Internal audit plan 2014-15

Audit and Governance Committee Report Report of Head of Corporate Development Author: Joan Poole Tel: 01483 444854 Email: joan.poole@guildford.gov.uk Lead Councillor responsible: Nigel Manning Tel: 01252 665999 Email: nigel.manning@guildford.gov.uk Date: 26 March 2014 Internal audit plan 2014-15 Recommendations The Committee is recommended to (1) approve the audit plan for 2014-15 set out in Appendix 1 (2) approve the audit plan for the first half of 2014-15 set out in Appendix 2 and (3) note progress against the plan for the period October 2013 to March 2014 contained in Appendix 3. Reason for Recommendation: To ensure an adequate level of audit coverage. 1. Purpose of Report To present the draft audit plan for 2014-15 and the work programme for the first half of the year, which is extracted from the audit plan. This report also presents a calculation of the resources required for the proper audit of Council services. 2. Strategic Priorities 2.1 The audit of Council services supports the priority of providing efficient, cost effective and relevant quality public services that give the community value for money. 3. Background 3.1 We have based the plan on a risk assessment in line with best practice. We aim to audit the majority of services at least once every three years although we review the major systems annually. We update the risk assessment after each audit. 3.2 We base the audit planning process on an assessment of risk and the resources available. The audit plan is a balance between supply and demand 1

and is affected by unplanned events even though there is a contingency budget. The current audit resources are: In-house resources Contractor Total resources 3.2 FTE 0.50 FTE 3.7 FTE 3.4 We have to ensure that the level of audit coverage is sufficient to provide assurance on the overall standard of corporate governance. The planning process includes: 1. identifying the audit universe (all of the areas that require audit attention) 2. carrying out a risk assessment to identify the level of risk and the appropriate frequency of audit 3. an estimate of the resources required to carry out the audits 4. reviewing how we resource the plan 5. producing the audit plan based on the available resources. 3.5 The audit plan includes a certain amount of contingency to allow for unplanned work because the actual requirements will vary from year to year. We base the planned figure on records from previous years but it can only ever be an estimate. 3.6 Over the last few years, we have augmented in house the internal audit resources by employing a contractor. In 2013-14, we appointed RSM Tenon on a twelve month contract to carry out the fundamental systems work. During the year the contractor was taken over by Baker Tilly but the contract did not change and we retained our account manager for continuity. 3.7 Because of the amount of contingency work in the year, they have also carried out other audits and we have employed an experienced auditor for three months to ensure that planned work is covered. In 2014-15 we will be tendering for a new contract for a longer period or exploring options for a secondment. 3.7 The plan aims to cover areas that support the Council s strategic priorities, governance issues and financial probity. In addition, we have to reflect the recent changes within the Council. These changes bring both opportunities and challenges for us. Audit skills are relevant to many of the new initiatives across the Council and we have become involved in both lean and fundamental service reviews, which are part of the overall business improvement programme. While this is not traditional audit work it affords an in depth knowledge of the services that a purely systems audit would not always provide and is therefore an important source of information about the Council. This information feeds into the risk assessments. 2

3.8 We also need to be aware that there are increased risks in times of change. Over the last six months there have been significant changes in the Council structure. There is a new corporate management team and services have been merged under six new Executive Heads of Service posts. We have a new Corporate Plan and this will provide the focus for our activities over the next two years. There are also continuing financial pressures on the Council to provide value for money. This means being more efficient and effective and looking for innovative ways of working. The challenge for audit is to help services become leaner and more effective within a controlled environment. 3.9 Change and uncertainty does affect staff and increases the risk of system failure, the relaxation or circumvention of the expected controls and fraudulent activity. We need to ensure that the appropriate control measures are in place and applied consistently across all services. We also need to be sure that we have good governance arrangements in place and that we are operating within both the legal framework and our own protocols and standards. 3.10 In general the overall control framework within the Council is sound with sufficient controls in place to prevent significant loss but it would be wrong to ignore the changes that are taking place and how this affects people and systems. There is no evidence to suggest that there is a systemic problem but it would be wrong not to factor these into the risk assessments. 3.11 This is a challenging time for audit. We need to be proactive in helping services move forward, improve and achieve the desired outcomes of the Corporate Plan but we also need to ensure that effective systems of control are in place. 3.12 We will review the audit structure during 2014-15 to ensure that we have the right mix of resources to come up with the best solution for the future. 4. Audit Plan 2014-2015 4.1 The plan is extracted from the audit planning system and includes both the high risk annual audits and the overdue audits. The overdue audits are either low risk or have previously been subject to only a partial audit. 4.2 The audit plan for the year totals 790 days and is set out in Appendix 1. This figure represents the work schedule for internal resources (670 days) plus 120 days for the contractor, based on the current contract. 4.3 The resource calculation takes into account the total available time less time for annual leave, bank holidays, sick leave, training, appraisals and other nonrechargeable work. The figure for non-rechargeable works is based on previous experience (all members of internal audit complete timesheets therefore the estimates are reasonably accurate). We try to keep nonproductive time to a minimum and there is a monthly target of 90 per cent productive time for all audit staff. 4.4 The full year s plan is set out in Appendix 1 and the proposed work plan for the first six months of 2014-15 is in Appendix 2. The plans show the latest risk assessment based on the updated risk assessment. The risk ratings are as follows: 3

Risk score A B C D Audit frequency Annual audit Audit every two years Audit every three years Audit every five years 4.5 The plan produced for 2014-15 shows a resource requirement for internal resources of 670 days. The total available days using the current resources is 656 which is a slight shortfall of the 670 days, but will be manageable. The plan also assumes that the audit manager spends a hundred per cent of her time on audit however over the last few years the internal audit manager has been involved in a number of one-off projects which are not on the plan and therefore a budget of 15 days has been included in 2014-15 to cover this work. 4.6 The plan is ambitious and wide ranging. There are many challenges ahead for the Council. We have tried to strike a balance between reviewing the basic financial and management controls, the major governance areas that we must get right, the smaller services and the fundamental systems on which the external auditor bases his opinion. 4.7 In addition, the plan includes a time allocation for trading services which is a new area arising from the Corporate Plan. We will be working with managers to help them to deliver different service options either through channel shift, automation or different service models with the appropriate level of control. 5. Progress against the plan October 2013 to March 2014 5.1 The last six months have continued to be unpredictable and this has affected the delivery of the planned work. As a result we have employed Baker Tilly carry out three further audits. 5.2 Progress against the plan for the period October 2013 to March 2014 is set out in Appendix 3. Where audits have been postponed due to specific operational reasons they have been carried forward to 2014-15. 6. Financial Implications 6.1 There are no financial implications. 7. Legal Implications 7.1 The Local Government Act 1972 (S151) requires that a local council shall make arrangements for the proper administration of their financial affairs. 4

7.2 The 1972 Act is supported by the Accounts and Audit Regulations 2011 which state that A relevant body must undertake an adequate and effective internal audit of its accounting records and of its system of internal control in accordance with the proper practices in relation to internal control. 7.3 The internal audit plan is necessary to satisfy these legal obligations. 8. Human Resources 8.1 There are no HR implications. We will manage the shortfall during the course of the year and will adjust the plan as necessary. 9. Conclusion 9.1 This is a time of change for the organisation. The audit plan for 2014-15 is structured to reflect the changing needs and priorities of the Council. We will be reviewing the audit service within the next three months to ensure that we have the necessary resources and expertise to deliver a robust audit plan in line with best practice. 5

Appendix 1 Proposed Audit Plan 2014-15 Operational Internal Team Contractor Risk Rating Audit Type HB 10 A s151 audit Council Tax 10 A s151 audit Rents 10 A s151 audit Main Accounting 10 A s151 audit Treasury Management 10 A s151 audit NNDR 10 A s151 audit Payroll 10 A s151 audit Creditors 10 A s151 audit Debtors 10 A s151 audit Car Parks 10 A Fundamental Service Review Glive contract 10 A Compliance with contract Finance Controls 10 A Compliance with financial procedures Authorisation Controls 10 A corporate authorisation controls Procurement Cards 10 B Management Controls Fleet Maintenance 15 A Systems Audits - Operational Trade Waste 15 B Systems Audits - Operational CCTV 10 A Compliance with legislation Bailiffs 10 B Compliance with Regulations Environmental Health (Food Standards) 15 A Compliance with legislation Direct Debits 10 A Compliance with legislation Taxable Benefits 20 A Compliance with legislation MOT 10 B Systems Audit Fuel Management 5 B Systems Audit Follow-Up Electoral Registration 10 B Systems Audit Elections 10 A Compliance with legislation Garage Clearance 10 A System and data quality audit Sale of Council Houses 3 C Compliance with legislation Homelessness 10 B Compliance with legislation Improvement Grants 10 B Compliance with legislation Planning 10 A Compliance with legislation Licensing 15 A Compliance with legislation Stores (year end and follow-up) 10 B Asset management audit Markets 5 C Systems Audit Dog Warden 5 C Compliance with legislation Noise Nuisance 5 B Reviewing new system Guildhall 5 C Asset Management Review Museum 5 B Systems Audit -Operational 6

TIC 5 B Systems Audit -Operational Electric Theatre 10 B Systems Audit -Operational Guildford House 5 B Systems Audit -Operational Petty Cash & Floats 5 C Compliance with financial procedures General Advice to Services 36 General ad hoc advice and small projects Contract Audit GBC Contractor Purchase to Pay 5 A Contract audit New Payments System 5 A Contract audit Kitchens and bath refurbishments 15 A Contract audit Engineering-Highways contracts 15 B Contracts Audit ICT GBC Contractor Network Security 10 A Compliance with best practice ICT Project Management 10 A Compliance with best practice Access Controls 10 A Compliance with best practice Governance GBC Contractor Risk Management 10 A Governance audit Performance Management 10 A Governance audit Procurement 15 A Governance audit Legionella/Asbestos 10 A Governance audit follow-up information Security 10 A Governance audit Complaints 5 A Governance audit Project Management 5 A Governance audit Data Quality 10 A Governance audit Public Health and Wellbeing Agenda 10 A Governance audit Trading Services 10 A Governance audit Emergency Planning 15 A Governance audit Contingency 25 Non-Rechargeable Management and Overheads GBC Contractor Sick Leave 20 Appraisals 5 1:1s 5 Training 5 External Audit 3 Audit Planning 8 7

Supervision of Jobs 5 Audit Management 5 CDMT 3 Committee Reports 5 Recommendation Management 5 Corporate Dev. Support 5 Administration 5 New Audit Contract 8 Non Audit Duties Mayors Fund 3 Compliance Elections 6 Resourcing Ombudsman 15 Compliance Equalities 5 Compliance Lean 15 FOI/SAR 15 Special Projects 15 Total Days for Plan Coverage GBC Contractor Total 670 120 790 Resource Calculation Total Available Days in year 261 Less leave and bank holidays 41 221 Less non rechargeable Sickness 5 Training 3 Appraisals etc 3 Net Days per year 210 Days Resources currently available 588 (210x2.8FTE) Temporary Contract 68 Internal Audit Resources 656 Contractor Days 120 776 Days 8

Appendix 2 - Work Plan April-September 2014 Risk Operational GBC Rating Audit Type April-Sept Car Parks 10 A Fundamental Service Review 10 Finance Controls 10 A Compliance with financial procedures 5 Authorisation Controls 10 A Corporate authorisation controls 5 Procurement Cards 10 B Management Controls 10 Trade Waste 15 B Systems Audits - Operational 15 Bailiffs 10 B Compliance with Regulations 10 Direct Debits 10 A Compliance with legislation 10 MOT 10 B Systems Audit 10 Fuel Management 5 B Systems Audit Follow-Up 5 Garage Clearance 10 A System and data quality audit 10 Sale of Council Houses 3 C Compliance with legislation 1.5 Improvement Grants 10 B Compliance with legislation 10 Licensing 15 A Compliance with legislation 15 Markets 5 C Systems Audit 5 Dog Warden 5 C Compliance with legislation 5 Noise Nuisance 5 B Reviewing new system 5 Museum 5 B Systems Audit 5 TIC 5 B Systems Audit 5 Guildford House 5 B Systems Audit 5 Petty Cash & Floats 5 C Compliance with financial procedures 2.5 General Advice to Services 36 General ad hoc advice and small projects 18 Totals 199 167 9

Contract Audit GBC Purchase to Pay 5 A New system software controls 5 New Payments System 5 A New system software controls 5 Totals 10 10 Governance GBC Risk Management 10 A Governance audit 5 Performance Management 10 A Governance audit 5 Procurement 20 A Governance audit 10 Complaints 5 A Governance audit 5 Project Management 10 A Governance audit 5 Data Quality 10 A Governance audit 5 Trading Services 10 A Governance audit 10 Emergency Planning 15 A Governance audit 15 Contingency 15 A Governance audit 10 Totals 105 70 Non-Rechargeable Management and Overheads GBC Sick Leave 20 10 Appraisals 5 2.5 1:1s 5 2.5 Training 5 2.5 External Audit 3 1.5 Audit Planning 8 4 Supervision of Jobs 5 2.5 Audit Management 5 2.5 10

CDMT 3 1.5 Committee Reports 5 2.5 Recommendation Management 5 2.5 Corporate Dev. Support 5 2.5 Administration 5 2.5 New Audit Contract 8 8 Totals 87 47.5 Non Audit Duties Mayors Fund 3 Compliance 3 Elections 6 Resourcing 6 Ombudsman 15 Compliance 7.5 Equalities 5 Compliance 2.5 Lean 15 VFM 7.5 FOI/SAR 15 Compliance 7.5 Special Projects 15 7.5 Totals 74 41.5 11

Appendix 3 - Progress against Plan October 2013 to March 2014 Operational Risk Rating Audit Type Days Comments HB A Fundamental Systems Audit 12 Complete Council Tax A Fundamental Systems Audit 10 Complete Rents A Fundamental Systems Audit 10 Complete Main Accounting A Fundamental Systems Audit 10 Complete Treasury Management A Fundamental Systems Audit 10 Complete NNDR A Fundamental Systems Audit 10 Complete Payroll A Fundamental Systems Audit 10 Complete Creditors A Fundamental Systems Audit 10 Complete Debtors A Fundamental Systems Audit 10 Complete Glive contract A Carried Forward to 2014-15 8 Carried forward to 2014-15 Spectrum Contract Compliance with contract 8 Awaiting draft Wokling Road Depot x3 Two of the three audits completed. Fleet Management Fleet Maintenance carried forward to Fleet Maintenance A Systems Audits - Operational 15 2014-15 Recycling Car Mileage C Compliance with Regulations - new system 5 Complete Taxation A Compliance with legislation 10 Testing underway Electric Theatre B Systems Audit 10 Complete Energy Management A Systems Audit 10 Complete Day Centres B Systems Audit 10 Complete Building Control A System and data quality audit 8 Awaiting draft Sale of Council Houses C Compliance with legislation 1 Complete Electoral Registration A Compliance with legislation 10 Carried forward to 2014-15 12

Caravan Sites B Compliance with legislation 5 Complete Licensing A Compliance with legislation 10 Complete Elections B Compliance with legislation 10 Carried forward to 2014-15 Performance Management Property Management General Advice to Services Contract Audit A Review (Assets) 10 Complete General ad hoc advice and small projects 15 Complete Kitchens and bath refurbishments A Contract audit 12 Carried forward to 2014-15 Engineering-Highways contracts B Contracts Audit 10 Carried forward to 2014-15 Non-Decent Homes Standard A Contract audit 10 Complete Note The two contract audits that have been carried forward were superseded by three reviews on estimates, gas servicing and TV aerials because of concerns over the controls in place. ICT Network Security A Compliance with best practice 10 Awaiting draft Software Controls A Compliance with best practice 10 Awaiting draft Application Controls A Compliance with best practice 10 Awaiting draft (follow-up) Business Continuity/Disaster Recovery A Compliance with best practice 10 Awaiting draft Totals 40 Governance Risk Management A Governance audit 10 Complete Performance Management A Governance audit 10 Complete Procurement A Governance audit 10 Complete Legionella/Asbestos A Governance audit 5 Complete Public Health and Wellbeing A Governance audit 5 Complete information Security A Governance audit 5 Complete 13

Complaints A Governance audit 5 Complete Project Management A Governance audit 5 Complete Data Quality A Governance audit 10 Complete Contingency 15 Additional Work Domestic Homicide Review Review of Licensing Guildford Community Centre Data Governance Audit for the DVLA Freedom of Information/Subject Access Requests Gas Services Responsive Repairs and Estimates TV Aerial Contract Complete Ongping Complete Complete Ongoing Complete Complete Complete 14