INTERNAL AUDIT FINAL REPORT. Project Management. June 2013

Transcription

1 Broxbourne Borough Council Contract Audit Project Management APPENDIX E INTERNAL AUDIT FINAL REPORT Project Management June 2013 Ref 18.12/13 June 2013 Page 1

2 Broxbourne Borough Council Contract Audit Project Management CONTENTS Section PAGE 1 Introduction 3 2 Background 3 3 Executive Summary 4 4 Conclusion Implementation of Agreed Recommendations 5 6 Acknowledgement 5 7 Management Action Plan 6-12 Appendices A Assurance Definitions 13 B Project sample 14 C s interviewed 15 June 2013 Page 2

3 Broxbourne Borough Council Contract Audit Project Management 1. Introduction 1.1 As part of the agreed 2012/13 Internal Audit Plan we have reviewed the processes and controls in place with regard to project management throughout the Council. 1.2 For the scope, objectives and methodology please refer to the Terms of Reference previously issued. 1.3 It is intended that the report will be presented to the next Audit Committee. The implementation of the recommendations will be monitored with a follow up review in six months time. Agreed recommendations that remain outstanding at the time of the follow up will continue to be tracked through a separate report to and the Audit Committee. 2. Background 2.1 Project management processes within Broxbourne Council have not been the subject of an audit in the past. Whilst IT projects have been flagged up as a high risk on the corporate risk register, this audit was scoped to review project management practices across the Council. 2.2 For the purposes of this audit, the definition of a project has been taken to be a unique set of co-ordinated activities, with definite starting and finishing points, undertaken by an individual or team to meet specific objectives within defined time, cost and performance parameters. 2.3 The Council s internal inter-disciplinary group (IDG), chaired by the Chief Executive, considers a schedule of Council projects and receives verbal updates from the lead officer on specific projects of importance to the Council and the community. A review of the remit of IDG is in progress. The review will also look at which projects will be monitored by the group and will consider the recommendations made in this review. 2.4 Capital projects are required to be supported by a business case before they receive funding. As part of the capital process, a quarterly monitor is produced that reviews large spend projects across the Council. This monitor has recently been extended to include details of slippage in projects and a more explanatory narrative around each project. 2.5 The audit approach adopted was to use a checklist to conduct a high level review. This checklist was applied to four current projects to understand current project management processes across the Council. In addition, key officers responsible for project management and delivery were interviewed over the course of the audit. 2.6 Projects reviewed and officers interviewed as part of this audit are set out at Appendices B and C. June 2013 Page 3

4 Broxbourne Borough Council Contract Audit Project Management 3. Executive Summary 3.1 An assessment of each of the control objectives reviewed is summarised in the table below: Control Objective 1. The corporate framework encourages effective project management. Each project is justified through an effective business case that sets out the aims and benefits to the Council of the project. Fully met Largely met Partly met Not met 2. An efficient and effective change control process is utilised, with key stakeholders kept informed. 3. Responsibility for deliverables, monitoring, reporting on actions and outcomes (as well as ensuring available resources) has been defined and helps meet the project s objectives. 4. Project risks are identified and appropriate mitigation occurs through the life of the project. 5. Projects are completed to budget and within agreed time frames. Post project reviews ensure stakeholder satisfaction with the project and lessons are learnt for future projects. 3.2 This report contains eleven recommendations. Of these eleven, two are fundamental, seven are significant and there are two recommendations that require attention. These recommendations should help improve control and address risks. 4. Conclusion 4.1 The overall audit opinion is that limited assurance can be given concerning the effectiveness of management s controls in meeting the objectives of the system. Our opinion is based on the evaluation of controls and testing of their effectiveness for the sample of four projects examined. 4.2 The key findings from the review are as follows: There is no formal project management guidance for project managers. This has resulted in different approaches to project management being prevalent throughout the Council. Important aspects such as risk management and change control are therefore not as well embedded in the process as best practice would expect. Development of any guidance needs to recognise the different requirements for managing low and high cost projects. There is evidence that joined up working between departments occurs for the majority of projects. It was found that officers are aware of both internal and June 2013 Page 4

5 Broxbourne Borough Council Contract Audit Project Management external stakeholders affected by a project, for which early consultation and changes in project status are delivered promptly. There is the need to establish a control/monitoring forum at senior management level to scrutinise and challenge the project management process. Whilst the IDG provides a forum for the formal discussion of Council projects at the corporate level, it does not provide rigorous monitoring and scrutiny of individual projects through out the project life cycle. Most emphasis is placed at the pre-project planning stage rather than rigorous monitoring once the project is under way and through to completion. There is scope to improve the challenge to project completion by developing a project monitoring procedure which could be a function of either this group or alternatively creating a group to take on this role, such as a capital monitoring group. There is a lack of formal review at the end of each project as to the success against its stated objectives and deliverables. Some examples of post project reviews had been carried out and were available at the time of the audit in respect of photovoltaic cells and neighbourhood projects. Existing officer groups could add more rigour by assisting in the peer review and scrutiny of completed projects. There is a need to ensure that risk management is embedded in the project process throughout the life of the project. The use of Microsoft Project software could be considered to ensure effective project management across the Council. 4.3 The audit report highlights areas of risk. These should be added to the current corporate and departmental risk registers as necessary and appropriate mitigating action taken. This will aid in the risk management process, help inform management decisions and assist with future audit plans. 5. Implementation of Agreed Actions 5.1 All of the recommendations in the report have been discussed with and will be taken forward through this forum. There is audit time allocated in the 2013/14 audit plan to follow through with the recommendations raised in this report and look at other aspects of project management. 6. Acknowledgement 6.1 We would like to thank all of the staff involved for their help and co-operation during the course of this audit. June 2013 Page 5

6 7. Management Action Plan Ref Observation Risk Category Recommendation Manager Comments 1 Through discussions with officers responsible for project management, it was clear that processes followed for project management differ throughout the Council. Ineffective project delivery through an individualistic approach to project management. Fundamental We recommend that the Council devises a corporate framework that would assist project managers in their role and ensure a consistent approach to project management. A draft framework had been produced by the Head of Personnel & Payroll in 2009 (as a guide) but was not formally adopted. Concerns were raised about project effectiveness and strain on resources if any corporate guidance was too in depth and inflexible. The need to manage project risk (refer to recommendations at reference 2) and change control should be included within any devised framework. From discussions with project officers, the developments at Grundy Park and Cedars Park showed good examples of this. To compare, the Council s procurement guidance is split into a high and low level procurement. The lower level guidance is generally more This could be split into a high and low cost project checklist in order to; Ensure objectives and key deliverables are identified early in the projects design. That an effective methodology for project delivery is available e.g. use of project milestones. Produce a document that acknowledges the breadth of project that is managed throughout the Council and allows a degree of flexibility. Ensure that a consistent approach towards identifying risk and the use of change control is used throughout the organisation. The Head of Projects is revisiting the methodology proposed by the Head of Personnel and Payroll in 2009, to ensure it has more of a focus as to how project management should be undertaken at Broxbourne. During 13/14 A Cuffaro Head of Projects June 2013 Page 6

7 Ref Observation Risk Category Recommendation Manager Comments flexible than high level. A similar approach here may be useful. A checklist of expected project documents and key milestones should help project officers to apply a consistent approach. Through officer discussions it was apparent that there was some confusion as to the extent and the responsibilities that this lead role encompasses. Lead officers do not understand or perform their role adequately, which could jeopardise the success of projects. Significant We recommend that as part of a corporate framework, the Lead role for projects is clarified, to ensure officers are aware of their wider responsibilities. Whilst lead officer is generally meant to mean project manager, this is to be clarified as part of the revamped project management guidance stated in the above recommendation. During 13/14 From projects reviewed and through officer discussion, it was evident that responsibilities and accountabilities are not always defined at the start of the project. A Cuffaro Head of Projects There is a risk that where projects overlap with other departments, relevant officers are not involved or consulted until the latter stages of the project. 2 Post project procedures were discussed with lead officers as well as a number of officers who have responsibility for projects. Completed projects do not meet specifications. Fundamental We recommend that at the end of each project a formal review of the success of the project against its objectives and deliverables is undertaken by the project manager The remit for the Council s IDG is being reviewed. Within each meeting there is to be a greater focus on the constructive challenge June 2013 Page 7

8 Ref Observation Risk Category Recommendation Manager Comments and formally signed off as complete. A review of the completed project to the initial specification is not always undertaken. to projects as well as ensuring that there is a formal post project review at the end of completed projects. June 2013 As part of the officer led interdisciplinary group (IDG), project officers will notify the group upon project completion. The completed project is added to a completed projects list. However, this does not constitute a formal and rigourous debrief and assessment against original objectives. However, there is no requirement for a formal review to be undertaken by the project manager as to the success of the project in meeting its objectives. June 2013 Page 8

9 Ref Observation Risk Category Recommendation Manager Comments 3 From discussions with project officers, key risks and issues that have affected project delivery are not always recorded or brought to wider attention. Issues that have impeded project delivery are not communicated. Significant We recommend that consideration be given to establishing a central log of risk and issues arising from projects, as an extension to current corporate and departmental risk registers. As part of the changes to IDG, key issues relating to Council projects are to be discussed in a more open forum. Evidence of the appreciation of risk was found for a number of high priority and high value projects i.e. Grundy Park. With the informal arrangements for monitoring risk, there is a danger that mistakes/issues with a project will not be communicated to officers undertaking similar projects in the future. This would allow project officers to understand relevant issues when conducting similar projects. It is planned to keep an up to date log of the main risks and key issues arising from projects. The Treasury, Insurance & Risk Manager is to be consulted during this process. During 2013/14 A Cuffaro Head of Projects Through discussions with project officers, it is clear that a formal process for capturing and monitoring project risk(s) is not widespread. Project risk management is in most cases, undertaken informally and does not always take place throughout the life of the project. Risks throughout the project are not monitored or mitigated against. Significant We recommend that more gravitas should be given to project risk. Business cases could require more formal risk assessment and mitigating actions to risk should be identified and monitored throughout the life of the project. With the changes as to how future IDG meetings are to be run, there is to be greater scrutiny and challenge throughout the life of a project. Project risks will be discussed more openly by the group, with greater scrutiny of initial project proposals. During 2013/14 June 2013 Page 9

10 Ref Observation Risk Category Recommendation Manager Comments 4 During 2011, a course on project management was run internally to highlight issues pertinent to Council projects. Attendees were mainly Directors and Heads of Service. Training courses do not cover important project management issues nor are attended by those with project lead Significant We recommend that the Council s internal training on project management covers project risk and is attended by those with project management responsibilities. responsibilities. Not all officers who have responsibilities for projects have attended this training. The Head of Projects has been asked to lead on producing a training course that meets the needs of the Council s project managers. The new Lead for Corporate Projects & Community Planning will assist in this training development. During 2013/14 It was not clear as to whether project risk was included as part this training. Consequentially, Council officers who are responsible for projects may not have been given the necessary skills to effectively carry out their duties. A Cuffaro Head of Projects A training course on project management was run by Wiz Training and Development and was attended by two ICT officers in December This was pitched at the beginner/intermediate level as an introduction to project management. Training is not attended or relevant to the needs of the Council s project managers. Significant We recommend that the Council ensures that its officers have access to project management training relevant to their experience and needs, before undertaking projects for the Council. Refer to above comments. Attendance on a project management training course relevant to their needs should June 2013 Page 10

11 Ref Observation Risk Category Recommendation Manager Comments be a pre-requisite for officers who have responsibilities for delivering projects. 5 Internal Audit attended a meeting of the officer led Interdisciplinary Group (IDG) to observe how the group functions and deals with key projects. The officer group is made up of the CEO (chair), directors and heads of service with project delivery responsibilities. A schedule of key projects is worked through at each meeting, with explanations for delays and the rectification of outstanding issues, sought. With the officers that attend and the matters discussed, potentially, this group is best positioned to formally challenge and to review completed Council projects. groups do not provide sufficient challenge and review of Council projects. Significant We recommend that a senior officer group should take on the remit for providing a rigourous monitoring process for Council projects. This could be an existing group such as the IDG or IT group, or a new group, such as a capital monitoring group. Terms of reference should be developed once an appropriate forum has been identified. IDG has been designated as the forum to give greater challenge and scrutiny to the Councils projects. The IDG is undergoing a revamp to ensure it offers greater support and challenge to the Council s projects. Whilst it is still a work in progress, some changes to the agenda and schedules have already been made. June 2013 At present the role of IDG does not expressly relate to project monitoring and review. 6 The detailed aspects of monitoring a project outside of its financial management, does If major projects are not rigorously monitored then Significant We recommend that a more structured project review process should be developed for use at the During 2013/14 June 2013 Page 11

12 Ref Observation Risk Category Recommendation Manager Comments not have a specific forum they may not meet designated for its discussion. their objectives. Whilst progress reports are given by project officers to IDG, peer review of progress against milestones and deliverables is not undertaken. monitoring forum identified in recommendation 5 above. This process should be linked into the project review stage. A Cuffaro Head of Projects June 2013 Page 12

13 Appendix A Definitions of Assurance and Recommendation Priorities Levels of Assurance Full Substantial Moderate Limited No Recommendation priorities Fundamental Significant Requires Attention There is a comprehensive system of control designed to achieve the system objectives and manage the risks in achieving those objectives. No weaknesses have been identified. Whilst there is a largely sound system of control, there are some minor weaknesses, which may put a limited number of the system objectives at risk. Basically sound control, with areas of weakness, which put system objectives at risk. (Any fundamental recommendations will prevent this level of assessment.) There are significant weaknesses in key control areas, which put system objectives at risk. There are fundamental control weaknesses, leaving the system open to material error or abuse. Recommendations relate to major weaknesses, which present material risks to objectives and require urgent attention by management, and the Audit Committee. (immediate action) Recommendations relate to significant control weaknesses whose impact or frequency, present a risk which needs to be addressed by management within their areas of responsibility. Recommendations relate to control weaknesses whose impact or frequency needs to be addressed by management within their areas of responsibility and/or recommendations are considered to be best practice. Managers responsibilities managers should develop and maintain sound systems for governance, risk management and internal control, including measures to prevent and detect error and fraud. Internal Audit is not a substitute for this. We plan our work to identify significant control weaknesses and do not guarantee to detect error or fraud managers should not rely on our work to replace their own monitoring and vigilance. June 2013 Page 13

14 Broxbourne Borough Council Appendix B Contract Audit Project Management Projects reviewed Project Department 12/13 Budget Cheshunt Park Golf Club Bore Hole Community Services Date of Original Request 40k 24k deferred from 2006/7. Concurrence for additional funding 2010/11 in Total Spend to date 34.6k Estimated Date of Completion Not detailed within the concurrence. Actual Date of Completion November 2012 West Cheshunt Skate Park Community Services and BLMSO 117k 100k in 2011/12 capital programme carried forward into 12/13, with additional funding given during 12/ k During 2012/13 April 2013 Telephone Migration (Telephony) Computer Services 95k 95k in 2012/13 capital programme 95k December 2012 In progress Theobalds Lane Footpath (cycle-way) Resources 8k Concurrence from 2009/10 7.5k Not detailed within the concurrence. March 2013 June 2013 Page 14

15 Broxbourne Borough Council Contract Audit Project Management Appendix C s Interviewed Environmental Manager Dave Renouf Golf Club Manager Louise Sanderson Community Development Manager Steve Whitlam Head of Computer Services Janice Brooks ICT Consultant Matt Such Asst Director of Property Services Roland Childerhouse Strategy & Projects Manager Clare Watson Special Projects Co-ordinator Richard Grove Treasury & Insurance Manager Chris Wybrew June 2013 Page 15