PURPOSE The purpose of this report is to advise the Audit and Risk Committee of the outcome of the internal audit of sensitive expenditure.

Transcription

1 AUDIT AND RISK COMMITTEE AGENDA 6.5 SENSITIVE EXPENDITURE INTERNAL AUDIT Author: Authoriser: Alison Wiley, Manager Internal Audit Kaiwhakahaere Arotake ā-roto Roy Baker, Chief Financial Officer Kaiārahi Pūtea Matua PURPOSE The purpose of this report is to advise the Audit and Risk Committee of the outcome of the internal audit of sensitive expenditure. RECOMMENDATIONS That the Audit and Risk Committee: 1. Receive the report. 2. Note the outcome of the sensitive expenditure internal audit and the agreed corrective actions. Reports contain recommendations only. Refer to the meeting minutes for the final decision. BACKGROUND 1. KPMG was engaged to deliver the sensitive expenditure audit per the approved 2018/19 internal audit programme. As a local entity, and an organisation with a high local public profile, it is important that Porirua City Council expenditure can withstand Council, Executive Leadership Team and public scrutiny. 2. The full report (attachment 1) summarises the key issues identified for improvement during the audit, along with associated risks, recommendations and management s agreed action plans. 3. The objective of the audit was to assess compliance with the Council s Sensitive Expenditure Policy and related policies. 4. The review was rated Partially effective and the recommendations relate to: DISCUSSION Taxi vouchers (Moderate) Policies (Moderate) PCC vehicles and fuel card management (Low) 5. After further analysis of the report findings, we believe that the number of pcard transactions without a receipt (as documented on Page 6 of attachment 1) is less than identified by KPMG s data analytics and represents approximately 1.5% of total pcard expenditure. Nevertheless, pcard holders and approvers need to be reminded about the importance of acquiring and attaching receipts to expenditure. Finance will continue to monitor this area and communications are planned as part of the sensitive expenditure policy reviews that are underway. 6. After further discussion about FBT and the three individuals who are entitled to use PCC vehicles for private use (as documented on Pages 7-8 of attachment 1), we believe being able to estimate private use of these vehicles for FBT purposes is irrelevant; IRD requires FBT to be paid if the cars are available for private use regardless of whether they are used or not. Therefore, the current process of paying FBT under the assumption of 100% private use of these vehicles will continue. Item 6.5 Page 43

2 AUDIT AND RISK COMMITTEE AGENDA ATTACHMENTS 1. Sensitive Expenditure Internal Audit Report Item 6.5 Page 44

3 Sensitive Expenditure Internal Audit September 2018 Item Attachment 1 Page 45 porate Services Internal Audit

4 Opinion on management control Partially effective 3 AUDIT AND RISK COMMITTEE ATTACHMENTS This report details the audit observations and recommendations from the sensitive expenditure 4 internal audit. The objective of the audit was to assess compliance with Porirua City Council (PCC) s Sensitive Expenditure Policy and related policies. The focus was on expenditure and reimbursements in the period 1 July 2017 to 30 June This review was conducted between 13 August 2018 and 31 August The audit background and scope is detailed in Appendix A. In the public sector, the use of purchase cards and sensitive expenditure is of high public interest and represents a reputational risk to PCC if not well controlled. Council, management and staff use sensitive expenditure in a manner that supports PCC s business operations and is reasonable. Our recommendations are about enhancing the control environment over the Taxi vouchers usage, PCC vehicles and fuel cards oversight. Our testing identified areas of non-compliance with Sensitive Expenditure Policy and related polices. This is mainly because of the requirements of the Sensitive Expenditure policy. Therefore, we have recommended that the policies are updated to reflect a more pragmatic approach to sensitive expenditure. Total spend per category and associated volumes of transactions incurred during the period under review are detailed below. Staff reimbursements General expenses Purchase cards Taxi cards Fuel cards 501 transactions 2,383 transactions 91 active cards 17 cards 88 vehicles $183,581 $5,594,914 $683,018 $3,895 $135,743 We have raised two moderate and one low priority findings. While breaches of Sensitive Expenditure Policies are usually minor from a financial point of view, these need to be addressed by management to maintain the high level of probity expected of PCC. This should ensure that sensitive expenditure decisions continue to be based on good controls, good judgement and will allow PCC s sensitive expenditure to withstand public scrutiny. The recommendations from the audit relate to: Taxi vouchers usage Finalising updating Sensitive Expenditure policy and related policies PCC vehicles and fuel cards oversight Final report distribution list: Chief Executive & General Managers 3 Control weaknesses were identified which, if not appropriately addressed, could in the future result in the audited business processes not achieving their control objectives. There is only partial fulfilment or adherence with the control as stated (i.e. the control is not being performed with full effectiveness, is being performed inconsistently or with irregular frequency). Control design needs some improvement (may not be fully effective in mitigating risk) or the design might be manual where an automated control would be more effective). 4 Sensitive expenditure is expenditure by a public entity that provides, has the potential to provide, or has the perceived potential to provide a private benefit to an individual staff member of a public entity that is additional to the business benefit to the entity of the expenditure. It also includes expenditure by a public entity that could be considered unusual for the entity s purpose and/or functions. Item Attachment 1 Page 46

5 The following table summarises the key issues identified for improvement during the course of the audit, categorised according to their level of priority. Audit observations are detailed later on in the report along with the associated risks, recommendations and managements agreed action plans. It is important to note that all changes and improvements that result from the audit should be fully documented, reviewed and approved. Key observations / Recommendations High Moderate Low 1. Taxi vouchers Consider terminating the use of taxi vouchers or implement a process to monitor use of the taxi vouchers. 2. Policies Refine and clarify expectations of reasonable and acceptable expenditure by PCC staff and enforce compliance with the Sensitive Expenditure policy. 3. PCC vehicle and fuel card management Develop processes for monitoring the use of PCC vehicles and fuel cards. Priority Key High Significant improvements required Moderate Improvements are necessary Low Some improvements required Immediate corrective action is required (within 6 months). These recommendations relate to a serious weakness which exposes the Council to a material extent in terms of achievement of Council s objectives, financial results, operational efficiencies, legislative compliance or otherwise impair the Council s reputation. Corrective action is required (within 6-12 months). These recommendations relate to deficiencies that need to be addressed to meet expected standards of good practice. These include any control weaknesses which could undermine the system of internal control or operational efficiency. Corrective action is required (12 to 18 months). A weakness which does not seriously detract from the system of internal control or operational efficiency but will be beneficial to management to address. Item Attachment 1 Page 47

6 1. Taxi vouchers Consider terminating the use of taxi vouchers or implement a process to monitor use of taxi vouchers. Moderate Based on our sample test of taxi vouchers transactions, we noted that taxi vouchers were, for most part, used for business purposes. However, there are inadequate controls to monitor their use. We noted: The Manager, Corporate Support centrally manages taxi vouchers and only issues taxi vouchers if required for a business purpose. Until they started, there was no tracking over vouchers issued. There is no reconciliation of taxi voucher statement. Two of the taxi vouchers are issued with no expiry date. Three individuals in possession of purchase cards were issued with taxi vouchers. Two taxi vouchers issued for PPRS units are valid for up to two years. Through sample testing, we noted: Three purchase card holders used seven taxi voucher transactions. One individual used two taxi vouchers for non-business purpose. The individual concerned confirmed the amounts will be reimbursed to PCC. Risks Potential to take advantage and use the taxi voucher for personal gain, rather than intended business purposes. Reputation damage due to non-compliance with the Sensitive Expenditure policy. Recommendations Withdraw the use of taxi vouchers to individuals who have purchase cards Review all the active taxi vouchers and immediately deactivate taxi vouchers allocated to those who no longer need them. Implement a process to review the use of taxi vouchers on a monthly basis. Unless there is cost benefit or health and safety issue in keeping taxi vouchers, consider stop using taxi vouchers. Confirm that the individual, who used taxi vouchers for non-business purposes has reimbursed the amounts to PCC. Management action plan Responsibility Due date Taxi vouchers will be withdrawn and replaced with a Corporate Cabs account (or pcards). Recommendations as above will be implemented prior to new process being established. Manager, Corporate Support 1 November 2018 Item Attachment 1 Page 48

7 Purchase card number AUDIT AND RISK COMMITTEE ATTACHMENTS 2. Policies Refine and clarify expectations of reasonable and acceptable expenditure by PCC staff and enforce compliance with the Sensitive Expenditure policy. Moderate The total purchase cards expenditure during the period under review was $683,018. The top 10 cards make up 49% of the total purchase card expenditure Top 10 purchase cards spend $21,258 $22,742 $22,852 $24,368 $25,396 $29,327 $29,960 $36,441 $50,113 $70,333-10,000 20,000 30,000 40,000 50,000 60,000 70,000 80,000 Amount ($) PCC s sensitive expenditure and related policies generally align with the Office of the Auditor General s Controlling sensitive expenditure: Guidance for public entities (OAG guidelines). The policies are a mix of principles based guidance with specific rules for certain circumstances. Some guidance on what expenditure PCC will and will not cover and guidance on what level of expenditure PCC considers reasonable is not always clear. Also, policies have not been regularly updated and contained information that no longer applied in practice. General observations We noted: Policies were not easy to locate on PCC s intranet. Limited on-going training to reiterate the importance of, and reinforce compliance with PCC policies. Some sections in the policies do not clearly state the expectations of reasonable and acceptable reimbursable expenditure by PCC staff. For example, the travel policy ( meal expense page 6) states For international travel an appropriate equivalent amount will be reimbursed. PCC s requirements are spread across multiple policy documents. This makes it difficult for staff and management to easily understand policy requirements and ensure consistency. The OAG guidelines section 4.7 states that entities are expected to include in their policies guidance on limits on how much alcohol will be paid for. The current PCC s policies do not clearly state the limits on alcohol. The current Corporate Travel procedures for Porirua City Council was last updated in June We acknowledge that this document is currently being updated by the Manager Corporate Support. The current policy contains a lot of outdated information (e.g. preferred air travel suppliers and hotel providers as well as an allowance of up to $5 per day for calling home if away more than one night among others). The Sensitive Expenditure policy Section 6 states that good practice often involves the application of the following principles when reporting breaches of official policy: - PCC internal reporting on non-compliance prior to external reporting. - Reporting to PCC management before Council. - Informing direct line of management associated with the area in which the breach occurred before escalating to the General Manager and General Manager Corporate Services/CFO. Item Attachment 1 Page 49

8 2. Policies Refine and clarify expectations of reasonable and acceptable expenditure by PCC staff and enforce compliance with the Sensitive Expenditure policy. Moderate We noted that the detection of non-compliance with the Sensitive Expenditure policy is reliant on manual reviews. The use of data analytics to detect breaches and find anomalies is limited. It was noted that one individual was reimbursed for same expense twice by claiming for an expense paid by purchase card. Specific observations We noted: Sensitive Expenditure policy - Section 3 This policy should be read in conjunction with other related PCC documents and procedures, including the Purchasing and Contracts procedures. We confirmed this policy does not exist. - Section Claims relating to sensitive expenditure need to be submitted promptly after the expenditure has incurred. We noted some of the expenses submitted recently dated more than 12 months ago. - Section Claims relating to sensitive expenditure need to clearly state the business purpose of the expenditure. In cases where the business purpose is not clear from the supplier documentation supporting the claim, a written statement of the purpose should be included as part of the claim. More than ten instances were identified where the business purpose was not apparent. - Section Expense claims must be authorised by the manager to whom the employees reports. Expenses for one department were approved by the manager of a different department. We also noted that some of the purchase card transactions have been paid without obtaining approval in the system. - Section PCC staff should not pay for coffees, lunches, and drinks without the prior approval of their General Manager. From the transactions reviewed, there was one instance where these expenses were approved after they had been incurred. - Section Gifts need prior approval of the Chief Executive regardless of value. Five instances were noted where approval was obtained after the gifts were purchased. Purchase Card policy - Section states that staff who make a number of small value transactions (such as two or more business related transactions per month at retail outlets) can apply for a purchase card. The policy also states that the Financial Services team must review the central register of all purchase card holders on a six-monthly basis. This is to ensure that those staff currently holding cards are still entitled to them. Our data analytics identified five active purchase cards that had no transactions incurring bank charges only during the year under review. We confirmed that these cards have been closed now because the card holders have left PCC. Also, we noted that an identical purchase card was used by two staff members. PCC is currently investigating this further. - Section Where a valid tax invoice is not available, or has been lost by the cardholder, a note explaining the nature of the transaction must be scanned and attached to the FlexiPurchase system. This note must also verify that the expenditure incurred was a valid work-related expense signed by the cardholder. 281 transactions valued at $17,845 with no receipts were identified by our data analytics. - Section states that the Financial Services team will monitor the HR distributed list of departing staff and cancel the purchase card when the staff member leaves within five working days of the employee leaving PCC. However, six individual s purchase cards who have left PCC were still active at the time of our review. We confirmed these cards have now been closed by PCC. - Section All entertainment and hospitality expenditure must include details of the people attending and the purpose of the meeting. Item Attachment 1 Page 50

9 2. Policies Refine and clarify expectations of reasonable and acceptable expenditure by PCC staff and enforce Moderate compliance with the Sensitive Expenditure policy. Two transactions were identified where details of people attending were not always included with the expenditure supporting documentation. Travel policy - Page 2 - Travel bookings are made through Manager Corporate Support. Instances were noted where bookings were made directly with an airline. - Page 6 - Meals are reimbursed on the presentation of itemised receipts only, unless circumstances prevent this. One transaction was identified where the receipt attached was not itemised. Risks Current policies do not reflect the accurate expectations of reasonable and acceptable expenditures and the related processes. Excessive or frequent breaches of policy could result in reputational damage for PCC. Lack of awareness of policy requirements may result in expenditure incurred outside of policy limits. Manual processes for detecting non-compliance with policies increases the likelihood of missing non-compliant transactions (e.g. reimbursing for expenses paid through purchase card also). Recommendations Implement regular review of policies. This could be conducted once every one to two years. Review and update all policies that are related to sensitive expenditure to reflect actual expectations of reasonable and acceptable expenditure, including areas that resulted in non-compliance from our sample testing. Implement a process to regularly monitor transactions for non-compliance with policies using data analytics. Management action plan Responsibility Due date Process to regularly review policies will be established. Review of Sensitive Expenditure Policies is underway, once this is complete and these have been approved, expectations will be communicated to all staff. Manager, Corporate Support 1 April 2019 Item Attachment 1 Page 51

10 3. PCC vehicle and fuel card management Develop processes for monitoring the use of PCC vehicles and fuel cards. AUDIT AND RISK COMMITTEE ATTACHMENTS Low The use of PCC vehicles can be categorised as following: Pool vehicles Vehicles allocated to business unit Six business use vehicles assigned to individuals Three vehicles assigned to Executive Management Team/Mayor PCC staff can book the vehicles online (e.g. similar to room booking in outlook). Requires manual signing of the log book. Equipped with EROAD, a GPS tracking system. The record of a department having allocated vehicles is in the Techone asset and task systems. If an additional vehicle is required, a business case must be approved. Equipped with EROAD. The six individuals are authorised to take vehicles home as part of their duties. These vehicles are not available for private use. Financial Accountant manages the Vehicle private use restriction letters for fringe benefit tax (FBT) reasons. FInancial Accountant periodically monitors usage through EROAD, a GPS tracking system Entitled to use them for private use under the contractual agreements. Human Resources manages the approved documents. Financial Accountant manages the fringe benefit tax (FBT) portion arising from the estimated use of these vehicles. Not equipped with EROAD. A summary of expenditure incurred through fuel cards is detailed in the table below. Item purchased Volume Amount ($) Car Wash Diesel 91,853 litres 89, LPG Bottle 40 litres Lubricants Sundry Adjustment Unleaded litres 45, Total 135, The control to monitor the use of PCC vehicles and fuel cards is not sufficient. The log book is only available for pool vehicles and review of these identified that the following information is not recorded: The start and end location of journeys. Total distance travelled per odometer readouts per journey. The business purpose of the travel. Whether the vehicle was re-fuelled during the trip. This limits PCC s ability to actively monitor the use of PCC vehicles. The analysis of fuel card usage is currently being discussed, but has not been implemented. The booking process for PCC pool vehicles is informal. A staff member can access an available pool vehicle by filling in their details in the physical log book (e.g. date, vehicle no., cost centre, department, in/out time). There is no control in place to ensure that pool vehicle use is for a valid business purpose. We noted: Some users are unaware of the requirement of completing a physical log book for pool vehicles. The physical log book for pool vehicles are not always completed. The fuel card transaction date for pool vehicles does not always match with the date on the log book. Physical log book entries are manually typed into in Excel by Administration Assistant to enable monitoring and review. This process is time consuming. The remuneration authority has granted 20% full private use of a PCC vehicle to the Mayor. However, PCC pays FBT under the assumption of 100% private use of the PCC vehicle. This is because the private use of the PCC vehicle is not being tracked which results in overpayment of FBT. This also applies to two other individuals who Item Attachment 1 Page 52

11 3. PCC vehicle and fuel card management Low Develop processes for monitoring the use of PCC vehicles and fuel cards. are entitled to use PCC vehicle for private use. As three vehicles do not have EROAD system, PCC is unable to estimate the private usage of these vehicles. Risk Staff may incur expenditure that is considered unreasonable by using PCC vehicles and/or fuel cards for personal use. Recommendations Determine if there is a need to keep the log book or whether the booking system is sufficient. If the former, amend the log book to include key fields noted above and reiterate the requirement of completing the log book. Consider changing the physical log book to an online form of the log book. Implement a process to analyse fuel card usage data with monthly invoices for unusual spend. This can include analysing: - Vehicles filled up multiple times per day. - Purchase of fuel larger than the size of the vehicles fuel tank. - Vehicles filled up during unusual hours if applicable. Management action plan Responsibility Due date Keeping the log book for pool vehicles is not a requirement (GPS and booking system is sufficient) but it is used to charge out fleet use so will be retained in its current format for the time being however the current process for booking pool vehicles will be reviewed for efficiency. Three monthly fuel card audits to be carried out to coincide with the fuel excise refund report. This will check: Abnormal/ high consumption More than 2 transactions in a week for vehicles Transactions after business hours Cards with no activity or little activity Any transaction that is highlighted using the criteria above will dictate an in depth cross-reference of the transaction with the GPS tracking tool. In addition, all wild card transactions will be scrutinised using the same criteria. Manager, Corporate Support Manager, Operations Support Complete Three monthly audits will resume October 2018 for the Jul-Sept period Item Attachment 1 Page 53

12 Introduction KPMG was engaged to deliver the sensitive expenditure review per the approved PCC s 2018/19 internal audit programme. As a local entity, and an organisation with a high local public profile, it is important that PCC s expenditure can withstand PCC, Executive Leadership team and public scrutiny. Inadequate controls over sensitive expenditure can present individuals with an opportunity to not follow policy, to commit fraud, as well as presenting significant reputational risks to the organisation. This review was conducted between 13 August 2018 and 31 August Objectives The objective of this review were to assess the reasonableness and appropriateness of sensitive expenditure incurred in PCC and compliance with discretionary expenditure policies and procedures for staff and councillors. This review included: Assessing the design of controls to prevent, detect and respond to breaches of sensitive expenditure policies. Performing sample testing across in-scope expenditure types to assess compliance with sensitive expenditure and related policies. Assessing PCC s policies and procedures relating to sensitive expenditure for alignment with the Office of the Auditor General s Controlling sensitive expenditure: Guidance for public entities. Scope The scope of the review covered the period 1 July 2017 to 30 June The review covered the sensitive expenditure as outlined in the discretionary expenditure polices for all PCC staff and councillors, including (but not limited to): International travel and travel related expenditure. Corporate credit cards. Staff expense claims. Item Attachment 1 Page 54

13 We interviewed: Michael Tana Mayor Roy Baker General Manager, Corporate Services and Chief Financial Officer Jerry Wrenn General Manager, People and Capability Steve McIntosh Chief Information Officer Danielle Lewis Manager, Corporate Support Lynlee Baily Manager, Democratic Services Chris Herbert Manager, Operations Support Lorraine Walmsley Manager, Financial Services Fiona Kirkwood Manager Human Resources Services Caroline Fotualii Committee Advisor, Democratic Services Peta Anderson Financial Accountant, Financial Services Ashley Gaskin Accounts Payable Diane Koha Executive Assistant to the Chief Executive Tracey Steel Executive Assistant to the Mayor Natasha Davis Senior Administration Officer, Operations Support We obtained: Sensitive Expenditure policy (last updated April 2016) Corporate Travel Procedures for Porirua City Council (last updated June 2014) Purchase card policy (last updated August 2017) Mobile Device Policy (last updated 15 August 2018) Vehicle Use Policy for private use (No date of revision) Reimbursement of elected member expenses (25 May 2016) Vehicle users policy (last updated August 2018) AUDIT AND RISK COMMITTEE ATTACHMENTS Item Attachment 1 Page 55