Archived decisions
Hampshire County Council | |||
Governance Committee |
Item 7 | ||
14 December 2007 |
|||
Hampshire County Council internal audit progress report | |||
Report of the County Treasurer | |||
Contact: Ejner Knudsen, ext 7403, email [email protected]
1 Introduction
1.1 This report summarises:
· Progress against the Hampshire County Council's internal audit plan for 2007/08.
· An update on action taken by management to address the issues raised in the Hampshire County Council annual internal audit opinion for 2006/07.
· Significant matters arising from 2007/08 internal audit work.
· Priorities for the remainder of 2007/08.
2 Recommendations
2.1 That the Governance Committee notes the progress of internal audit work during 2007/08 and notes the key issues arising from that work.
3 Progress against the internal audit plan for 2007/08
3.1 The 2007/08 internal audit plan was prepared in line with the updated internal audit strategy that was approved by the Governance Committee in April 2007. The original plan totalled 3,722 days and, in addition, 311 days of work in progress was carried forward from last year. Just under half the year's plan has been delivered to date as shown in table 1 below.
Table 1 - summary of audit days delivered 1 April 2007 to 31 October 2007
Days |
||
Previous year carry forward |
311 | |
2007/08 agreed audit plan |
3,722 |
|
Variations to the plan |
-174 |
|
Revised plan for 2007/08 |
3,548 | |
Actual days delivered |
1,749 | |
Percentage of revised plan delivered |
49% | |
3.2 Over the last four years, there has been a great deal of pressure on resourcing the internal audit delivery. This has been due to the impact of ongoing long term sickness as well as the effects of implementing agreed changes to the audit strategy which have typically required a richer staff mix. The section continues to experience ongoing sickness issues, and additional resources have recently been secured to cover the impact in the short term. Plans are regularly reviewed to ensure that the necessary level of assurance can be provided in 2007/08.
3.3 A summary of the audit opinions given to date for each department is included in Appendix A.
4 Action taken by management to address the issues raised in the Hampshire County Council annual internal audit opinion for 2006/07
4.1 The 2006/07 annual internal audit opinion reported to members of the Governance Committee in June 2007, raised new or ongoing concerns in the following areas:
· Adult Services budget
· SAP access controls
· Direct payments
· Pension contributions
· Rebates and turnover levels.
4.2 The 2007/08 internal audit plan includes time to follow-up these issues and work is in progress in some areas. However, an update on progress is summarised below and the full results of follow-up work will be included in the annual internal audit opinion which will be presented to members in June 2008.
Adult Services budget
4.3 The Adult Services department reported an overspend of £7.5m at the end of 2006/07 rather than the anticipated £10.9m. The recovery plan is now in its second year and aims to bring the budget into line during 2007/08. We carried out five reviews on different aspects of budgetary control during 2006/07 and follow up work to ensure that our recommendations have been implemented is now underway.
SAP access controls
4.4 Over the last two years, we have raised issues regarding the segregation of duties within SAP and use of superuser accounts. Segregation of duties is currently being considered by the SAP Steering Group and Security Team to agree the way forward. A further audit review of SAP access is also due to commence shortly and will include the controls over the use of supersuser accounts. The results of this work will be reported in our annual opinion for 2007/08.
Direct payments
4.5 The 2006/07 annual report identified that whilst there are procedures and guidance notes in place for direct payments these were not embedded into the Adult Services department and care managers seemed unaware of their role in checking financial records and providing advice on financial management. We identified a risk that the direct payments received by clients may be intercepted or used to purchase items inappropriate for their assessed care needs.
4.6 This matter was discussed at the Governance Committee first in October 2006 and also in April 2007 and a plan of action agreed including a business process review to enable the control framework to cope with an expansion of the service.
4.7 The proposals for improving the Direct Payment scheme are now out for consultation with a deadline of 14 December 2007. Due to these developments we are not planning a major review of Direct Payments in this financial year. However due to the issues found in the previous audit we are intending to carry out some follow up work during quarter four of 2007/08 to ensure that the recommendations made in our audit reports were considered as part of the business process inovation review. We also continue to be notified of potential irregularities (see paragraph 5.5)
Pension contributions
4.8 Our 2006/07 review found that controls over the calculation and deduction of pension contributions for HCC staff, payment of these deductions into the pension fund, the integrity of HCC financial statements relating to pensions, and production of annual benefits statements are in place. However, some control issues were identified relating to the administration of the pension contributions, particularly in agreeing the payroll deductions to the pension fund receipts, and checks on the data supplied by other contributing bodies. There were known issues relating to the operation of the interface between SAP and AXISe, the system used to record pension contributions, and these were included on the section's action plan which is being monitored by management.
4.9 The business process innovation work that we reported as planned for 2007/08, is now planned for quarter two in 2008/09. This should provide an opportunity for further improvement to be made to controls. The responses to several of the recommendations made are not due for completion yet, although follow up work will be completed in quarter four, as part of the annual review of pension contributions, to monitor the progress made.
Rebates and turnover levels
4.10 County Supplies often arrange contracts on a call-off basis, where a rebate can be claimed by the County Council raising an invoice, once pre-determined volumes of purchases have been made. Our 2005/06 report raised concerns regarding the collection of rebates and our 2006/07 follow up review demonstrated that these issues were ongoing. We found that rebates were still not being collected in accordance with the contracted timescales and sales data was not always available to support the rebate that was being claimed.
4.11 The collection of the outstanding rebates will be followed up as part of the budgetary control work planned for County Supplies in quarter 4.
5 Significant matters arising from 2007/08 internal audit work
5.1 Details of the main issues identified between April and October 2007 are given in appendix C which is not for publication by virtue of Paragraph 7 of Part I of Schedule 12A to the Local Government Act 1972. Appropriate action has been agreed by relevant managers to address these issues and progress is being monitored.
Irregularities
5.2 Eight new cases of potential irregularity were reported in the period to 31 October 2007, three arising from the Reporting Concerns at Work (whistleblowing) policy. Work commenced on seven of the new cases and also continues on some irregularities reported in previous years.
5.3 Two of the three cases reported to the police for further investigation have resulted in recent court cases. The trial of the former Headteacher and Deputy Headteacher of Sundridge School, referred to in our 2006/07 annual internal audit report, has resulted in the former Headteacher being found guilty of conspiracy to defraud with a sentence of 27 months in prison. Sentencing of the former Deputy Headteacher who pleaded guilty to charges against him a year ago will take place in January 2008.
5.4 The other court case related to a Service User in receipt of Direct Payments. Despite the fact that the Service User had pleaded guilty to the charges of forgery and false accounting, the Courts ruled that an adult caution should be issued, due to other considerations. This case will be reviewed with Legal Services to assess the merits and costs of civil action to recover the overpayment.
5.5 Of the new cases under investigation, three related to irregularities within procurement processes. We also continued to have concerns over the potential misuse of direct payments referred to us during the quarter. All of these cases were referred back to the Adult Services department because agreed follow up procedures had yet to be actioned. We are particularly concerned at the length of time allowed for Service Users to provide clear evidence of their proper use of funds before the direct payments are suspended and alternative care arrangements are put in place.
5.6 Details of the significant investigations undertaken in 2007/08 have been summarised in Appendix C.
5.7 Proactive fraud detection work has also been undertaken and data matches reported by the Audit Commission in January 2007 as a result of the 2006 National Fraud Initiative (NFI) were risk assessed and continue to be investigated. To date the NFI data matching exercise has not identified any significant financial savings for the County Council, however the process does provide continued assurance that the incidence of fraud in the systems reviewed is low.
6 Priorities for the remainder of 2007/08
6.1 During the first half of the financial year internal audit work focused mainly on completing work in progress from 2006/07, irregularity investigations, establishment visits and some departmental systems. During the second half of the year internal audit attention will turn to key financial systems reviews. This is to allow audit samples to be drawn from a greater number of transactions.
6.2 In line with the internal audit strategy and other reports to members on monitoring compliance with the Code of Corporate Governance, internal audit work will be carried out during the period October 2007 to March 2008 in order to provide an opinion on the effectiveness of corporate governance and the extent of compliance in departments and the County Council as a whole. The scope of this work will include performance management, data quality, risk management and health and safety. The results of this work will be included in the annual internal audit opinion for 2007/08 which will be presented to members in June 2008.
Section 100 D - Local Government Act 1972 - background papers
The following documents disclose facts or matters on which this report, or an important part of it, is based and has been relied upon to a material extent in the preparation of this report.
NB the list excludes:
Published works.
Documents which disclose exempt or confidential information as defined in the Act.
TITLE FILE
None
Appendix A
Internal audit opinions for work delivered between April 2007 and October 2007
Department |
Opinion on the control framework (definitions are given at the bottom of the table) |
Controls working in practice |
||||||
Comprehensive |
Appropriate |
Incomplete |
Inadequate | |||||
Adult Services |
Payroll Assessment of care Block Contracts Two Learning Disability Homes Two Learning Disability Day Services. |
Non residential charging policy One older persons residential and nursing home Two Learning Disability Homes |
Yes, with exceptions | |||||
Work in progress: · Debtors and cash income · Travel and subsistence · Unannounced visits · Business Plans · Revenue Contracts · IT Management · Industrial Work Funds · Client Affairs · Charging Policy. | ||||||||
Chief Executives |
Contract Procedures Members Allowances Education Personnel Services Pay and Benefits - IPP process PAYE/NI |
Civil Contingencies and Business Resilience |
Yes, with exceptions | |||||
Work in progress: · Debtors · Creditors · Resourcing Centre · Service Centre · Pay and Benefits - final data · Pay and Benefits - computer audit. | ||||||||
Children's Services |
3 Primary schools |
Adult and Community Learning Unit Surplus Balances 26 Primary schools 16 Secondary schools 2 Community schools 3 Special schools 1 Children's Home |
||||||
18 Primary schools have passed the Financial Management Standard in Schools assessment. Work in progress: · Youth Offending Teams · Foster Care · JENI monies · Budgetary Control |
||||||||
Environment |
Safety camera partnership |
|||||||
Work in progress: · Corporate governance · Debtors · Payroll · Contract systems - currency of contract · Traffic control and road safety · Data Protection/FOI · Travel shop · Other work completed: · ESPACE half year grant claim · CHANGELAB half year grant claim · BRANCH half year grant claim | ||||||||
IT Services |
Backup and recovery routines. Website management. Management controls. |
Yes, with exceptions | ||||||
Work in progress: · Debtors · Payroll · Costing and charging · Information security management · SAP Basis · Capacity planning and management · Interfaces | ||||||||
Property, Business and Regulatory Services |
Post contract HC3S contracts |
Yes, with exceptions | ||||||
Work in progress: · Pre-contract - Ashburton Court · South East centre of Excellence · Consultants | ||||||||
Recreation and Heritage |
Rights of Way Tile Barn and Beaulieu Activity Centres |
Hampshire Mountain Centre |
Yes, with exceptions | |||||
Work in progress: · Payroll · Debtors and Cash Income · Queen Elizabeth Country Park · Yateley Country Park | ||||||||
County Treasurer's |
Blue badge Bank reconciliation Car leasing |
Yes, with exceptions | ||||||
Work in progress: · Capital expenditure and receipts monitoring · Pension fund management and investments · Departmental payroll · Accounts receivable · SAP financial module · Central loans and investments | ||||||||
Audit opinion definitions
Comprehensive Controls are in place to manage all the risks identified Appropriate Sufficient controls exist which manages the significant risk identified in an effective and efficient manner. Incomplete There is one or more key controls missing, therefore there is a need to introduce additional controls to manage the risk to the organisation. Inadequate Controls are considered to be insufficient to meet the risk, with the absence of at least one critical control mechanism. Failure to improve controls could lead to increased risk of major loss or embarrassment to the organisation. |
||||