202324_InternalAudit_Financial Ledger_Report_FINAL
Argyll and Bute Council · 13 June 2024
Back to Audit and Scrutiny Committee — 13 June 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Report April 2024 FINAL High Medium Low VFM Number of Findings 0 0 0 0 Financial Ledger Audit Opinion: Substantial
Page 2
2 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 2. Objectives and Summary Assessment ........................................................................................... 4 3. Detailed Findings ............................................................................................................................ 6 Appendix 1 – Audit Opinion ................................................................................................................. 10 Contact Details Internal Auditor: Moira Weatherstone Telephone: 01546 604146 e-mail: moira.weatherstone@argyll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 1. Executive Summary Introduction 1. As part of the 2023/24 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to the Financial Ledger. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. The main purpose of a general ledger system is to record the financial activity of the council and to produce financial and management reports to help council employees make decisions. Oracle Fusion General Ledger enables its users to: Record and review accounting information Enter journals to record actual entries directly into the General Ledger Review account balances online or through reports using OTBI and OTBI Self Service Analyse, correct, and adjust accounting information Use Oracle Fusion ADFDI (Application Development Framework Desktop Integration) to upload journals 5. The main system used by Financial Services to manage the General Ledger and Accounts Payable functions was Oracle EBS 12.1. Oracle ended support for this version of EBS in December 2021. For reasons of PSN and Cyber Essentials Plus compliance, and also broader cyber-security protection of a business critical system the council depends on, it was not practical for Finance to use this system beyond the end of June 2022. 6. The new solution (Fusion) and consultancy were procured following the Councils Procurement rules with Procurement being involved in the project from the start with contracts let with Oracle for the solution and Evosys for the implementation services. 7. OTBI (Oracle Transactional Business Intelligence) Self Service is the replacement for Discoverer viewer. OTBI is accessed through the Fusion system which is the replacement for Oracle.
Page 4
4 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 Scope 8. The scope of the audit is a post implementation review to determine how the system is operating paying particular attention to feeder systems, reporting functionality, procedures and training as outlined in the Terms of Reference agreed with the Head of Financial Services on 15 December 2023. Risks 9. The risks considered throughout the audit were: Audit Risk 1: Failure to ensure systems are operating effectively Audit Risk 2: Failure to ensure feeder systems are working effectively Audit Risk 3: failure to ensure that procedures are in place and staff are fully trained in systems Audit Opinion 10. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 1 to this report. 11. Our overall audit opinion for this audit is that we can take a substantial level of assurance. This means that internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Recommendations 12. There are no recommendations as a result of this audit. 13. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 14. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Fusion and associated systems are fully operational Audit Risk 1: Substantial Oracle ended support for EBS 12.1, the General Ledger and Accounts Payable system in December 2021. For reasons
Page 5
5 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 with post implementation reviews being undertaken of PSN and Cyber Essentials Plus compliance, and also broader cyber- security protection of a business critical system the council depends on, it was not practical for Finance to use this system beyond the end of June 2022 and therefore Fusion, the replacement had to be in place and fully operating by that date. After the initial delay of the start date, Fusion became operational in June 2022. Whilst fully operational it is recognised that some functionality has been lost which was previously available in Oracle EBS 12.1 resulting in the requirement to use manual interventions. However, it is reported that the manual interventions are functioning well and in relation to time do not add significant additional work. 2 Feeder systems within the Financial Ledger are operating effectively and in a timely manner Audit Risk 2 Substantial All feeder systems within the Financial Ledger are operating effectively. Interface feeder system reports are run by the system administration team. Cash and debtors interface reports are produced every day, however, others are generated when staff members process them – for example payroll (around the same timings every month). Reports are checked by the system administration team to ensure that they are successful. Payables is checked by the Creditors Supervisor. 3 Reporting systems within the Financial Ledger are functioning effectively Audit Risk 1 Substantial OTBI (Oracle Transactional Business Intelligence) Self Service is the replacement for Discoverer viewer. OTBI is accessed through the Fusion system. Running reports on OBTI is very different to Discoverer Viewer. There is now no longer a need to build reports as a standard set of reports are available for users, although a number of users have full licences to allow them to write reports. Users of Fusion reported a more user friendly reporting tool. However, commented that there had been a loss of some functionality which was available in Discoverer Viewer. The work around for the loss of functionality now
Page 6
6 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 requires manual processes. The main report run is year to date budget v actual. Although not as simple as Discoverer Viewer in terms of the ability to produce a report that shows controllable costs only, it still is considered an effective reporting tool. 4 Procedures are in place and relevant training has been provided to staff Audit Risk 3 High Training sessions were delivered by Evosys. Further training was provided through peer support as required. In addition training was backed up by manuals/guides provided by Evosys, however these have been amended to make them more focussed for Council staff to use. 15. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings Fusion and associated systems are fully operational with post implementation reviews being undertaken 16. Oracle ended support for EBS 12.1, the General Ledger and Accounts Payable system in December 2021. For reasons of PSN and Cyber Essentials Plus compliance, and also broader cyber-security protection of a business critical system the council depends on, it was not practical for finance to use this system beyond the end of June 2022 and therefore Fusion, the replacement had to be in place and fully operating by that date. After an initial delay in the start date, Fusion became operational in June 2022. 17. All functions have been moved over to Oracle Fusion, a supported platform which receives quarterly updates. All interfaces were in place, after being tested when Fusion went live in June 2022. Some issues were found after go live, but these have been resolved. All usual regular processes have been checked, including monthly processes. 18. Whilst the system is functioning well and users continue to adapt to Fusion it has not fully delivered on the expectations the users may have had in terms of delivering efficiencies. A small number of the processes that could previously be undertaken by Oracle EBS 12.1 are no longer supported on Fusion resulting in additional work through manual interventions. 19. Fusion doesn’t allow staff to build the Council’s support service model based on Budgets, this now requires manual intervention with the use of spreadsheets to run the model. It is noted that at present Fusion cannot be adjusted to run the support service model and that the manual interventions are reported to be working well. 20. Fusion has all appropriate accounts payable processes in place and is able to pay all due accounts. However, it was highlighted that there were ongoing issues with recurring payments
Page 7
7 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 and whereby Oracle EBS 12.1 was able to process these, Fusion requires monthly intervention to complete the process. This functionality is currently being reviewed in order to find appropriate solutions. 21. During the course of the audit we met with users of the system from various sections in Financial Services, including Creditors staff. It was highlighted by staff that there were a number of issues identified due to the fact that Fusion does not work the same way Oracle EBS 12.1. However, all reported satisfactory work around solutions. 22. An end of project report was issued in November 2022, by the Project Leaders to the Project Board. This report highlighted what went well with project, how the project performed against the PID, including the planned budget costs, schedule and any defined tolerances. It also covered any changes which were agreed during the life of the project. In addition there were identified follow-up action points and lessons learned. It was noted that there were a few action points still to be concluded. Feeder systems within the Financial Ledger are operating effectively and in a timely manner 23. All feeder systems within the Financial Ledger are operating effectively, interface feeder system reports are run by the system administration team. Cash and debtors interface reports are produced every day, however, others are generated when staff members process them – for example payroll (around the same timings every month). Reports are checked by the system administration team to ensure that they are successful. Payables is checked by the Creditors Supervisor. 24. Work on Fusion is undertaken as part of the continuous monitoring programme and reliance is placed on this with reports being reviewed as part of this audit. Reporting systems within the Financial Ledger are functioning effectively 25. OTBI (Oracle Transactional Business Intelligence) Self Service is the replacement for Discoverer viewer. OTBI is accessed through the Fusion system. Running reports on OBTI is very different to Discoverer Viewer. There is now no longer a need to build reports due to the fact that there are a standard set of reports are available for users, although a number of users have full licences to allow them to write reports. Users of Fusion reported a more user friendly reporting tool. 26. The main report run is year to date budget v actual. Although not as simple as Discoverer Viewer in terms of the ability to produce a report that shows controllable costs only, it still is considered an effective reporting tool. Reports written using the hierarchies were originally written by EVOSYS and adapted by the Council’s internal IT and present staff do not have the ability to write new ones at this point in time. It may be possible in the future to get a report written which only shows controllable costs however as it stands at the current time this would require IT resource and is not a priority at this time. OTBI reports don’t allow us to report on the hierarchies. With the lack of ability to run a report showing only the controllable costs the reports now require ‘lookups’ and pivot tables. It was reported that whist it does create additional work, this is not a time consuming job.
Page 8
8 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 Procedures are in place and relevant training has been provided to staff 27. A procurement exercise was undertaken to then find an implementation partner to support the process during the setup, go live and post go live. The contract being awarded to Evosys. Training sessions were delivered by Evosys. Further training was provided through peer support as required. Additionally, training for users was provided by internal staff. 28. Training was backed up by manuals / guides provided by Evosys, however these have been amended to make them more focussed for Council staff to use.
Page 9
In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 10
10 Argyll and Bute Council – Internal Audit Report – Financial Ledger, April 2024 Appendix 1 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.