2022_23_InternalAudit_PurchaseCards_ FinalReport
Argyll and Bute Council · 20 June 2023
Back to Audit and Scrutiny Committee — 20 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Argyll and Bute Council Internal Audit Report June 2023 FINAL High Medium Low VFM Number of Findings 0 9 4 0 Purchasing Cards Audit Opinion: Reasonable
Page 2
2 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 Contents 1. Executive Summary ........................................................................................................................ 3 Introduction ............................................................................................................................................ 3 Background ............................................................................................................................................. 3 Scope ....................................................................................................................................................... 4 Risks ........................................................................................................................................................ 4 Audit Opinion ......................................................................................................................................... 4 Recommendations ................................................................................................................................. 4 2. Objectives and Summary Assessment ........................................................................................... 5 3. Detailed Findings ............................................................................................................................ 8 Appendix 1 – Action Plan ..................................................................................................................... 14 Appendix 2 – Audit Opinion ................................................................................................................. 18 Contact Details Internal Auditor: Annemarie McLean Telephone: 01700 501354 e-mail: Annemarie.mclean@argyll-bute.gov.uk www.argyll-bute.gov.uk
Page 3
3 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 1. Executive Summary Introduction 1. As part of the 2022/23 internal audit plan, approved by the Audit & Scrutiny Committee in March 2023, we have undertaken an audit of Argyll and Bute Council’s (the Council) system of internal control and governance in relation to Purchase Cards. 2. The audit was conducted in accordance with the Public Sector Internal Audit Standards (PSIAS) with our conclusions based on discussions with council officers and the information available at the time the fieldwork was performed. The findings outlined in this report are only those which have come to our attention during the course of our normal audit work and are not necessarily all the issues which may exist. Appendix 1 to this report includes agreed actions to strengthen internal control however it is the responsibility of management to determine the extent of the internal control system appropriate to the Council. 3. The contents of this report have been agreed with the appropriate council officers to confirm factual accuracy and appreciation is due for the cooperation and assistance received from all officers over the course of the audit. Background 4. Public procurement is the process by which public bodies acquire goods, services and works from third parties to meet customer and service user needs. Procurement covers all activities from identification of a requirement to spend to the receipt of goods or services. 5. Legislation governs how Scottish public bodies buy their goods, services and works. All purchasing must take place in accordance with the statutory duty to secure best value under the Local Government (Scotland) Act 2003. 6. To achieve best value, Argyll and Bute Council (the Council) is required to secure continuous improvement in performance whilst maintaining an appropriate balance between quality and cost; and in making those arrangements and securing that balance, have regard to economy, efficiency, effectiveness, and equal opportunities requirements which contribute to the achievement of sustainable development. 7. The Council uses purchasing cards as a method of payment covering a wide range of purchases/transactions. They operate in a similar way to any type of bank card and are issued to an individual who are then provided with a unique personal PIN number. 8. The Council currently has approximately 200 purchasing cards in circulation and in 21/22 the total value of purchase card expenditure was £2.07 million, across 14,697 transactions. Although purchase card expenditure represents only 1% of the Council’s total spend (£171.4m for 21/22), it accounts for 18% of invoices and has generated income in the form of a rebate based on card usage, of £12,835 which is paid to the Council by the card issuer. 9. In February 2022 an Internal Audit of purchasing cards found it difficult to establish whether transactions carried out via purchasing cards were achieving best value. At that time no detailed analysis of purchase card transactions had been carried out for the reasons below: the majority of purchase card transactions fell within the procurement threshold of £0 - £999 for which there was limited guidance available.
Page 4
4 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 there was no requirement to record purchase card transactions on PECOS; purchase card transaction reports were not provided to the procurement team. Scope 10. The scope of the audit was to review compliance with procedures and authorisation processes to establish value for money as outlined in the Terms of Reference agreed with the Procurement Commercial & Contract Management Team Manager on 31 January 2023. Risks 11. The risks considered throughout the audit were: Audit Risk 1 - Failure to ensure key system, financial and management controls are in place and operating effectively Audit Risk 2: Failure to ensure all expenditure has been incurred in compliance with agreed procurement procedures Audit Risk 3: Failure to achieve best value through the procurement process Audit Opinion 12. We provide an overall audit opinion for all the audits we conduct. This is based on our judgement on the level of assurance which we can take over the established internal controls, governance and management of risk as evidenced by our audit work. Full details of the five possible categories of audit opinion is provided in Appendix 2 to this report. 13. Our overall audit opinion for this audit is that we can take a reasonable level of assurance. Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Recommendations 14. We have highlighted nine medium priority recommendations and four low priority recommendations where we believe there is scope to strengthen the control and governance environment. These are summarised below: “Purchase cards – Payment Method and not procurement route _Supplementary Guidance to cardholders” should be recirculated to all staff with a reminder that the guidance must be followed, including the importance of obtaining value for money The Procurement Manual should include details of the purchase cards supplementary guidance note to be followed Budget holders should be provided with a list of purchase card holders who have been given authority to pay for goods and services to meet operational needs. The Purchase Card Holder list should be circulated to budget holders on a regular basis to confirm that purchase card holders, their limits , approvers and administrative delegates are still appropriate Appropriate procedures should be put in place to ensure that purchase card transactions are approved by the Budget Holder prior to purchases being made
Page 5
5 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 Increases or decreases to purchase card limits must be approved by the budget holder or Head of Service in advance of any change and procurement should be notified prior to any increases over £1000 Single purchases which exceed the procurement thresholds identified as route 1 and route 2 must be notified to the procurement team in advance of the purchase Consideration should be given as to how processes can be streamlined to ensure that purchase card transactions are appropriately recorded, authorised and with sufficient supporting documentation to evidence the purchase. The use of PECOS is considered best practice. Transaction limits on the banking system must not exceed the purchase card limit Card holders must not make personal purchase cards available to any other member of staff for the purposes of procurement of goods and services or pass on the card PIN number A review of procurement methods using purchase cards over the internet should be undertaken and appropriate guidance added to the Procurement Manual and circulated to purchase card holders and all relevant staff A review of individual card holder high volume/high value transactions should be undertaken and a review of education purchase card spend carried out with consideration given to restricting the volume/value of transactions each month In order to allow greater scrutiny and determine whether best value can be demonstrated, the procurement team should have authority to access other system(s) Facilities to record and upload copies of invoices and receipts must be made available to staff and staff reminded of the importance of providing evidence to support purchases 15. Full details of the audit findings, recommendations and management responses can be found in Section 3 of this report and in the action plan at Appendix 1. 2. Objectives and Summary Assessment 16. Exhibit 1 sets out the control objectives identified during the planning phase of the audit and our assessment against each objective. Exhibit 1 – Summary Assessment of Control Objectives Control Objective Link to Risk Assessment Summary Conclusion 1 Procurement procedures have been updated and circulated to purchase card holders and authorisers to provide guidance for transactions below £1000 Audit Risk 1 Reasonable Senior staff within the Procurement and Contract Management Team (PCMT) produced a supplementary guidance note titled “Purchase cards – Payment Method and not procurement route _Supplementary Guidance to cardholders”. This was distributed to purchase card holders and authorisers. This Supplementary Guidance Note should be added to The Procurement Manual. 2 Purchasing card expenditure complies with the Council’s Audit Risk 2 Limited Purchases made using purchase cards, at times do not comply with the Council’s procurement guidance. The Councils Authorised Signatories list
Page 6
6 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 Procurement Guidance forms an operational part of the Scheme of Delegation and should provide a record of those staff who have been authorised to act in respect of payments and specify the limits of their authority. In recognition that purchase cards are a method of payment and not authorisation to spend the Authorised Signatories List does not have a category for purchase cards, however, Creditors maintain a spreadsheet of purchase card holders and their card limits. Transactional testing was unable to obtain evidence of prior approval for 42% of transactions, some approval is verbal or via retrospective purchase orders. In addition, at times, procurement procedures are not being followed and procurement teams are not consulted prior to purchases in excess of £1,000. Testing of payments in excess of £10,000 identified transactions with a total value of expenditure with one company exceeding £50,000. We identified an instance where spend had been incurred for Council purposes via EBay and PayPal, there is currently no guidance for cardholders for using such sites. Education account for a significant volume of transactional spend using purchase cards. The Devolved School Management (DSM) scheme, empowers Head Teachers to determine the purchasing requirements for their schools within their budgets and in accordance with the Council’s procurement processes/regulations & procurement manual. The Education Purchasing Team (EPT) was reinstated in 2020 and has been extended to March 2025 supporting Head Teachers and central education staff to deliver an increase in contracted spend. While the review identified that there is still work to be done in this area there are positive
Page 7
7 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 indications that there is a shift in culture towards engaging with EPT, seeing EPT as an additional resource which can free up staff time within schools and make the budgets go further. Requests to Creditors for temporary or permanent increases in spend and changes to categories of spend are either verbal or by email. There is currently no formal process in place to ensure that the budget holder has approved any changes. 3 Purchasing Card expenditure is recorded in a manner that allows the Council‘s Procurement Team to determine whether best value has been achieved. Audit Risk 3 Reasonable Analysis of purchase card spend by the Procurement Team identified that orders via Amazon account for a large volume of uncontracted transactions. In order to gain oversight of items being purchased, the Procurement Team set up a Council Amazon Business account. This process is working well and has already delivered significant savings which are reported by Procurement Team. One of the difficulties in trying to gain control of purchase card spend is that Procurement and Finance staff do not get sight of departmental spend until the transactions and invoices are uploaded and coded via the banking system to the general ledger. Procurement staff do not have access to the banking system so cannot see invoices which are not recorded on PECOS. Receipts and invoices are not always added to the banking system. Staff working remotely, or in non-Council networked properties may not have access to appropriate technology or have been provided guidance on alternative ways to upload this information. 17. In order to gather information for this review, a survey was issued to cardholders, authorisers, delegates and budget holders, we received 109 responses. Additionally, 60 purchase card transactions were selected for testing from the three months, January, February and March
Page 8
8 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 2023. Further transactional testing was undertaken where potential issues were identified. The results of the 102 respondents and the transactional testing are included within the detailed findings below. 18. Further details of our conclusions against each control objective can be found in Section 3 of this report. 3. Detailed Findings Procurement procedures have been updated and circulated to purchase card holders and authorisers to provide guidance for transactions below £1,000 19. The Council’s Procurement Strategy sets out a framework which is designed to enable the Council’s to continue to make sure it complies with statutory procurement duties while promoting the benefits of early procurement engagement and increasing the level of collaboration both internally, between services and externally with other partners. Purchase cards as a payment method are cross departmental, are administered by Creditors whose tasks include issuing of procedure notes and guidance documents. Cards are requested by Services who are responsible for compliance with the Councils Financial Standing Orders and procurement rules. The use of purchase cards is now widespread and an established part of the Council’s daily mechanism for payment of goods, supplies and services. 20. The 2021/22 internal audit of Purchase Cards identified a potential gap within the procurement guidance for purchases below £1,000. The Procurement and Contract Management Team (PCMT) subsequently produced a supplementary guidance note “Purchase cards – Payment Method and not procurement route _Supplementary Guidance to cardholders”. The document is concise and clearly states that purchase cards are a method of payment only and should not replace any procurement process. It outlines the Council’s procurement thresholds and describes in detail the recommended actions required for purchases under £1,000. 21. The Supplementary guidance was issued to all cardholders, delegates and authorisers in October 2022. Of the 109 responses received from the survey undertaken, 70 said they had received the guidance and 32 said they had not or were unaware. Of the 86 cardholders surveyed, 41 indicated that they do not refer to the guidance when planning a purchase. Action Plan 1 22. Within the Procurement Manual purchase cards are not listed as a supplementary guidance note to be followed, nor does it reference the Education Purchase Team. Action Plan 2 Purchasing card expenditure complies with the Council’s Procurement Guidance 23. When providing staff with a corporate purchase card, the Council is granting card holders the ability to pay for goods and services on its behalf up to an agreed card limit. The Council’s Constitution, Part D sets out the Financial and Regulations, Section 7 Systems and Procedures, states: “Executive Directors will ensure that a proper scheme of delegation has been established within their department and is operating effectively. The scheme of delegation should identify staff
Page 9
9 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 authorised to act on the Executive Director’s behalf in respect of payments, income collection and placing orders together with the limits of their authority”. 24. The Councils Authorised Signatories list forms the operational part of the Scheme of Delegation and provides a record of those staff who are authorised to act in respect of payments within specified limits of their authority. As purchase cards are a method of payment the Authorised Signatory list does not have a category to record Purchase Card Holders or their card limits. A detailed spreadsheet is maintained by Creditors recording purchase card holders, their card limits, their single transaction limit, the approver and any administrative delegates. This is not currently circulated to budget holders for review. Requests for a purchase card within specified limits and categories must be signed by either the Head of Service or the budget holder. Action Plan 3 25. Prior to using a purchase card appropriate approval should always be obtained, and retained, prior to a purchases being incurred. Of the cardholders who are not on the Authorised Signatories List, 23% stated they did not obtain approval prior to spend, either from a budget holder or the authorised signatory. Of those who did get prior approval, 23% stated that this was verbal approval only. The Council’s Constitution states that verbal approvals should only be given in an emergency and should be confirmed in writing immediately. Anecdotal evidence, gathered from conversations, emails and the survey suggests that some staff consider retrospective purchase orders as evidence of appropriate approval and therefore mitigates this risk, however, that spend has already taken place. Transactional testing was unable to obtain evidence of prior approval having been sought for 42% of transactions. It is budget holder’s responsibility to provide clear instructions and approval to purchase card holders, outlining what goods and services they require the card holders to purchase. Procurement thresholds must be adhered to. Action Plan 4 26. A review of the current list of card holders found that card limits are mostly within the range of £200 to £5,000 and with only a few up to £10,000. The exception being the Procurement team and Fleet who have higher limits due to their unique and specific roles. There is currently one card holder, who has higher limit than staff within the procurement team. 27. There are occasions where cardholders may require a short term increase of their limit e.g. schools paying for school trips. Transactional testing identified instances where card limits or single transaction limits have been breached. At present requests for an increase on the card limit is made by phone call or email to the purchase card administrator who contacts the bank to arrange for a short term increase, normally until the end of the next monthly statements. There is no formal procedure in place to request increases or decreases to card limits. In addition, there is no requirement to obtain or retain either budget holder or Head of Service approval for requested changes. Action Plan 5 28. At present, where card limits exceed normal procurement thresholds there is no requirement to notify the Procurement team, increasing the risk that procurement procedures will not be followed. A summary of the Council’s Procurement thresholds for Supplies/Goods/Services spend are:
Page 10
10 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 £0-999 - Pricing agreement should be reached prior to purchase, with ordering from an e-cat or external marketplace on PECOS should be considered first £1,000 - £49,999 – Route 1 new procurements of this value should be procurement team led. Your procurement officer, Education Purchasing Team, Travel & Accommodation Team, Corporate Purchasing Team or D&I Purchasing Team can all support with these requirement. £50,000 - £181,302 – Route 2 procurements of this value must be procurement team led. Specific testing of payments over £10,000 identified transactions where the total value of expenditure with one company exceeded £50,000 that had not been referred to the designated Procurement team. While the expenditure was necessary to deliver essential services, it was an annual planned spend and the cardholder, at that time, was not authorised to award contracts on behalf the Council. The transactions are not recorded on PECOS and the supplier was not an approved Council contracted supplier, at that time. This transaction required an increase to the card limit, and payment of each invoice was split over two transactions. We checked further transactions for this card and over the 3 months there were 76 transactions none of which are recorded on PECOS, in addition of these 11 were over £1,000. This increases the risk that the Council may not be able to evidence compliance with its statutory duties in relation to Procurement Regulations. The Service were contacted and are now engaging with the Procurement Team to remedy this going forward. Action Plan 6 29. There is further evidence that some purchases are made which do not follow Council procurement guidelines. A search of PECOS found that of 27 transaction recorded, 18 of these were retrospective orders. In addition, 28 transactions could not be found, 9 invoices were valued between £1,000 and £3,000 with no evidence of engagement with the procurement team. This picture is consistent with survey responses where 54 cardholders said they do not create an order on PECOS before using the card, reasons include, replacement for imprest account, three staff do not have access to PECOS, it was not possible to get costings beforehand and it was felt that double processing is inefficient if staff have to record purchases both on banking system and PECOS. The use of PECOS to seek pre- approval for purchases is considered best practice. Action Plan 7 30. A sample check of the banking system comparing credit limits with single transaction card limits identified three cards where the single transaction limit is higher than the card limit. Action Plan 8 31. Where bank closures resulted in staff being unable to withdraw cash for traditional imprest accounts, staff were issued purchase cards and Personal Identification Numbers (PIN) to enable them to withdraw cash. While the testing of the imprest account process is not within the scope of this review, we identified situations where staff other than the cardholder withdraw cash using their purchase card. The sharing of a PIN number does not comply with the bank’s terms and conditions. Conversations with staff identified that the reasons behind this was either the card was being treated as the office/service card or for operational reasons, for example staff
Page 11
11 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 working shifts and emergency purchases like food shopping or emergency clothing for children needed to be provided. Action Plan 9 32. During the review we identified instances where spend has been incurred for Council purposes via EBay and PayPal. This increases the risk that the Council is engaging with suppliers without the protection of the checks afforded by procurement, for example, that the items purchased meet quality standards and that the purchase card may be made using a personal account. Action Plan 10 33. Education account for a significant volume and value of transactional spend via purchase cards. The Devolved School Management (DSM) schemes set out local authorities’ financial processes for funding their schools, how they delegate some financial decisions to their schools, and the accountability and responsibility for financial decisions with guidance contained within the Education Reform Joint Agreement 2018. Head Teachers are empowered to determine the purchasing requirements for their schools within the budgets devolved to them and are required to follow procurement procedures. 34. The Education Purchasing Team (EPT) was reinstated in 2020 for a period of two years. A key factor in this decision, was that an internal audit report identified - “There is a general lack of awareness amongst Head Teachers of the processes to follow when making purchases over £1,000 and sample testing confirmed a lack of compliance with those processes.” The EPT has been extended until 31 March 2025, having been considered a success with one of the key benefits being an increase in contracted spend. The EPT team have produced a very clear detailed Education Buying Guide which includes names of specific suppliers and contracts for common educational purchases and instructions on how to purchase from these routes. 35. Interpretation of the transactional data highlighted that in the 3 month period January to March 2023, one Budget Holder within Education, was the second highest user of a purchase card in terms of both number of transactions and volume of spend with a total of 367 transactions amounting to the value of £33,569 (some of these are cash in lieu of the imprest account). There were 6 transactions over £1,000 where there was no supporting evidence of engagement with the procurement team. Procurement Team have reviewed and discussed these with the Budget Holder who is now engaging with EPT. Action Plan 11 36. The findings from our survey and testing, although not limited to education, did identify issues within schools, which include verbal requests for purchases, retrospective purchase orders being seen as sufficient approval, not following the procurement guidelines and what appears to be very frequent ordering, some purchases appear as frequent as multiple times in one day. This may not be an efficient use of staff resources, compared with a planned once a week ordering, unless there is specific and an urgent requirement to do so. In addition, controls in place to prevent the use of non-contract suppliers and unregulated procurement are not as effective when purchases are not routed via Procurement Team. Action Plan 1
Page 12
12 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 Purchasing Card expenditure is recorded in a manner that allows the Council‘s Procurement Team to determine whether best value has been achieved 37. Analysis of the existing spend profile (financial year 2020/21) has identified the volume of uncontracted suppliers as a priority area of focus. Some actions that are in the strategy to address this include: To continue to work with all services to implement the No Purchase Order No Payment; eventually resulting in the stopping of all relevant manual batched payments and providing the PCCMT access to line item detail of all supplier spend. To continue to support all services to source and purchase goods and services from national and local contracts where possible. To continue to increase the remit of the Transactional Purchasing Team (TPT) To continuously review the eProcurement System (PECOS) to ensure catalogues and suppliers are up to date and available for use by both the TPT and service end users. Continue to support Education Services with all procurement activity via the Education Purchasing Team to increase Education’s volume of spend under contract. 38. During the COVID 19 pandemic business continuity period there have been increased risks of more unregulated expenditure due to more home and remote working, together with increased potential for contracted suppliers to be unable to deliver the goods and services required of the Council. 39. Analysis of purchase card spend by the Procurement Team identified that orders via Amazon, account for a large volume of uncontracted transactions. In order to gain oversight of items being purchased, the Procurement Team arranged the setting up of a Council Amazon Business account. Now orders are placed with a Council email address and are routed to the Procurement Team for approval where it is established that the purchase represents best value, or rejection where the purchase does not represent best value e.g. the items are available through a contracted supplier or this is not an appropriate route to purchase e.g. spend on IT equipment which should be routed via ICT department. Another benefit is the Amazon account retains all the invoices for purchases. This process is working very well and has already delivered significant savings which are reported by Procurement Team. 40. One of the difficulties in trying to gain control of purchase card spend is that Procurement and Finance staff do not get sight of departmental spend until the transactions are processed through the general ledger and reports are issued. Purchase card statements are monthly which can indicate that the actual transactions may have occurred almost 2 months earlier. Purchase card transactions are coded to the relevant cost centre by cardholders in the banking system which has a mandatory requirement to upload a receipt for every transaction, these are then authorised by the approver. Currently, staff within the procurement team do not have access to this system, therefore cannot see invoices/receipts for purchases not recorded on PECOS and making it challenging to determine whether best value has been achieved. Action Plan 12 41. A check of transactions on the banking system was undertaken to establish whether invoices and receipts that are not recorded on PECOS have been uploaded as required. We found multiple instances where instead of an invoice, a pdf stating “no receipts available” or “receipts retained in the office and available to view if required”. Discussions with staff have indicated that due to
Page 13
13 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 hybrid working, not all staff have ready access to a scanner/appropriate equipment to digitalise the receipts/invoices. This has the potential to result in loss of income due to transactions being coded as ‘Outwith the Scope’ of VAT. While VAT testing was not part of this review, we referred some transactions to the VAT Team for further review. Action Plan 13
Page 14
Appendix 1 – Action Plan No Finding Risk Agreed Action Responsibility / Due Date Medium 1 Supplementary Guidance Supplementary guidance was issued to all purchase cardholders, delegates and authorisers in October 2022. Of the 109 responses received from the survey undertaken, 70 said they had received the guidance and 32 said they had not or were unaware. Of the 86 cardholders surveyed, 41 indicated that they do not refer to the guidance when planning a purchase. Inconsistencies in use of purchase cards The supplementary guidance will be reissued to all cardholders, delegates and authorisers after it has been updated by PCCMT – per action point 10 Creditors Supervisor 31 December 2023 Medium 2 Procurement Manual Within the Procurement Manual purchase cards are not listed as a supplementary guidance note to be followed. Inconsistencies across procedures Guidance note to be added to Manual by PCCMT. PCCMT Manager 31 December 2023 Medium 3 Purchase Card Holder List Purchase cards are a method of payment a detailed spreadsheet is maintained by Creditors providing details of purchase card holders, their card limit, the single transaction limit, the approver and any administrative delegates This is not currently circulated to budget holders for review. Operational needs of services may not be appropriate. The Purchase cardholder list will be circulated to Budget Holders for review. This be an annual process Creditors Supervisor 31 December 2023 Medium 4 Approval to use Purchase Card Prior to using a purchase card appropriate approval should always be obtained, and retained, prior to a purchases being incurred. Of the cardholders who are not on the Authorised Signatories List, 23% stated they did not obtain approval prior either from a budget holder or the authorised signatory. Of those who did get prior approval, 23% stated that this was verbal approval only. Un-authorised use of purchase card A reminder will be added to the email to Budget Holders circulating the Purchase Card Holder list that is their responsibility to approve spend prior to purchases being made. Creditors Supervisor 31 December 2023
Page 15
15 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 No Finding Risk Agreed Action Responsibility / Due Date Medium 5 Changes to Purchase Card Limits or Categories of Spend There is no procedure in place to request increases or decreases to card limits or changes to spend categories. In addition, there is no requirement to obtain or retain either budget holder or Head of Service approval for requested changes within purchase cards or a procedure in place for such changes. In-appropriate use of purchase cards A form will be introduced which will be issued to Budget holders whenever a permanent increase or decrease to the Card limit is required. For temporary limits up to £1000 the cardholder must also ensure the approver/budget holder is copied into the email sent to us Creditors Supervisor 31 December 2023 Medium 6 Procurement Thresholds At present, where card limits exceed normal procurement thresholds there is no requirement to notify the Procurement team, increasing the risk that procurement procedures will not be followed. Procurement procedures not being followed Procurement team will be copied into the email for all permanent and temporary increases over £1000 Creditors Supervisor 31 December 2023 Medium 7 Procurement Processes There is evidence that some purchases are made which do not follow Council procurement guidelines. A search of PECOS found that of 27 transaction recorded, 18 of these were retrospective orders. In addition, 28 transactions could not be found, 9 invoices were valued between £1,000 and £3,000 with no evidence of engagement with the procurement team. Procurement procedures not being followed As per action point 10, the PCCMT will update the purchase card supplementary guidance, Creditors will reissue to all cardholders, delegates and authorisers as per action plan 1 PCCMT Manager 31 December 2023 Creditors Supervisor 31 December 2023 Medium 8 Purchase Card Limits A sample check of the banking system comparing credit limits with single transaction card limits identified three cards where the single transaction limit is higher than the card limit. Staff within procurement team be given access to the relevant system. Purchase card limits may be exceeded A report will be requested from the Bank for all card holders, with their card limits and single card limits. If this is available Creditors staff will review to ensure that single transaction limits do not exceed card limits. Creditors Supervisor 31 December 2023
Page 16
16 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 No Finding Risk Agreed Action Responsibility / Due Date This will be carried out in conjunction with budget holder review of card holders and limits. Medium 9 Sharing of Purchase Cards While the testing of the imprest account process is not within the scope of this review, we identified situations where staff other than the cardholder withdraw cash using their purchase card. The sharing of a PIN number does not comply with the bank’s terms and conditions Un-authorised use of purchase card A reminder will be added to the email to Budget Holders circulating the Purchase Card Holder list that sharing of a PIN number does not comply with the banks terms and conditions Creditors Supervisor 31 December 2023 Low 10 Internet Use of Purchase Cards During the review we identified instances where spend has been incurred for Council purposes via EBay and PayPal. Unable to demonstrate or achieve value for money The PCCMT will update the purchase card supplementary guidance, which will be reissued to all cardholders, delegates and authorisers as per action plan 1 and 10 PCCMT Manager 31 December 2023 Low 11 High Volume/Value use of Purchase Card Interpretation of the transactional data highlighted that in the 3 month period January to March 2023, one Budget Holder within Education, was the second highest user of a purchase card in terms of both number of transactions and volume of spend with a total of 367 transactions amounting to the value of £33,569 Unable to demonstrate or achieve value for money The PCCMT will monitor the purchase card transaction list and work with staff where multiple orders are placed. A reminder will be issued in the monthly newsletter issued by EPT PCCMT Manager 31 December 2023 Low 12 Access to Systems Currently staff within procurement team do not have access to appropriate systems, therefore cannot see invoices/receipts for purchases not recorded on PECOS and making it challenging to determine whether best value has been achieved. Inability to interpret information to ensure procurement processes are being followed and value for money achieved PCCMT Manager will identify staff who require access to the purchase card banking system to view invoices. Creditors will provide access to these staff PCCMT Manager 30 September 2023 Creditors Supervisor 31 December 2023 Low 13 Scanning of Invoices/Receipts Unable to provide supporting documentation to evidence spend Wording will be added to the email to Budget Holders circulating the Purchase Card Holder list reminding Creditors Supervisor 31 December 2023
Page 17
17 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 No Finding Risk Agreed Action Responsibility / Due Date Discussions with staff have indicated that due to hybrid working, not all staff have ready access to a scanner/appropriate equipment to digitalise the receipts/invoices. them that staff require to have ready access to a scanner/appropriate equipment to digitalise the receipts/invoices. In order to assist management in using our reports a system of grading audit findings has been adopted to allow the significance of findings to be ascertained. The definitions of each classification are as follows: Grading Definition High A major observation on high level controls and other important internal controls or a significant matter relating to the critical success of the objectives of the system. The weakness may therefore give rise to loss or error. Medium Observations on less significant internal controls and/or improvements to the efficiency and effectiveness of controls which will assist in meeting the objectives of the system. The weakness is not necessarily substantial however the risk of error would be significantly reduced if corrective action was taken. Low Minor recommendations to improve the efficiency and effectiveness of controls or an isolated issue subsequently corrected. The weakness does not appear to significantly affect the ability of the system to meet its objectives. VFM An observation which does not highlight an issue relating to internal controls but represents a possible opportunity for the council to achieve better value for money (VFM).
Page 18
18 Argyll and Bute Council – Internal Audit Report – Purchase Cards, June 2023 Appendix 2 – Audit Opinion Level of Assurance Definition High Internal control, governance and the management of risk are at a high standard. Only marginal elements of residual risk have been identified with these either being accepted or dealt with. A sound system of control designed to achieve the system objectives is in place and being applied consistently. Substantial Internal control, governance and the management of risk is sound. However, there are minor areas of weakness which put some system objectives at risk and specific elements of residual risk that are slightly above an acceptable level and need to be addressed within a reasonable timescale. Reasonable Internal control, governance and the management of risk are broadly reliable. However, whilst not displaying a general trend, there are areas of concern which have been identified where elements of residual risk or weakness may put some of the system objectives at risk. Limited Internal control, governance and the management of risk are displaying a general trend of unacceptable residual risk above an acceptable level and placing system objectives are at risk. Weakness must be addressed with a reasonable timescale with management allocating appropriate resources to the issues raised. No Assurance Internal control, governance and the management of risk is poor. Significant residual risk and/or significant non-compliance with basic controls exists leaving the system open to error, loss or abuse. Residual risk must be addressed immediately with management allocating appropriate resources to the issues.