Appendix 1e DIRECTORATE OF AUDIT, RISK AND ASSURANCE INTERNAL AUDIT SERVICE TO THE GLA

Appendix 1e DIRECTORATE OF AUDIT, RISK AND ASSURANCE INTERNAL AUDIT SERVICE TO THE GLA REVIEW OF PAYROLL February 2012

DISTRIBUTION LIST Audit Team Karen Welsh, Auditor Prakash Gohil, Audit Manager Distribution List David Gallie, Assistant Director of Finance Juliette Carter, Assistant Director HR and OD Patrick Alleyne, Senior HR Manager Frances Nguene, Chief Accountant

CONTENTS EXECUTIVE SUMMARY Page Background 1 Audit Assurance 1 Areas of Effective Control 1 Key Risk Issues for Management Action 2 FINDINGS AND RECOMMENDATIONS Review Objectives 3 Scope 3 Starters and Leavers 3 Changes to Standing Data 4 Reconciliation of Payroll 5 ACTION PLAN Assurance and Risk Rating Definitions 8 Findings and Recommendations 9

EXECUTIVE SUMMARY 1. Background 1.1 This audit has been carried out as part of the GLA 2011/12 audit plan. The objectives of the payroll system are to ensure that all staff are paid accurately, on a timely basis and payments are made to the correct people. 1.2 At the outset of the review, the potential risks identified to achieving the objectives of the payroll system were: Inaccuracies in standing data Unauthorised and incorrect amendments made Over / under payments made Inadequate reconciliation arrangements Inadequate record keeping Incorrect personnel paid Transactions not timely 1.3 We are looking to provide assurance that the key risks are effectively managed. 1.4 Payroll services were previously provided to the Greater London Authority (GLA) by Northgate until the contract ceased in October 2011. The Payroll functions have now been transferred to the London Fire and Emergency Planning Authority (LFEPA) and this is part of the Shared Services agenda. 1.5 At the time of this review, the GLA employs 722 staff and total gross payments for the financial year to January 2012 totalled 26.3m. 2. Audit Assurance Substantial Assurance Key risks are being managed effectively, however some controls need to be improved to ensure business objectives are met. 3. Areas of Effective Control 3.1 Adequate records are being maintained on starters and leavers at the GLA. Approved documentation and employment contracts are held on the personnel files by Human Resources (HR). Details of starters and leavers are recorded on the HR system (cyborg) by HR on a timely basis and information is sent to the payroll provider on a weekly basis with copies sent to the GLA Finance. 3.2 Standard forms for change of address and bank details are available on the GLA intranet for use by all staff. Changes made to payroll records are supported by approved documentation and held by HR. February 2012 Payroll 1

EXECUTIVE SUMMARY 3.3 Adequate separation of duties is in place for the monthly reconciliation of payroll data which is undertaken by an Accountant or Senior Finance Officer and reviewed by the Chief Accountant. Details of all payments and deductions are supplied to the GLA by the Payroll Supplier on a monthly basis. Pay release forms are prepared by the payroll provider and authorised by one of the approved personnel within the GLA Finance Unit. Checks are undertaken to the GLA establishment list by Link Accountants and form part of the reconciliation process undertaken on a monthly basis. Queries are documented and raised with either HR or the Payroll Provider as necessary. 4. Key Risk Issues for Management Action 4.1 The Payroll function contract was awarded to the London Fire and Emergency Planning Authority (LFEPA) in October 2011. Arrangements for discharging functions relating to human resources and payroll functions by LFEPA on behalf of the GLA and Instrument for discharge of functions, and provision of associated services documents are in existence, however, the documents are only in draft format and do not appear to have been approved formally. There is a risk that functions are not discharged properly. 4.2 Request for maternity leave are submitted to the HR Unit along with forms MATB1, however dates for leave on requests did not match details recorded on the payroll system. There is a risk that overpayments may be made to personnel. February 2012 Payroll 2

FINDINGS AND RECOMMENDATIONS 5. Review Objectives 5.1 We reviewed the control framework established by management to mitigate the risks relating to payroll. In particular, we looked to provide an assurance that: 6. Scope Adequate and approved documentation is maintained to support all new starters and leavers and all such data is captured and updated within the payroll system in a timely manner. All changes / adjustments to individual payroll records are supported by documentary evidence which has been independently checked and approved. The payroll is verified, fully reconciled for completeness and accuracy prior to the payroll payments being run. 6.1 We reviewed the effectiveness of the procedures and controls established by the Authority to mitigate the risks associated with payroll. We also reviewed starters and leavers, the reconciliation and authorisation of payroll data processes within the GLA Human Resources and Finance Unit. In addition we looked at the progress of the payroll service with the new supplier (LFEPA) including the benefits of electronic processing. 7. Starters and Leavers 7.1 Payroll services were previously provided to the Greater London Authority (GLA) by Northgate until the contract expired in October 2011. The Payroll functions have now transferred to the London Fire and Emergency Planning Authority (LFEPA) as part of the Shared Services agenda. Contracts for the Arrangements for Discharging Functions and Instrument for discharge of functions and provision of associated services are in place. However, we found that the documents are in draft format and there is no evidence to show that the documents have been formally approved by all the relevant parties. Risk and Recommendation Failure to have an approved delegation of responsibility in place between the GLA and payroll provider may result in responsibilities not being discharged properly. We recommend that the delegation of responsibility is fully completed and formally approved between the GLA and LFEPA. 7.2 Under the new payroll supplier, pay slips are available online by staff. A few problems with this system were identified such as forgotten passwords caused by irregular access to the system. However, a back up system is in place, as copies of payslips are held by Finance and can be obtained by staff if required. February 2012 Payroll 3

FINDINGS AND RECOMMENDATIONS Meetings are also held with GLA and LFEPA on a regular basis to discuss and action any issues or concerns raised. 7.3 The Recruitment and Operational Team within HR is aware of all starters and these are recorded on the payroll system (cyborg) by HR personnel. Reports are run from the system and a list of all starters for the current financial year was obtained. A sample of fifteen starters was reviewed including six which had transferred to the GLA from the London Development Agency (LDA) in July 2011. Personnel who transferred from LDA did not have contracts as their posts were treated as being continuous; although, there is adequate documentation to support posts on the HR files. The remaining starters, approval for posts were evidenced on files which had been approved by HR and Finance. Starter forms had been completed and start dates matched to the supporting documentation held on personnel files. Contracts of employment were in place and had been signed by the new member of staff and HR. 7.4 A letter of resignation is submitted and confirmation of leaving date is issued by HR. From a review of eleven leavers for the period April to December 2011, resignation letters were available for seven personnel, three were on fixed contracts and the correct dates were shown on their contracts. Details for one member of staff were not seen on the personnel file. Leaving dates were confirmed by HR for eight out of the eleven files reviewed. Risk and Recommendation Failure to confirm leaving date with employee may result in payments being made after personnel have left the organisation. We recommend that confirmation of leaving date is sent by HR to the employee and a record is maintained on the personnel file. 7.5 All details of starters and leavers are input onto the payroll system (Cyborg) by HR personnel on receipt of approved documentation. The system is managed by LEFPA and any changes to system are undertaken by LEFPA following a request from HR. Access levels have been issued within the HR Unit to enable inputting, producing reports and reviewing. Read only access has also been issued to GLA Finance. Reports are generated from the system which includes starters, leavers, one off allowances, on-going allowances and the GLA establishment list. Copies of all these reports are sent to GLA Finance to assist with the payroll reconciliation process. LFEPA is informed of all starters and leavers by the GLA HR on a weekly basis. Overall we found that adequate records are maintained to support details of starters and leavers and other parties are informed on a timely basis. 8. Changes to Standing Data 8.1 Changes to standing data relate to new address and bank details, maternity leave, career breaks and any contract changes. Standard forms for change of February 2012 Payroll 4

FINDINGS AND RECOMMENDATIONS address and bank details are available on the GLA intranet site and are submitted to HR for new address and finance for bank details. All changes are sent to LEFPA on a regular basis and copies are sent to finance where applicable. Annual pay increases have not been paid for some time and salary increments are automatic and are processed by HR. 8.2 From a review of ten ongoing allowances to HR personnel files, eight files contained supporting documentation and two were automatic allowances as part of the job. Seven one off allowances was compared to documentation held on HR personnel file, of which one file was not located (this person is part of the Standards Committee and a file is not held). Of the remaining six details were seen for four within HR and two others were noted on the finance reconciliations. (These two related to peer outreach workers and would not therefore have personnel files as they are only casual workers). 8.3 Supporting documentation was evidenced on personnel files for maternity leave; however, dates recorded on payroll reports did not match dates recorded on letters held on personnel files. Both cases were on-going at the time of the audit. Risk and Recommendation Failure to confirm dates of maternity leave may result in overpayments being made. We recommend that dates for maternity leave are confirmed and checked to the payroll system and supporting documentation. 8.4 LEFPA and GLA Finance are informed of all changes made to payroll data. Reports are run by LEFPA and include all details of allowances, deductions and payments made. Reports are checked by GLA Finance as part of their reconciliation process on a monthly basis. Reconciliations are also reviewed by the Chief Accountant within GLA Finance. 8.5 HR personnel have secure access to the system with read-only access given to other units where applicable. There is adequate separation of duties as HR personnel responsible for inputting starter details are not permitted to process leaver information on the system as teams are split within the HR Unit. The system will also produce emails to the library, facilities, IT and finance to inform of a new member of staff and of staff leaving the GLA. 9. Reconciliation of Payroll 9.1 Two monthly payroll runs are processed, the main payroll and a supplementary run. The supplementary run takes account of starters received after the main run and any changes received. GLA payroll processing timetable for 2011/12 is in place for the main and the supplementary payroll runs. The timetable includes dates for completing input, processing start, pay release forms, BACS submission, payslips available and pay dates. The timetable also includes dates for third party payments. February 2012 Payroll 5

FINDINGS AND RECOMMENDATIONS 9.2 All starters, P45, P46 and changes are received by Finance on a weekly basis from HR. Season ticket loans, expenses and overtime are processed by Finance and supporting documentation is sent to LFEPA on a weekly basis by courier from GLA Finance. A GLA establishment list is produced by HR and sent to Finance on a monthly basis. The list records details relating to Directorate, post number and code, full time equivalent (FTE) and count, grade, post start date, post review date, post creation details, employee number, employee name, employee grade, employee FTE and headcount, salary and position name. Details from the establishment list are confirmed with Directorates on a regular basis by the Link Accountants and information is reported back to the GLA Finance for reconciliation purposes. 9.3 Pay release forms are prepared by LFEPA and sent to GLA Finance for authorisation. The pay release forms are completed for the main, supplementary payroll runs and for third party payments. An approved signatory list is in place for GLA Finance staff to authorise pay release forms. However, no signatory list is held by GLA Finance to compare LFEPA personnel signatures on forms. We reviewed pay release forms for the current financial year for the main, supplementary payrolls and third party payments. The forms were prepared by LFEPA and had been authorised by either the Chief Accountant or Assistant Director of Finance at GLA respectively. Supporting reports are also submitted by LFEPA with the pay release forms to support payment figures. 9.4 Payroll reconciliations are undertaken by GLA Finance and include payroll to GLA establishment list, season ticket loan account and cycle to work account. Reconciliations are undertaken on a monthly basis by an Accountant and reviewed by the Chief Accountant. Evidence of any issues identified from the reconciliation had been raised by GLA Finance with HR. From our review of payroll reconciliations, we compared reconciliations to pay release forms for the current financial year. We found that for two main payroll runs (November and December 2011) and one supplementary run (December 2011) the amounts on the pay release forms did not match the details on the reconciliation process. An explanation was obtained from LFEPA for the differences on the two main payroll runs which stated that the pay release forms deal with the money physically paid and that the appropriate adjustments are made on the General Ledger. 9.5 Reconciliation of payroll expenditure and payroll costs as notified by payroll supplier is undertaken on a monthly basis for the main and the supplementary payroll runs. The reconciliation process includes the Gross and Net pay, deductions, NI and superannuation. Reconciliation statements are completed by the Chief Finance Officer with reports supplied by payroll supplier and the GLA SAP system and these are reviewed by the Chief Accountant on a monthly basis. We reviewed the control account reconciliations for period 7 and 8 and found that the balances are checked to the SAP system and all outstanding items had been recorded. February 2012 Payroll 6

FINDINGS AND RECOMMENDATIONS 9.6 Payroll payments are made by LFEPA following authorisation of the pay release forms. Requests for payments are submitted to the GLA Treasury Unit by LFEPA for reimbursement and requests were noted on files with journal transactions being processed by GLA finance. We reviewed journals for the current financial year and found that journals had been made on a monthly basis by an Accountant and approved by the Chief Accountant. 9.7 Monthly payroll totals are recorded by GLA Finance and are reviewed by the Assistant Director of Finance. An analysis of payroll movements for the current financial year was obtained. We found that differences over 5% are investigated and this was noted for July and August 2011. An explanation on the analysis stated that the differences relate to staff transferred from the LDA to GLA. Other totals for the current financial year were below the 5% threshold and no action was needed. February 2012 Payroll 7

ACTION PLAN RISK AND AUDIT ASSURANCE STATEMENT - DEFINITIONS Assurance Level Assurance Criteria 1 Full There is particularly effective management of key risks and business objectives are being achieved. 2 Substantial Key risks are being managed effectively, however some controls need to be improved to ensure business objectives are met. 3 Limited Some improvement is required to address key risks before business objectives can be met. 4 No DEFINITIONS OF RISK RATINGS Significant improvement is required to address key risks before business objectives can be met. There is a sound framework of control operating effectively to achieve business objectives. The framework of control is adequate and controls to mitigate key risks are generally operating effectively. A number of controls to mitigate key risks are not operating effectively. The control framework is inadequate and controls in place are not operating effectively to mitigate key risks. The business area is open to abuse, significant error or loss and/or misappropriation. Priority Categories recommendations according to their level of priority. 1 Critical risk issues for the attention of senior management to address control weakness that could have significant impact upon not only the system, function or process objectives, but also the achievement of the organisation s objectives in relation to: The efficient and effective use of resources The safeguarding of assets The preparation of reliable financial and operational information Compliance with laws and regulations. 2 Major risk issues for the attention of senior management to address control weaknesses that has or is likely to have a significant impact upon the achievement of key system, function or process objectives. This weakness, whilst high impact for the system, function or process does not have a significant impact on the achievement of the overall organisational objectives. 3 Other recommendations for local management action to address risk and control weakness that has a low impact on the achievement of the key system, function or process objectives ; or this weakness has exposed the system, function or process to a key risk, however the likelihood is this risk occurring is low. 4 Minor matters need to address risk and control weakness that does not impact upon the achievement of key system, function or process or process objectives; however implementation of the recommendation would improve overall control. _ February 2012 Payroll 8

ACTION PLAN Ref. Finding and Risk Priority Recommendation Accepted Responsibility Target Date 7.1 The Payroll functions have now 3 The delegation of Yes Assistant Immediate transferred to the London Fire and responsibility is fully Since the Director of Emergency Planning Authority completed and formally completion of Finance (LFEPA) as part of the Shared approved between the the fieldwork for Services agenda. Contracts for the GLA and LFEPA. this audit, LFEPA s Arrangements for Discharging lawyers have Functions and Instrument for passed the final discharge of functions and documentation provision of associated services are to the GLA. in place. However, we found that The the documents are in draft format and there is no evidence to show that the documents have been documentation will be formally approved formally approved by all the shortly. relevant parties. Failure to have an approved delegation of responsibility in place between the GLA and payroll provider may result in responsibilities not being discharged properly. 7.4 Leaving dates were confirmed by HR for eight out of the eleven files reviewed. Failure to confirm leaving date with employee may result in payments being made after personnel have left the organisations. 4 Confirmation of leaving date is sent by HR to the employee and a record is maintained on the personnel file. Yes This is part of the standard operating procedure within human resources for dealing with leavers. Senior Human Resources Manager Already in place. February 2012 Payroll 9

ACTION PLAN Ref. Finding and Risk Priority Recommendation Accepted Responsibility Target Date 8.3 Supporting documentation was 3 Dates for maternity leave Yes Senior Human Immediate evidenced on personnel files for are confirmed and Resources However, the maternity leave; however, dates checked to the payroll discrepancy in Manager recorded on payroll reports did not system and supporting the dates may match dates recorded on letters documentation. relate to the fact held on personnel files. Failure to that the payroll confirm dates of maternity leave dates are may result in overpayments being specifically the made. maternity pay period dates and the request documentation will often include annual leave and parental leave which is taken before and after the maternity pay period. February 2012 Payroll 10