Closing Report to the WM Audit Committee for the year ended 30 June 2013

Transcription

1 Closing Report to the WM Audit Committee for the year ended 30 June 2013 MasterKey Investment Service (MKIS) MasterKey Investment Service Fundamentals (MKISF) Investor Directed Portfolio Services (IDPS) MLC Investments Limited Issued: 15 August 2013

2 Contents 1. Overview 1 2. Scope of Work Key Auditing Matters... 5 Appendix A - MKIS Draft Example Reports... 6 Appendix B NAL Audit Report Ernst & Young, Australia. All Rights Reserved. Liability limited by a scheme approved under Professional Standards Legislation. i

3 1. Overview Status of the Audit for Internal Controls and Review of Investor Statements We have substantially completed our audits of the Investor Directed Portfolio Services for MasterKey Investment Service ( MKIS ), MasterKey Investment Service Fundamentals ( MKISF ) and Navigator Australia Limited ( NAL ) internal controls around the preparation of investor statements and our review of the annual investor statements for the year ended 30 June Our audit was performed in accordance with the specific requirements of the Australian Securities and Investments Commission s ( ASIC ) Class Order 02/294 for IDPS Operators. The scope of our audit excludes a requirement to form an opinion on the accuracy of taxation information. We confirm that: Our audit was performed in accordance with our engagement letters and Australian Auditing Standards to provide reasonable assurance over the effectiveness of the internal controls in mitigating the risk of material misstatement in the annual investor statements. Subject to receipt of signed management representation letters, we anticipate issuing an unqualified audit report and an unqualified review report, the format of which are prescribed by ASIC and attached in Appendix A, for both MKIS and MKISF. We have issued an unqualified audit report and unqualified review report for NAL on 2 August 2013, the format of which are prescribed by ASIC and attached in Appendix B. Scope of Work Independence We request you consider the matters set out in this report to ensure: there are no residual further considerations or matters that could impact IDPS internal controls and investor statements; you concur with the resolution of these matters; and there are no further significant matters of which you are aware that should be considered before the audit reports are finalised. Section 2 details the scope of work for our audit and review. All members of our audit team have declared their independence of the National Australia Bank in accordance with the requirements of Ernst & Young and the National Australia Bank. 1

4 Internal Control Findings In the course of our audits, we have continued to assess the design and operational effectiveness of controls relating to processes impacting on the internal controls around the preparation of investor statements for the year ended 30 June In regards to MKIS & MKISF, we have identified some weaknesses in operational controls relating to the Compass (unit registry) system. These issues relate to IT access rights to the Compass system. We have completed additional procedures to ascertain the potential risks have been appropriately mitigated for audit purposes. We are finalising our findings and recommendations with management and these findings will be incorporated into our formal management recommendations letter for NabWealth. In the prior year we issued an unqualified audit opinion for NAL as Operator of the IDPS but included a finding as a result of key control breakdowns in the reconciliation of the administration system (STAR) to the General Ledger. The key control breakdown was driven by the Masterkey Custom platform transitioning to Navigator (Project Fusion). As a response to control observations, NabWealth management created Project Apple. We have reviewed the results of these remediation procedures as part of the 2013 audit and have concluded that our opinion for 2013 will be unqualified and will not include a finding. Except for our findings in relation to Compass, we have only identified One star control observations that will be reported in our management letter. These control findings are not material to the opinions issued as at 30 June Our consideration of the control structure and procedures would not necessarily disclose all matters that might be weaknesses as our audit is based on selective tests of accounting records and supporting data and is not intended to provide specific assurance on the internal control structure of MKIS, MKISF and the IDPS operated by NAL. 2

5 2. Scope of Work Outlined below are the key areas of focus of our audit strategy. Area Applications, Additions Redemptions, Transfers, Switches Processes relating to: investors applying for units; investors redeeming units; investors switching their investment strategy or account name changes within their IDPS bank account Distributions (applicable to MKIS & MKISF only) Process relating to payment of distributions to investors Description and Audit Findings Summary of matter: Performed walkthrough for each Compass system process (MKIS & MKISF) and each STAR system process (NAL) to assess the design effectiveness of controls. Checked samples for each of the processes to assess whether the key controls were operating effectively to ascertain complete and accurate processing of investor transactions. Audit Findings: We have considered the results of our procedures on applications, additions, redemptions, transfers and switches and we did not identify any significant issues. Summary of matter: For external funds, we selected samples to compare unit holdings, distribution rates and distribution amounts as per Fund Manager Statements and agreed these back to Compass. For MLC internal funds, we selected samples to compare unit holdings, distribution rates and distribution amounts as per UNISON Reports and agreed these back to Compass. Performed recalculation for samples selected, based on the number of units the investor held multiplied by the distribution rate to assess that Compass has recorded the distribution correctly. Audit Findings: We have considered the results of our procedures on distributions and we did not identify any significant issues. Fee charges and refunds Process relating to various fees charged to investors on their investments Summary of matter: For MKIS & MKISF, fee charges and refunds are calculated automatically by Compass based on the investors details and parameters already set up in Compass. We performed various fee/refund recalculations based on the rate set out in the MKIS and MKISF Product Disclosure Statement and the investors holdings. For NAL, management fees are calculated by the corporate entity based on funds under management. The process is tested as part of the corporate entity s 30 September year end procedures. EY ITRA have also performed testing around the IT general controls to ensure that ongoing remuneration fees are automatically and accurately calculated in Compass and STAR. Audit Findings: We have considered the results of our procedures on management fees and refunds and we did not identify any significant issues. 3

6 Area Bank and Asset Reconciliations Process relating to daily bank reconciliations between administration systems and bank statements Process relating to daily unit reconciliations between administration systems and the external custodian Process relating to quarterly unit prices and unit reconciliations between administration systems, Investor Statements and the external custodian Complaints register Review of complaints and complaints analysis reports Description and Audit Findings Summary of matter: In order to assess the appropriateness of the associated reconciliation procedures, we: Reviewed samples of bank reconciliations, which the Investment Reconciliation team perform daily between Compass/STAR and bank statements. Reviewed samples of asset reconciliations, which the Investment Reconciliation team perform: Daily between number of units held by Compass and the external custodian. Quarterly between unit prices and number of units held by Compass, Investor Statements and the external custodian. Assessed timelines and resolution of reconciling items within the asset and bank reconciliations. Audit Findings: We have considered the results of our procedures relating to bank and asset reconciliations and did not identify any significant issues. We have identified a One star finding for management consideration that we will include in our management letter. Summary of matter: Reviewed the complaints register and complaints analysis reports to assess whether there is any indication of a systemic breakdown in the key controls that we have identified whilst performing our audit procedures. Audit Findings: We have reviewed the complaints register for systematic complaints and we did not identify any significant issues. IT Environment Assessment of the IT environment Summary of matter: Undertook testing around the IT general control environment and controls for the relevant IT applications. Audit Findings: Consistent with the prior year and current findings across the NabWealth business, IT access controls continue to require improvement. Our audit strategy has been tailored to respond to these known weaknesses, for example, we performed additional testing to ascertain that that the processor and reviewer were MLC employees at the time of processing unit registry transactions. In addition, we have identified specific weaknesses in the control environment of Compass. Please refer to Section 3 for more information. Investor Statements Process relating to accuracy of investors statements sent annually to investors Summary of matter: Reviewed the process relating to compilation of investor statements and agreed details for a sample of investor statements back to the relevant Compass or STAR system. Audit Findings: We did not identify any significant issues. 4

7 3. Key Auditing Matters The following are the key auditing matters considered during our audit: Description of Matter Weakness in operational controls relating to Compass (MKIS & MKISF) Our IT audit specialists have tested the effectiveness of IT logical access and manage change controls of key systems (Compass and Unison) relevant to key business processes of MKIS and MKISF. The findings identified that: 1. Business analysts (IT support staff) were provided elevated database access which enables them to make direct changes to the Compass database. This arises because the business analysts are granted emergency access to the database to enable them to perform maintenance tasks. However we observed that this emergency access was granted on average 400 times a month and even through such access expires within 24 hours, access would be routinely granted at the beginning of each day in case it was required. In addition, the logs maintained had insufficient information to monitor changes made to the Compass database or match against the reason why access was granted in the first place. 2. Although segregation of duties is still required to process a transaction through Compass, there were no formal monitoring controls in place to ascertain that all changes approved through Compass were based on client instructions (i.e. no direct link between Compass and the CRMS a workflow system). The elevated database access issue described above further aggravates this, as business analysts can manipulate the client service processor profiles within Compass (enabling a single processor to assume two Compass profiles). The above findings result in: An elevated level of risk in processing unauthorised/incorrect changes through Compass, in the absence of formal monitoring controls. Increases the opportunity for business analysts to make unauthorised changes to Compass. Increases the opportunity for fraud and collusion in processing Compass transactions. Additional Procedures and Recommendations In order to mitigate the increased risk of unauthorised changes or transactions through Compass, we performed the following additional procedures and testing: 1. We reconciled Compass and CRMS (a workflow system) transactions for the key risk areas of redemptions and transfers for the full financial year to ascertain that all Compass transactions were initiated on the basis of client instructions and were accompanied by valid client request forms. We investigated exceptions by requesting management to provide sufficient and appropriate audit evidence to demonstrate that Compass transactions initiated outside of the CRMS workflow had an appropriate business rationale and client instruction. 2. We reviewed the complaints register for the full financial year to ascertain that there have been no customer complaints arising from unauthorised transactions on client accounts which could indicate a breakdown in the Compass IT environment. Based on the remediation work performed above, together with the procedures surrounding the bank and asset reconciliations, nothing has come to our attention that would indicate unitholder balances and the associated annual investor statements have been materially misstated. 5

8 Appendix A - MKIS Draft Example Reports Independent audit report by the auditor to the Board of Directors of MLC Investments Limited on internal controls and other relevant accounting procedures as they relate to the specified annual investor statements for the year ended 30 June 2013 We have audited the internal controls and other relevant accounting procedures of MLC Investments Limited ( the Operator ), including those over its custodian and any other relevant person acting on behalf of the Operator, relating to the preparation of annual investor statements given to the clients of MLC MasterKey Investment Service ( the clients ) for the year ended 30 June These internal controls and accounting procedures are hereafter referred to as the internal controls. Director s and Management s Responsibility The directors and management of the Operator are responsible for maintaining an effective internal control structure including the internal controls in relation to the preparation of annual investor statements of the clients, which comprise for each client a statement of the quantity and value of assets and liabilities held through the Operator by the client as at 30 June 2013 and the corresponding revenue and expenses of the client for the year ended on that date. The Operator s assertions about the effectiveness of the internal controls and other relevant accounting procedures in relation to the accounting and reporting of assets, liabilities, revenue and expenses are included in the Operator s Declaration dated 9 September We have conducted an independent audit of these internal controls. Auditor s Responsibility Our audit has been conducted in accordance with AUS 810 Special Purpose Reports on the Effectiveness of Control Procedures and other Australian Auditing Standards applicable to performance audits and accordingly included such tests and procedures as we considered necessary in the circumstances. These procedures included testing that the aggregates of assets (other than assets held by a client), liabilities, revenue and expenses shown collectively in the annual investor statements were properly reconciled in all material respects by the Operator as at 30 June 2013 to the corresponding amounts shown in reports prepared by the custodian. These procedures have been undertaken to express an opinion whether: 1. the Operator maintained internal controls and other relevant accounting procedures in relation to the preparation of annual investor statements, including those over its custodian and any other relevant person acting on behalf of the Operator, that were suitably designed and operated effectively in all material respects to provide reasonable but not absolute assurance that the annual investor statements for the year ended 30 June 2013 are or have been given to clients without material misstatements; and 2. the aggregates of assets (other than assets held by a client), liabilities, revenue and expenses shown in the clients annual investor statements for the year ended 30 June 2013 have been properly reconciled in all material respects by the Operator as at 30 June 2013 to the corresponding amounts shown in reports prepared by the custodian. 6

9 This report has been prepared to meet the requirements of Australian Securities & Investments Commission Class Order 02/294 "Investor directed portfolio services" (as amended). No responsibility will be accepted for any reliance on this report for any other purpose. Inherent limitations Because of the inherent limitations in any internal control structure it is possible that fraud, error or non-compliance with laws and regulations may occur and not be detected. Further, the internal control structure, within which the internal controls that we have audited operate, has not been audited and no opinion is expressed as to its effectiveness. An audit is not designed to detect all weaknesses in internal control and other accounting procedures as it is not performed continuously throughout the period and the tests performed are on a sample basis. Any projection of the evaluation of control procedures to future periods is subject to the risk that the procedures may become inadequate because of changes in conditions, or that the degree of compliance with them may deteriorate. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion. Auditor s Opinion In our opinion: 1. the Operator maintained internal controls and other relevant accounting procedures in relation to the preparation of annual investor statements, including those over its custodian and any other relevant person acting on behalf of the Operator, that were suitably designed and operated effectively, in all material respects, to provide reasonable but not absolute assurance that the annual investor statements for the year ended 30 June 2013 are or have been given to clients without material misstatements; and 2. the aggregates of assets (other than assets held by a client), liabilities, revenue and expenses shown in the clients annual investor statements for the year ended 30 June 2013 have been properly reconciled in all material respects by the Operator as at 30 June 2013 to the corresponding amounts shown in reports prepared by the custodian. Ernst & Young Sydney 9 September

10 Independent review report by the auditor to the Board of Directors of MLC Investments Limited on the specified annual investor statements for the year ended 30 June 2013 We have reviewed the annual investor statements given to the clients of MLC MasterKey Investment Service (the clients) for the year ended 30 June 2013 prepared by MLC Investments Limited (the Operator). Directors and Management s Responsibility The directors and management of the Operator are responsible for the annual investor statements of the clients, which comprise for each client a statement of the quantity and value of assets and liabilities held through the Operator by the client as at 30 June 2013 and the corresponding revenue and expenses of the client for the year ended on that date. Auditor s Responsibility Our responsibility is to express a conclusion on the annual investor statements based on our review. We have conducted a review in accordance with Standard on Review Engagements ASRE 2405 Review of Historical Financial Information Other than a Financial Report in order to state whether, on the basis of the procedures described, anything has come to our attention that would cause us to believe that any client s annual investor statement is materially misstated. A review is limited primarily to inquiries of the Operator s personnel and analytical procedures applied to the financial data. A review is substantially less in scope than an audit conducted in accordance with Australian Auditing Standards and consequently does not enable us to obtain assurance that we would become aware of all significant matters that might be identified in an audit. Accordingly, we do not express an audit opinion. We have also performed an independent audit of internal controls and other relevant accounting procedures of the Operator, including those over its custodian(s) and any other relevant person acting on behalf of the Operator as they relate to the preparation of the annual investor statements (the internal controls) and have issued a separate unqualified audit opinion to provide reasonable, but not absolute, assurance that the internal controls implemented by the Operator were suitably designed and operated effectively to ensure that there are no material misstatements in the clients annual investor statements for the year ended 30 June This report has been prepared to meet the requirements of Australian Securities & Investments Commission Class Order 02/294 "Investor directed portfolio services" (as amended). No responsibility will be accepted for any reliance on this report for any other purpose. Inherent limitations Because of the inherent limitations in any internal control structure it is possible that fraud, error, or non-compliance with laws and regulations may occur and not be detected. Further, the internal control structure, within which the internal controls that we have reviewed operate, has not been reviewed and no view is expressed as to its effectiveness. A review is not designed to detect all weaknesses in control procedures as it is not performed continuously throughout the period and the tests performed are on a sample basis. Also, a review does not provide all the evidence that would be required in an audit, thus the level of assurance provided is less than given in an audit. We have not performed an audit of any individual annual investor statement and, accordingly, we do not express an audit opinion in relation to any client s individual annual investor statement. Any projection of the evaluation of control procedures to future periods is subject to the risk that the procedures may become inadequate because of changes in conditions, or that the degree of compliance with them may deteriorate. 8

11 The Statement provided below has been prepared on the above basis. Statement Based on our review, which is not an audit, nothing has come to our attention that causes us to believe that any annual investor statement for the year ended 30 June 2013 which has been given to any client is not prepared, in all material respects, in accordance with the requirements of the Australian Securities and Investments Commission s ( ASIC ) Class Order 02/294. Ernst & Young Sydney 9 September

12 Appendix B NAL Audit Report Independent audit report by the auditor to the Board of Directors of Navigator Australia Limited on internal controls and other relevant accounting procedures as they relate to the specified annual investor statements for the year ended 30 June 2013 We have audited the internal controls and other relevant accounting procedures of Navigator Australia Limited ( the Operator ), including any other relevant person acting on behalf of the Operator, relating to the preparation of annual investor statements given to the clients of Navigator Australia Limited ( the clients ) for the year ended 30 June These internal controls and accounting procedures are hereafter referred to as the internal controls. Director s and Management s Responsibility The directors and management of the Operator are responsible for maintaining an effective internal control structure including the internal controls in relation to the preparation of annual investor statements of the clients, which comprise for each client a statement of the quantity and value of assets and liabilities held through the Operator by the client as at 30 June 2013 and the corresponding revenue and expenses of the client for the year ended on that date. We have conducted an independent audit of these internal controls. Auditor s Responsibility Our audit has been conducted in accordance with AUS 810 Special Purpose Reports on the Effectiveness of Control Procedures and other Australian Auditing Standards applicable to performance audits and accordingly included such tests and procedures as we considered necessary in the circumstances. These procedures included testing that the aggregates of assets (other than assets held by a client), liabilities, revenue and expenses shown collectively in the annual investor statements were properly reconciled in all material respects by the Operator as at 30 June 2013 to the corresponding amounts shown in reports prepared by the Operator which have been independently audited. These procedures have been undertaken to express an opinion whether: 1. the Operator maintained internal controls and other relevant accounting procedures in relation to the preparation of annual investor statements, including any other relevant person acting on behalf of the Operator, that were suitably designed and operated effectively in all material respects to provide reasonable but not absolute assurance that the annual investor statements for the year ended 30 June 2013 are or have been given to clients without material misstatements; and 2. the aggregates of assets (other than assets held by a client), liabilities, revenue and expenses shown in the clients annual investor statements for the year ended 30 June 2013 have been properly reconciled in all material respects by the Operator as at 30 June 2013 to the corresponding amounts shown in reports prepared by the Operator, which have been independently audited. This report has been prepared to meet the requirements of Australian Securities & Investments Commission Class Order 02/294 "Investor directed portfolio services" (as amended). No responsibility will be accepted for any reliance on this report for any other purpose. 10

13 Inherent limitations Because of the inherent limitations in any internal control structure it is possible that fraud, error or non-compliance with laws and regulations may occur and not be detected. Further, the internal control structure, within which the internal controls that we have audited operate, has not been audited and no opinion is expressed as to its effectiveness. An audit is not designed to detect all weaknesses in internal control and other accounting procedures as it is not performed continuously throughout the period and the tests performed are on a sample basis. Any projection of the evaluation of control procedures to future periods is subject to the risk that the procedures may become inadequate because of changes in conditions, or that the degree of compliance with them may deteriorate. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion. Auditor s Opinion In our opinion: 1. the Operator maintained internal controls and other relevant accounting procedures in relation to the preparation of annual investor statements, including any other relevant person acting on behalf of the Operator, that were suitably designed and operated effectively, in all material respects, to provide reasonable but not absolute assurance that the annual investor statements for the year ended 30 June 2013 are or have been given to clients without material misstatements; and 2. the aggregates of assets (other than assets held by a client), liabilities, revenue and expenses shown in the clients annual investor statements for the year ended 30 June 2013 have been properly reconciled in all material respects by the Operator as at 30 June 2013 to the corresponding amounts shown in reports prepared by the Operator, which have been independently audited. Ernst & Young Melbourne 2 August

14 EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organisation and may refer to one or more of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organisation, please visit ey.com Ernst & Young, Australia. All Rights Reserved. This communication provides general information which is current at the time of production. The information contained in this communication does not constitute advice and should not be relied on as such. Professional advice should be sought prior to any action being taken in reliance on any of the information. Ernst & Young disclaims all responsibility and liability (including, without limitation, for any direct or indirect or consequential costs, loss or damage or loss of profits) arising from anything done or omitted to be done by any party in reliance, whether wholly or partially, on any of the information. Any party that relies on the information does so at its own risk. Liability limited by a scheme approved under Professional Standards Legislation. ey.com