at each

meeting with guidance from the Executive Director of Finance and Corporate Services.

3.18 We have been unable to assess the impact of the new reporting functionality on the management of identified errors,

inconsistencies, discrepancies and budget over/underspends as this is not yet fully implemented. We will follow up this

aspect of this review at a later date.

3.19 As part of the corporate process for managing project budgets, LLDC have implemented a Change Board, whereby

Budget Managers can put forward requests to vire budgets between projects to ensure that project under/overspends

are managed effectively. All virement requests are submitted to the Change Board in writing with full details of the

proposed budget transfer before any discussion takes place. The Change Board meets every month and is chaired by

the Executive Director of Finance and Corporate Services.

3.20 We briefly reviewed the documentation presented to the recent Change Board and found that this to be satisfactory. At

the time of our review, 25 change requests had been presented to the Change Board from April 2012, with 24 being

approved and one rejected. We will perform a separate internal audit review of change management during 2012/13.

4 Follow up

4.1 As part of this review, we undertook a follow up review on the implementation of recommendations made in Phase One

of the implementation of the Sentinel system. Six recommendations were made; five have been implemented with work

ongoing for the remaining recommendations. Our status update report is provided at section 7.




5 Audit approach

5.1 The audit was undertaken reviewing key documents and meeting with key personnel within LLDC.

5.2 A list of the LLDC staff consulted during the completion of this review is included at Appendix C.




6 Recommendations and management action plan

Finding and implication Recommendation Priority Management response, responsible officer and implementation date

The Finance team are able to

create and modify report

templates within Sentinel.

However, version control is not

robustly applied.

Implication: In the absence of

robust version control, staff may

not be sure of using the most up

to date version of a report

template.

1. Version control should be

introduced and enforced for all

report templates created and

modified within the Sentinel

system to ensure that staff are

able to identify and use the

most up-to-date versions.

2 Management Response: Recommendation accepted

Action to be taken: Implement version control within Sentinel

Responsible officer: Olu Ogunsanlu, Financial Controller

Date for implementation: 31st October 2012

Budget Managers have not yet

received training on how to use

the reporting functionality within

the Sentinel system.

Implication: Budget Managers

will not be able to access

financial reports that may

enhance their effectiveness.

2. Training should be provided to

Budget Managers to enable

them to access key financial

reports from the Sentinel

system. This access should

be limited to read-only.


Action to be taken: Roll out of training across the Corporation

Responsible officer: Mark Clarke and Louise Jeffery, Senior Finance Business Partners

Date for implementation: 31st December 2012

No post-implementation review

of the new reporting functionality

in Sentinel has been

undertaken.

Implication: The LLDC may fail

to identify lessons to be learned

from the implementation of the

Sentinel reporting functionality

for future reference.

3. A post-implementation review

should be undertaken to

evaluate the implementation of

the reporting functionality

within Sentinel. This should

identify what went well and

lessons to be learned.


Action to be taken: Carry out the review

Responsible officer: Paul Hilton, Interim Finance Director

Date for implementation: 31st March 2013




7 Follow up on Purchase to Pay (Phase 1) report recommendations

Ref Recommendation Priority Status update as at 26th June 2012

1 Management should investigate whether it is possible to enhance

the existing system-based controls within Sentinel to enforce

delegated authority limits when the value of a single PO has been

allocated across a number of work streams.

Agreed date for implementation: January 2012.

1 Implemented

A patch has been installed on the system whereby authorisation is required for

the total value of a Purchase Order rather than for the separate parts, if the PO

is split across a number of workstreams.

Ref: Interim Director of Finance

2 An audit report should be introduced to identify any instances where

a single PO number has been subject to multiple authorisation. This

report should be run on a monthly basis. Any instances identified

should be investigated to determine whether authorisation controls

had been breached.

Agreed date for implementation: Quarter 1 of 2012/13

2 Implemented

At the time of our review, an LLDC audit report had identified four instances,

prior to the installation of the patch, where a single PO number had been subject

to multiple authorisation. These were under investigation. LLDC have covered

off the multiple approvals issue.


3 Existing guidance should be enhanced to state that the allocation of

a single PO value across several work streams must not to be used

to circumvent delegated authority controls and that any such use will

be treated as a serious breach of OPLC financial regulations.

Agreed date for implementation: March 2012

1 On going

Guidance for staff is in the process of being updated. A comprehensive review

of all the financial procedures is due to take place during the Games period.

Revised date for implementation: End of October2012

Responsible officer: Interim Director of Finance

4 The Financial Accounting Manager should ensure that all inputs to

PS Financials are verified and evidence of these checks

documented at all times.

Agreed date for implementation: January 2012.

2 Implemented

All changes are checked and this is demonstrable before changes are made on

the finance system. Sufficient supporting documentation requesting any change

is received from the Budget manager in the form of email. The Finance team

undertake spot checks with the company to ensure that details are correct.

Ref: Financial Controller

5 Management should consider whether to review all purchase orders

since the use of the Sentinel system to identify all instances of

2 Implemented

The upgrade to the SQL server has taken place and a patch has been put in




Ref Recommendation Priority Status update as at 26th June 2012

authorisations above delegated limits. This may assist PS

Financials in their investigations.

Agreed date for implementation : 30th June 2012

place within PS Financials whereby PO authorisation is granted on the total

value of the PO rather than on individual lines where the purchase order has

been split across different workstreams. The only way to circumvent the

authorised schedule of delegated authority is to change the authorisation levels

within the PS Financials system.


6 Staff should be reminded that the procurement requirements under

each method must be appropriately satisfied before a purchase

order is raised.

Agreed date for implementation: March 2012

2 Implemented

Updates to the Procurement guidance have been completed and incorporated

into the Financial Regulations of LLDC. The updated Financial Regulations will

be circulated to all staff following approval.


Revised date for implementation: End of August 2012.




Appendices

A Audit objectives

Audit objective: Per the terms of reference

Key risks

Effective financial management may be compromised due to:

Inadequate or unclear financial reporting arrangements, as set out in the LLDC Financial

Regulations and Finance Manual;

The provision of inadequate, inaccurate and/or untimely financial reports and financial

management information for budget monitoring purposes;

Ineffective review of financial reports and financial management information by budget heads

resulting in failure to identify errors, inconsistencies, discrepancies and budget

over/underspends on a timely basis; and

Ineffective management of identified errors, inconsistencies, discrepancies and budget


Scope

An assessment of the adequacy of the existing financial reporting arrangements including:

The clarity and allocation of roles and responsibilities for procurement budget management, in

particular between the Finance team and budget heads;

The availability, clarity and completeness of documentation re budget monitoring, review and

reporting procedures and internal controls;

The adequacy of existing financial management information and financial reports for budget

management purposes.

Testing the operational effectiveness of the budget management and control processes

operated at budget head level.




B Audit definitions

Opinion/conclusion

(Green)

Overall, there is a sound control framework in place to achieve system objectives and the

controls to manage the risks audited are being consistently applied. There may be some

weaknesses but these are relatively small or relate to attaining higher or best practice

standards.

(Amber-Green) Minor weaknesses have been identified in the control framework or non-compliance which may

put achievement of system objectives at risk.

(Amber) Weaknesses have been identified in the control framework or non-compliance which put

achievement of system objectives at risk. Some remedial action will be required.

(Amber-Red)

Significant weaknesses have been identified in the control framework or non-compliance with

controls which put achievement of system objectives at risk. Remedial action should be taken

promptly.

(Red) Fundamental weaknesses have been identified in the control framework or non-compliance with

controls leaving the systems open to error or abuse. Remedial action is required as a priority.

Risk and significance categories

Priority ranking 1:

There is potential for financial loss, damage to the LLDC reputation or loss of information. This

may have implications for the achievement of business objectives and the recommendation

should be actioned immediately.

Priority ranking 2: There is a need to strengthen internal control or enhance business efficiency.

Priority ranking 3: Internal control should be strengthened, but there is little risk of material loss.




C Staff consulted during review

Name: Job title

Jonathan Dutton Executive Director Finance and Corporate Services

Paul Hilton Interim Finance Director

Olu Ogunsanlu Financial Controller

Louise Jeffrey Financial Business Partner

Budget Heads

We would like to thank these staff for their assistance provided during the completion of this review.

Documents

Purchase to Pay (Reporting)/media/lldc/committ… · Purchase to Pay (Phase One) report presented to the Audit Committee in January 2012. 2 Conclusion (Amber-Green) Minor weaknesses