VELINDRE NHS TRUST INTERNAL AUDIT REVIEW GENERAL LEDGER

Transcription

1 INTERNAL AUDIT REVIEW

2 INDEX 1. EXECUTIVE SUMMARY 2. MAIN REPORT 2.1 Introduction and Background 2.2 Objectives and Scope 2.3 Opinion and Conclusion 2.4 Summary of Findings 2.5 Detailed Findings 2.6 Acknowledgements 3. DETAILED AUDIT FINDINGS, RECOMMENDATIONS AND ACTIONS Appendix 1 Assurance and Priority Ratings description REVIEW REFERENCE: VT13.10 REPORT STATUS: FINAL DATE OF FIELDWORK: OCTOBER / NOVEMBER 2012 AGREED DRAFT REPORT DATE: DECEMBER 2012 MANAGEMENT RESPONSES RECEIVED: FEBRUARY 2012 FINAL REPORT DATE: FEBRUARY 2012 AUDITOR /s : M LEWIS CA STEPHENS AUDIT & ASSURANCE SERVICES

3 1. EXECUTIVE SUMMARY 1.1 INTRODUCTION AND SCOPE In accordance with the 2012/2013 Internal Audit Plan, a review of the management of the General Ledger within Velindre NHS Trust has been undertaken. The objective of the audit was to evaluate and determine the adequacy of the systems and controls in place for the management of the General Ledger, in order to provide reasonable assurance to the Trusts Audit Committee that risks material to the achievement of system objectives are managed appropriately. 1.2 OPINION AND KEY FINDINGS The level of assurance given as to the effectiveness of the system of internal control in place to manage the risk associated with the objectives covered in this review is Substantial Assurance. Overall the controls in place to manage the risks associated with the systems and processes tested within the review are of an adequate standard; however the audit has identified a limited weakness relating to the lack of a formal authorisation process for chart of account amendments. This was also reported in the 2011/12 audit report. There were no high priority issues identified during the review that require prompt management action. This report relates to the general ledger management undertaken within Velindre NHS Trust, and the findings are applicable to Public Health Wales. Where findings are identified that are specific to PHW, these will be raised directly. AUDIT & ASSURANCE SERVICES Page 2

4 2. MAIN REPORT 2.1 INTRODUCTION In accordance with the 2012/2013 Internal Audit Plan, a review of the management of the General Ledger within Velindre NHS Trust has been undertaken. The objective of the audit was to evaluate and determine the adequacy of the systems and controls in place for the management of the General Ledger process, in order to provide reasonable assurance to the Trust s Audit Committee that risks material to the achievement of system objectives are managed appropriately. The audit also provides assurance over the service being provided to the Public Health Wales (PHW) Trust as part of the agreed Service Level Agreement. All assignment undertaken from 2012/13 are delivered under the umbrella of the NHS Wales Shared Services Partnership Audit & Assurance Services. 2.2 AUDIT APPROACH AND OBJECTIVES The approach to audit assignments is risk based, where the risks are identified with the lead manager. Controls would then be identified to manage those risks and the assignment scope designed to provide assurances on those issues. The audit assignment has been allocated an assurance rating, dependant on the level of assurance Internal Audit are able to provide. The assurance rating is described against the inherent risk and control effectiveness of the system reviewed. There are four potential levels of assurance available, along with three recommendation priorities and these are described In Appendix 1. The overall objectives of the audit were to provide assurance as to whether the management of the General Ledger is adequate so that both Trusts financial performances are accurately recorded and reported. The main areas that were reviewed are: All transactions of the organisations are recorded. All input to the financial ledger is complete, accurate, timely and valid. All journals within the financial ledger are authorised and documented. The structure of the financial ledger reflects the information needs of the organisation. Changes in the monthly reporting process have not adversely affected risk/control. AUDIT & ASSURANCE SERVICES Page 3

5 The risks considered in the review are as follows: The General Ledger may contain errors. Unauthorised data may be input to the accounts. Inaccurate monthly financial position reported. 2.3 CONCLUSION AND OPINION We are required to provide an opinion as to the adequacy and effectiveness of the system of internal control under review. The opinion is based on the work performed as set out in the scope and objectives within this report. An overall assurance rating is provided describing the effectiveness of the system of internal control in place to manage the identified risks associated with the objectives covered in this review. The level of assurance given to the control over the General Ledger is Substantial Assurance. RATING INDICATOR DEFINITION Substantial assurance - + Green The Board can take substantial assurance that arrangements to secure governance, risk management and internal control, within those areas under review, are suitably designed and applied effectively. Few matters require attention and are compliance or advisory in nature with low impact on residual risk exposure. Design of system / controls The findings from the review have highlighted three issues that are classified as weakness in the system / control design for the management of the general ledger. These are identified in the main body report as (D). Operation of system / controls The findings from the review have highlighted two issues that is classified as weakness in the operation of the designed system / control for the management of the general ledger. These are identified in the main body of the report as (O). Recommendations H M L Total SUMMARY OF SIGNIFICANT FINDINGS Good Practice was noted in respect of; AUDIT & ASSURANCE SERVICES Page 4

6 A monthly timetable has been developed identifying timescales for the completion and input of management accounting information. This is available to all Management Accounting staff for Velindre NHS Trust and Public Health Wales NHS Trust. Feeders sampled were accurately recorded, authorised and are separately uploaded to the General Ledger for both Trusts. Feeders are clearly identified by organisation, with desktop procedures available for key tasks. All journals were appropriately authorised for upload and contained adequate narratives. A detailed trial balance for both Trusts is produced and reviewed as part of the month end process. A sample of monthly Trail Balances were checked for Velindre NHS Trust and Public Health Wales NHS Trust, with all monthly balances reviewed netting to zero. The 2011/12 year end financial balances were accurately transferred to the Oracle opening balances of 2012/13 for both Trusts. Responsibilities for reconciling Velindre and Public Health Wales NHS Trust accounts have been formally documented. Reconciliations of the supporting accounting systems are completed each month by the staff responsible for the systems. Suspense accounts reviewed each month and expenditure recoded as appropriate. All requests for additions and amendments to the Chart of Accounts were uploaded correctly and on a timely basis, for both Trusts. Separate financial codes in place to record income and expenditure received and incurred for PHW NHS Trust. The key findings of the report relate to the lack of an authorisation process for amendments to the chart of accounts. The findings of the audit are contained in detail on an exception basis in Section 3, the most significant finding which requires management action is: A minimum required requestor or authorisation level has not been formally documented in any procedures. 2.5 DETAILED FINDINGS AUDIT & ASSURANCE SERVICES Page 5

7 Detailed findings and recommendations have been made in Section 3 of the report. Where enhancements are deemed necessary a rating has been allocated to assist management in the determination of prioritisation. 2.6 ACKNOWLEDGEMENT We would like to acknowledge the time and co-operation given by management and staff during the course of this review. AUDIT & ASSURANCE SERVICES Page 6

8 SECTION 3 FINDINGS EVALUATION RECOMMENDATION 2.1 RISK: The General Ledger may contain errors. MANAGEMENT PROPOSAL 1.1 There is no document to formally evidence the reconciliation of closing and opening balances. There is a risk that errors will not be identified. The reconciliation of closing and opening balances should be formally recorded, including: The Oracle Ledger codes and balances for both month 13 and the opening for month 1 are the same. Testing of closing and opening balances identified differences in four accounts: Creditors / Trade and Other Payables Debtors / Trade & Other Receivables Cash and Bank Finance Costs Whilst the cumulative differences between these accounts net to zero, there is no evidence that the discrepancies were identified, reviewed and reconciled. Priority Low (D) Differences between balances. Reasons for differences. Name of person who undertook the task. Date undertaken. The balances on these codes were manually amended for technical accounting issues and were not input into the ledger. e.g. In the Trust Annual accounts the Cash and Bank figure needs to be split between the cash and bank figure and the Borrowing notes (Finance lease liabilities) A copy of the month 13 manual adjustments to the accounts will be included in the month 1 reconciliation file. Responsible Officer A Bright Completed AUDIT & ASSURANCE SERVICES Page 7

9 FINDINGS 1. 2 Testing identified that some feeders had been uploaded outside the agreed reporting timetable. Payroll Feeder Month 4 Pharmacy Feeder Month 5 Priority Low (O) EVALUATION Feeders may not be uploaded on a timely basis, resulting in inaccuracies in accounts. RECOMMENDATION Feeders should be uploaded within agreed reporting timetable. MANAGEMENT PROPOSAL Agreed. All the files were uploaded within the correct month. The monthly closedown timetable gives the expected dates that those files will be available but there will be occasions when the files can not be upload as they are incorrect and will need to be re-run by the provider e.g. Payroll. Responsible Officer A Bright Completed 1.3 Testing of monthly reconciliations identified that some documents had not been appropriately signed off. There is a risk that errors will not be identified. All reconciliations should be formally recorded, signed and dated, and filed appropriately. Agreed to be signed and dated Responsible Officer A Bright Month 2 Balance Sheet to Ledger Bank Reconciliation Payroll Reconciliation Completed by 1 st of February 2013 Month 4 Balance Sheet to Ledger AUDIT & ASSURANCE SERVICES Page 8

10 FINDINGS Payroll Reconciliation EVALUATION RECOMMENDATION MANAGEMENT PROPOSAL The audit also identified that there was no Accounts Receivable reconciliation on file for Month 4. Priority Low (O) 2. RISK: Unauthorised data may be input into the accounts. 2.2 The 2010/11 audit report recommended formalising the level of authority required for requesting changes to the Chart of Accounts. However, the current audit did not identify any formal minimum level of authorisation i.e. updated procedures. Furthermore, there are no desktop procedures for this task. This limits the knowledge of the function to the single individual who currently undertakes this task. There is a risk that an amendment will be made that is not required. Requests for amendment to the chart of accounts should be subject to authorisation by an agreed minimum level of staff. This should be formally recorded in procedures. Desktop procedures should be developed to ensure continuity of service. Agreed Responsible Officer A Bright To be completed by the 1 st of March 2013 AUDIT & ASSURANCE SERVICES Page 9

11 Priority Medium (D) FINDINGS EVALUATION RECOMMENDATION MANAGEMENT PROPOSAL 2.3 Testing of changes to the chart of accounts identified one amendment that was not appropriately supported by backing documentation. Change requests are made by , with some amendments included in attachments. Whilst the had been printed as evidence of the change the relevant excel attached was not retained. There is a risk that an amendment will be made that is not required. Loss of audit trail. A formal request form should be developed, to ensure all relevant information is recorded and retained for new or changes to Chart of Account requests. Agreed Responsible Officer A Bright Completed Priority Low (D) 2.4 Backing documentation could not be located for approx 25% of journals sampled Priority Medium The veracity of the ledger input could not be checked All journal documentation should be located. All the journals requested will be collected from each of the division and collated and will be supplied to you by the 1 st of march Responsible Officer A Bright To be completed by the 1 st of March 2013 AUDIT & ASSURANCE SERVICES Page 10

12 Appendix 1 AUDIT ASSIGNMENT ASSURANCE RATINGS An Assurance Rating is allocated to each audit assignment undertaken. There are four potential levels of assurance available and these are described below: Full Assurance - There is a sound system of internal control and there is consistent operational compliance with controls across all areas reviewed. There are no key findings and only enhancements or minor issues with limited consequences to the achievement of system objectives. Adequate Assurance - Generally, there is a sound system of internal control and broadly there is operational compliance with those controls. However, some weaknesses in the design of controls and/or inconsistent application of controls could put the achievement of particular system objectives at risk. Limited Assurance - Whilst some control is evident, weaknesses in the design, and/or inconsistent application of controls, put the achievement of system objectives at significant risk in a number of areas reviewed. No Assurance Widespread weaknesses in controls and/or consistent noncompliance with controls have resulted or are likely to result, in failure to achieve the system objectives in several of the areas reviewed. Recommendation Prioritisation Each recommendation made within the report is allocated a priority rating dependant on its significance. There are three levels as highlighted in the table below: High Priority Rating Medium Low Explanation Poor key control design OR widespread noncompliance with key controls PLUS Significant risk to achievement of a system objective OR evidence present of material loss, error or misstatement Minor weaknesses in control design OR limited noncompliance with control PLUS Some risks to achievement of a system objective Potential to enhance design of adequate systems further PLUS Isolated instances of non-compliance with controls with controls with negligible consequences Timescale for Action Commencement Immediate Within one month Within three months AUDIT & ASSURANCE SERVICES Page 11