Annual Internal Audit Report for Thanet District Council 2016-17

 

1.            Introduction

 

The Public Sector Internal Audit Standard (PSIAS) defines internal audit as:

 

“Internal Audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes."

 

A more detailed explanation, of the role and responsibilities of internal audit, is set out in the agreed Audit Charter.  The East Kent Audit Partnership (EKAP) aims to comply with the PSIAS, and to this end has produced evidence to the s.151 and Monitoring Officers to assist the Council’s review of the system of internal control in operation throughout the year.

 

This report is a summary of the year, a snapshot of the areas at the time they were reviewed and the results of follow up reviews to reflect the actions taken by management to address the control issues identified. The process that the EKAP adopts regarding following up the agreed recommendations will bring any outstanding high-risk areas to the attention of Members via the quarterly reports, and through this annual report if there are any issues outstanding at the year-end.

 

2.            Objectives

 

The majority of reviews undertaken by Internal Audit are designed to provide assurance on the operation of the Council’s internal control environment. At the end of an audit we provide recommendations and agree actions with management that will, if implemented, further enhance the environment of the controls in practice. Other work undertaken, includes the provision of specific advice and support to management to enhance the economy, efficiency and effectiveness of the services for which they are responsible. The annual audit plan is informed by special investigations and anti-fraud work carried out as well as the risk management framework of the Council.

 

A key aim of the EKAP is to deliver a professional, cost effective, efficient, internal audit function to the partner organisations. The EKAP aims to have an enabling role in raising the standards of services across the partners though its unique position in assessing the relative standards of services across the partners. The EKAP is also a key element of each councils’ anti fraud and corruption system by acting as a deterrent to would be internal perpetrators.

 

The four partners are all committed to the principles and benefits of a shared internal audit service, and have agreed a formal legal document setting out detailed arrangements. The statutory officers from each partner site (the s.151 Officer) together form the Client Officer Group and govern the partnership through annual meetings. The shared arrangement for EKAP also secures organisational independence, which in turn assists the EKAP in making conclusions about any resource limitations or ensuring there are no instances of restricted access.

 

 

3.            Internal Audit Performance Against Targets

 

3.1       EKAP Resources

The EKAP has provided the service to the partners based on a FTE of 7.2. Additional audit days have been provided via audit contractors, in order to meet the planned workloads.

 

3.2     Performance against Targets

The EKAP is committed to continuous improvement and has various measures to ensure the service can strive to improve. The performance measures and indicators for the year are shown in the balanced scorecard of performance measures at Appendix 6.

 

3.3     Internal Quality Assurance and Performance Management.

All internal audit reports are subject to review, either by the relevant EKAP Deputy Head of Audit or Head of the Audit Partnership; all of who are Chartered Internal Auditors.  In each case this includes a detailed examination of the working papers, action and review points, at each stage of report. The review process is recorded and evidenced within the working paper index and in a table at the end of each audit report.  Detailed work instructions are documented within the Audit Manual.  The Head of Audit Partnership collates performance data monthly and, together with the monitoring of the delivery of the agreed audit plan carried out by the relevant Deputy Head of Audit, regular meetings are held with the s.151 Officer.  The minutes to these meetings provide additional evidence to the strategic management of the EKAP performance.

 

3.4     External Quality Assurance

The external auditors, Grant Thornton, conducted a review in February 2016 of the Internal Audit arrangements. They have concluded that, where possible, they can place reliance on the work of the EKAP. 

 

3.5     Liaison between Internal Audit and External Audit.

Liaison with the audit managers from Grant Thornton for the partner authorities and the EKAP is undertaken largely via email to ensure adequate audit coverage, to agree any complementary work and to avoid any duplication of effort. The EKAP has not met with any other review body during the year in its role as the Internal Auditor to Thanet District Council. Consequently, the assurance, which follows is based on EKAP reviews of Thanet District Council’s services.

 

3.6     Compliance with Professional Standards

The EKAP self-assessment of the level of compliance against the Public Sector Internal Audit Standards shows that some actions are required to achieve full compliance which EKAP will continue to work towards. There is however, no appetite to pay for an External Quality Assessment of the EKAP’s level of compliance, relying on a review by the s.151 officers of the self-assessment. Consequently the EKAP can only say that it partially conforms with PSIAS.

 

3.7     Financial Performance

Expenditure and recharges for year 2016-17 are all in line with the Internal Audit cost centre hosted by Dover District Council. Financial management has delivered a cashable saving of 10% against budget. 

 

Year

Cost / Audit Day

2006-07

£288

2007-08

£277

2008-09

£262 (Reserve Refunded to Partners)

2009-10

£281

2010-11

£268

2011-12

£257

2012.13

£279

2013-14

£290

2014-15

£287

2015-16

£293

2016-17

£294

 

The EKAP was formed to provide a resilient, professional service and therefore achieving financial savings was not the main driver, despite this considerable efficiencies have been gained through forming the partnership. The net result is a reduced EKAP cost per audit day below the original budget estimate.

 

4.            Overview of Work Done

 

The original audit plan for 2016-17 included a total of 28 projects. We have communicated closely with the s.151 Officer, CMT and this Committee to ensure the projects actually undertaken continue to represent the best use of resources. As a result of this liaison some changes to the plan were agreed during the year. A few projects (5) have therefore been pushed back in the overall strategic plan, to permit some higher risk projects to come forward in the plan (6). The total number of projects undertaken in 2016-17 was 29, with 5 being WIP at the year end to be finalised in April.

 

Review of the Internal Control Environment

4.1     Risks

 

During 2016-17, 135 recommendations were made in the agreed final audit reports to Thanet District Council.  These are analysed as being Critical, High, Medium or Low risk in the following table:

 

Risk Criticality

No. of Recommendations

Percentage

Critical

7

5%

High

47

35%

Medium

53

39%

Low

28

21%

TOTAL

135

100%

 

Naturally, more emphasis is placed on recommendations for improvement regarding high risks.  Any high priority recommendations where management has not made progress in implementing the agreed system improvement are brought to management and Members’ attention through Internal Audit’s quarterly update reports. During 2016-17 the EKAP has raised and reported to the quarterly Governance Committee meetings 135 recommendations, and whilst 79% were in the Critical, High or Medium Risk categories, none are so significant that they need to be escalated at this time.

 

4.2     Assurances

Internal Audit applies one of four ‘assurance opinions’ to each review, please see Appendix 1 for the definitions. This provides a level of reliance that management can place on the system of internal control to deliver the goals and objectives covered in that particular review. The conclusions drawn are described as being “a snapshot in time” and the purpose of allocating an assurance level is so that risk is managed effectively and control improvements can be planned. Consequently, where the assurance level is either ‘no’ or ‘limited’, or where high priority recommendations have been identified, a follow up progress review is undertaken and, where appropriate, the assurance level is revised.

 

The summary of Assurance Levels issued on the 29 pieces of work commissioned for Thanet District Council over the course of the year is as follows:

 

NB: the percentages shown are calculated on finalised reports with an assurance level

 

Assurance

No.

Percentage of Completed Reviews

Substantial

13

68%

Reasonable

2

11%

Limited

4

21%

No

0

0%

Work in Progress at Year-End

5

-

Not Applicable

5

-

 

NB: ‘Not Applicable’ is shown against special investigations or work commissioned by management that did not result in an assurance level.

 

Taken together 79% of the reviews account for substantial or reasonable assurance, whilst 21% of reviews placed a limited or partially limited assurance to management on the system of internal control in operation at the time of the review.

 

There were two reviews completed on behalf of East Kent Housing Ltd. one was a management request that did not attract an assurance and the other was Substantial Assurance. Information is provided in Appendix 3.

 

There were 16 reviews completed on behalf of EK Services and the assurances for these audits were - 5 Substantial, 4 Reasonable, 1 Limited, 2 Not Applicable and 4 work in progress at the year-end. Information is provided in Appendix 4

 

For each recommendation, an implementation date is agreed with the Manager responsible for implementing it. Understandably, the follow up review is then timed to allow the service manager sufficient time to make progress in implementing the agreed actions against the agreed timescales. Those areas receiving either a ‘limited’ or ‘no’ assurance audit opinion during the year are detailed in the table at four, these areas are also recorded as an appendix to the quarterly report until the follow up report is issued, so that they do not get overlooked. The results of any follow up reviews yet to be undertaken will therefore be reported to the quarterly committee at the appropriate time.

 

4.3     Progress Reports

In agreeing the final Internal Audit Report, management accepts responsibility to take action to resolve all the risks highlighted in that final report.  The EKAP carries out a follow up/progress review at an appropriate time after finalising an agreed report to test whether agreed action has in fact taken place and whether it has been effective in reducing risk.

 

As part of the follow up action, the recommendations under review are either:

 

§     “closed” as they are successfully implemented, or

§     “closed” as the recommendation is yet to be implemented but is on target, or

§     (for medium or low risks only) “closed” as management has decided to tolerate the risk, or the circumstances have changed since the original review was undertaken. 

 

At the conclusion of the follow up review the overall assurance level is re-assessed. As Internal Audit is tasked to perform one progress report per original audit and bring those findings back, it is at this juncture that any outstanding high-risks are escalated to the Governance and Audit Committee via the quarterly update report.

 

The results for the follow up activity for 2016-17 are set out below. The shift to the right in the third column in the table from the original opinion to the revised opinion also measures the positive impact that the EKAP has made on the system of internal control in operation throughout 2016-17.

 

Total Follow Ups undertaken  15

No Assurance

Limited Assurance

Reasonable Assurance

Substantial Assurance

Original Opinion

1

10

0

4

Revised Opinion

0

6

5

4

 

The reviews with an original limited assurance, together with the result of the follow up report, are shown in the following table:

 

Area Under Review

Original Assurance

Follow Up Result

Sports Development

Reasonable / Limited

Reasonable / Limited

Equality & Diversity

Limited

Reasonable

Environmental H&S at Work

Limited

Reasonable

Your Leisure

No / No/ Reasonable

Limited / Reasonable

Corporate Properties and Concessions

Reasonable / Limited

Reasonable / Limited

Complaints Monitoring

Limited

Limited

Dog Warden & Street Enforcement

Limited

Reasonable

Safeguarding

Limited

Limited

Playgrounds

Limited

Limited

Officer Code of Conduct

Limited

Reasonable

Planning Applications & s.106

Reasonable / Limited

Reasonable

 

Consequently, there are six areas for TDC which remain (partially) limited after follow up and these have been escalated to the Governance and Audit Committee.

 

East Kent Housing received three follow up reviews for which the revised assurance levels were one Substantial, one Reasonable/ and Housing Repairs remained at Limited assurance after follow up, this was escalated to the December 2016 audit committees.

 

EK Services received four follow ups; the revised assurances were Substantial for one review and Reasonable for three reviews.

 

4.4     Special Investigations and Fraud Related Work

The prevention and detection of fraud and corruption is ultimately the responsibility of management however, the EKAP is aware of its own responsibility in this area and is alert to the risk of fraud and corruption. Consequently the EKAP structures its work in such a way as to maximise the probability of detecting any instances of fraud. The EKAP will immediately report to the relevant officer any detected fraud or corruption identified during the course of its work; or any areas where such risks exist.

 

The EKAP is, from time to time, required to carry out special investigations, including suspected fraud and irregularity investigations and other special projects.  Whilst some reactive work was carried out during the year at the request of management, there have been no new fraud investigations conducted by the EKAP on behalf of Thanet District Council.

 

4.5     Completion of Strategic Audit Plan

Appendix 2 shows the planned time for reviews undertaken, against actual time taken, follow up reviews and unplanned reviews resulting from any special investigations or management requests. 315.05 audit days were competed for Thanet District Council during 2016-2017, which represents 106.67% plan completion. The 19.69 days ahead at the year end, will be adjusted in 2017-18.  The EKAP was formed in October 2007; it completes a rolling programme of work to cover a defined number of days each year. As at the 31st March each year there is undoubtedly some “work in progress” at each of the partner sites; some naturally being slightly ahead and some being slightly behind in any given year. However, the progress in ensuring adequate coverage against the agreed audit plan of work since 2007-08 concludes that EKAP is 19.69 days ahead of schedule as we commence 2017-18, as shown in the table below.

 

 

Year

Plan Days

Plus B/Fwd

Adjusted Requirement from EKAP

Days Delivered

Percentage Completed

Days Carried

Forward

(Days Planned – Days Delivered)

2008-09

400

0

400.00

397.61

99.40%

-2.39

2009-10

408

2.39

410.39

399.82

97.42%

-8.18

2010-11

430

10.57

440.57

466.04

105.78%

+36.04

2011-12

342

-25.47

316.53

309.32

97.72%

-32.68

2012-13

320

7.21

327.21

318.20

97.25%

-1.80

2013-14

300

9.01

309.01

288.70

93.43%

-11.30

2015-16

300

20.31

320.31

315.67

98.55%

15.67

2016-17

300

4.64

304.64

309.28

101.52%

9.28

2017-18

300

-4.67

295.33

315.05

106.67%

15.05

Total

3100

 

 

3119.69

100.63%

19.69

 

Appendix 3 shows the planned time for reviews undertaken, against actual time taken, follow up reviews and unplanned reviews resulting from any special investigations for East Kent Housing Ltd. Thanet District Council contributed 25 days from its original plan in 2011-12 and 20 days subsequently as it’s share in this four way arrangement. The EKH Annual Report in its full format will be presented to the EKH - Finance and Audit Sub Committee on 3rd July 2017.

 

Appendix 4 shows the planned time for reviews undertaken, against actual time taken, follow up reviews and unplanned reviews resulting from any special investigations for East Kent Services. Thanet District Council contributed 60 days from its original plan as its share in this three-way arrangement. As EKS is hosted by TDC, the EKS Annual Report in its full format, is attached as Appendix 5.

 

 

5.         Overall assessment of the System of Internal Controls 2016-17

 

Based on the work of the EKAP on behalf of Thanet District Council during 2016-17, the overall opinion is:

 

            There are no major areas of concern, which would give rise to a qualified audit statement regarding the systems of internal control concerning either the main financial systems or overall systems of corporate governance.  The Council can have a very good level of assurance in respect of all of its main financial systems and a good level of assurance in respect of the majority of its Governance arrangements. Many of the main financial systems that have been covered, which feed into the production of the Council’s Financial Statements, have a Substantial assurance level following audit reviews. The Council can therefore be very assured in these areas. This position is the result of improvements to the systems and procedures over recent years and the willingness of management to address areas of concern that have been raised. 

 

            Several audits however, have also identified a common theme at Thanet District Council in recent years, that the lack of continuity of management has a detrimental impact upon the implementation of agreed audit recommendations. In many cases, at the time of the follow-up the auditor finds that the Manager who originally agreed to the recommendations is no longer in the Council’s employ and that they are now dealing with a replacement (often an interim). Members of Governance and Audit Committee should be aware of this risk as it impacts upon the risk management and internal control framework of the organisation.

 

There were four areas where only a limited assurance level was concluded and these reflect a lack of confidence in arrangements, and these were brought to officers' attention. These reviews are shown in the table in paragraph 6 along with the details of our planned follow up activity for other areas awaiting a progress report.

 

6.         Significant issues arising in 2016-17

 

From the work undertaken during 2016-17, there were no instances of unsatisfactory responses to key control issues raised in internal audit reports by the end of the year. There are occasions when audit recommendations are not accepted for operational reasons such as a manager’s opinion that the associated costs outweigh the risk, but none of these are significant and require reporting or escalation at this time.

 

The EKAP has been commissioned to perform only one follow up, there were six reviews that remained either fully or partially Limited Assurance after follow up and twenty-one  recommendations that were originally assessed as high risk, which remained a high priority and outstanding after follow up were escalated to the Governance and Audit Committee during the year. 

 

Reviews previously assessed as providing a Limited Assurance or partial No Assurance that are yet to be followed up are shown in the table below. The progress reports for these will be reported to the Committee at the meeting following completion of the follow up.

 

Area Under Review

Original Assurance

(Date to Committee)

Progress Report Due

Officers’ Code of Conduct, Gifts & Hospitality

Limited

March 2017

   Quarter 3 2017-18

Building Control

Limited

March 2017

Quarter 3 2017-18

Local Code of Corporate Governance

Limited

June 2017

Quarter 3 2017-18

Project Management

Limited

June 2017

Quarter 3 2017-18

 

And for EK Services there was one review that remained Limited Assurance after follow up and two recommendations that were originally assessed as high risk, which remained a high priority and outstanding after follow up were escalated to the Governance and Audit Committee during the year. 

 

Area Under Review

Original Assurance (Date to Committee)

Progress Report

PCI DSS

Limited

September 2016

Quarter Two 2017-18

 

And for East Kent Housing one review (Housing Repairs) remained at Limited assurance after follow up, there are no other limited assurances awaiting a follow up.

 

7.            Overall Conclusion

 

The Internal Audit function provided by the EKAP has performed well against its targets for the year. Clearly there have been some adjustments to the original audit plan for the year 2016-17, however, this is as expected and there are no matters of concern to be raised at this time. 

 

It is a requirement of s.151 of the Local Government Act 1974 for the Council to maintain an ‘effective’ internal audit function, when forming my opinion on the Council’s overall system of control, I need to have regard to the amount of work which we have undertaken upon which I am basing my opinion.

 

The EKAP assesses the overall system of internal control in operation throughout 2016-17 as providing reasonable assurance. No system of control can provide absolute assurance, nor can Internal Audit give that assurance. This statement is intended to provide reasonable assurance that there is an ongoing process for identifying, evaluating and managing the key risks.


                                                                        Appendix 1

 

Definition of Audit Assurance Statements & Recommendation Priorities

 

Assurance Statements:

 

Substantial Assurance - From the testing completed during this review a sound system of control is currently being managed and achieved.  All of the necessary, key controls of the system are in place.  Any errors found were minor and not indicative of system faults. These may however result in a negligible level of risk to the achievement of the system objectives.

 

Reasonable Assurance - From the testing completed during this review most of the necessary controls of the system in place are managed and achieved.  There is evidence of non-compliance with some of the key controls resulting in a marginal level of risk to the achievement of the system objectives. Scope for improvement has been identified, strengthening existing controls or recommending new controls.

 

Limited Assurance - From the testing completed during this review some of the necessary controls of the system are in place, managed and achieved.  There is evidence of significant errors or non-compliance with many key controls not operating as intended resulting in a risk to the achievement of the system objectives. Scope for improvement has been identified, improving existing controls or recommending new controls.

 

No Assurance - From the testing completed during this review a substantial number of the necessary key controls of the system have been identified as absent or weak.  There is evidence of substantial errors or non-compliance with many key controls leaving the system open to fundamental error or abuse.   The requirement for urgent improvement has been identified, to improve existing controls or new controls should be introduced to reduce the critical risk.

 

Priority of Recommendations Definitions:

 

Critical – A finding which significantly impacts upon a corporate risk or seriously impairs the organisation’s ability to achieve a corporate priority.  Critical recommendations also relate to non-compliance with significant pieces of legislation which the organisation is required to adhere to and which could result in a financial penalty or prosecution. Such recommendations are likely to require immediate remedial action and are actions the Council must take without delay.

 

High – A finding which significantly impacts upon the operational service objective of the area under review. This would also normally be the priority assigned to recommendations relating to the (actual or potential) breach of a less prominent legal responsibility or significant internal policies; unless the consequences of non-compliance are severe. High priority recommendations are likely to require remedial action at the next available opportunity or as soon as is practical and are recommendations that the Council must take.

 

Medium – A finding where the Council is in (actual or potential) breach of - or where there is a weakness within - its own policies, procedures or internal control measures, but which does not directly impact upon a strategic risk, key priority, or the operational service objective of the area under review.  Medium priority recommendations are likely to require remedial action within three to six months and are actions which the Council should take.

 

Low – A finding where there is little if any risk to the Council or the recommendation is of a business efficiency nature and is therefore advisory in nature.  Low priority recommendations are suggested for implementation within six to nine months and generally describe actions the Council could take.

 

Appendix 2

Performance against the Agreed 2016-17

Thanet District Council Audit Plan

 

Area

Original Planned Days

 

Revised Budgeted Days

 

Actual  days to

 31-03-2017

Status and Assurance Level

FINANCIAL SYSTEMS:

Main Accounting System

10

10

8.23

Finalised - Substantial

Budgetary Control

10

10

8.81

Finalised - Substantial

RESIDUAL HOUSING SERVICES:

Homelessness

10

10

17.63

Finalised - Substantial

GOVERNANCE RELATED:

Member Code of Conduct & Standards Arrangements

10

10

9.04

Finalised - Substantial

Officer Code of Conduct, Register of Interests, and Gifts and Hospitality

10

11

11.39

Finalised - Limited

Local Code of Corporate Governance

7

7

9.07

Finalised - Limited

Anti-Fraud & Corruption

9

0

0

Postpone until 2017-18

Performance Management

10

0

0

Postpone until 2017-18

Project Management

10

0

8.93

Work-in-progress

Corporate Advice/CMT

2

2

3.62

Finalised for 2016-17

s.151 Officer Meetings and Support

9

9

10.39

Finalised for 2016-17

Governance & Audit Committee Meetings and Report Preparation

12

12

13.01

Finalised for 2016-17

2017-18 Audit Plan and Preparation Meetings

9

9

10.08

Finalised for 2016-17

CONTRACT RELATED:

Service Contract Management

10

10

0.75

Work-in-Progress

Procurement

10

10

0.24

Work-in-Progress

SERVICE LEVEL:

Cemeteries & Crematoria

10

10

9.96

Finalised - Substantial

S11 Safeguarding Return to KCC

1

0

0

Not Required

HMO & Selective Licensing

10

10

10.18

Finalised - Substantial

Coastal Management

10

10

9.99

Finalised - Substantial

Public Health Burials

6

6

6.59

Finalised - Reasonable

Environmental Protection Service Requests

10

10

11.66

Finalised - Substantial

Playgrounds

8

8

9.76

Finalised - Limited

Events Management

10

10

0

Postpone until 2017-18

Disabled Facilities Grants

10

10

9.36

Finalised - Substantial

Asset Management

10

10

0

Postponed until 2017-18

Ramsgate Marina

12

12

12.3

Finalised - Substantial

Members Allowances & Expenses

10

10

5.53

Finalised - Substantial

Building Control

10

10

13.35

Finalised - Limited

Imprest Floats & Travel Warrants

6

6

6.03

Finalised - Substantial

Phones, Mobiles & Utilities

7

3

0

Postpone until 2017-18

OTHER :

Liaison With External Auditors

2

0

0

Finalised for 2016-17

Follow-up Reviews

10

10

26.43

Finalised for 2016-17

FINALISATION OF 2015-16 AUDITS:

Days under delivered in 2015-16

0

4.64

0

Completed

Grounds Maintenance

5

40.85

10.52

Finalised – Limited

Street Cleansing

9.74

Finalised – Limited

Planning Applications, Income & s106 Agreements

13.61

Finalised – Reasonable/Limited

Museums

1.28

Finalised - Limited

Recruitment

5.70

Finalised - Substantial

RESPONSIVE ASSURANCE:

Car Parking – Key Control Testing

0

2

2.37

Finalised

Dreamland – Post Implementation Review

0

12

13.22

Finalised

CSO Compliance Query

0

0

0.84

Finalised

Safeguarding Referral

0

0

3.44

Finalised

Referendum – 1 Presiding Officer

0

1

1

Finalised

Right to Buy

0

0

1.48

Work-in-Progress

EK HUMAN RESOURCES:

Payroll

5

5

3.15

Work-in-Progress

Employee Benefits-in-Kind

5

5

1.24

Work-in-Progress

Leavers/Disciplinary

5

5

5.13

Finalised - Substantial

TOTAL

300

295.36

315.05

106.67%


Appendix 3

 

Performance against the Agreed 2016-17

East Kent Housing Audit Plan

 

Review

Original Planned Days

Revised Planned Days

Actual days to

  31-03-2017

Status and Assurance Level

Planned Work:

Governance

15

0

0

Postponed to future audit plan

Finance Systems and ICT Controls

15

10

0

Postponed to future audit plan

Finance & Audit Sub Ctte/Plan/CMT

3

4

5.38

Completed

Follow-up Reviews

3

4

4.96

Completed

Rent Accounting & Collection

15

0

0

Postponed to future audit plan

Tenancy & Estate Management

29

22

20.55

Finalised - Substantial

Days over delivered in 2015-16

0

-18.15

0

Completed

Responsive Assurance:

Procurement

0

15

14.92

Finalised

Repairs and Maintenance Contract Query

0

0

0.60

Finalised

Performance Indicator Data Quality

0

10

5.48

Work-in-Progress

Single System Controls

0

15

2.12

Postponed to 2017-18

Total

80

61.85

54.01

87.32% at 31-03-2017


Appendix 4

 

Performance against the Agreed 2016-17

EK Services Audit Plan

 

Review

Original Planned Days

Revised Planned Days

Actual days to   31-03-2017

Status and Assurance Level

Planned Work:

Housing Benefit Overpayments

15

14

13.85

Finalised - Substantial

Fraud Arrangements

15

0

0.64

Postponed to future audit plan

Housing Benefit Subsidy

15

10

0.36

Work-in-progress

Council Tax

30

15

0.47

Work-in-progress

Customer Services

15

15

15.31

Finalised - Substantial

ICT Change Controls

12

11

11.99

Finalised - Substantial

ICT Software Licensing

12

11

11.85

Finalised - Reasonable

ICT Network Security

12

11

10.89

Work-in-progress

DDC / TDC Quarterly Housing Benefit Testing

20

20

18.43

Completed

Other:

Corporate/Committee

8

7

9.85

Completed

Follow-up

6

4

4.46

Completed

Finalisation of 2015-16 Audits:

Business Rates Credits

0

33.58

6.11

Finalised - Reasonable

Business Rates Reliefs

10.43

Finalised - Reasonable

Debtors

2.45

Finalised - Substantial

ICT Disaster Recovery

5.81

Finalised – Reasonable/Substantial

ICT Management & Finance

3.84

Finalised - Substantial

ICT PCI DSS

4.94

Finalised - Limited

Days under delivered in 2015-16

7.33

7.33

0

Completed

Responsive Assurance:

Housing Benefit +40 testing

0

17

17.95

Completed

Total

167.33

167.33

149.63

89.42% at 31-03-2017


Appendix 5

 

Annual Internal Audit Report for EK SERVICES 2016-17

 

1.            Introduction/Summary

The main points to note from this report are that the agreed programme of audits has been completed with some projects being finalised as work in progress at 31st March 2017. The majority of reviews have given a substantial or reasonable assurance and there are no major areas of concern that would give rise to a qualified opinion.

 

The financial management of the Internal Audit cost centre held by Dover District Council has performed well and has delivered a cashable saving of 10% against budget.

 

Overview of Work Done

The original audit plan for 2016-17 included a total of 16 projects. We have communicated closely with the s.151 Officers and the audit committees to ensure the projects actually undertaken continued to represent the best use of resources. As a result of this liaison some changes to the plan were agreed during the year. A few projects (1) have therefore been pushed back in the overall strategic plan, to permit some higher risk projects to come forward in the plan (1). The total number of projects undertaken in 2016-17 was 16, with 3 being WIP at the year end to be finalised in April.

 

2.            Review of the Internal Control Environment

 

2.1         Risks and Assurances

 

During 2016-17, 40 recommendations were made in the agreed final audit reports for EK Services.  These are analysed as being High, Medium or Low risk in the following table:

 

Risk Criticality

No. of Recommendations

Percentage

High

8

20%

Medium

18

45%

Low

14

35%

TOTAL

40

100%

 

Naturally, more emphasis is placed on recommendations for improvement regarding high risks.  Any high priority recommendations where management has not made progress in implementing the agreed system improvement are brought to management and Councillors’ attention through Internal Audit’s quarterly update reports. During 2016-17 the EKAP has raised 40 recommendations, and whilst 65% were in the High or Medium Risk categories, none are so significant that they need to be escalated at this time.

 

Internal Audit applies one of four ‘assurance opinions’ to each review, this provides a level of reliance that management can place on the system of internal control to deliver the goals and objectives covered in that particular review. The conclusions drawn are described as being “a snapshot in time” and the purpose of allocating an assurance level is so that risk is managed effectively and control improvements can be planned. Consequently, where the assurance level is either ‘no’ or ‘limited’, or where high priority recommendations have been identified, a follow up progress review is undertaken and, where appropriate, the assurance level is revised.

 

The summary of Assurance Levels issued on the 16 pieces of work commissioned for EK Services over the course of the year is as follows:

 

NB: the percentages shown are calculated on finalised reports with an assurance level

 

Assurance

No.

Percentage of Completed Reviews

Substantial

5

50%

Reasonable

4

40%

Limited

1

10%

No

0

0%

Work in Progress at Year-End

4

-

Not Applicable

2

-

 

NB: ‘Not Applicable’ is shown against quarterly benefit checks.

 

Taken together 90% of the reviews account for substantial or reasonable assurance. There was one review assessed as having a limited assurance.

 

For each recommendation, an implementation date is agreed with the Manager responsible for implementing it. Understandably, the follow up review is then timed to allow the service manager sufficient time to make progress in implementing the agreed actions against the agreed timescales. The results of any follow up reviews yet to be undertaken will therefore be reported to the quarterly committee at the appropriate time:

 

2.2         Progress Reports

 

In agreeing the final Internal Audit Report, management accepts responsibility to take action to resolve all the risks highlighted in that final report.  The EKAP carries out a follow up progress review at an appropriate time after finalising an agreed report to test whether agreed action has in fact taken place and whether it has been effective in reducing risk.

 

As part of the follow up action, the recommendations under review are either:

 

§     “closed” as they are successfully implemented, or

§     “closed” as the recommendation is yet to be implemented but is on target, or

§     (for medium or low risks only) “closed” as management has decided to tolerate the risk, or the circumstances have since changed. 

 

At the conclusion of the follow up review the overall assurance level is re-assessed. As Internal Audit are tasked to perform one progress report per original audit and bring those findings back, it is at this juncture that any outstanding high-risks are escalated to the Governance and Audit Committee via the quarterly update report.

 

Four follow up reports were carried out for EK Services during the year. The results for the follow up activity for 2016-17 will continue to be reported at the appropriate time. The results in the following table show the original opinion and the revised opinion after follow up to measure the impact that the EKAP review process has made on the system of internal control.

 

 

Total Follow Ups undertaken 4

No Assurance

Limited Assurance

Reasonable Assurance

Substantial Assurance

Original Opinion

0

0

3

1

Revised Opinion

0

0

3

1

 

There are no fundamental issues of note arising from the audits undertaken in 2016-17. There were no reviews previously assessed as providing a Limited Assurance that have been followed up in 2016/17.

 

2.3         Special Investigations and Fraud Related Work

 

The prevention and detection of fraud and corruption is ultimately the responsibility of management however, the EKAP is aware of its own responsibility in this area and is alert to the risk of fraud and corruption. Consequently the EKAP structures its work in such a way as to maximise the probability of detecting any instances of fraud. The EKAP will immediately report to the relevant officer any detected fraud or corruption identified during the course of its work; or any areas where such risks exist.

The EKAP is, from time to time, required to carry out special investigations, including suspected fraud and irregularity investigations and other special projects. During the year 2016-17 there have been no fraud investigations conducted by the EKAP on behalf of EK Services.

 

2.4       Completion of Strategic Audit Plan

 

The analysis in Annex A shows the individual reviews that were completed during the year. As at 31st March 2017 delivery was slightly behind plan and EKAP had delivered 149.63 days against 167.33 required (89.42%). The 17.70 days carried over will be adjusted in 2017-18 as part of the rolling three-year plan process.

 

The EKAP completes a rolling programme of work to cover a defined number of days each year. As at the 31st March each year there is undoubtedly some “work in progress” at each of the partner sites; some naturally being slightly ahead and some being slightly behind in any given year. However, the progress in ensuring adequate coverage against the agreed audit plan of work since 2011-12 concludes that EKAP is 17.7 days behind schedule as we commence 2017-18, as shown in the table below

 

Year

Days Required

Plus B/Fwd

Adjusted Requirement from EKAP

Days Delivered

Percentage Completed

Days Against Target

2011-12

169

0

0

143.90

85.15%

-25.10

2012-13

160

25.10

185.10

156.99

84.81%

-3.01

2013-14

160

28.11

188.11

156.96

83.44%

-3.04

2014-15

160

31.15

191.15

200.94

105.12%

+40.94

2015-16

160

-9.79

150.21

142.88

95.12%

-17.12

2016-17

160

7.33

167.33

149.63

89.42%

-10.37

Total

969

 

 

951.30

98.17%

-17.70

 

3.0       Significant issues arising in 2016-17

 

From the work undertaken during 2016-17, there were no instances of unsatisfactory responses to key control issues raised in internal audit reports by the end of the year. There are occasions when audit recommendations are not accepted for operational reasons such as a manager’s opinion that costs outweigh the risk, but none of these are significant and require reporting or escalation at this time.

 

The EKAP has been commissioned to perform only one follow up, there were no reviews that remained a Limited Assurance after follow up, however two  recommendations that were originally assessed as high risk, which remained a high priority and outstanding after follow up were escalated to the three audit committees during the year. 

 

Reviews previously assessed as providing a Limited Assurance that are yet to be followed up are shown in the table below. The progress reports for this review will be reported to the committees at the meeting following completion of the follow up.

 

Area Under Review

Original Assurance (Date to Committee)

Progress Report

PCI DSS

Limited

September 2016

Quarter Two 2017-18

 

 

4.0         Overall Conclusion

 

The work of Internal Audit and this report contribute to the overall internal control environment in operation within EK Services, and also assists in providing an audit trail to the statements that must be published annually with the financial accounts for each partner council. It is a requirement of s.151 of the Local Government Act 1974 for the Council to maintain an ‘effective’ internal audit function, when forming my opinion on the Council’s overall system of control, I need to have regard to the amount of work which we have undertaken upon which I am basing my opinion.

 

Based on the work of the EKAP on behalf of EK Services during 2016-17, the overall opinion is that there are no major areas of concern, which would give rise to a qualified audit statement regarding the systems of internal control concerning either the main financial systems or overall systems of corporate governance. The EKAP assesses the overall system of internal control in operation throughout 2016-17 as providing reasonable assurance. No system of control can provide absolute assurance, nor can Internal Audit give that assurance. This statement is intended to provide reasonable assurance that there is an ongoing process for identifying, evaluating and managing the key risks.

 

 

 


 

Appendix 6

EKAP Balanced Scorecard – 2016-17

 

 

INTERNAL PROCESSES PERSPECTIVE:

 

 

 

 

Chargeable as % of available days

 

 

Chargeable days as % of planned days

CCC

DDC

SDC
TDC
EKS
EKH

 
Overall

 

Follow up/ Progress Reviews;

 

·         Issued

·         Not yet due

·         Now due for Follow Up

 

 

  

Compliance with the Public Sector Internal Audit Standards (PSIAS)

(see Annual Report for more details)

2016-17 Actual

 

Quarter 4

 

86%

 

 

 

102.80%

97.91%

94.88%

106.67%

89.42%

87.32%

 

98.15%

 

 

 

78

20

33

 

 

 

 

Partial

Target

 

 

 

 

80%

 

 

 

100%

100%

100%

100%

100%

100%

 

100%

 

 

 

-

-

-

 

 

 

 

Full

 

 

FINANCIAL PERSPECTIVE:

 

 

Reported Annually

 

·      Cost per Audit Day

 

·      Direct Costs

 

·      + Indirect Costs (Recharges from Host)

 

·      - ‘Unplanned Income’

 

·      = Net EKAP cost (all Partners)

 

·      Saving Target Achieved

(shared between all partners)

2016-17 Actual

 

 

 

£294.47

 

£378,711.25

 

£10,530

 

£536.25

 

£388,705

 

£42,415

Original Budget

 

 

 

£326.61

 

£419,420

 

£11,700

 

Zero

 

£431,120

 

£42,415

 

CUSTOMER PERSPECTIVE:

 

 

 

 

Number of Satisfaction Questionnaires Issued;

 

Number of completed questionnaires received back;

 

 

Percentage of Customers who felt that;

 

·         Interviews were conducted in a professional manner

·         The audit report was ‘Good’ or better

·         That the audit was worthwhile.

 

 

 

 

 

 

2016-17 Actual

 

Quarter 4

 

80

 

 

43

 

=  54%

 

 

 

100%

 

100%

 

100%

 

 

 

 

 

 

Target

 

 

 

 

 

 

 

 

 

 

 

 

 

100%

 

90%

 

100%

 

 

INNOVATION & LEARNING PERSPECTIVE:

 

Quarter 4

 

 

Percentage of staff qualified to relevant technician level

 

Percentage of staff holding a relevant higher level qualification

 

Percentage of staff studying for a relevant professional qualification

 

Number of days technical training per FTE

 

Percentage of staff meeting formal CPD requirements (post qualification)

 

 

                                                           

 

 

2016-17 Actual

 

 

 

 

83%

 

 

36%

 

 

28%

 

 

0.97

 

 

36%

 

 

 

 
Target

 

 

 

 

 

75%

 

 

32%

 

 

N/A

 

 

3.5

 

 

32%