Update on audit recommendationsdemocracy.gloucester.gov.uk/documents/s13648/KPMG update repo… · The contacts at KPMG in connection with this report are: Page Report sections Ian

Update on audit recommendations

Gloucester City CouncilGloucester City Council

December 2011

Contents

The contacts at KPMG in connection with this report are:

Page

Report sectionsp

Ian PenningtonDirectorKPMG LLP (UK)

Tel: 029 2046 8087

■ Introduction 2

■ Key issues and recommendations 3

Tel: 029 2046 [email protected]

Darren GilbertSenior ManagerKPMG LLP (UK)


David LockeManager

This report is addressed to the Council and has been prepared for the sole use of the Council. We take no responsibility to any member of staff acting in their individual capacities, or to third parties. The Audit Commission has issued a document entitled Statement of Responsibilities of Auditors and Audited Bodies. This summarises

where the responsibilities of auditors begin and end and what is expected from the audited body. We draw your attention to this document which is available on the Audit C i i ’ b it t dit i i k

gKPMG LLP (UK)


Commission’s website at www.auditcommission.gov.uk.

External auditors do not act as a substitute for the audited body’s own responsibility for putting in place proper arrangements to ensure that public business is conducted in accordance with the law and proper standards, and that public money is safeguarded and properly accounted for, and used economically, efficiently and effectively.

If you have any concerns or are dissatisfied with any part of KPMG’s work, in the first instance you should contact Ian Pennington, the appointed engagement lead to the Council, who will try to resolve your complaint. If you are dissatisfied with your response please contact Trevor Rees on 0161 246 4000, or by email to

[email protected], who is the national contact partner for all of KPMG’s work with the Audit Commission. After this, if you are still dissatisfied with how your complaint has been handled you can access the Audit Commission’s complaints procedure. Put your complaint in writing to the Complaints Unit Manager, Audit

Commission Westward House Lime Kiln Close Stoke Gifford Bristol BS34 8SR or by email to complaints@audit commission gov uk Their telephone number is 0844

1© 2011 KPMG LLP, a UK limited liability partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved. This document is confidential and its circulation and use are restricted. KPMG and the KPMG logo are registered trademarks of KPMG International Cooperative, a Swiss entity.

Commission, Westward House, Lime Kiln Close, Stoke Gifford, Bristol, BS34 8SR or by email to [email protected]. Their telephone number is 0844 798 3131, textphone (minicom) 020 7630 0421.

Section oneIntroduction

Purpose of report

We agreed with officers that we would prepare a summary of points raised during the 2009/10 and 2010/11 financial statement audits. The objective is to obtain an updated position on the progress against them and, for those that have been finalised, to clear them. This report can h b li f d h A di C i d i 2012 h i i I i l i d d l

This report summarises recommendations previously made to Gloucester City

then act as a baseline for management and the Audit Committee during 2012 when monitoring progress. It is also intended to act as a catalyst to addressing any historic and overdue actions that have been agreed in the past when audit issues have been reported.

All of these points have been raised in the past and so will be familiar to the Audit Committee. We have structured this report to give a summary of the original issue and management response, then a position update as of December 2011 and a suggested future action.

This future action has been proposed by officers and is for consideration and approval by Audit Committee. In some cases our original b ti h b t d d l d i th k i i d i thi d t ffi h d id d th t th

yCouncil (the Council) and outlines the current status of them.

Where actions are either observation has been acted on and resolved, in other cases work is in progress and in a third category officers have now decided that the cost/benefit of implementing our recommendation is not favourable and so the risk is to be tolerated.

Where recommendations are either implemented or risks tolerated, it is our intention to drop these points from future reports after the Audit Committee have approved this report. This will enable only actions that are currently in progress to be rolled forward to future reports. If, of course, our audit reveals new risks in areas closed off by this report then we will, as you would expect, raise them as new issues in future.

Acknowledgements

closed or will not be progressed they will not appear in future reports if the Audit Committee agrees with officers’ assessments and Acknowledgements

We would like to take this opportunity to thank officers and Members for their continuing help and co-operation throughout our audit work.

officers assessments and proposed course of action.


Key issues and recommendations

Each recommendation is set out as it originally appeared, together with the date of the

Priority rating for recommendation

Priority one: issues that are fundamental and material to your system of internal

Priority two: issues that have an important effect on internal controls but do not need

Priority three: issues that would, if corrected, improve the internal control in g

original recommendation and its risk grade.

Management responses, where applicable, are a

y ycontrol. We believe that these issues might mean that you do not meet a system objective or reduce (mitigate) a risk.

immediate action. You may still meet a system objective in full or in part or reduce (mitigate) a risk adequately but the weakness remains in the system.

general but are not vital to the overall system. These are generally issues of best practice that we feel would benefit you if you introduced them.

Recommendations have been included as they were set out in the original reports in which they were raised, with the priority rating left as it was at the time.

More recent recommendations from the 2010/11 audit have been repeated with the management response as received in September 2011 for update.

Older recommendations have been restated with an update as at May 2011 when they were updated for the interim audit report

combination of the original response and a subsequent update.

The current status column Older recommendations have been restated with an update as at May 2011 when they were updated for the interim audit report.

Where older recommendations have been superseded by subsequent recommendations we have noted this in the status column.

Where older recommendations are either still outstanding, implemented in full or where they are not being taken forward by officers then the Council has made comment in the status column with an action recommended to the Committee.

updates the position as at December 2011 and indicates officers’ proposed course of action with regard to the recommendation.


Key issues and recommendations


Issue and recommendation Management response/ responsible officer/ due date

Current status and proposed future action

Accounting records – raised Sept 2011 as grade one Status: In progressgoriginal recommendation and its risk grade.


During the course of the audit it has become evident that certain reporting and record keeping areas of the financial systems are cumbersome and are not working efficiently. For example:

the fixed asset recording system includes multiple line

The audit recommendation focuses on capital accounting treatment. However, a review is planned on all areas of the Year End process. Systems/processes shall be reviewed to confirm if efficiency improvements

Action:

The planned review of the technical processes is underway. This has included a revised format for the Statement of Accounts, an ‘in year’


The current status column

entries even for simple assets; and

capital grants monitoring sheets do not easily permit monitoring of movement on individual grants and of the complex entries on receipt of taxation income.

The required information is available but it is difficult to access d Thi k th dit l b t t l

to confirm if efficiency improvements are viable, particularly with the intention to produce Management Accounts and effective close down on a quarterly or half-yearly basis.

This will also be support the review and actioning of earlier closedown in

closedown and a review of year end processes and journals. In addition, there will be a review of the department structure following the voluntary redundancy of the Technical Accounting Service Manager.


and use. This makes the audit process slow but must also cause issues for officers using the data on a day to day basis. There is some evidence that the convoluted nature of some of the records, especially over fixed assets, has resulted in a number of the capital accounting errors that arose this year and contributed towards the number of correcting journals that have to be posted during the year by finance staff

and actioning of earlier closedown in this area and the implementation of Internal Audit recommendations from their 2010/11 review of capital accounting.

Responsible Officer: have to be posted during the year by finance staff.

Recommendation

Review of the process of maintaining accounting records to consider how this can be streamlined and improved.

Technical Accounting Service Manager

Due date: 31 March 2012


Key issues and recommendations (continued)




Timing of and response to Internal Audit work – raised Status: In progressgoriginal recommendation and its risk grade.


Sept 2011 as grade one

As a significant part of our audit work, we place reliance on work undertaken by internal audit.

As reported at the interim stage, we had to postpone some of this work until later in the year than would be ideal and, as a

As mentioned in the response to recommendation 1, the review of our processes and the establishment of “in-year” closedown (e.g. to include capital accounting) will enable Internal

Action:

As per the response above, the ‘in year’ closedown within 2011/12 will support delivery of earlier Internal Audit reviews.



result, had to perform some level of additional work ourselves as internal audit work was not done by the required time. This does not appear to us to be the fault of internal audit, rather that internal audit staff are not able to complete reviews in some areas owing to work not having been completed in time by the service.

capital accounting) will enable Internal Audit to review those processes at an earlier point in the year.

Responsible Officer:



Recommendation

The access for internal audit to service areas to allow them to complete their programme of work on time and in full will strengthen the control environment of the Council.

g

Due date: 31 March 2012






Group accounts – raised September 2011 as grade two Status: In progressgoriginal recommendation and its risk grade.


Late delivery of information from some group entities has caused a delay in the preparation of the Council’s financial statements. Following the adoption of IFRS accounting rules, it is now known which entities are included in the Council’s group accounts and, while this is subject to annual reassessment it is unlikely to change significantly from year to

For the 2010/11 accounts, contact with the consolidated entities was initiated from February 2011 and was continued throughout the final accounts process. This proactive liaison will continue in 2011/12 The

Action:

The Group entity position and reviews is being completed in January 2012 to confirm entities to be consolidated. Contact will then be made with each



reassessment, it is unlikely to change significantly from year to year.

Recommendation

Work proactively with each of the consolidated entities to agree a reporting timetable with each to smooth and speed up the process of financial close down.

liaison will continue in 2011/12. The confirmed IFRS group entities will help focus this contact.


Financial Planning Service Manager

D d t 31 J 2012

entity to ensure group deadlines and requirements are known.


p Due date: 31 January 2012






Faster close – raised September 2011 as grade two Status: in progressgoriginal recommendation and its risk grade.


The closedown process is difficult and time pressured in every organisation. The Council had intended to attempt to ease this pressure by trying to do some of the more challenging tasks early such as fixed assets, then rolling forward information to year end. Due to pressures of IFRS this was not possible this year

Agreed. As stated in the response to recommendation 1, elements of the closedown process (for example capital accounting areas) are being reviewed for closedown at month 6/9 and potentially on a quarterly basis

Action:

As stated above the ‘in year’ closedown within 2011/12 will support the year end closedown and improve its timeliness.



year.

Recommendation

Consider bringing forward aspects of the closedown process to improve timeliness.

and potentially on a quarterly basis ongoing.



D d t 31 D b 2011updates the position as at December 2011 and indicates officers’ proposed course of action with regard to the recommendation.

Due date: 31 December 2011

Component accounting – raised September 2011 as grade three

IFRS accounting rules require the adoption of ‘component accounting’ and the Council has now adopted a threshold of assets that exceed £500k in individual cost for this This is at

Agreed. The component accounting threshold shall be reviewed for appropriateness on an annual basis

Status: in progress

Action:

The review of our component accounting threshold has been built assets that exceed £500k in individual cost for this. This is at

the higher end of our experience of other local authorities, especially for a district council.

Recommendation

Review the appropriateness of the £500,000 threshold for component accounting

appropriateness on an annual basis, as a fundamental part of final accounts closedown and preparation.



ginto our annual closedown timetable, to ensure that it is reviewed for appropriateness on an ongoing basis.

component accounting. Manager

Due date: 30 April 2012






Long-term planning – raised June 2011 as grade two Status: completegoriginal recommendation and its risk grade.


Currently the Council has a good ‘three year money plan’ with robust procedures in all stages, from putting together the plan up to monitoring its implementation. The Council might want to consider extending this further to five years to further add value to its long term decision making.

Agreed. The 3 Year Money Plan prepared in 2010 included a nominal 4th year and it was always planned to increase the plan to cover a period of 5 years.

Action:

As previously planned, a longer term draft money plan has been approved by members. The five year money plan incorporates a high number of



Recommendation

Extend the current business plan to five years.


Group Manager Financial Services

Due Date: October 2011

assumptions, doe to both its nature and the current uncertainties around the levels of central government grants due to confirmation being held for one year only.


Issue – De-registration of system access – raised June 2011 as grade two

There is no formal process in place to notify systems administrators of the need to de-register users who no longer require access to a system following a transfer to another rolewithin the Council. If a user requires new access to a system

Agreed. An updated leavers process has been put in place after being highlighted by Internal Audit at the b i i f 2011/12 A t

Status: complete

Action:

KPMG will review this process as part of standard IT audit testing during the 2011/12 audit year with a view to d l ti thi f th li t f dit

q ydue to a transfer, this will be captured by the user registration form in the same way as a new joiner, but does not indicate if existing access to systems should be amended or removed.

Recommendation

Incorporate transfers into the de-registration process currently

beginning of 2011/12. A separate movers / transfers process was implemented at the same time, as was discussed during the audit.


BT&T Technical Design &

deleting this from the list of audit points.

being implemented. BT&T Technical Design & Development Service Manager

Due Date: April 2011






Financial ratios monitoring – raised June 2011 as grade Status: in progressgoriginal recommendation and its risk grade.


two

A number of key statistics are currently monitored by management on a monthly basis (including overdue council tax and rents). This would be strengthened by including a wider range of areas, such as cash flow ratios and gearing analysis

Agreed. Changes planned in the monitoring process following the LEAN review of Financial Services means that the reports to GLT and Members will be overhauled

Action:

The revised monitoring formats have been issued and agreed by senior management and members. Whilst finance officers understand the benefit



analysis.

Recommendation

Include a wider range of areas, such as cash flow ratios and gearing analysis in the key financial ratios monitored by the Council.

will be overhauled.

This process can now include investigation into appropriate use of ratios to help present the financial position of the council.


of some use of ratios in monitoring, it is thought that inclusion at this point would lead to confusion. We remain committed to improving the monitoring and will consider inclusion of ratios in the future.


p


Due Date: August 2011

Valuation of Investment Properties – raised June 2011 as grade two

Status: in progress

Action:The IFRS Code requires investment properties to be valued on an annual basis to assess for revaluation gains or losses. To date, investment properties have been valued on a rolling basis every 5 years. To ensure compliance with the Code, the Council must value their investment property on an annual basis and adjust accordingly for any gains or losses.

Agreed. As part of the IFRS work, all investment properties have been valued for the last two financial years. The Property Services section are fully aware of the future requirement for annual valuations.

Investment properties are planned to be valued on an annual basis. Instructions for the valuation will be issued in Dec 2011/Jan 2012.

Recommendation

Carry out valuation of investment properties on an annual basis.


Corporate Property Service Manager

Due Date: March 2012






Review of work by senior staff – raised June 2011 as Status: Complete/in progressgoriginal recommendation and its risk grade.


grade one

There is no evidence of review of the preparation of IFRS re-stated accounts and IFRS conversion process. This has resulted in material errors being identified through our audit and delays in completing the work, with a second audit visit required to complete our work While the conversion process

The Year End process has included review of key milestones including IFRS, specifically and senior staff have been involved in many of the key areas IFRS preparation work was not

Action:

Our original response confirmed that senior staff were involved within the final accounts process, from a point of delivery and review. Senior staff



required to complete our work. While the conversion process will not be repeated, an informal ‘lessons learned’ exercise could be useful, to allow for lessons to be transferred to other internal finance projects and future accounts closedown processes. In particular, the principle of review by senior staff of work where it is demanding or outside of the normal course of activity should be introduced as this is likely to improve the

areas. IFRS preparation work was not dealt with in the same way, however Service Managers, Group Manager and Director have all been involved in the Year End process.

review of the accounts and key areas will remain embedded in the year end close down timetable


y y pquality of work produced and make capacity constraints more obvious at an earlier stage.

Recommendation

Ensure a documented review by senior staff takes place to confirm key financial reporting areas.




Issue and recommendation Update at May 2011 Current status and proposed future action

Issue – Circularisation of establishment lists – raised Status: in progressgoriginal recommendation and its risk grade.


October 2010 as grade two

There is a risk that departing employees may not be removed from the payroll system subsequent to their departure.

Recommendation

Payroll verification lists should be run monthly and reviewed by

The Council circulated a list of employees taken from the payroll system to group managers once in 2009/10. The intention had been to circulate it on a quarterly basis during

Action:

Circulation and review of specific Payroll Verification reports form only one part of the control of establishment lists. The budget



Payroll verification lists should be run monthly and reviewed by relevant managers on a departmental basis.

Responsible

Group Manager Financial Services and Group Manager Organisational Development

circulate it on a quarterly basis during 2010/11.

An establishment list was circulated in July 2010, however no further lists were issued during the year. Although an establishment list will be circulated at the year end it is clear that there is

process ensures that each manager not only confirms the existing staffing list, but also plans the structure for the following year. In addition, monitoring against budgets on a regular basis and forecasting of out turn costs also ensures that managers have control ofupdates the position as at

December 2011 and indicates officers’ proposed course of action with regard to the recommendation.

at the year-end, it is clear that there is not yet a set procedure for the regular review of these lists by management.

Budgetary pressure has meant that the Payroll function has been closely monitoring employee numbers on a

ensures that managers have control of the staff payments in their service.

Payroll verification reports will be issued and returned in December 2011 as part of the regular process.

Payroll is also a part of project Fusionmonthly basis throughout 2010/11. As a result, the circulation of establishment lists has not always been deemed necessary by management.

The implementation of this

Payroll is also a part of project Fusion between the County council and the City Council and will be a service delivered via the County council from 1st April 2012. Future establishment list controls will need to be reviewed as part of the project.The implementation of this

recommendation should be reviewed again in 2011/12.

as part of the project.





Periodic reconciliation of the NNDR system to the cash Status: complete/in progressgoriginal recommendation and its risk grade.


receipting system – raised October 2010 as grade two

Reconciliations were found not to be signed/dated as reviewed by an independent finance officer.

Recommendation

Reconciliations should be signed/dated as reviewed by an

This recommendation has not been implemented. Whilst the reconciliations are printed and filed by the Revenues team, there is no signature to indicate the performance

Action:

The revenues and benefits service was outsourced to Civica in October 2011. The reconciliation between business rates and cash receipting is



Reconciliations should be signed/dated as reviewed by an independent finance officer.

Responsible

Group Manager (Revenues, Fees and Charges)

signature to indicate the performance of a management review.

We have now had further discussions with the Council to clarify the issue. The Council will ensure that reconciliations are signed off by the Group Manager (Revenues &

now completed via the contractor, Civica.

The Council will ensure that the contract is monitored on an ongoing basis and part of this will be ensuring that core reconciliations have been


Group Manager (Revenues & Charges) from June 2011. completed.





Issue – Data centre access – raised June 2009 as grade goriginal recommendation and its risk grade.


two

Due to a problem with the server room card reader, access cards are shared and no new individual cards can be created. We also view the number of staff with server room access as excessive.

Autumn 2009: We will change access system to match the ID card system and control access based on ID Cards.

August 2010: As indicated by the risk

Status

Server access cards are now allocated to specific individuals, although some may be shared as the issue with creating new cards remains.



Responsible

BT&T Technical Design & Development Service Manager

rating this issue does not need immediate action. A comprehensive access control solution is being considered for the Council as a whole, and Data Centre access will be part of this solution. This is with the Projects and Maintenance team

The upgrade of access control is still being considered, which should address the issue.

BT&T considers that the number of individuals with access is reasonable. Also, the visibility of the data centre


and Maintenance team.

It is Management's view that the current solution for controlling access to the Data Centre, combined with BT&T staff observing who enters the room (the room also has glass walls

, y(glass walls, only accessible from the BT&T room) provides management with comfort. As a result this point is categorised as being one raised as an audit risk but where management have opted to accept this risk as being

so people in the room can be seen) provides a level of security that is adequate for the purposes of the Council.

tolerable.

Action:

To delete from audit list of points





Backups - raised June 2009 as grade two Statusgoriginal recommendation and its risk grade.


The Council is using industry standard back up software and a strategy to back up all servers. It completes back ups and has successfully restored files when required. We noted that general records of the completed backups are made and kept for 9 months. Detailed logs of the backup events are made and kept for one week Problems with back ups are reported

Autumn 2009: At 30/9/09 the Authority noted this recommendation as having been completed.

August 2010: We do not record the various corrective actions taken by

Corrective actions taken to record back-ups are now recorded in the call management system by BT&T. In 2011, trend analysis has been introduced so that issues logged in this system can be monitored



and kept for one week. Problems with back ups are reported automatically by email and corrective actions are taken. However, no formalised written record is kept of these actions. We also noted that there has been no formal testing of the quality of the backups made. We also noted further opportunities for improvement in testing restores.

We had recommended that processes were introduced to

BT&T staff in responding to a backup issue. It is Management’s view that to do so would be excessive.

We do not systematically schedule test restorations of our backup tapes. Backup tapes are regularly used to

system can be monitored.

However, back-up restorations are not currently performed, as there is no facility to do this currently without overwriting an existing server. Internal Audit has also raised this in their 2010/11 IT Audit Reportupdates the position as at


We had recommended that processes were introduced to address these weaknesses and it may be that the council would find devising a more detailed back up strategy which formally describes its overall approach to backups a useful step.

Responsible

p p g yrestore files and this provides a level of confidence that the backups are usable.

We are planning to introduce snapshot technology next year and this will provide a number of enhancements to

2010/11 IT Audit Report.

It is noted that snapshot technology is now in place which allows snapshot back-ups to be taken for higher risk systems and if specific processes are being carried out around servers,

BT&T Technical Design & Development Service Managerprovide a number of enhancements to our backup regime.

It is management’s view that the level of risk here is adequate for the purposes of the Council.

adding an additional level of comfort.

As a result this point is categorised as being one raised as an audit risk but where management have opted to accept this risk as being tolerable.

A iAction:

To delete from audit list of points





Change management – raised October 2010 as Status: in progressgoriginal recommendation and its risk grade.


grade two

There are documented processes for making changes to systems but there is a lack of evidence of it being formally followed. This could result in inappropriate updates being made to the live system environment

Agree, the procedure for application change management to be formally documented for future reference.

Change management procedures have been

Action:

Currently B T & T have implemented all audit recommendations for change management controls. However, advancing these controls into the rest



system environment.

We recommended that change management procedures should have written evidence of them being enforced.

Responsible

BT&T T h i l D i & D l t S i

introduced and is intended to cover all third party systems. However, it did not cover third party systems prior to January 2011 and there have been instances of changes being initiated directly with third party support providers for these applications without BT&T being made aware. It is only configuration changes by system

of the Council has not been identified by the Council as a priority, so no further action has been taken at this stage.



is only configuration changes by system administrators that do not come through the BT&T procedures where this is an issue.

Changes are approved by the Change Advisory Board – until recently board meetings had not been minuted, resulting in a lack of evidence around the approval process. Following an Internal Audit recommendation at the beginning of March, minutes are now taken of these meetings.

There have been instances in the year relating to systems outside of financial audit scope wheresystems outside of financial audit scope where configuration changes have been performed without the use of appropriate change management procedures, and have led to system downtime.

As a result we categorise this as in progress but where actions remain outstanding


where actions remain outstanding.




Access rights – raised June 2010 as The Financial Management System – Sarah Tilling Status: in progressgoriginal recommendation and its risk grade.


grade two

There is no documentation to map an appropriate group of access rights for users based on their job role. The systems in question were: Payroll, the Financial Management System; Cash

Templates based on job roles are used to create users. However each user typically requires some additional access rights unique to their particular job. It is the view of management that the level of risk this introduces is minimal and the safeguards in place are adequate for the purposes of the council.

Action:

Currently B T & T have carried out actions as indicated in the update in May 2011. No additional work, other than that



Financial Management System; Cash receipting; Council Tax; NNDR and Benefits. It is recommended that user access rights are mapped to job roles. The response of application system administrators to this recommendation will be collated by the IT department.

Cash receipting (Income Management) – Pauline Winters

There are limited number of users who are attributed to a group of access rights based on their job role.

Council tax / NNDR – Pauline Winters

Templates based on job roles are used to create users However

indicated, is planned. As this is not a high priority, it is considered work in progress and we’ve set no target dates for completing the work.


y p

Responsible


Templates based on job roles are used to create users. However some user may require additional access rights unique to their particular job, and this is assigned to them on a case by case basis. It is the view of management that the level of risk this introduces is minimal and the safeguards in place are adequate for the purposes of the council.

IBS benefits system Sandra ThomasIBS benefits system – Sandra Thomas

The IBS system contains an extensive list of use groups which are used to ensure that access rights for users are based on their job role and was in place at the time of the Audit

Additional management response May 2011

We continue to seek to reduce risk, where pertinent, and are developing access models across all systems. This work is currently limited to systems where BT&T have had input into system development, but is aimed to expand to all systems in due course.

Due Date – initial systems October 2011, All systems ongoing assessment by March 2012


assessment by March 2012.




Removing user network access – raised June 2010 as goriginal recommendation and its risk grade.


grade one

When staff leave the Council’s employment their rights to access Council IT systems need to be removed promptly. If this does not happen, there is a risk that the individual (or others) may gain inappropriate access to systems or data.

We have now developed a procedure with HR to ensure BT&T is notified promptly when an individual leaves and this is being implemented in September 2010

Status:

KPMG will test this as being effective for the full year 2011/12 as part of the IT audit, as scheduled for Spring 2012.

Action:combination of the original response and a subsequent update.


There is no formalised procedure for removing user access to the network and applications when staff leave the Council. Five out of a sample of eleven staff we tested who had left in the year still had accounts on the system. Some limited mitigation exists as users with significant administration rights are known to IT staff and so are likely to be removed if they leave

September 2010.

Group Manager Business Transformation and Technology

The procedure implemented to ensure that BT&T and devolved system administrators are informed of leavers

None at present.


leave.

Recommendation

Develop a procedure with HR to ensure IT are notified promptly when an individual leaves and to allow the removal of their access profiles.

does not appear to have been operating effectively during the year based on audit testing around leavers on key systems.

There appears to be a communication issue regarding BT&T and systemsResponsible

Group Manager Business Transformation and Technology

issue regarding BT&T and systems administrators being informed of leavers in some cases, and there is also a gap in the process regarding removal of contractors’ and consultants’ accounts.

Th d l hi iThe procedure to resolve this issue was implemented in January 2011, so was not operational for the full year, but management believes it has been effective since.





Authorisation of journals – raised October 2010 as Status: in progressgoriginal recommendation and its risk grade.


grade one

Journals are not being authorised appropriately and our prior year recommendation of reviewing individual access to both raise and post journals has not been implemented. We note that the Council has a relatively small finance department and that the staff who have

Whilst the Council accepts that it would be preferable to limit access to the posting of journals, in a finance department of this size this in not practical. Such a limitation of access would impact on service delivery

Action:



small finance department and that the staff who have this high level of access are qualified finance officers but would still recommend a segregation of duties between raising and posting journals is introduced. We further note that one of the users with this access to the ledgers is, in fact, an employee of Gloucester City Homes not GCC.

access would impact on service delivery particularly when there are sickness or holiday absentees.

We would also comment that the majority of journals raised within finance are corrections or reallocations of costs to the appropriate serviceupdates the position as at


Recommendation

Individual access to both raise and post journals should be reviewed and suitable measures to mitigate this risk put into place.

Responsible

service.

We feel that the risk caused by the current procedures is minimal. However, we will continue to monitor and review as necessary.

The Council remains concerned that any further limitation on access for the posting ofResponsible


further limitation on access for the posting of journals would harm the Council’s service delivery. Therefore, senior officers remain capable of authorising their own journals and there are no plans to alter the design of this process.

C i l i i lCompensating controls remain in place which mitigate (but do not remove completely) the risk that erroneous journal postings will result in significant misstatements within the accounts. Exception reporting is also used to monitor larger journals (>£10k)


larger journals (>£10k).




Commissioning & procurement strategy – raised October Status: completegoriginal recommendation and its risk grade.


2010 as grade one

It is best practice for councils to agree a commissioning and procurement strategy that sets a framework for making decisions. This is even more important in these times of austerity.

Recommendation agreed

Regular monitoring and updates will take place in 2010/11

The procurement strategy is currently

Action:

The procurement strategy, including recommendations from the Task and Finish group, was approved in early 2011/12.



A strategy and policy was only introduced in March 2010 and there is a lack of evidence that contract and off contract spend monitoring has been carried out in the year.

Recommendation

With the implementation of this strategy at year end, regular it i f it ff ti d l d t t fl t

The procurement strategy is currently in the final stages of completion. The Council Task and Finish Group is working on recommendations for amendments which will require approval by Cabinet and Council before implementation.

There has since been further action with regard to procurement. These include our involvement in the South West Portal, positive results from the LEAN order to invoice processing review and the development of closer


monitoring of its effectiveness and regular updates to reflect current economic circumstances should occur.

Responsible


p

Although the strategy has yet to be completed, procurement procedures are presently following the guidance contained within the draft. The Council’s constitution provides further guidance regarding procurement

plinks with the County council as part of Project Fusion.

guidance regarding procurement procedures.





Creditor accounts – raised October 2010 as grade two Status: completegoriginal recommendation and its risk grade.


We note that both capital grants and s106 receipts are accounted in such a way as to generate a creditor account which does not reduce as the grants or contributions are applied. While there is not any financial impact of this treatment this appears to be a cumbersome method of accounting that impedes the ability of the Council to track

The method and timing of accounting for capital and s106 grants shall be reviewed and updated as part of the lessons learnt exercise.

Due date - Lessons learnt exercise to

Action:

This was delivered within 2010/11 and will continue as an approach. The lead officer is the Technical Accountant.



accounting that impedes the ability of the Council to track expenditure against individual receipts of funding.

This process generates two risks. This first is that these accounts will, under this method, continually grow and thus create an inefficient reconciliation process for the finance team. Secondly, and more significantly, there is a risk that the traceability of individual receipts will be impaired leaving the

be completed in October 2010

Work has been ongoing throughout the year to resolve this issue. Although yet to be resolved fully, it is anticipated that the presentation of the grants received and applied will be improved


traceability of individual receipts will be impaired, leaving the Council vulnerable to claims from developers for refunds of unused s106 funds.

Recommendation

Reassess the method of accounting for capital and s106 grants and introduce a means of tracing individual

pp pfor the 2010/11 year-end audit.

To be reviewed during the final audit visit in July 2011.

grants and introduce a means of tracing individual grants/payments. This will improve the robustness of the process and improve efficiency of accounting practice.

Responsible

Responsible officer – Technical Accounting Service Manager (Steve Meers)(Steve Meers)





Cashflow statements - raised October 2010 as grade two Status:goriginal recommendation and its risk grade.


The Cedar ledger system should be capable of accurately producing a cashflow statement but, following SORP changes, it has not been remapped to allow this to properly occur. This resulted in a significant amount of time spent by both finance and audit teams in attempting to reconcile this data

Recommendation agreed.

Improvement of the cashflowstatement production will be reviewed as part of the lessons learnt exercise.

The cashflow remained difficult to audit in 2010/11.

Action:

We regard this point as still being live and in need of attention for the



Recommendation

With the introduction of IFRS, the Cedar system needs to be diligently remapped to ensure that this problem does not reoccur. Consideration might also be given to moving the cashflow disclosure to being made using the indirect method which is often both easier to calculate and clearer to the

Due date - Lessons learnt exercise to be completed in October 2010

The finance team is currently in the process of re-working the structures within the Cedar system to facilitate a i l ti t d

and in need of attention for the 2011/12 year end.


reader.

Responsible

Responsible officer – Financial Planning Service Manager (Stephanie Payne) and Technical Accounting Service Manager (Steve Meers)

simpler reporting process at year-end.

The system updates should help the Council improve its year-end reporting process for the cashflow statement, income statement and statement of financial position.g ( ) p

The Council is also considering back up plans should any difficulties be encountered in the process of updating the Cedar system. Consideration is currently being given to the possibility of utilising a CIPFA cashflow toolkit toof utilising a CIPFA cashflow toolkit to help in the production of the statement.





Aged Debtors and Creditors - raised October 2010 as Status: completedgoriginal recommendation and its risk grade.


grade two

The Council has some old sundry debtors and creditor balances that appears to be very old. Officers believe this might have arisen due to matching problems in the past. Amounts are not individually significant but overall comes to £90k Stricter review of old debts and credits is appropriate

The Revenues team have introduced a revised procedure in 2010/11 for the monthly review of sundry items. This is delivered by the Revenues Service Manager and includes delivery of

Action:

This was delivered within 2010/11 and is ongoing. Detailed review of aged debtors and creditors will be undertaken as part of the in year



£90k. Stricter review of old debts and credits is appropriate, given the large amounts more than 365 days old held within sundry debtors and sundry creditors.

Recommendation

Review and investigate these old balances and take appropriate action to recover, pay or write off.

Manager and includes delivery of appropriate action (e.g. write off).

Due date – immediate

The Revenues Service Manager notifies the Group Manager Audit & Assurance once she has identified an

closedown and again at year end.


pp p , p y

Responsible

Responsible officer – Revenues Service Manager (Michelle Hockings)

old balance which requires writing-off. The Group Manager Audit & Assurance then investigates the write-offs on a sample basis before agreeing that the amount should indeed be written off.

Michaelle Hopkins (Revenues) entersMichaelle Hopkins (Revenues) enters the write-off into the Ash system, and Pauline Winters is then required to authorise write-offs up to £5k. The Ash system is automatically interfaced with the general ledger within Cedar.

W h i d h i ffWe have reviewed the write-offs processed in 2010/11 to date. The total is around £27k, which implies that the Revenues team is still working through the process of writing-off older balances.





Payroll Controls - raised October 2010 as grade one Status: completegoriginal recommendation and its risk grade.


Some year end processes (e.g. a payroll reconciliation) did not occur until late August, almost five months after the year end. This is a significant time lag and should be undertaken at or near year end in order for maximum benefit to be obtained from the process.


We note that due to the payroll to ledger interface being an automated process, that payroll reconciliations had not been previously performed.

Action:

The payroll to ledger reconciliation is now completed on a monthly basis. This is delivered by the Creditors Assistant and reviewed by the



Recommendation

Review the year end closedown timetable such as to schedule these important reviews to be undertaken immediately after year end in future.

Responsible

We shall ensure that the year end reconciliations are performed closer to year end in future.

Due date – April/May 2011

This recommendation will be fully i d t f KPMG’ d

Technical Accountant. This control has been in place for 2011/12 to date.


Responsible officer - Technical Accounting Service Manager (Steve Meers)

reviewed as part of KPMG’s year-end audit. Discussions with Steve Meers in March 2011 indicate that the reconciliation should be performed on a timely basis this year.





Accounting Policies - raised October 2010 as grade one Status:goriginal recommendation and its risk grade.


Review of accounting policies identified that the Council’s current policies are less detailed than the SORP guidance and certain policies are not in line with the latest SORP requirements. The Council are presently updating this for the final version of the accounts.


Review of IFRS requirements is already underway within the team and the requirements will be fully considered and actioned as part of

While the adoption of IFRS accounting policies was challenging, by the end of the audit the policies published were appropriate, except in one case (component accounting) which is highlighted above



Recommendation

When revising the accounting policies for 2010/11 it will be necessary to ensure that appropriate updates have been made for IFRS and that all available CIPFA/SORP guidance is diligently followed to ensure that accounting policies are fit for future years and robust.

next year’s accounting policies. IFRS is being reviewed and delivered within the team under a project plan.

Due date – June 2011

Once the new IFRS accounting li i h b fi li d ill

highlighted above.

Action:

As there is now one specific recommendation above this recommendation is superseded and can be deleted from future listings.


y

Responsible

Financial Planning Service Manager (Stephanie Payne) and Technical Accounting Service Manager (Steve Meers)

policies have been finalised, we will review those new policies during the year-end audit.

g


© 2011 KPMG LLP a UK public limited partnership is a subsidiary of KPMG© 2011 KPMG LLP, a UK public limited partnership, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative, a Swiss entity. All rights reserved.

The KPMG name, logo and ‘cutting through complexity’ are registered trademarks or trademarks of KPMG International Cooperative (KPMG I t ti l)International).

Documents

Update on audit recommendationsdemocracy.gloucester.gov.uk/documents/s13648/KPMG update repo… · The contacts at KPMG in connection with this report are: Page Report sections Ian