London Borough of Southwark

Transcription

1 London Borough of Southwark Internal Audit Report 2015/16 ADD08 - School Audits Summary of Themes arising from the Internal Audit three-year programme 2012/13 to 2014/15 January 2016

2 CONTENTS PAGE NO. 1. Background to internal audit 3 2. Approach to internal audit of schools 3 3. Recommendations and assurance opinions 4 4. Summary of recommendations 5 5. Summary of key findings 6 Appendix A Contact details 9 Appendix B Areas subject to audit 10 Appendix C Before, during and after the site visit 12 London Borough of Southwark Schools Audits Summary of Key Themes to / Page 2

3 1 BACKGROUND TO INTERNAL AUDIT 1.1 What is internal audit? Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. (Source: International Standards for the Professional Practice of Internal Auditing, the Institute of Internal Auditors) 1.2 Why is internal audit needed? Legislation Public accountability Risk management, governance and control expertise Assurance on systems of control Fraud prevention, detection and/or investigation Objective advice Help to manage risks 1.3 Purpose of internal audit in schools The purpose of the process is to provide assurance to the council, the schools governing body and the head teacher that the controls in place within the school are robust and operating efficiently in practice. In turn, this ensures that the school is minimising its exposure to financial and reputational risk. To this end, our internal audit terms of reference set out the objective of the audit as follows: Purpose of Internal Audit in Schools To assess and provide an assurance opinion on the level of local compliance with key corporate and statutory procedures relating to both financial and operational procedures. To make recommendations necessary to ensure an effective control framework is in operation. 2 APPROACH TO INTERNAL AUDIT OF SCHOOLS 2.1 Programme of school audits A three year rolling cycle of internal audits across all of the schools within the London Borough of Southwark is undertaken. This report summarises the key findings made in schools over the three year period 2012/13 to 2014/15 and provides information to schools on the framework of control expected by the council. 2.2 Areas of internal audit coverage During each audit a consistent approach is taken, as agreed with the schools finance team at the council, to cover the following areas: Governance Procurement Banking Data Security Budget Monitoring Asset Handling Payroll and Pensions Cash Handling (a new area introduced in late 2014/15). London Borough of Southwark Schools Audits Summary of Key Themes to / Page 3

4 2.3 Limitations to the scope of internal audit work Testing is performed on a sample basis, selected from transactions processed in the previous 12 months. The audit does not assess the adequacy of teaching arrangements at the school. Our work does not provide any guarantee against material errors, loss or fraud, or provide an absolute assurance that material error; loss or fraud does not exist. 3 RECOMMENDATIONS AND ASSURANCE OPINIONS Recommendations are categorised based on the risks associated with the findings arising from our audit work, where controls are not in place or not being complied with. We provide levels of assurance on all school audits undertaken based on the categories and numbers of recommendations. This assurance is given on traffic light system. The highest level of assurance is Green. This specifies that the council and governing body can take substantial assurance that the controls upon which the organisation relies to manage this risk are suitably designed, consistently applied and effective. The lowest level of assurance is Red. This specifies that the council and governing body cannot take assurance that the controls upon which the organisation relies to manage this risk are suitably designed, consistently applied or effective. London Borough of Southwark Schools Audits Summary of Key Themes to / Page 4

5 4 SUMMARY OF RECOMMENDATIONS ARISING FROM INTERNAL AUDITS OF SOUTHWARK SCHOOLS The summaries of findings within this report are based on all schools reviews from the programme of audits carried out from 2012/13 to 1014/15. The graph below provides a breakdown of the recommendations made over the three years. 100% Recommendations 2012/13 to 2014/15 90% 80% 70% 60% 50% 40% 30% Low 20% 10% 0% A comparison between each financial year by the relative proportion of each category of recommendations is shown in the pie-charts below. London Borough of Southwark Schools Audits Summary of Key Themes to / Page 5

6 5 SUMMARY OF KEY FINDINGS BY AREA 5.1 Governance Declaration of business interest forms are not up to date and have not been produced by all members Instrument of Governance is not always up to date HR document retention does not always provide a complete audit trail of the new starter process DBS checks are not being evidenced as obtained prior to employment commencing Southwark Low Banking Bank mandate is not always appropriately signed Bank mandate does not reflect the scheme of delegation concerning cheque signatories Petty cash safes are usually vulnerable to unauthorised access Southwark Low Budget Monitoring Governors are not being sent copies of budgeting monitoring in advance of meetings In some cases annual budgets were not being approved by the governing body There is a lack of evidence to show that cost centre reports are being reviewed by budget holders There is limited scrutiny of overspends (and also underspends) by the Business Manager and Head teachers Southwark London Borough of Southwark Schools Audits Summary of Key Themes to / Page 6

7 Low 5.4 Payroll and Pensions Up to date contract with the payroll provider is not held on file There is a lack of segregation of duties between the preparer and the sender of the BACS files Starter and leaver forms are not being authorised and kept on file Pension opt-out forms are not stored on file for all employees who opt-out of the pension scheme Overtime claims are not supported by timesheets, or appropriately approved by senior management General roles and responsibilities appear ad-hoc and not clearly set out in the financial regulations Southwark Low Procurement Order forms are not being used correctly or not completed in full Separation of duties in authorisation is not taking place or evidenced Evidence that goods are being checked upon delivery and signed as received Insufficient quotes are being obtained in the tendering process (a breach of financial regulations!) Purchase orders are not always being raised for foreseeable expenditure Purchase orders are not being approved in line with financial regulations (i.e. separate officers) Credit card statements are not being separately reviewed and expenditure is not being monitored Southwark London Borough of Southwark Schools Audits Summary of Key Themes to / Page 7

8 Low Data Security Users of the finance system are not being reviewed on at least an annual basis ICT provider contracts are sometimes nearing expiration and do not specify the need for remote back-ups Southwark Low Inventory There is sometimes a lack of accountability over the assets listed in the School s register (should be budget holders) There is a lack of evidence to show that assets have been checked and the register updated on a regular basis Southwark Cash Handling Robust controls for the proper recording of cash transactions are not in place. This includes recording of transactions, use of receipts and independent reconciliations. Southwark We aim to agree workable solutions to the issues identified from our testing techniques. We attempt to agree shorter timeframes for resolving risk areas as opposed to Low risk areas. Typically 3 months for s 6 months for and 9 months for Low category recommendations. London Borough of Southwark Schools Audits Summary of Key Themes to / Page 8

9 APPENDIX A CONTACT DETAILS Contacts Mike Pinder Head of Anti-Fraud and Audit michael.pinder@southwark.gov.uk Angela Mason-Bell Manager RSM Risk Assurance Services LLP angela.mason-bell@southwark.gov.uk / angela.mason-bell@rsmuk.com Ian Wiltshire Assistant Manager RSM Risk Assurance Services LLP ian.wiltshire@southwark.gov.uk Luc Tudor Internal Auditor luc.tudor@southwark.gov.uk London Borough of Southwark Schools Audits Summary of Key Themes to / Page 9

10 APPENDIX B - AREAS SUBJECT TO AUDIT Governance Banking Budgeting Declaration of business interest forms for governors Governors are given opportunities to declare interests at each meeting Meetings are quorate and held at least termly An independent clerk is used Who the school banks with The school has not been overdrawn Bank Mandate and cheque signatories conform to the school's scheme of delegation Check the last three bank reconciliations and re-preform the latest one Determine controls on the security over cheque stationery, confirm their storage location and review the stationary to ensure no cheques are pre-signed. Payroll and Pensions Payroll Pensions Procurement Agreement of the budget Three months of budget monitoring Reporting of budgeting monitoring to governors Commitment of expenditure to individual budget areas The contract in place with payroll provider is signed and covers the current financial year Review entire payroll process to determine that there is adequate separation of duties Review the last 12 months payroll and highlight any major differences and investigate why Sample test overtime claims Test for a sample of payments that they are for correct amount Sample test amendments to pay and process Sample test process for leavers and starters Check evidence of current DBS checks Pension opt-out forms Payroll provider is responsible for payments regarding pensions Process for informing LBS pensions team of changes to payroll data The full purchasing process from the use of purchase order forms to invoice authorisation Process for payments made over thresholds set in the school s financial procedures Direct debits and control over payments Procurement cards and control over payment Bankline London Borough of Southwark Schools Audits Summary of Key Themes to / Page 10

11 Data Security Access to the finance system Password security Back ups of data DBS checks Inventory Inventory and asset checks are no longer conducted as part of the internal audit reviews Cash Handling Receipting of cash and cheques received Records of monies due and received Banking records Reconciliation processes of monies collected to those banked Whether the cash in the safe agrees with records Physical security over cash held on the premises / access to keys London Borough of Southwark Schools Audits Summary of Key Themes to / Page 11

12 APPENDIX C - BEFORE, DURING AND AFTER THE SITE VISIT TO YOUR SCHOOL Before the site visit, we will: Inform you in advance of when we will attend Arrange times that suit you Send a schedule of information that we will require whilst on site Send a copy of the council s internal audit charter During the site visit, we will: Two days on site Meetings at start of day one and debrief at end of day two Carry out he review of the areas outlined in appendix A Keep out of the way as much as possible Discuss issues arising at the end of day one Hold a debrief meeting on our findings and recommendations After the site visit, we will: Write a draft report and cross reference all our work to evidence obtained throughout the audit This report and evidence is then sent for quality review A draft report is issued to the Headteacher with 3 weeks to respond with management comments Once management comments are returned the report is once more reviewed by audit management, queries or areas of disagreement are resolved through discussion and then the final report is issued. How to make the audit process easier: Be accessible: key documents are readily accessible Be available: necessary officers available to talk to, head teacher available on the afternoon of day two for the debrief Samples: have lists and transactions from which we can select our samples ready at the start of day one Draft Report: respond promptly Be open: we aren t there to catch you out, if there is an issue you are aware of, tell us! London Borough of Southwark Schools Audits Summary of Key Themes to / Page 12

13 As a practising member firm of the Institute of Chartered Accountants in England and Wales (ICAEW), we are subject to its ethical and other professional requirements which are detailed at The matters raised in this report are only those which came to our attention during the course of our review and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by you for their full impact before they are implemented. This report, or our work, should not be taken as a substitute for management s responsibilities for the application of sound commercial practices. We emphasise that the responsibility for a sound system of internal controls rests with management and our work should not be relied upon to identify all strengths and weaknesses that may exist. Therefore, the most that the internal audit service can provide is reasonable assurance that there are no major weaknesses in the risk management, governance and control processes reviewed within this assignment. Neither should our work be relied upon to identify all circumstances of fraud and irregularity should there be any. This report is supplied on the understanding that it is solely for the use of the persons to whom it is addressed and for the purposes set out herein. Our work has been undertaken solely to prepare this report and state those matters that we have agreed to state to them. This report should not therefore be regarded as suitable to be used or relied on by any other party wishing to acquire any rights from RSM Risk Assurance Services LLP for any purpose or in any context. Any party other than the Board which obtains access to this report or a copy and chooses to rely on this report (or any part of it) will do so at its own risk. To the fullest extent permitted by law, RSM Risk Assurance Services LLP will accept no responsibility or liability in respect of this report to any other party and shall not be liable for any loss, damage or expense of whatsoever nature which is caused by any person s reliance on representations in this report. This report is released to our Client on the basis that it shall not be copied, referred to or disclosed, in whole or in part (save as otherwise permitted by agreed written terms), without our prior written consent. We have no responsibility to update this report for events and circumstances occurring after the date of this report. rsmuk.com The UK group of companies and LLPs trading as RSM is a member of the RSM network. RSM is the trading name used by the members of the RSM network. Each member of the RSM network is an independent accounting and consulting firm each of which practises in its own right. The RSM network is not itself a separate legal entity of any description in any jurisdiction. The RSM network is administered by RSM International Limited, a company registered in England and Wales (company number ) whose registered office is at 11 Old Jewry, London EC2R 8DU. The brand and trademark RSM and other intellectual property rights used by members of the network are owned by RSM International Association, an association governed by article 60 et seq of the Civil Code of Switzerland whose seat is in Zug. RSM UK Consulting LLP, RSM Corporate Finance LLP, RSM Restructuring Advisory LLP, RSM Risk Assurance Services LLP, RSM Tax and Advisory Services LLP, RSM UK Audit LLP, RSM Employer Services Limited and RSM UK Tax and Accounting Limited are not authorised under the Financial Services and Markets Act 2000 but we are able in certain circumstances to offer a limited range of investment services because we are members of the Institute of Chartered Accountants in England and Wales. We can provide these investment services if they are an incidental part of the professional services we have been engaged to provide. Baker Tilly Creditor Services LLP is authorised and regulated by the Financial Conduct Authority for credit-related regulated activities. RSM & Co (UK) Limited is authorised and regulated by the Financial Conduct Authority to conduct a range of investment business activities. Whilst every effort has been made to ensure accuracy, information contained in this communication may not be comprehensive and recipients should not act upon it without seeking professional advice RSM UK Group LLP, all rights reserved London Borough of Southwark Schools Audits Summary of Key Themes to / Page 13