Informing the audit risk assessment for Cheshire Fire Authority This version of the report is a draft. Its contents and subject matter remain under review and its contents may change and be expanded as part of the finalisation of the report. Year ending 31 March 2013 xx April 2013 Julian Farmer Engagement lead T +44 01612346385 E julian.d.farmer@gt.uk.com Alan Rawling Manager T +44 01612146374 E alan.j.rawling@gt.uk.com
The contents of this report relate only to the matters which have come to our attention, which we believe need to be reported to you as part of our audit process. It is not a comprehensive record of all the relevant matters, which may be subject to change, and in particular we cannot be held responsible to you for reporting all of the risks which may affect your business or any weaknesses in your internal controls. This report has been prepared solely for your benefit and should not be quoted in whole or in part without our prior written consent. We do not accept any responsibility for any loss occasioned to any third party acting, or refraining from acting on the basis of the content of this report, as this report was not prepared for, nor intended for, any other purpose..
Contents Section Page Purpose 4 Fraud 5 Fraud Risk Assessment 6-8 Laws and Regulations 9 Impact of Laws and Regulations 10 Going Concern 11 Going Concern Considerations 12-13 3
Purpose The purpose of this report is to contribute towards the effective two-way communication between auditors and the Fire Authority, as 'those charged with governance'. The report covers some important areas of the auditor risk assessment where we are required to make inquiries of the Authority under auditing standards. Background Under International Standards on Auditing (UK and Ireland) (ISA(UK&I)) auditors have specific responsibilities to communicate with those charged with governance. ISA(UK&I) emphasise the importance of two-way communication between the auditor and those charged with governance and also specify matters that should be communicated. This two-way communication assists both the auditor and the Authority in understanding matters relating to the audit and developing a constructive working relationship. It also enables the auditor to obtain information relevant to the audit and supports the Authority in fulfilling its responsibilities in relation to the financial reporting process. Communication As part of our risk assessment procedures we are required to obtain an understanding of management processes and the Authority's oversight of the following areas: fraud laws and regulations going concern. This report includes a series of questions on each of these areas and the response we have received from the Authority's management. The Authority should consider whether these responses are consistent with its understanding and whether there are any further comments it wishes to make. 4
Fraud Issue Matters in relation to fraud ISA(UK&I)240 covers auditors responsibilities relating to fraud in an audit of financial statements. The primary responsibility to prevent and detect fraud rests with both the Authority and management. Management, with the oversight of the Authority, needs to ensure a strong emphasis on fraud prevention and deterrence and encourage a culture of honest and ethical behaviour. As part of its oversight, the Authority should consider the potential for override of controls and inappropriate influence over the financial reporting process. As auditors, we are responsible for obtaining reasonable assurance that the financial statements are free from material misstatement due to fraud or error. We are required to maintain professional scepticism throughout the audit, considering the potential for management override of controls. As part of our audit risk assessment procedures we are required to consider risks of fraud. This includes considering the arrangements management has put in place with regard to fraud risks including: assessment that the financial statements could be materially misstated due to fraud process for identifying and responding to risks of fraud, including any identified specific risks communication with the Authority regarding its processes for identifying and responding to risks of fraud communication to employees regarding business practices and ethical behaviour. We need to understand how the Authority oversees the above processes. We are also required to make inquiries of both management and the Authority as to their knowledge of any actual, suspected or alleged fraud. These areas have been set out in the fraud risk assessment questions below together with responses from the management. 5
Fraud risk assessment Question Has the Authority assessed the risk of material misstatement in the financial statements due to fraud? What are the results of this process? What processes does the Authority have in place to identify and respond to risks of fraud? Have any specific fraud risks, or areas with a high risk of fraud, been identified and what has been done to mitigate these risks? Are internal controls, including segregation of duties, in place and operating effectively? If not, where are the risk areas and what mitigating actions have been taken? Management response The Authority receives the Annual Governance Report from External Audit and regular reports from Internal Audit, in particular an annual report on financial controls. Performance and Overview Committee receives regular reports on the financial performance of the Authority, and Budget Management Board (BMB) also considers reports on financial activity. Member Champions attend Risk Management Board which flags up major corporate risk. The Authority has no reason to believe that there is any risk of material misstatement due to fraud. The control mechanisms mentioned above all contribute to the potential identification of fraud. The Authority also has in place a Whistle Blowing Policy which specifically references reporting potential instances of fraud and corruption. The Authority participates in the National Fraud Initiative. The Authority has a relatively low risk of fraud, in particular because it has low levels of income. Treasury activity is subject to a Treasury Management Strategy and Treasury Management Practices, as well as an annual report, which are all reported to Members. Imprest accounts are subject to a regime of reconciliation and internal control, overseen by the Finance Team. The Risk Management Board (RMB) considers all corporate risks and should a fraud risk of sufficient severity be identified, it would be regularly considered at RMB. The Financial Regulations require the Authority to maintain an appropriate regime of internal controls. The procurement system has an automated workflow which ensures that only officers who are appropriately approved on the scheme of financial delegation may approve orders and payments. Internal Audit report regularly on the financial control regime. There is therefore no particular risk area in relation to internal control. 6
Fraud risk assessment Question Are there any areas where there is a potential for override of controls or inappropriate influence over the financial reporting process (for example because of undue pressure to achieve financial targets)? Management response The Authority exercises control through separation of duties and other control mechanisms across its whole business. Financial performance is reported through meetings with Heads of Departments,(HODS) on to BMB, Policy Approval Group (PAG) and to Performance and Overview Committee. There are no specific financial reduction targets set for any HOD; HODs are expected to manage within budgets, but are encouraged to recognise potential problems early and discuss them at BMB. Are there any areas where there is a potential for misreporting override of controls or inappropriate influence over the financial reporting process? How does the Authority exercise oversight over management's processes for identifying and responding to risks of fraud? What arrangements are in place to report fraud issues and risks to the Authority? All member reports are scrutinised by PAG, and all financial reports are scrutinised by the Head of Finance. Internal Audit reports and recommendations are considered by Performance and Overview (P&O) Committee. P&O Committee has a self defined work programme and is able to request reports on any area of the Service. Governance & Constitution Committee exercise oversight of the Scheme of Delegation and Financial Regulations. The Member Champions for risk attend Risk Management Board which considers risks, and this would include fraud risk. RMB minutes are reported to Policy Committee. How does the Authority communicate and encourage ethical behaviour of its staff and contractors? The Authority operates within Financial Regulations and has a well established Code of Conduct which is regularly updated. The Authority has a biennial Staff Survey. The Authority employs a Head of Procurement who manages the Authority s tendering process and advises on ethical issues within the process. How do you encourage staff to report their concerns about fraud? Have any significant issues been reported? The Authority operates a Whistle Blowing Policy which specifically references fraud and corruption. No concerns have been reported. 7
Fraud risk assessment Question Are you aware of any related party relationships or transactions that could give rise to risks of fraud? Are you aware of any instances of actual, suspected or alleged, fraud, either within the Authority as a whole or within specific departments since 1 April 2012? Management response The Authority regularly reviews members and officers professional relationships, and there are no known related party relationships which could give rise to risks of fraud. The Authority is not aware of any such instances. 8
Laws and regulations Issue Matters in relation to laws and regulations ISA(UK&I)250 requires us to consider the impact of laws and regulations in an audit of the financial statements. Management, with the oversight of the Authority, is responsible for ensuring that the Authority's operations are conducted in accordance with laws and regulations including those that determine amounts in the financial statements. As auditors, we are responsible for obtaining reasonable assurance that the financial statements are free from material misstatement due to fraud or error, taking into account the appropriate legal and regulatory framework. As part of our risk assessment procedures we are required to make inquiries of management and the Authority as to whether the entity is in compliance with laws and regulations. Where we become aware of information of non-compliance or suspected non-compliance we need to gain an understanding of the non-compliance and the possible effect on the financial statements. Risk assessment questions have been set out below together with responses from management. 9
Impact of Laws and regulations Question What arrangements does the Authority have in place to prevent and detect non-compliance with laws and regulations? How does management gain assurance that all relevant laws and regulations have been complied with? How is the Authority provided with assurance that all relevant laws and regulations have been complied with? Have there been any instances of non-compliance or suspected non-compliance with law and regulation since 1 April 2012, or earlier with an on-going impact on the 2012/13 financial statements? What arrangements does the Authority have in place to identify, evaluate and account for litigation or claims? Management response The Authority employs a suitably qualified Monitoring Officer, who advises on all legal matters. Where necessary, the Authority employs external experts. The Authority has officers who are members of the Chief Fire Officers Association, The Fire Finance Network, and encourages members and officers to attend external committees, workshops and other events to keep up to date with legislation and regulation. The Authority receives regular bulletins from DCLG, and has an in-house horizon scanning process. All new activity is subject to a business case being presented at an appropriate arena, which is subject to challenge, including in respect of legality. All reports to members include an explanation of any legal implications. The Monitoring Officer and his team advise officers and members on legal issues. There are a number of monitoring processes, for example in relation to driving, medical issues, etc designed to ensure that regulations are complied with. The Authority employs a designated Health and Safety Team to advise on and audit Health and Safety matters. Regular reports on constitutional matters are reported to the Governance and Constitution Committee. Members also have the opportunity to cross refer from their own Local Authorities. All reports to Members include an explanation of their legal implications. There have been no known instances of such non-compliance. The Authority has in place a complaints procedure which follows a defined process. Should this procedure identify that there was a risk of litigation the matter would be referred to the legal team 10
Impact of Laws and regulations Question Is there any actual or potential litigation or claims that would affect the financial statements? Have there been any reports from other regulatory bodies, such as HM Revenues and Customs which indicate noncompliance? Management response In the Statement of Accounts for 2011-12 we recognised a provision in respect of insurance claims. There is also a contingent liability in respect of the same issue and the potential for exposure to costs relating to part time workers pension contributions. These are likely to recur in the Statement of Accounts for 2012-13, and there may be other pension issues to consider. No. 11
Going Concern Issue Matters in relation to laws and regulations ISA(UK&I)570 covers auditor responsibilities in the audit of financial statements relating to management's use of the going concern assumption in the financial statements. The going concern assumption is a fundamental principle in the preparation of financial statements. Under this assumption entities are viewed as continuing in business for the foreseeable future. Assets and liabilities are recorded on the basis that the entity will be able to realise its assets and discharge its liabilities in the normal course of business. The code of practice on local authority accounting requires an authority s financial statements to be prepared on a going concern basis. Although the Authority is not subject to the same future trading uncertainties as private sector entities, consideration of the key features of the going concern provides an indication of the Authority's financial resilience. Going concern considerations have been set out below and management has provided its response. 12
Going Concern Considerations Question Does the Authority have procedures in place to assess its ability to continue as a going concern? Is management aware of the existence of other events or conditions that may cast doubt on the Authority's ability to continue as a going concern? Are arrangements in place to report the going concern assessment to the Authority? Are the financial assumptions in that report (e.g., future levels of income and expenditure) consistent with the Authority's Business Plan and the financial information provided to the Authority throughout the year? Management response The Authority considers its financial position on a regular basis, and has a Medium Term Financial Plan (MTFP) which considers the financial performance of the Authority over the next four years. It also considers its position in relation to reserves on an annual basis. The Authority is not aware of any such events. The MTFP demonstrates that the Authority remains viable, and is regularly reported to Members. No specific report on Going Concern has been provided to the Authority other than as part of the assessment of the Statutory Accounts, and consideration of the MTFP The Financial Assumptions used in the MTFP are considered to be realistic. The level of savings which are indicated by the MTFP are to be realised by the delivery of IRMP 10, and by the programme of Value For Money savings reviews which the Authority is undertaking. Those assumptions are continually updated in a very volatile funding climate. 13
Going Concern Considerations Question Are the implications of statutory or policy changes appropriately reflected in the Business Plan, financial forecasts and report on going concern? Have there been any significant issues raised with the Authority during the year which could cast doubts on the assumptions made? (Examples include adverse comments raised by internal and external audit regarding financial performance or significant weaknesses in systems of financial control). Does a review of available financial information identify any adverse financial indicators including negative cash flow? If so, what action is being taken to improve financial performance? Does the Authority have sufficient staff in post, with the appropriate skills and experience, particularly at senior manager level, to ensure the delivery of the Authority's objectives? If not, what action is being taken to obtain those skills? Management response The MTFP reflects the likely financial position of the Authority and the need to generate savings. The MTFP will be constantly updated as IRMP 10 is delivered. Any statutory changes (for example to pensions) will also be reflected in the updating of the MTFP. The Authority is not aware of any such issues. There is no such negative indication identified within the budget or the MTFP. The staffing levels required to deliver the plan are constantly under review and monitored at the IRMP Programme Board, which monitors progress against the plan. Where necessary, additional resources will be made available through use of the IRMP reserve. As an example, we are engaging external legal expertise to assist with the programme of land procurement for new stations. 14
2013 Grant Thornton UK LLP. All rights reserved. 'Grant Thornton' means Grant Thornton UK LLP, a limited liability partnership. Grant Thornton is a member firm of Grant Thornton International Ltd (Grant Thornton International). References to 'Grant Thornton' are to the brand under which the Grant Thornton member firms operate and refer to one or more member firms, as the context requires. Grant Thornton International and the member firms are not a worldwide partnership. Services are delivered independently by member firms, which are not responsible for the services or activities of one another. Grant Thornton International does not provide services to clients. grant-thornton.co.uk