6. 2025 03 13 Internal Audit Reports Issued (v.2)
North Ayrshire Council · 13 March 2025
Back to Audit and Scrutiny Committee — 13 March 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
PUBLIC INFORMATION PUBLIC INFORMATION NORTH AYRSHIRE COUNCIL 13 March 2025 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed since January 2025. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed since January 2025. Internal control reviews have been completed in respect of the areas detailed in Appendix A to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix A includes the report and action plan from each audit. 2.3 The findings from 3 separate audit assignments are detailed at Appendix A to this report and the levels of assurance for each are noted in the table below: Audit Title Assurance Level Pupil Equity Fund Substantial iPay Impact Reasonable Accounts Payable Transaction Testing Limited
Page 2
PUBLIC INFORMATION PUBLIC INFORMATION 3. Proposals 3.1 It is proposed that the Committee notes the outcomes from the Internal Audit work completed since January 2025. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment. Mark Boyd Head of Service (Finance) For further information please contact John McCallum, Senior Manager (Audit, Fraud, Safety, Risk & Insurance), on 01294 324607. Background Papers None.
Page 3
PUBLIC INFORMATION Appendix A PUBLIC INFORMATION INTERNAL AUDIT REPORT PUPIL EQUITY FUNDING Assurance Level: Substantial Version: Final Date: 8th January 2025 Author: Claire Morris File Ref: 2025-PA-003 Classification: Public
Page 4
PUBLIC INFORMATION PUBLIC INFORMATION PUPIL EQUITY FUNDING 1 Background 1.1 Pupil Equity Funding (PEF) is provided by the Scottish Government to support schools with closing the poverty related attainment gap. 1.2 In 2024/25 the Council received £4,196,680 of funding. £195,342 of funding was rolled forward from 2023/24 – meaning a total of £4,392,022 is available to spend in 2024/25. 2 Objectives and Scope 2.1 The objectives of the audit were to ensure that: • Headteachers have detailed, measurable plans on how they intend to use their PEF allocation • PEF outcomes are being monitored • PEF spend is being monitored and potential under/overspends are identified timeously • Spend and record keeping is in line with the conditions of the grant. 2.2 Audit selected a sample of 8 schools (2 secondary, 5 primary, 1 ASN) for review during this audit. 3 Findings Detailed Plans 3.1 Education’s Service Improvement Plan 2023-2026 sets out 5 priorities for the Service. 3.2 Each school is required to produce its own School Improvement Plan (SIP), based on these 5 priorities. PEF is included as part of these plans. 3.3 School Plans follow a standard template and require the following points to be addressed for each priority: • Pupil outcomes (what will change for learners?) • Improvement plan (how will this be achieved?) • Timescales/ responsibilities (what are timescales and who will lead?) • Measure of impact (how will the school know the change has resulted in an improvement and what data will be collated to evidence improvement?) • Cost (if known) PEF Outcomes 3.4 Progress against Improvement Plans is monitored throughout the year by Education Senior Managers and a formal quality review is carried out in school twice a year. 3.5 Schools produce a Standards & Quality Report each year. This report details the key achievements of the school over the previous school year and must include a reference to PEF outcomes.
Page 5
PUBLIC INFORMATION PUBLIC INFORMATION 3.6 Audit reviewed both the Improvement Plan and Standards & Quality Report for each sample school and confirmed they all contain information on PEF. 3.7 The PEF grant requires schools to make both the SIP and the Standards & Quality Report available to the public. Education HQ has instructed Headteachers that this should be done by publishing the documents on their school website. 3.8 Audit reviewed the school websites for all sample schools to ensure Improvement Plans for 2024/25 and Standards & Quality Reports for 2023/24 were available. Not all schools had updated their websites, although the documents had been prepared and were provided to Audit on request. All schools have now updated their websites. 3.9 In addition to the above documents, Education also requires schools to produce a PEF Impact Statement at the end of each school year. This is a very detailed document which requires schools to address the following questions for each intervention put into place: • Focus on short/medium/long term outcomes. What was the intended impact of this intervention? • How did you measure the impact of the intervention? What does the evidence/data show? What has improved/changed for the target group? What difference did PEF make? • In what ways is this supporting you to reduce the poverty-related attainment gap? • What now? Continue? Embed? Amend? Stop? 3.10 Copies of these Impact Statements are submitted to HQ for review to ensure any best practice, lessons learned, or possibilities for collaborative working are identified. 3.11 Audit obtained copies of Impact Statements for all sample schools and confirmed all had been completed in detail. Monitoring of Spend 3.12 Whilst budget setting and monitoring of spend is the responsibility of the Headteacher, Education HQ do provide support via the following: • PEF Guidance Document • Forecast of Spend Template • Monthly spend monitoring reports 3.13 The PEF Guidance document is very detailed and covers areas such as: • Key principles of PEF • How PEF can be used • Forecasting how to spend the budget • The Council’s procurement rules • Information on recruitment The document also contains a number of links to Council policies and procedures where Headteachers can find further guidance. 3.14 The Forecast of Spend Template supports Headteachers with setting their PEF budget. The template supports Headteachers with the calculation of staffing costs,
Page 6
PUBLIC INFORMATION PUBLIC INFORMATION including on-costs and pay awards. It also provides space for Headteachers to set out non-employee planned spend. 3.15 Monthly monitoring reports are generated by Education HQ and sent to Headteachers. These reports set out: • Actual employee spend to date • Projected employee costs to the year end (or contract end date if this comes first) • Actual non-employee spend to date • Balance of budget still to be spent 3.16 Audit confirmed that detailed monitoring spreadsheets had been sent to all sample schools containing spend information to 30 September 24. 3.17 In addition to the above support, Education Senior Management monitor the progress of PEF spend per school quarterly. Spend and Record Keeping 3.18 Audit has not tested PEF employee costs in detail. Reliance has been placed on the monthly review of actual employee spend against budgets by Education Business Officers (EBOs) to ensure all PEF employee costs are being coded correctly in Integra. 3.19 Audit has reviewed all 2024/25 non-employee spend for all sample schools to ensure the type of spend is in line with the PEF grant requirements. No issues were noted. 3.20 The grant, and the Council’s retention policy requires invoices to be retained for 6 years after the spend was incurred. In order to ensure that schools are complying with this, Audit selected a small number of PEF purchases made in 2019/20 across all sample schools and ensured that the spend seemed reasonable and invoices had been retained. No issues were noted. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was gained with regard the planning and monitoring of PEF grant spend. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited.
Page 7
PUBLIC INFORMATION PUBLIC INFORMATION None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 8
PUBLIC INFORMATION PUBLIC INFORMATION INTERNAL AUDIT REPORT IPAYIMPACT Assurance Level: Reasonable Version: Final Date: 20th January 2025 Author: Yvonne Trundle File Ref: 2024-PA-014 Classification: Public
Page 9
PUBLIC INFORMATION PUBLIC INFORMATION IPAYIMPACT 1 Background 1.1 The iPayImpact system went live in October 2021 and replaced the ParentPay system. This system is an online payment system operating within the schools and allows parents to pay online for school meals, trips and events, music tuition fees, tickets and items from the school shop. This removes the need for cash in the schools. 1.2 This system allows parents to see what meals and snacks their child chooses to buy, check the balance and top up funds as well as set up a direct debit for regular automatic top ups. 1.3 Facilities Management (FM) advised that ASN pupils and Primary 1-5 pupils receive free school meals. Primary 6-7 and secondary school pupils may also be eligible for free school meals. School meals income is paid into an NAC school meals bank account. 1.4 Education advised that the uptake of this system to allow parents to pay online for payments related to the school fund varies across the schools. This income is paid into the individual school fund bank account. 2 Objectives and Scope 2.1 The objectives of the audit were to ensure that: • Suitable written procedures are in place for system admin duties. • Income due to the Council is being received, reconciled and banked regularly and there are adequate controls over refunds and manual adjustments. • Processes are in place to prevent parents and guardians running up significant debt balances. • There is a robust process in place for adding, amending and removing user access, passwords are in line with best practice and access permissions are based on job role. • Leavers have been removed on a timely basis, generic accounts are limited and controlled, and external users are required to sign the 3rd party Acceptable Use Policy. • The role of system administrators is restricted to a small number of relevant staff. 3 Findings Written Procedures 3.1 User manuals are available on the system, and this includes an admin user manual. FM admin had no written procedures for the system admin tasks they carry out on a daily and weekly basis which incorporates the Council process and a step-by-step guide on how these key tasks are carried out. However, they were prepared during the audit.
Page 10
PUBLIC INFORMATION PUBLIC INFORMATION Income Collection Process 3.2 The school meals income is transferred by BACS on a weekly basis to the general income bank account and a file is transferred on a weekly basis to CivicaPay to allow Cashiers to reconcile this income to the general income bank statement. There is a weekly transfer of all payments from CivicaPay to Integra where it is coded to the relevant finance codes. 3.3 The school fund income is transferred by BACS on a weekly basis to the school fund bank account to allow the school to reconcile this income to the school fund bank statement and to allow the income to be recorded against the relevant school fund type. 3.4 FM provided a refund report for the period 01/08/23 to 28/04/24. There were 465 refunds totalling £14,210.19. All refunds for school meals are processed by FM admin and all refunds were requested by and approved by a different user. School fund refunds are generally processed by a school user but are requested and approved by the same user. (action a) Debt management 3.5 North Ayrshire Council’s approach is that no child should go without a school meal so if a pupil presents at the school canteen for lunch, they will not be refused if there are insufficient funds in their iPayImpact account. There is a separate process in place for primary and secondary schools to manage this debt. 3.6 FM will send weekly reminders to parents and guardians of primary school pupils that have an active account which has a negative balance to advise that a payment should be made to ensure negative balances are cleared. 3.7 Secondary schools manage debt by following a standard process called “procedure for the management of school meals debt in secondary schools”. Testing carried out identified there was £12,492.45 outstanding school meals balance between August 2023 and May 2024. 3.8 Although there are processes in place to try to recover outstanding school meals, a school meals debt report was submitted to the North Ayrshire Council committee in June 2023 and it was agreed the debt would be written off for the start of the new school year in August 2023. The school meals debt was £94,041. Facilities Management confirmed this was a one off decision and no such write off has occurred since. Access Controls 3.9 FM admin advised that the team should be emailed if an employee needs access to the system and should be emailed if a user leaves and needs their access removed or moves job/school and needs their access amended. 3.10 FM admin were not receiving the IT monthly movers and leavers report. However, an FM shared mailbox was added to the distribution list during the audit. Unfortunately, the shared mailbox provided meant the reports were not being provided to the FM administrators that have responsibility for users access so this was updated in December 2024 to the correct shared mailbox. FM admin have agreed to retrospectively action the IT monthly movers and leavers reports received since June 2024.
Page 11
PUBLIC INFORMATION PUBLIC INFORMATION 3.11 FM admin have agreed to amend the email issued to a new user to include a link to the creating secure passphrases guidelines to encourage users to set up a password in line with this Corporate guidance. 3.12 The password requirements were reviewed and we found that the minimum requirements could be further strengthened. (action b) 3.13 FM admin advised that they do not carry out regular reviews of users to ensure access is correct and is still required. Audit testing found 24 users whose access level should be checked given their job title and if periodic reviews were carried out, this would be picked up and rectified. (action c) User Testing 3.14 The auditor carried out tests on the 1,777 users (excluding users with system admin access as they are tested separately). Audit testing found the following: • There are 154 users that have left the Council. • There are 237 users that have moved school but still have access to previous school. • There are 109 users whose access should be checked with the school as there is no evidence from the payroll system that the user ever worked at the school they have access to. This also includes 26 users that cannot be traced to the payroll system. • There are 191 generic accounts. • There are 22 test accounts. • There were 6 duplicate users who have the same access level to the same school. 3.15 The above results were passed to FM admin who reviewed the findings and took action to remove or amend access. FM admin confirmed Fusion Collect and Smartboard generic accounts are required for operational purposes. 3.16 The results of the user testing identified that schools are not always notifying FM admin if a user leaves, moves school or changes job role to allow their access to be removed or amended. There should be a standard process in place for all schools to notify FM admin of users that have left, moved or changed job role to ensure the user’s access is removed or amended. (action d) System Administrator Controls 3.17 There are 2 levels of system administrators for iPayImpact. There are system administrators at the client level which means users have access to all schools. There are system administrators at the school level which means the users will have access to a particular school or a number of schools depending on their job role. The auditor confirmed each system administrator has a unique username. 3.18 The auditor carried out tests on the 19 system administrators with client level access. Audit testing found the following: • There are 3 users whose access should be checked to make sure it is still needed and is appropriate as 2 work in Transformation and 1 is an Education Business Assistant at Brodick Primary. • There is 1 leaver, and this access should be removed. • There are 3 generic accounts which should be reviewed to see if they are still needed and to confirm their purpose.
Page 12
PUBLIC INFORMATION PUBLIC INFORMATION • There are 5 test accounts which should be reviewed to see if they are still needed or if they can be removed. 3.19 The above results were passed to FM admin who reviewed the findings and took action to remove or amend access which resulted in a reduction in the number of administrators from 19 to 6. There are now only 5 members of the FM admin team and one generic IT username with this level of access. 3.20 The auditor carried out tests on the 127 system administrators with school level access. Audit testing found the following: • There are 12 users that have left and their access should be removed. • There are 7 users who have moved school and their access should be removed or amended. • There is 1 user who was an Education Business Officer (EBO) until 25.09.22 but still has access to 5 schools and this access should be removed. • There is 1 user who is an EBO that moved from Arran High to Greenwood Academy on 06.11.22 but still has access to the 7 primary schools in the Arran cluster and this access should be removed. • There are 2 users whose access should be queried with the school due to a changed of job role and amend the access level, if required. 3.21 The above results were passed to FM admin who reviewed the findings and took action to remove or amend access. 3.22 The auditor reviewed the number of administrators per school and once the findings at 3.20 have been actioned, there are no schools with more than 8 users with school admin level access. Internal Audit normally recommends 3 or 4 system administrators; however 4 members of the FM admin team have school admin access to each school and the EBOs have school admin access to all schools in their cluster which accounts for the higher numbers. 3.23 The results of the system administrator user testing identified that schools are not always notifying FM admin if a user leaves, moves school or changes job role to allow their access to be removed or amended. There should be a standard process in place for all schools to notify FM admin of users that have left, moved or changed job role to ensure that user access is removed or amended in a timeous manner. (action d) 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to controls around the iPayImpact system. There were a high number of leavers and movers found as well as a high number of generic and test accounts found. Implementation of the audit actions will tighten controls around password controls and ensure prompt action is taken to remove leavers and amend movers.
Page 13
PUBLIC INFORMATION PUBLIC INFORMATION Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 14
PUBLIC INFORMATION PUBLIC INFORMATION KEY FINDINGS AND ACTION PLAN IPAYIMPACT Action a Finding Facilities Management provided a refund report for the period 01/08/23 to 28/04/24. There were 465 refunds totalling £14,210.19. All refunds for school meals are processed by FM admin and all refunds were requested by and approved by a different user. School fund refunds are generally processed by a school user but are requested and approved by the same user. Action Description FM should contact the supplier to see if school fund refunds can be set up to ensure they are requested and approved by a different user. If the system cannot be amended, the schools should implement an independent approval process for school fund refunds. Risk No separation of duties for processing refunds; refunds are processed without proper approval. Priority (1, 2, 3) 2 Paragraph Reference 3.4 Managed by Sam Anson, Executive Director (Education) Andrew McClelland, Head of Service (Education) Assigned to Carolyn Hope, Senior Manager (Facilities Management) Lynn Taylor, Senior Manager (Resources & Infrastructure) Due Date 31 March 2025 Management Comment The supplier has advised (on 8th Jan 2025) that the separation of approval cannot be accommodated for the school fund element of the system as school funds are held in the school’s own account and no approval is needed. This is different to school meals funds which are held in a council bank account and therefore require different users to request and approve. At the supplier’s request FM has however submitted a ‘New Idea Form’ with the supplier which will be considered for any future programme developments. A communication will be issued to all educational establishments to advise that two different employees should be involved in the request and refund process. Action b Finding The password requirements were reviewed and we found that the minimum requirements could be further strengthened Action Description FM should amend the minimum password requirements are enhanced in line with Council policy and best practice. Risk Lack of strong password controls increases the risk of a user account being subject to unauthorised access which could lead to a cyber-attack. Priority (1, 2, 3) 1 Paragraph Reference 3.12 Managed by Sam Anson, Executive Director (Education) Assigned to Carolyn Hope, Senior Manager (Facilities Management) Due Date 31 January 2025 Management Comment The supplier confirmed on 8th January 2025, that they can accommodate this change quickly. This will be effective from w/c
Page 15
PUBLIC INFORMATION PUBLIC INFORMATION 13 January 2025 and all users will be forced to reset their password upon logging in. Action c Finding FM admin advised that they do not carry out regular reviews of users to ensure access is correct and is still required. Audit testing found 24 users whose access level should be checked given their job title and if periodic reviews were carried out, this would be picked up and rectified. Action Description FM should carry out a periodic review of users in conjunction with Education to ensure that the user access level granted is correct and access is still needed. Risk Users access level may not be in line with job role; user may no longer need access to the system. Priority (1, 2, 3) 2 Paragraph Reference 3.13 Managed by Sam Anson, Executive Director (Education) Assigned to Carolyn Hope, Senior Manager (Facilities Management) Due Date 31 January 2025 Management Comment An instruction has been issued to the support team to carry out this review on a 6 monthly basis as a minimum. Action d Finding The results of the user testing and system administrator user testing identified that schools are not always notifying FM admin if a user leaves, moves school or changes job role to allow their access to be removed or amended. Action Description There should be a standard process in place for all schools to notify FM admin of users that have left, moved or changed job role to ensure the users access is removed or amended in a timely manner. This should be documented and issued to relevant staff. Risk Leavers have unauthorised access to the system and movers have inappropriate access to the system. Priority (1, 2, 3) 1 Paragraph Reference 3.16, 3.23 Managed by Andrew McClelland, Head of Service (Education) Assigned to Carolyn Hope, Senior Manager (Facilities Management) Lynn Taylor, Senior Manager (Resources & Infrastructure) Due Date 31 March 2025 Management Comment An additional step will be added to the ‘Movers/Leavers’ process to include FM admin access. This will be issued to all educational establishments. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 16
PUBLIC INFORMATION PUBLIC INFORMATION INTERNAL AUDIT REPORT ACCOUNTS PAYABLE TRANSACTION TESTING Assurance Level: Limited Version: Final Date: 18th February 2025 Author: Yvonne Trundle File Ref: 2025-PA-001 Classification: Public
Page 17
PUBLIC INFORMATION PUBLIC INFORMATION ACCOUNTS PAYABLE TRANSACTION TESTING 1 Background 1.1 This audit was conducted as part of the approved 2024/25 Internal Audit Plan and used data analytics to interrogate the Accounts Payable (AP) system on Integra and the Procurement Card system and examine any anomalies which arose. 1.2 Audit software called IDEA (Interactive Data Extraction and Analysis) has been used to carry out this testing. In addition, Internal Audit are working with the Data Analytics Team to utilise Power BI for future audits. 1.3 There were 4,135 active Trade Suppliers (for processing payments to standard suppliers, individuals, and social services) and 1,096 Sundry Suppliers (for processing one-off sundry payments) on Integra as at 15.07.24. 1.4 There were 123,267 invoices paid to trade and sundry suppliers from 1st July 2023 to 30th June 2024, totalling just over £417.6 million. 1.5 There were 30,179 procurement card transactions made during the period of the audit totalling just under £5.9 million. The SDOL system is the Royal Bank of Scotland Smart Data Online system used to record and manage procurement card transactions. 1.6 The AP and E-Procurement (EP) Teams previously sat in Finance and transferred to Customer Services, Business Support team (People & ICT) on 1st October 2024. Internal Audit was advised that this is the first step to creating a fully centralised E- Invoicing team and work is currently being undertaken with the Transformation team on a project over the next 12 to 18 months, to centralise AP and E-Invoicing across the Council. This will include reviewing and updating processes and procedures to ensure these are fully robust and meet audit requirements. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • duplicate suppliers are identified and de-activated to minimise the risk of duplicate invoices being paid. • duplicate invoices have not gone undetected. • advance payments have been reported to Financial Management for the list of pre-payments at financial year-end. • high value invoices have been properly authorised. • invoices paid to employees are bona fide. • card purchases are in line with the policy and there is adequate separation of duties. 2.2 The audit period was 1st July 2023 to 30th June 2024. 3 Findings Supplier Tests 3.1 Testing was carried out to identify duplicate trade suppliers on the system. Testing identified 42 duplicate suppliers either by supplier name or bank details. These were passed to the AP team to review and deactivate as appropriate. (action a)
Page 18
PUBLIC INFORMATION PUBLIC INFORMATION Invoice Tests 3.2 The AP team maintains a keying error spreadsheet and the auditor extracted duplicate payments made over £20,000. This check noted that a certificate of payment for a large capital project for the amount of £3.7 million was paid twice in error and subsequently corrected. Due to the large payment amount, this could have an impact on the Council’s cashflow. An approval email was sent to the AP team on 19.02.24 which evidenced that the Head of Service (Neighbourhood Services) approved this payment. A further approval email was sent to the AP team on 28.02.24 without any approval by an authorised signatory. The Service advised the second email was submitted in error. The certificate of payment had a scanned signature for the Head of Service (Neighbourhood Services). AP advised they will accept electronic signatures on documents if an authorised signatory is copied into the email which wasn’t done for the second email. A different invoice number was keyed by the AP user which is why Integra did not identify it as a duplicate payment. The Service and AP have confirmed that a unique invoice reference for certificates of payments will be used going forward to prevent a similar mistake being made. (action b) 3.3 The auditor tested for duplicate invoices for payments to suppliers and identified possible duplicates that were investigated further. This check confirmed 131 were duplicates that had already been identified and action taken by the AP team by either processing a reversal, keying a credit or requesting a BACS recall. This testing identified 41 potential duplicate invoices totalling £123,282.71 which had not already been identified by the AP team. The potential duplicates have been passed to the AP team to check and arrange recovery. The AP team have reviewed the potential duplicates and confirmed the value of actual duplicates was £60,294.75 which they are in the process of recovering. (action c) 3.4 The auditor tested for duplicate sundry payments and identified possible duplicates that were investigated further, and this check confirmed 5 were duplicates that had already been identified and action taken by the AP team. This testing identified 2 duplicate payments totalling £6,641.24 that have not already been identified by the Service or the AP team. (action d) 3.5 There were 960 sundry suppliers paid during the period of the audit and 103 sundry suppliers were paid more than once with 19 sundry suppliers being paid between 3 and 7 times. Accounts Payable should remind services that if a sundry supplier is paid more than once, they should request they are set up as a regular supplier. (action e) 3.6 There were 124 invoices with a payment date before the invoice date. Testing was carried out on a sample of 10 and in 9 cases the invoice date was keyed incorrectly and in 1 case the invoice was keyed correctly and this has been paid in advance. However, it should be noted that it was only paid 1 day in advance. 3.7 There were 474 invoices with a payment date more than 1 year after the invoice date. Testing was carried out on a sample of 10 and in 6 cases the invoice date was keyed incorrectly and in 4 cases the invoice was keyed correctly and had been paid more than 1 year later. Financial Management confirmed that there are no VAT implications when paying invoices more than 1 year old. However, it should be noted that invoice date keying errors will impact the Council’s ability to monitor invoice payment dates. 3.8 The auditor tested for purchase orders that have been requisitioned and approved by the same person and none were found. There are 4 users with requisitioner and approver role, but there was a separation of duties in all such cases. There are small
Page 19
PUBLIC INFORMATION PUBLIC INFORMATION number of exceptions which require a user to have dual roles and a valid reason for this needs to be provided. Advance Payment Tests 3.9 The auditor tested for round sum amounts over £20,000 to help identify advance payments. There were 28 invoices found meeting this criterion plus an additional 22 payments over £20,000 were randomly selected so a total of 50 were checked. This resulted in 22 being passed to Financial Management to confirm the correct action had been taken ahead of the annual accounts being closed. The Financial Management review confirmed the correct action had been taken and no adjustments were required. High Value Payment Tests 3.10 There were 3,478 invoices between £10,000 and £100,000 and 10 were selected to ensure the invoices were approved by an authorised signatory and within their approval limit. The sample included 5 Purchase Order (PO) invoices and 5 non-PO invoices. This testing found 1 non-PO invoice for £24,660 that was approved by an authorised signatory with a £5,000 limit. The approver has been advised they must only approve invoices within their approval limit and to speak to their line manager if they require the approval limit to be increased. The HSCP admin keying the invoice was not aware of the approval limit check. (action f) 3.11 The auditor queried a payment of £89,488 that was paid via the CareFirst feeder as there was no invoice attached on Integra to evidence who approved the payment. HSCP advised that placement requests are approved at the Care Assessment Review Group in agreement with Team Managers and Senior Managers. The Finance Team will receive an Individual Placement Agreement (IPA) confirming the agreed package which is then added to CareFirst. The IPAs were provided and although they appear to have been approved by an authorised signatory, the approval is a scanned signature and in one case the email chain advised the scanned signature was added by HSCP admin. The authorised signatory was not copied into the emails to provide electronic evidence of approval. (action g) 3.12 There were 577 invoices over £100,000 and 20 were selected to ensure the invoices were approved by an authorised signatory and within their approval limit. The sample included 10 PO invoices and 10 non-PO invoices and there were no findings to note. Payments to Employee Tests 3.13 The auditor tested for employees who have been paid via Integra. There were 46 employees that have been paid via Integra during the audit period. The majority relate to HSCP payments for Kinship, adoption and respite. There is an HSCP employee that has been paid £8,990 to Street Beatz for dance therapy and the invoices have been paid by Education and HSCP. Education advised that Street Beatz was the only local provider for dance therapy. 3.14 The auditor tested for employees who have been paid a sundry payment. There was a payment of £736.50 to Corsehill Bowling Club for support with bills in order to hand the building back to NAC; however, the bank details provided matched that of an employee. Community Facilities investigated and provided evidence that the money was used to pay an outstanding Scottish Power utility bill. The evidence was provided by the payee as Community Facilities were not able to provide paperwork to support the amount paid. (action h)
Page 20
PUBLIC INFORMATION PUBLIC INFORMATION Procurement Card Transaction Tests 3.15 The procurement card report listed all transactions up to 30th June 2024. As at 25th July 2024, there were 185 transactions totalling £25,110.49 that had not been reviewed or approved and there were 248 transactions totalling £24,350.13 that had been reviewed but not approved. As per the procurement card policy and procedure, all transactions must be reviewed and approved by 28th of each month and must be checked 48 hours after to ensure all transactions are reviewed and approved before the statement is paid. (action i) 3.16 There are 8 users that are cardholders and approvers. Transactions by users with this dual role were checked and there were no findings to note. There are small number of exceptions which require a user to have dual roles and a valid reason for this needs to be provided. 3.17 There was a potential duplicate payment queried with the Education Business Officer who advised a credit note was received so the duplicate payment had already been identified and rectified. However, this testing identified 4 transactions that have been split to bring the purchase below the procurement card single transaction limit. One of the transactions was for Communities and Housing and 3 were for Education. (action j) 3.18 There were 164 transactions totalling £23,268.24 with no description of spend recorded on the SDOL system. (action k) 4 Internal Audit Opinion 4.1 Overall, limited assurance was obtained with regard to the controls around the processing of invoices and card payment. The audit is covering 12 months transactions instead of 6 months but there has still been a significant increase in the total number and total value of potential duplicates. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 21
PUBLIC INFORMATION PUBLIC INFORMATION KEY FINDINGS AND ACTION PLAN ACCOUNTS PAYABLE TRANSACTION TESTING Action a Finding Testing was carried out to identify duplicate trade suppliers on the system. Testing identified 42 duplicate suppliers either by supplier name or bank details. These were passed to the AP team. Action Description The AP team should review the list of duplicate suppliers and deactivate suppliers as appropriate. The AP team should be reminded to check if the supplier is already on the system before they are added again. Risk Duplicate invoices may be paid to the same supplier via different supplier numbers. Priority (1, 2, 3) 1 Paragraph Reference 3.1 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Elaine Nixon, Senior Manager (Customer Services) Due Date Complete Management Comment True duplicates have been identified and deactivated on the system. Further training has been delivered to staff to ensure they are vigilant when selecting a supplier to avoid duplicate entries. Action b Finding The AP team maintains a keying error spreadsheet and the auditor extracted duplicate payments made over £20,000. This check noted that a certificate of payment for a large capital project for the amount of £3.7 million was paid twice in error and subsequently corrected. Due to the large payment amount, this could have an impact on the Council’s cashflow. An approval email was sent to the AP team on 19.02.24 which evidenced that the Head of Service (Neighbourhood Services) approved this payment. A further approval email was sent to the AP team on 28.02.24 without any approval by an authorised signatory. The Service advised the second email was submitted in error. The certificate of payment had a scanned signature for the Head of Service (Neighbourhood Services). AP advised they will accept electronic signatures on documents if an authorised signatory is copied into the email which wasn’t done for the second email. A different invoice number was keyed by the AP user which is why Integra did not identify it as a duplicate payment. The Service and AP have confirmed that a unique invoice reference for certificates of payments will be used going forward to prevent a similar mistake being made. Action Description The AP team must ensure that payment requests containing electronic signatures are only processed, where the relevant authorised signatory is copied into the request. The AP team should ensure a robust process is put in place to prevent future errors and to ensure that additional checks are carried out on high value payments before processing. Risk Duplicate invoices may be paid to the same supplier by keying a different invoice reference for the same payment; invoices are paid without proper checks on the authorisation process. Priority (1, 2, 3) 2 Paragraph Reference 3.2
Page 22
PUBLIC INFORMATION PUBLIC INFORMATION Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Elaine Nixon, Senior Manager (Customer Services) Due Date Complete Management Comment This process has been tightened by ensuring that an agreed uniformed invoice number is used, and this will allow Integra to identify any duplications. All transactions over £100k are double checked by another member of the team before being processed for payment including ensuring that an authorised signatory has been copied into the email and the system is checked to ensure that payment has not already been made. Action c Finding Testing identified 41 potential duplicate invoices totalling £123,282.71 which have not already been identified by the AP team. Action Description The AP team should review the potential duplicate payments and arrange for recovery of monies paid twice. Risk The Council has paid the same invoice twice and the money has not been recovered. Priority (1, 2, 3) 1 Paragraph Reference 3.3 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Elaine Nixon, Senior Manager (Customer Services) Due Date 31 March 2025 Management Comment A review has been carried out and the value of actual duplicates to be recovered was £60,294.75. To date £56,124.82. has been recovered. This leaves £4,169.93 still to be recovered which is currently under query. Action d Finding Testing identified 2 duplicate sundry payments totalling £6,641.24 that have not already been identified by the Service or the AP team. Action Description The AP team should review the potential duplicate payments and arrange for recovery of monies paid twice. Risk The Council has made the same sundry payment twice and the money has not been recovered. Priority (1, 2, 3) 1 Paragraph Reference 3.4 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Elaine Nixon, Senior Manager (Customer Services) Due Date Complete Management Comment These duplicate payments have been recovered. Further checks have been put in place to avoid this happening in the future. Action e Finding There were 960 sundry suppliers paid during the period of the audit and 103 sundry suppliers were paid more than once with 19 sundry suppliers being paid between 3 and 7 times. Action Description Accounts Payable should remind services that all sundry payments which are to be paid more than once, excluding those which are exempt, should be set up as a regular supplier.
Page 23
PUBLIC INFORMATION PUBLIC INFORMATION Risk Bank details are keyed for each payment; independent checks on bank details are not carried out by Accounts Payable; duplicate payments might not be identified as quickly. Priority (1, 2, 3) 2 Paragraph Reference 3.5 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Elaine Nixon, Senior Manager (Customer Services) Due Date Complete Management Comment Reminder email issued to all users to make sure that if a sundry supplier of goods or services has already had a payment, then they are required to be set up as a supplier on the system and not paid as a sundry payment. Action f Finding Testing found a non-PO invoice for £24,660 that was approved by an authorised signatory with a £5,000 limit. The approver has been advised they must only approve invoices within their approval limit and to speak to their line manager if they require the approval limit to be increased. The HSCP admin keying the invoice was not aware of the approval limit check. Action Description HSCP should remind staff keying invoices to Integra to check the person approving is an authorised signatory and is approving an invoice within their approval limit. Risk Invoices are paid without proper checks on the authorisation process. Priority (1, 2, 3) 2 Paragraph Reference 3.10 Managed by Caroline Cameron, Director (Health & Social Care Partnership) Assigned to Eleanor Currie, Interim Chief Finance Officer Due Date 31st March 2025 Management Comment The team processing manual invoices need an awareness of approval limits. The current approval limits will be circulated to the team along with contact details of who they can check with in future. Action g Finding The auditor queried a payment of £89,488 that was paid via the CareFirst feeder as there was no invoice attached on Integra to evidence who approved the payment. HSCP advised that placement requests are approved at CARG in agreement with Team Managers and Senior Managers. The Finance Team will receive an Individual Placement Agreement (IPA) confirming the agreed package which is then added to CareFirst. The IPAs were provided and although they appear to have been approved by an authorised signatory, the approval is a scanned signature and in one case the email chain advised the scanned signature was added by HSCP admin. The authorised signatory was not copied into the emails to provide electronic evidence of approval. Action Description HSCP should amend their process to ensure the IPAs are emailed to the Finance Team by the authorised signatory to provide electronic evidence of approval. Risk Care packages are added to CareFirst and invoices paid without proper evidence the authorised signatory has approved them. Priority (1, 2, 3) 2
Page 24
PUBLIC INFORMATION PUBLIC INFORMATION Paragraph Reference 3.11 Managed by Caroline Cameron, Director (Health & Social Care Partnership) Assigned to Eleanor Currie, Interim Chief Finance Officer Due Date 31st March 2025 Management Comment The IPAs will only be processed using a scanned signature if the authorised signatory is copied into the emails to provide electronic evidence of approval. Action h Finding The auditor tested for employees who have been paid a sundry payment. There was a payment of £736.50 to Corsehill Bowling Club for support with bills in order to hand the building back to NAC; however, the bank details provided matched that of an employee. Community Facilities investigated and provided evidence the money was used to pay an outstanding Scottish Power utility bill. The evidence was provided by the payee as Community Facilities were not able to provide paperwork to support the amount paid. Action Description Community Facilities should ensure as part of their procedures that all paperwork in support of grant payments is provided in advance, by the payee and retained for audit purposes. Risk Grant payments are not spent in line with the requirements of the grant; the grant payment is used by the payee for financial gain. Priority (1, 2, 3) 2 Paragraph Reference 3.14 Managed by Rhonda Leith, Head of Service (Connected Communities) Assigned to Donna Morrison, Team Manager (Community Resources) Due Date March 2025 Management Comment The payment instruction was originally requested by CLD (Community Learning and Development) but processed by Community Facilities. The Service has identified a need to clarify the responsibilities of officers requesting payments and those processing payments to ensure accountability and compliance with financial procedures. The MS Sundry Payment Request Form has been amended to include a new field for providing evidence of invoices being settled from the Service payment. Additionally, the form now prominently highlights that when issuing payments to organisations, the organisation's bank details must be used to credit the account. These changes aim to enhance accuracy, transparency, and efficiency in our payment processes. Action i Finding The procurement card report listed all transactions up to 30th June 2024. As at 25th July 2024, there were 185 transactions totalling £25,110.49 that had not been reviewed or approved and there were 248 transactions totalling £24,350.13 that had been reviewed but not approved. As per the procurement card policy and procedure, all transactions must be reviewed and approved by 28th of each month and must be checked 48 hours after to ensure all transactions are reviewed and approved before the statement is paid. Action Description Cardholders and approvers should be reminded to review and approve transactions by the 28th of each month in line with the
Page 25
PUBLIC INFORMATION PUBLIC INFORMATION Procurement Card Policy and Procedure. There should be an escalation process in place if transactions continue not to be reviewed and approved. Risk Purchases are paid before they have been reviewed and approved. Delayed transfer of transactions to the general ledger which impacts budget monitoring. Priority (1, 2, 3) 2 Paragraph Reference 3.15 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Elaine Nixon, Senior Manager (Customer Services) Due Date Complete Management Comment The number of transactions not approved or reviewed fluctuates as is a snapshot in time. Most services review and approve in bulk and there are peaks and troughs in relation to the volume of transactions e.g. schools are the main users of SDOL and therefore there is a lesser volume of transactions during school holiday periods. The system automatically generates a reminder to all SDOL users, and this is also backed up by an email that is also sent monthly to all users by the E-Procurement team. A quarterly report is issued to all Senior Managers by email asking them to ensure that all outstanding transactions are actioned. This report has now been amended to add a deadline in which the Senior Manager must ensure that the transaction requiring review/approval is completed. A further report will be run 4 weeks later, and any outstanding transactions will be escalated to the relevant Head of Service. Action j Finding Testing for potential duplicate card transactions highlighted 4 transactions that have been split to bring the purchase below the procurement card single transaction limit. Action Description eProcurement should remind cardholders to comply with the procurement card policy and procedure to ensure that orders are not split to bring the purchase below the procurement single transaction limit. Risk Single transaction limit control circumvented; transactions not complying with the procurement card policy and procedure. Priority (1, 2, 3) 2 Paragraph Reference 3.17 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Elaine Nixon, Senior Manager (Customer Services) Due Date Complete Management Comment E-Procurement Team have issued comms to SDOL users advising that they must comply with the procurement card policy & procedures which states that they must contact the E- Procurement team to increase their limits and not split payments over several transactions. Action k Finding There were 164 transactions totalling £23,268.24 with no description of spend recorded on the SDOL system.
Page 26
PUBLIC INFORMATION PUBLIC INFORMATION Action Description e-Procurement should contact the system provider to see if the description field could be changed to a mandatory field. e- Procurement should remind cardholders that a description should be added to all card transactions on the SDOL system. Risk Lack of audit trail for the card payment. Priority (1, 2, 3) 2 Paragraph Reference 3.18 Managed by Fiona Walker, Head of Service (People & ICT) Assigned to Elaine Nixon, Senior Manager (Customer Services) Due Date Complete Management Comment E-Procurement Team have issued an email to SDOL users advising that a detailed description must be added to all SDOL transactions. A further email has been issued to all SDOL approvers advising them to ensure that a detailed description has been entered on the transaction before approving it and if not, to contact the card holder and ask them to update before they approve. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.