Report 7 Appendix 1d Final Internal Audit Report Sundry Income and Debtors (inc. Fees and Charges) Greater London Authority February 2010

Transcription

1 Report 7 Appendix 1d Final Internal Audit Report Sundry Income and Debtors (inc. Fees and Charges) Greater London Authority February 2010 This report has been prepared on the basis of the limitations set out on page 19.

2 Contents Page Executive Summary 3 Observations and Recommendations 9 Appendix 1 Audit Framework 17 Appendix 2 - Staff Interviewed 18 Statement of Responsibility 19 This report and the work connected therewith are subject to the Terms and Conditions of the contract dated 20/06/2007 between Greater London Authority and Deloitte & Touche Public Sector Internal Audit Limited. The report is produced solely for the use of Greater London Authority. Its contents should not be quoted or referred to in whole or in part without our prior written consent except as required by law. Deloitte & Touche Public Sector Internal Audit Limited will accept no responsibility to any third party, as the report has not been prepared, and is not intended for any other purpose.

3 Executive Summary Introduction and Background 1. This audit forms part of the 2009/10 Internal Audit plan, which has been approved by the Mayor and the Audit Panel. 2. Section 12 of the Financial Regulations designates responsibility to the Executive Director of Resources to establish effective and properly controlled procedures to support the recovery of income due to the GLA arising from work done, goods supplied or services rendered and not paid for at the time of delivery. 3. Day to day responsibility for administering the GLA s Income and Debtor system is performed as part of the Exchequer Services. One Finance Officer is responsible for the raising of sales invoices and the recovery of outstanding debt and the Exchequer Team is responsible for cash and banking and receipting of debtor income. 4. The total amount raised on sales invoices between April and October 2009 amounted to 9,791,092.44, and cash and BACS receipted (paid) amounted to 9,337, The difference of approximately 450,000 represents the value of invoices raised during this period that remain unpaid as at 13 October During the time period between April and December last year, the difference was approximately 3.9m. This shows that a large improvement has been made on recovering late payments and outstanding debt since As of 2 October 2009, the total outstanding balance of income due was 915, In December 2008 it was 7,094, Consideration of the forthcoming implementation of SAP and transfer of the Exchequer Services to Transport for London (TfL) in December 2009 has been taken when raising recommendations following the audit of the Income and Debtors system. 7. Samples of prime source documents pertaining to the financial year 2009/10 were selected and tested to evaluate the effectiveness of the controls in operation. A summary of the findings is contained within the following paragraphs. Policies and Procedures 8. The accounting policies and procedures for the GLA are set out in the Authority s Finance Manual and Financial Regulations. The Finance Manual was last updated in October 2009, and the Financial Regulations in January Section 16 of the Financial Regulations state the policy for income, in particular the proper recording of all sums due to the GLA, and the prompt and proper accounting for all cash including its collection, custody, control and deposit. 10. The Debtor Financial Procedure notes provide a documented and comprehensive guide to support the administration of the GLA s income and debtor arrangements, however these have not been updated since Although the procedure notes exist for the Financial Services staff, there is no guidance for GLA staff members. The Finance Manual and Regulations outline a high level procedure, but does not for example include details such as; how to raise the invoice, what information to request from the customer (to record on the SIRF), that income should be charged Report 7 Appendix 1d page 3

4 according to the fees and charges schedule, criteria for cancelling an invoice and so forth. 11. In addition, no procedure notes are in place relating to cash, banking and receipting. 12. All relevant forms (sales invoice request forms and cancellation forms) are available on the Intranet, including the Finance Manual, Financial Regulations and Fees and Charges Policy and Schedule. However, within the Financial Regulations (section 16 for Income), no reference has been made to the Fees and Charges Policy and Schedule. 13. Due to the upcoming implementation of SAP, a combined recommendation regarding the review and implementation of procedures has been raised. Two recommendations have been made following our review of this area. Invoicing 14. Primarily it is the responsibility of GLA staff who are involved in providing or selling goods and services to the public or other organisations, to ensure that income due to the GLA is promptly notified to the Exchequer Services Section via the completion of a Sales Invoice Request Form (SIRF). This form provides the necessary details required to support the completion and raising of a sales invoice. 15. Tests were performed on a sample of 20 sales invoices between April and October 2009, to provide assurance that SIRFs were submitted to the Exchequer Services in a timely manner and processed within the target of 5 working days. Testing found that the corresponding SIRFs were complete with all relevant details and they were arithmetically correct based on the quantities and costs recorded. 16. It was also found that two of the 20 raised invoices had not been processed within the five working day target and two could not be verified as there was no stamp date. It was confirmed with the Finance Officer that whilst all invoices were supported by an appropriate SIRF, in which all fields were populated, some further information may have been needed from the originator. This would have further delayed the raising of the invoice and also the payment made by the customer. This has been raised as part of recommendation one. 17. Testing of ten new customer accounts was selected from April to October It was found that all ten accounts had an authorised customer account code control form that was prepared by the Finance Officer, authorised by Senior Management (either by the Head of Financial Services, Chief Accountant or Principal Accountant) and input onto Open Accounts by the Senior Finance Assistant. 18. Five credit notes were tested and it was established that each was supported by an internal memo requesting and authorising the cancellation of an invoice via a sales invoice cancellation form (SICF). However, it was found that for one out of the five credit notes tested, two related invoices with a total sum of 26,995 were cancelled. Credit notes should only be processed if the details on the sales invoice are incorrect i.e. the amount, customer details etc. No backing documentation had been retained by Financial Services and the reason stated on the SICF was insufficient, simply stating 'the invoice will not be paid'. In accordance with the Financial Regulations, it would appear that the income due from these invoices should have been written off. 19. Furthermore, additional testing was performed on the 20 samples previously mentioned to determine whether they had been raised in accordance with the Fees Report 7 Appendix 1d page 4

5 and Charges Policy and Schedule. The Policy was last reviewed in March 2006 and the Fees and Charges schedule is updated on an annual basis. Testing found that for one recharge, no evidence could be obtained for the agreed cost. For one other sample, no evidence could be provided of how the charge was costed. We were informed by the requesting officer that the same price has been charged for approximately five years and has not been reviewed since. Two recommendations have been made following our audit of this area. Cash and Banking 20. All cash and cheques received by the Authority are held in a secure cabinet within the Financial Services office area. If cheques are received by Facilities Management (for room hire) or other departments, we were informed that they are passed on to Financial Services as soon as possible (and the same day). In addition to the cabinet drawers being locked, there is also a metal bar across the drawers (also locked) that acts as a double safety guard. The cabinet keys are kept in a locked key box, and the key to the key box is retained by two Finance Officers (if one is sick or on annual leave) responsible for cash and banking. 21. It was confirmed that there are three Finance Officers (previously four) responsible for cash and banking. The Officers are responsible for matching payments received to sales invoices and recording this onto Open Accounts, and banking the cheques and cash received on a regular basis. This helps to ensure continuity. We were unable to test the segregation of duties between recording cash and cheque receipts and the banking of the income due to a lack of documentary evidence. Whilst we were assured that these processes are generally performed independently by different officers, we recommend that such duties be clearly segregated. 22. In addition, appropriate documentation is stamped and referenced and retained on file as part of the receipting process described below. However, it was identified that there is only one officer present when opening the post, who then distributes any cash received to the officers responsible for recording cash and cheque income, and banking this income. The issue was discussed with the Chief Accountant and Finance Manager and the level of risk this leaves was acknowledged and accepted. Therefore, no recommendation has been raised. 23. Following discussion with the Finance Officer and review of the paying in slips, it was found that cash is banked on at least a weekly basis. The frequency of banking is considered by the Chief Accountant as reasonable given the frequency of receipts. Review of the cash held in the locked cabinet as of 14/10/09 found that there was a total of 20, in cheques and held in cash. One recommendation has been made following our audit of this area. Receipts 24. The identification of payments is performed in a number of ways. Matching is the term used when a payment has been received and it can be matched to the correct sales invoice and subsequently recorded onto Open Accounts. Where cash or cheques have been received, they are generally accompanied with the remittance advice returned by the customer allowing the sales invoice to be easily identified. Subsequently, the Finance Officers will photocopy the cheque and receipt stamp Report 7 Appendix 1d page 5

6 the document to confirm when it was received. The stamp records the receipt number, date, customer code, amount, and cheque number. 25. With cheques, an additional record is completed on the customer s account on Open Accounts, to record that their payment has been received. A customer log number is then generated by the system and is used as the receipt number. This is retained on file with a photocopy of the cheque or remittance advice. 26. If no remittance advice is provided when a payment is received, for example when received through Banker s Automated Clearing Services (BACS), the correct sales invoice will have to be located. This is achieved by performing a search on Open Accounts, either by amount or customer name. When the correct sales invoice is identified, the payment is matched and the system generated BACS reference number is used as the receipt number. 27. The Exchequer Team perform weekly checks on bank statements to identify income received. Since the 2008/09 Income and Debtors audit, the reminder letter has been amended to include a request that the sales invoice number is quoted when paying by BACS and that a remittance advice is returned with the payment. 28. A sample of 20 invoices was tested to confirm whether the payments received had been allocated to the appropriate invoices, expense codes and customer codes. Audit testing found that for all invoices, where payment was received, it had been correctly identified to the invoice and the correct customer account had been matched onto Open Accounts. Testing also found that each invoice payment had a matching receipt. Audit testing found that four of 20 invoices tested did not have an admittance advice provided (as provided by the customer and which did not exist due to being paid by BACS), therefore the transaction on the bank statement was receipt stamped and used as the receipt. However, two of these did have an from the customer stating that payment had been made and should be received shortly. No recommendations have been made following our review of this area. Reconciliations 29. Monthly reconciliations between the sales ledger and general ledger are performed by the Finance Manager, who is independent of allocating payments to accounts and raising sales invoices. Any variances are reconciled in order to allow the accounts to be closed on a monthly basis. The reconciliation papers are signed and dated by the Finance Manager. 30. Monthly bank reconciliations are prepared by the Senior Finance Assistant, certified by the Finance Manager and signed off by the Chief Accountant or Principal Accountant. None of these members of staff are involved in raising sales invoices. Where the closing balances do not reconcile, these are investigated and recorded in separate reports for supporting evidence. Following adjustments made, the closing balances reconciled. No recommendation has been made following our review of this area. Write-offs 31. There is a basic policy for write-offs contained in the approved Financial Regulations, which are available on the GLA Intranet. The policy highlights the levels of authority required to write off debts depending upon the value. Report 7 Appendix 1d page 6

7 32. The Head of Financial Services may authorise the writing off of sums owed by a single debtor up to 25,000. Sums between 25,000 and 50,000 require the approval of the Executive Director of Resources and sums above 50,000 require the approval of the Mayor. 33. During 2009/10 no income had been written off as at the time of audit. However, the sales invoices to be written off have been agreed between the Chief Accountant and the Finance Officer for approximately 65,000. The invoices and values have been recorded in a central database and will be written off once a Director s Decision (DD) form has been finalised and approved by the Executive Director of Resources. 34. No debts have been written off in the 2009/10 financial year. This was informed by the Chief Accountant and also verified on Open Accounts when a search on write offs was performed. No recommendation has been made following our review of this area. Recovery of Outstanding Debts 35. Aged debtor reports are produced on a monthly basis by the Finance Officer and are reviewed by the Chief Accountant. In addition, quarterly meetings are held between the two officers to discuss any issues with the system, outstanding debts, debts to be written off and to agree any actions. 36. As at the 2 October 2009 there was an outstanding balance of 915,905.87; 524, of this is for invoices overdue by more than 121 days. This is a significant reduction compared to December 2008 figures of 7,094, The aged debtor reports show the number of days the debts have been outstanding, i.e. 30 days, 60 days, 90 days, and over 121 days. 38. Reminder letters are sent to customers once payments are overdue by 30 days, 45 days and over 60 days. 39. A report is run monthly from Open Accounts, generating reminder letters for outstanding debts. The age of the debt will determine which letter is generated for that particular debt. First reminder letters are generated for debts which are between 30 and 45 days over their due date; second reminder letters are generated for debts which are between 45 and 60 days over their due date; and final reminder letters are generated for debts which are more than 60 days overdue. 40. During the 2008/09 Income and Debtors audit it was agreed that the lack of reminder letters being sent was due to the customer account settings on Open Accounts. However, since then all customer accounts have now been set up to receive correspondence and exceptions are still being evidenced. Further analysis of the system found that as the late payment reports are run on a monthly basis there is potential for a debtor not to receive all reminder letters. If a debt becomes overdue shortly after the first report is run, this will mean that the debt is more than 30 days old when the following month s report is run. This will result in a second reminder letter being sent rather than a first reminder letter as the debt will now be more than 45 days overdue. 41. Since the 2008/09 Income and Debtors audit it has been found that no progress has been made in implementing an escalation process for significantly overdue payments. There is currently no escalation process as plans are still being discussed with the Executive Director of Resources. We were informed that Report 7 Appendix 1d page 7

8 discussions are now taking place with TfL regarding who will be the responsible party with regards to the legal involvement and will be included in the Service Level Agreement (SLA) between the two parties. One recommendation has been made following our review of this area. Audit Opinion Substantial Assurance Evaluation Opinion: While there is a basically sound system, there are areas of weakness which put some of the system objectives at risk Testing Opinion: There is evidence that the level of non-compliance with some of the controls may put some of the system objectives at risk. Report 7 Appendix 1d page 8

9 Observations and Recommendations In order to assist management in using our reports: We categorise our opinions according to our assessment of the controls in place and the level of compliance with these controls Full Assurance Substantial Assurance Limited Assurance No Assurance There is a sound system of control designed to achieve the system objectives and the controls are being consistently applied. While there is a basically sound system, there are areas of weakness which put some of the system objectives at risk, and/or there is evidence that the level of non-compliance with some of the controls may put some of the system objectives at risk. Weaknesses in the system of controls are such as to put the system objectives at risk, and/or the level of non-compliance puts the system objectives at risk. Control is generally weak, leaving the system open to significant error or abuse, and/or significant non-compliance with basic controls leaves the system open to error or abuse. b) We categorise our recommendations according to their level of priority. Priority 1 Priority 2 Priority 3 Major issues for the attention of senior management. Other recommendations for local management action. Minor matters. Report 7 Appendix 1d page 9

10 Policy and Procedures 1. Debtor Financial Procedures (Priority 2) Recommendation Rationale The Service Level Agreement between the GLA and TfL should include clear and comprehensive policies relating to: Debtors and Credit Management, including the target for raising sales invoices and cancellation of sales invoices; Write Off Policy; and Income, including cash, banking and receipt of income. Management response: Chief Accountant Policies relating to income and credit management should be outlined in the SLA with TfL to help ensure that all staff are aware of the processes to ensure that income due to the GLA is notified in a timely manner and invoices are raised, received, and where necessary that it is written off appropriately. During the audit, it was identified that: Debtor Financial Procedure notes have not been updated since 2006; the Financial Regulations do not sufficiently detail the policies and procedures regarding receipt of income, raising sales invoices and cancelling/writing off debt; Two out of 20 sales invoices were not raised within the 5 day target; and there is no reference to the Fees and Charges Policy and Schedule. There is an increased risk of income being received late, and financial loss to the GLA, where staff are not aware of the processes and this results in delays in raising invoices. Practices may not be consistent across the GLA and in compliance with policies if procedures are not up to date. Agreed. This has already been addressed in the SLA between the GLA and TfL. Deadline: Completed. Report 7 Appendix 1d page 10

11 2. Internal Procedure Notes (Priority 3) Recommendation Internal procedure notes should be developed and communicated to all staff detailing what steps should be taken in the event that cash or cheques are received by departments. Rationale Management response: Chief Accountant Agreed. A procedure note will be issued to relevant staff. Deadline: May Communicated procedure notes will help to ensure that all staff are aware of the procedures and that all cash and cheques received by departments is forwarded to Financial Services to be processed. It will also help to ensure that all cash has been accounted for. It was found that detailed cash and banking procedures are not included within the Income section of the Financial Regulations. There is an increased risk that payments made by customers to the GLA do not get recorded. This may result in reputational damage and dissatisfied customers if payments are chased that have already been paid. Report 7 Appendix 1d page 11

12 Invoicing 3. Fees and Charges Policy (Priority 2) Recommendation Rationale The Fees and Charges Policy should be reviewed and updated accordingly. The Policy should make reference to the Fees and Charges Schedule and the Sales Invoice Request Form. In addition, the following should also be included: The policy and procedures with regards to recharging services should be outlined; Review and update of any relevant departmental fees and charges schedules; Documentation to support the services charged should be retained; and The SIRF should include the Purchase Ledger Invoice Number (PLIN) the recharges refer to (to help ensure a clear audit trail) Management response: Chief Accountant An up to date Fees and Charges Policy will help to ensure that the services provided by the GLA are fairly and consistently priced to all customers and clients and if communicated, that staff are aware of the procedures when raising sales invoices. Testing of 20 sales invoices across Directorates found that for one recharge, no evidence could be obtained of the agreed cost. For one other sales invoice, no evidence could be provided of how the invoice was costed; it was confirmed by the requesting officer that the same price has been charged for approximately five years and has not been reviewed since. Where charges are not reviewed on a periodic basis and there is no evidence of how services are costed, there is an increased risk that prices are not in line with the market and may not reflect the cost to the GLA of service provision. This may lead to the GLA losing out on potential income. Agreed that the policy will be reviewed and updated to include reference to the Fees and Charges schedule, sales invoice request forms and recharging of costs. Deadline: June Report 7 Appendix 1d page 12

13 4. Cancellation of Sales Invoices (Priority 2) Recommendation The procedure for cancelling sales invoices should be documented and communicated to all GLA staff. Internal procedure notes for staff should detail the criteria in which sales invoices can be cancelled, and that where the criteria falls outside of this, the income should be written off. The Sales Invoice Cancellation Form (SICF) should clearly state the reason why the sales invoice can be cancelled, and that in doing so they have complied with any SLA's, authorisation levels, and Financial Regulations. Rationale Management response: Chief Accountant Internal guidance or procedure notes regarding the cancellation of sales invoices would help to ensure that income due to the GLA is not cancelled inappropriately. Testing of five credit notes found that one had been inappropriately cancelled. The credit note related to two invoices with a total sum of 26,995. No supporting documentation had been retained by Financial Services and the reason stated on the SICF provided little explanation. It is possible that the income due from these invoices should have been written off in accordance with the Financial Regulations. There is an increased risk that sales invoices are cancelled inappropriately if the policy and procedures in question are inadequate and/or not adhered to. Agreed. The procedure note to relevant staff will include the criteria for the cancellation of invoices. Deadline: May Report 7 Appendix 1d page 13

14 Cash and Banking 5. Segregation of recording and banking (Priority 3) Recommendation There should be clear segregation of duties between officers responsible for recording and banking cash and cheque income. Rationale Management response: Chief Accountant Segregating the recording and banking of income helps to ensure that the risk of misappropriation is reduced. There are three Finance Officers responsible for cash and banking. The Officers are responsible for matching payments received to sales invoices and recording this onto Open Accounts, and banking the cheques and cash received on a regular basis. We were unable to test the segregation of duties between recording cash and cheque receipts and banking. Without a clear segregation of duties, there is an increased risk of misappropriation of income. Not applicable. All cheques are now sent directly to TfL's Financial Services Centre for banking. Deadline: Completed. Report 7 Appendix 1d page 14

15 Recovery of Outstanding Debts 6. Outstanding Debt Procedures (Priority 1) Recommendation The policy on recovering outstanding debts should be included in the Service Level Agreement with TfL (including the escalation process for recovering outstanding debts, and responsibilities for recovery of debts). The policy should ensure that reminder letters are sent in a timely and consistent manner. For example, reminder letters should be processed the day the sales invoice is overdue and the same for the second and final reminder. The assurance requirements of the GLA regarding the recovery of outstanding debts should be included in the SLA. Rationale In order to help ensure that outstanding debts are being recovered effectively, the customer should be informed of the overdue payment in a timely manner and be reminded in accordance with the Credit Management Policy. Testing of 20 outstanding debts between April and September 2009 found that reminder letters were not being sent out in a consistent manner, and there was no evident escalation process in place for recovering significantly aged debts. For example: 7/17 first reminder letters had not been sent. 17 samples were reviewed as three were not applicable (less than 30 days late); 6/14 second reminder letters had not been sent. 14 samples were reviewed as six were not applicable (less than 45 days late) and 2/6 were due to be sent in the October batch; and 9/13 final reminder letters had not been sent. 13 samples were reviewed as 7 were not applicable (less than 60 days late) and 5/9 were due to be sent out in the October batch. In addition, there were three occasions where a second reminder was sent out and there is no evidence that an initial reminder was sent. On one occasion a final reminder was sent out and there is no evidence of either a first or second reminder having been sent out previously. There are two occasions where no documentation can be located for debts which should have had two reminder letters sent out. Where the procedures for recovering outstanding debts are not robust and are inconsistently applied, there is an increased risk that debts will not be recovered in a timely manner. Furthermore, future business with existing customers could be lost if they believe they have not been treated fairly and where the GLA have not communicated outstanding debts in accordance with the Financial Regulations. Report 7 Appendix 1d page 15

16 6. Outstanding Debt Procedures continued. Management response: Chief Accountant Reminder letters will continue to be issued by TfL under the SLA with the GLA. Deadline: Completed. Report 7 Appendix 1d page 16

17 Appendix 1 Audit Framework Audit Objectives The audit is designed to provide assurance to management over the adequacy and effectiveness of the Authority s controls over income recording and collection. Audit Approach and Methodology The audit approach was developed with reference to the Internal Audit Charter and by an assessment of risks and management controls operating within each area of the scope. The following procedures were adopted: identification of the role and objectives of each area; identification of risks within the systems, and controls in existence to allow the control objectives to be achieved; and evaluation and testing of controls within the systems. From these procedures we have identified weaknesses in the systems of control, produced specific proposals to improve the control environment and have drawn an overall conclusion on the design and operation of the system. Areas Covered Audit work was undertaken to cover controls in the following areas, to ensure that: The Authority has an approved fees and charges policy and procedure in place to ensure system objectives are achieved; All potential sources of income are identified and invoices are raised in a timely manner to ensure that the Authority receives the maximum income available (and in accordance with the approved Fees and Charges policy); All cash and cheque income received is held securely, banked intact, in a timely manner and processes are in accordance with communicated guidance (incl. appropriate segregation of duties); Receipts are credited to the correct account; The debtors control account is regularly and independently reconciled, and all reconciling items are appropriately cleared; and All write offs are valid, authorised and correctly processed; and Debt recovery procedures are instigated where necessary, and in accordance with procedural guidance. Report 7 Appendix 1d page 17

18 Appendix 2 - Staff Interviewed We would like to thank all staff that provided assistance during the course of this audit, and in particular: Chief Accountant Finance Officer Senior Finance Manager Senior Finance Officer Report 7 Appendix 1d page 18

19 Statement of Responsibility We take responsibility for this report which is prepared on the basis of the limitations set out below. The matters raised in this report are only those which came to our attention during the course of our internal audit work and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by you for their full impact before they are implemented. The performance of internal audit work is not and should not be taken as a substitute for management s responsibilities for the application of sound management practices. We emphasise that the responsibility for a sound system of internal controls and the prevention and detection of fraud and other irregularities rests with management and work performed by internal audit should not be relied upon to identify all strengths and weaknesses in internal controls, nor relied upon to identify all circumstances of fraud or irregularity. Auditors, in conducting their work, are required to have regards to the possibility of fraud or irregularities. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. Internal audit procedures are designed to focus on areas as identified by management as being of greatest risk and significance and as such we rely on management to provide us full access to their accounting records and transactions for the purposes of our audit work and to ensure the authenticity of these documents. Effective and timely implementation of our recommendations by management is important for the maintenance of a reliable internal control system. The assurance level awarded in our internal audit report is not comparable with the International Standard on Assurance Engagements (ISAE 3000) issued by the International Audit and Assurance Standards Board. Deloitte & Touche Public Sector Internal Audit Limited St Albans February 2010 In this document references to Deloitte are references to Deloitte & Touche Public Sector Internal Audit Limited. Deloitte & Touche Public Sector Internal Audit Limited is a subsidiary of Deloitte LLP, which is the United Kingdom member firm of Deloitte Touche Tohmatsu. Deloitte Touche Tohmatsu is a Swiss Verein (association), and, as such, neither Deloitte Touche Tohmatsu nor any of its member firms has any liability for each other s acts or omissions. Each of the member firms is a separate and independent legal entity operating under the names Deloitte, Deloitte Touche Tohmatsu, or other related names. Services are provided by the member firms or their subsidiaries or affiliates and not by the Deloitte Touche Tohmatsu Verein Deloitte & Touche Public Sector Internal Audit Limited. All rights reserved. Deloitte & Touche Public Sector Internal Audit Limited is registered in England and Wales with registered number Registered office: Hill House, 1 Little New Street, London EC4A 3TR. Report 7 Appendix 1d page 19