Internal Audit Report - 24-07 Credit Card Usage
Perth and Kinross Council · 2 December 2024
Back to Audit and Risk Committee — 2 December 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 Internal Audit Report All Services 24 - 07 Credit Card Usage November 2024 Final Report (Report No. 24/342) Legal and Governance Corporate and Democratic Services Perth & Kinross Council Council Offices 2 High Street Perth PH1 5PH
Page 2
2 24-07 Credit Card Usage Contents by Section 1. Introduction 2. Executive Summary 3. Audit Background Information 4. Scope and Limitations 5. Assessment of the Control Environment 6. Summary of Findings 7. Conclusions 8. Acknowledgement 9. Action Implementation & Follow Up 10. Management Action Plan 11. Authorisation 12. Distribution 13. Assessment Definitions
Page 3
3 1. Introduction 1.1 The audit of Credit Card Usage was undertaken as part of the Internal Audit Plan for 2024-2025, which was approved by the Audit & Performance Committee on 24 June 2024. The period under review for the purposes of the audit exercise was financial years 2022-23 to 2024-25. 1.2 The indicative scope for the audit was to review the appropriate use of the authorised credit card and adherence to the financial regulations, procurement policy and other relevant finance procedures. 2. Executive Summary 2.1 The audit has found that reasonable assurance can be placed on the Council’s internal controls in relation to credit card usage, the auditor cannot, at this point, properly assess best value or the extent to which the commissioned services are delivering the desired outcomes. 2.2 There are 5 actions arising from the findings in Section 6. An action plan is included at Section 10. Once these actions are completed, Internal Audit should be able to place substantial assurance on the arrangements in place. 3. Audit Background Information 3.1 This assignment forms part of the Internal Audit plan for 2024-25, approved by the Audit Committee on 24 June 2024. The period under review for the purposes of the audit exercise was financial years 2022-23 and 2023- 24. Please note, that due to the financial years reviewed, the report refers to strategic areas in place prior to the recent leadership restructure. 3.2 The Council’s credit card facility is administered by the central services team in Finance & Business Support. The use of credit cards is governed by the Financial Regulations 2023-26, which state the following: 8.5 The operation of credit card facilities or similar payment methods by the Council requires the prior approval of the Head of Finance (Chief Finance Officer), who may issue additional guidance on the procedures to be followed.
Page 4
4 9.12 The Head of Finance* is responsible for all debit and credit card transactions. Any income stream that accepts card payments must use a Payment Card Industry Data Security Standards compliant system. All card processing systems require approval of the Head of Finance and the Head of Legal and Governance Services. 11.10 The Head of Finance* will specify the records to be kept in respect of purchasing or credit card transactions. 11.22 It will be the Intelligent Client* who will ensure that any purchase made within their service by a credit card is valid and appropriate and the transaction is properly accounted for. The Intelligent Client should ensure periodic compliance checks are undertaken (as a minimum this must be completed annually). * It is to be noted that as from April 2024 the role of Head of Finance was replaced within the leadership structure with the Strategic Lead for Finance & Business Support and the Intelligent Client role was superseded by a new role of Business Finance Partner. 3.3 In addition to the Financial Regulations, there are Credit Card Guidelines, written in 2017, that show the standard operating procedure for the use of credit cards. 3.4 The Senior Income Officer in Finance & Business Support has administrative oversight for credit card deployment. The Finance Management Team approves all credit users. 3.5 There are nominated staff in Services who hold credit cards, with varying different limit values. The senior manager for each relevant service has responsibility for expenditure and use of the credit card held by their services. 3.6 Since January 2024 all finance teams have been under the management of the Strategic Lead for Finance & Business Support. 4. Scope and Limitations 4.1 The Audit reviewed appropriate use of authorised credit cards and user's adherence to the financial regulations, procurement policy and other relevant finance procedures. 4.2 There were no limitations identified that would impact the Audit. However, no checks were made of the accuracy of credit card reconciliation or journal entries passed in the Integra system.
Page 5
5 4.3 The audit referred to information from published regulations and guidelines. 4.4 In order to validate the operational process against the published standard operating procedure relevant staff were interviewed and a review of documentary evidence was undertaken. 4.5 A sample audit of purchases and the reconciliation process was conducted. 4.6 The details of the control objectives reviewed and Internal Audit’s assessment of their strength of control in each area is contained within Section 5 of this report. 5. Assessment of the Control Environment 5.1 The table below contains a summary of the findings against each control objective and Internal Audit’s assessment of the adequacy and effectiveness of the controls in place to meet each of the objectives agreed for this audit. Further details, including any improvement actions, are set out in the Management Action Plan. NB: Where there are no actions identified against an objective there is no action rating applicable, only an overall control objective assessment. No. Control Objective Action Rating Control Objective Assessment 5 4 3 2 1 1 To ensure there are sufficient controls in place to assure the appropriate deployment and security of credit cards in use. 1 Substantial Assurance 2 To ensure there are sufficient controls in place to assure the appropriate use of credit cards in purchasing goods and services out with the PECOS system. 2 Reasonable Assurance 3 To ensure there are sufficient controls in place to enable reconciliation of purchases made and sufficient budget monitoring. Substantial Assurance 5.2 The auditor has assessed that reasonable assurance can be placed on controls overall in relation to credit card usage from the audit. Meaning:
Page 6
6 There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. 5.3 A summary of the key findings and actions are provided in section 6, please note however, the following areas of good practice which have been highlighted during the audit. 5.3.1 Individual training is given to each new credit card holder on behalf of the allocated Financial Controller (Business Partner) for that Service. This is supplemented with credit card guidelines issued to all new credit card holders who are required to confirm they have read and understood them. 5.3.2 The Finance and Governance Team Leader in the former Communities contextualises the Credit Card Guidelines to the relevant team in that service. 5.3.3 In Communities when a credit card holder went on maternity leave the staff members card was temporarily stopped at the bank by the Senior Incomes Officer and the card was handed in and is kept in the Finance Team’ safe until the member of staff returns to work. 5.3.4 During COVID 19, due to office closure, the Finance Officer who administers housing purchases developed an e-form for emergency purchase retrospective approval. This enabled the purchase request form, authorisation and receipts to be scanned and attached to the same form. This system remains in use today. 5.3.5 All purchases requests within the former Education and Children’s Services are sent to the contracts team for validation prior to being sent to the credit card holder for purchasing. 6. Summary of Findings 6.1 Below is a summary of key findings and actions, which are reflected in the Management Action Plan, detailed in section 10. 6.2 Controls in place to assure the deployment and security of credit cards 6.2.1 The audit examined whether there were staff in named roles to ensure the safeguarding and use of credit cards; whether the council had sufficient controls in place to provide security should a card be lost or stolen, or no longer needed due to staff leaving or changing roles; and whether sufficient training and controls were in place to assure staff had awareness of credit card security and fraud prevention.
Page 7
7 6.2.2 The Financial Regulations stipulate the named roles relevant to the use of credit card for purchasing goods and services. These are supported by the Credit Card Guidelines. 6.2.3 The published Financial Regulations were written and last reviewed in May 2023. It was noted this version did not reflect the recent changes to the leadership structure. A revised version for 2024-2027 has now been approved by Council in October 2024. 6.2.4 The Credit Card Guidelines were written and last reviewed in 2017 and had not been revised to reflect the recent changes to the leadership structure. [Action point 1] 6.2.5 Other relevant guidance, such as the Counter Fraud and Corruption Strategy, is published on the Financial Matters and Guidance page on ERIC. 6.2.6 However, it was noted that information on fraud and corruption was not highlighted to staff when training was given. [Action point 2] 6.2.7 The Council holds insurance through Fidelity Guarantee Insurance that covers fraud, theft of money, etc. 6.2.8 At the time of audit, there were 73 credit cards issued to council staff. 6.2.9 It was noted that 16 staff on the list of credit card holders in 2023-24 had not used their cards over the past year (or more) and 8 had only been used once. An audit showed that these cards are held by Officers for emergency use i.e. where a card holder is not available to make a purchase out of hours, or when a card holder is absent from work (sick or holiday leave). This was not therefore considered a risk. 6.2.10 Credit cards are held by individual staff and can be taken off the Council office premises. The payment card security system does not allow card holder details or card numbers to be held on the Council system. Thus, staff must have access to them when out of office. Card holders are informed of their responsibility to keep the card safe and must sign (via an email) that they have read and understood the Credit Card Guidelines. 6.2.11 A credit card holder is responsible for informing the bank if a card is lost or stolen or there were anomalies on the statement. 6.2.12 There is a process in place to inform the Senior Incomes Officer in a timely manner when a member of staff is leaving the Council or moves role and no longer has authority to have a credit card, although this appears to be a d hoc.
Page 8
8 [Action point 3] 6.2.13 Overall, the auditor concluded there are sufficient controls in place to assure deployment and security of credit cards. 6.3 Controls are in place to assure the appropriate use of credit cards in purchasing goods and services out with the PECOS system 6.3.1 The audit reviewed whether standard operating procedures were being followed at each process step by relevant staff and whether there were sufficient controls in place to a) ensure the integrity of a budget holder, who may also be a credit card holder, when making a purchase, b) assure a conflict of interest was reported and mitigated for and c) safeguard against the misuse or fraudulent use of credit cards and dispute management. 6.3.2 The audit found that all services follow the standard operating procedures for the purchase of goods/services by credit cards. However, since COVID-19 the form to request a payment by credit card has not been used by all staff. Instead, an email request that holds all relevant information has been sent and accepted. Although this is out with the current credit card guidance it is recommended that the standard operating procedure be revised with a view to digitalising the process. [Action point 1] 6.3.3 Good practice was noted where an e-form was developed for Housing Officers to complete during COVID-19 for emergency purchase, that allowed scanned receipts to be uploaded into it, and retrospective budget holder approval to be added. 6.3.4 Further, good practice was noted where all requests for purchase by credit cards within Education and Children’s Service were sent to the service contracts team to check and validate the request is appropriate to be purchased by credit card, that the code is the correct one for that purchase, and the budget holder has authorisation for that purchase. If any anomalies are found the request is rejected. 6.3.5 All Services have a process whereby a purchase is questioned if it can be bought through PECOS instead. A budget holder may still insist that this be purchased but they would need to provide a rationale in writing as to why. 6.3.6 All purchases are required to have a receipt or invoice saved with the initial request, or a rationale as to why one isn’t available. Evidence of this practice was noted in the financial audit.
Page 9
9 6.3.7 Not all receipts/invoices are saved to EDMS at the time of purchase, but rather saved to a local folder or personal email and uploaded to EDMS at point of reconciliation. This is seen as a risk if the person is off work at time of reconciliation. It would be considered better practice for all purchase documentation to be saved directly to EDMS as point of purchase. [Action point 1] 6.3.8 Whilst a budget holder may in theory be able to authorise their own purchase request, all services have a process whereby another budget holder would approve a purchase in that situation. 6.3.9 Conflict of Interest is not part of the training for a credit card holder and no current process is followed by services to mitigate against a known conflict. It is felt there is a risk where a purchase is made on behalf of a person or company known personally by the credit card holder and no action is taken to mitigate this risk. [Action point 2] 6.3.10 Overall, the auditor concluded there are sufficient controls in place to safeguard against the misuse or fraudulent use of credit cards and dispute management. 6.4 Controls in place to enable reconciliation of purchases made and sufficient budget monitoring 6.4.1 The audit reviewed whether the reconciliation process was performed on a regular basis, by the appropriate staff members, and if there was regular management reporting to enable sufficient oversight and understanding of purchases made by credit card. 6.4.2 The audit found that the Senior Incomes Officer (SIO) upon receiving monthly bank statements allocates a spend amount, relevant to each service, to a service specific suspense account. The SIO then distributes the relevant statements to the delegated officer in each Service, as well an individual statement to each credit card holder. 6.4.3 Each credit card holder is responsible for reconciling their purchases against the statement and providing all relevant documentation to the financial controller in their service. 6.4.4 The reconciliation process checked all purchases shown on the statement against the purchase request, receipts and/or invoices by the credit card holder. Anomalies are checked back with the budget holder and raised to the attention of the Finance Controller. 6.4.5 Firstly, a journal entry is made for each purchase with a description of that purchase noted. The journal ledger shows the relevant budget code.
Page 10
10 6.4.6 Secondly, a check and/or sample audit is made by a Finance Officer before the reconciliation journal is finalised and approved. Where a Finance Officer is a credit card holder, their reconciliation is double checked by another Finance Officer. 6.4.7 Thirdly, the journal is checked and signed off by the delegated officer. Once approved it is imported to the Integra finance system to ensure payment is allocated to the correct budget code and the suspense account cleared back to zero. 6.4.8 Overall the auditor found that reconciliation was performed on a regular basis, by the appropriate staff members, and the process was robust. 6.4.9 It is to be noted that credit card spend is not committed from the budget at the time of purchase, unlike PECOS, but rather at the time of reconciliation, which could be up to 2 months later. No management reports can be which provide a budget holder with oversight of these purchases until reconciliation has taken place. The Finance team stated that they do not consider this to be a material risk, due to the low volumes of transactions accounted for in this manner. 6.4.10 The reconciliation journal is reviewed and approved by the delegated officer in each Service on a monthly basis. 7. Conclusion 7.1 The Internal Audit review can place reasonable assurance on the overall control environment for credit card usage. The agreed actions, once implemented, should enable Internal Audit to place Substantial Assurance on these. 8. Acknowledgements 8.1 Internal Audit would like to thank all officers who were involved in this audit, particularly the Senior Incomes Officer, and the officers who undertake the role of Financial Controller in each Service. 9. Action Implementation & Follow up 9.1 Responsibility for the maintenance of adequate and effective controls rests with management. Where the audit has identified areas for management action, these are identified in the Management Action Plan. Where a decision is taken by management not to act in response to finding from this review, it is the responsibility of management to assess and accept the risk arising from non- implementation. 9.2 Achievement of the agreed actions is monitored through Internal Audit’s ‘follow up’ arrangements.
Page 11
11 10. Management Action Plan Action Point Para. No Finding Risk Rating Agreed Action & Evidence Action Owner Target Completion Date 1 6.2.4 6.3.2 6.3.7 Guidelines: There is scope to update and improve the Credit Card Guidelines as a result of the following: The Credit Card Guidelines were written and last reviewed in 2017 and do not reflect the recent changes to the leadership structure, nor changes to working practice since COVID19. Processes developed over time and as a result of changing practices during the COVID pandemic and the request to purchase by credit card form is not always being used, instead an email request is accepted. Not all receipts/invoices are saved to EDMS at the time of purchase, but rather may be saved to a local folder or held on personal email. They are only uploaded to EDMS at the point of reconciliation. 2 Agreed action: The Senior Accountant will update the Credit Card Guidelines to reflect the change in leadership structure, as well as reflecting on the working practice relevant to the standard operating procedure. Agreed evidence: Updated Guidelines J Jennings, Senior Accountant March 2025
Page 12
12 2 6.2.6 6.3.9 Training It was noted that information on fraud and corruption was not highlighted to staff when training was given. Conflict of Interest is not part of the training for a credit card holder and no current process is followed in Services to mitigate against a known conflict. 2 Agreed action: The Senior Accountant will update the training information to signpost staff to the Finance matters and guidance site on ERIC, with particular reference to the Counter Fraud and Corruption Strategy. He will also signpost to the Employee Code of Conduct, Conflict of Interest procedure. All current credit card holders will be reminded of the need to follow this process to mitigate risk. Agreed evidence Updated guidance J Jennings, Senior Accountant March 2025 3 6.2.12 The process to inform the Senior Incomes Officer in a timely manner when a member of staff is leaving the Council or moves role and no longer has authority to have a credit card appears ad hoc. 2 Agreed action: The Incomes Team will remind managers to inform their delegated finance officer and the Senior Income Officer in Finance Business Services as soon as a member of their team, who is a credit card holder, has handed in their notice or it is known they will change roles and no longer require a credit card. Agreed evidence: Communication with credit card holders J Jennings, Senior Accountant March 2025
Page 13
13 10. Authorisation 10.1 The auditor for this assignment was J Borley. The supervising auditor was D Arachchilage. This report is authorised for issue: J Clark 11. Distribution 11.1 This report has been distributed to: T Glen, Chief Executive C Mailer, Depute Chief Executive L Simpson, Strategic Lead, Legal and Governance S Walker, Strategic Lead – Finance & Business Support C Robertson, Central Services Manager, Accountancy A O’Brien, Service Manager, Accountancy J Jennings, Senior Accountant, CDS Accountancy
Page 14
14 12. Assessment Definitions 12.1 The following table contains the definitions of the control objective assessment. Control Objective Assessment Level of assurance Definition Substantial Assurance A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable Assurance There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Assurance Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. No Assurance Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. 12.2 The following table contains the definitions applied by Internal Audit in rating audit findings/actions. Risk Rating for Individual Findings Rating Rating description Definition 5 Critical Significant observations/ major concerns which require immediate action. Management will need to add these to the appropriate Service risk register. Issue represents a control weakness which could cause, or is causing, severe disruption of the process or severe adverse effect on the ability to achieve process objectives 4 High Significant observations regarding the absence / failure of key controls requiring urgent action. Management should consider adding these to the appropriate Service/ divisional risk register Issue represents a control weakness which could have, or is having, major adverse effect on the ability to achieve process objectives
Page 15
15 Risk Rating for Individual Findings Rating Rating description Definition 3 Medium Observations regarding the effectiveness of key controls requiring reasonably urgent action. Management should consider these when updating any divisional / team risk registers Issue represents a control weakness which could have, or is having, significant adverse effect on the ability to achieve process objectives 2 Low Minor observations regarding the adequacy of controls which require action to improve the efficiency, effectiveness, or economy of operations or which otherwise require to be brought to the attention of Senior Management Issue represents a minor control weakness with minimal but reportable impact on the ability to achieve process objectives 1 Trivial / Minor Very minor observations which will be raised during the audit and may not be included within the final report Issue represents a very minor control weakness with negligible impact on the ability to achieve process objectives. The issue will be raised during the audit and may not be included within the final report.