APPENDIX B
Areas where Audit Work Suggested that Controls are not Adequate with a 'Poor' or 'Needs Improvement' opinion and key audit where a
number of 3* recommendations resulted from the review.
(Key audits are shown in 'Bold')
DEPT.
AUDIT AREA
OPINION
KEY AREAS OF CONCERN
CD
Exempt under Section 30 - Investigations and Proceedings
CD
Mobile computing Needs Improvement
Missing or failing controls were identified specifical y with regards to the absence of
and data transfer
an IT asset register, no mechanism for reporting security incidents and the use of
mobile devices without logical security or encryption.
CYPS
Schools (six)
Needs Improvement
Internal control arrangements within five schools audited during the period were
found to be in need of improvement in the areas of asset management, payroll,
imprest, income, purchasing arrangements, pupil number returns, school meals
and school fund administration.
HSC
Bristol 600
Needs Improvement
Internal control arrangements at the Bristol 600 Day Centre were found to be in
need of improvement in the areas of imprest administration, purchasing, payrol ,
semi official funds, meals income, asset management and the completion of
Declaration of Interest Forms.
HSC
Business
Needs Improvement
Weakness identified include a failure to validate BCPs by physical tests, BC
Continuity
arrangements when critical services are outsourced, BC provision when critical
services depend on several outside service providers, poor cross reference
between the departmental risk register and SDPs; and between SDPs and critical /
non-critical services; and between SDPs and BCPs.
RE
E Forms
Needs Improvement
Needs improvement was due to concerns around the complexity of the privilege
framework for setting up users, inadequate segregation of duties, lack of
information to identify active users, short minimum password length, weaknesses in
procedures for password resets and poor documentation of security practices.
KEY TO DEPARTMENT CODES
BT
TRANSFORMATION
CD
CITY DEVELOPMENT
CORP
CORPORATE
Page 1
APPENDIX B
DEPT.
AUDIT AREA
OPINION
KEY AREAS OF CONCERN
CYPS
CHILDREN, YOUNG PEOPLE & SKILLS
DCX
DEPUTY CHIEF EXECUTIVE
HSC
HEALTH & ADULT SOCIAL CARE
NH
NEIGHBOURHOODS
RE
RESOURCES
Page 2
APPENDIX C
STRICTLY PRIVATE AND CONFIDENTIAL
INTERNAL AUDIT 2008/09
UNPLANNED WORK IN PROGRESS/COMPLETED
DEPT
ASSIGNMENT
ORIGIN
STATUS AT
COMMENTS
(new in period 3 2008/09 in
28th February
bold)
2009
CD
Replacement of Pay & Display/
Parking Services Completed
Comment provided on tender specification. Provision to be made in
Pay on Foot Equipment Project
09/10 plan for further input.
(2007/08)
CORP NFI - Single Person Discount
Audit
In Progress
Council Tax review nearing completion. IA to seek HR views on
(SPD) match to Electoral
Commission
equitable process for dealing with employees who have failed to
Register.
declare their change in circumstances with regard to SPD. Savings
(2007/08)
from withdrawn SPDs are in excess of £400,000.
CORP Directorate Health Checks
Deputy Chief
Completed
Provision of information and Audit opinion for two Directorates
(period 3)
Executive
under review, Health & Social Care and Neighbourhoods.
Provision has been made in the 2009/10 Audit Plan for the
remaining Directorates scheduled to be subject to a health
check in 2009/10.
CYPS
A Primary School
Whistle Blower
Completed
IA investigation completed and concluded that there are some
(2007/08)
significant improvements needed in order to demonstrate
transparency in the use of funding and to safeguard the school and
individuals from potential al egations as a result of conflicts of interest
arising at the School. Final report issued 3/3/2009
CYPS
A Primary School (period 1)
Headteacher
Completed
Internal Audit's review of financial records and administration
arrangements fol owing concerns expressed by the Headteacher and
Chair of Governors has now been completed. The final audit report
was issued on 9/2/09 where it was concluded that the level of internal
control was poor. In particular it was evident that there had been a
breakdown in appropriate standards of governance and accountability
at the School although there was no evidence of any material fraud or
irregularity from the records sighted. A fol ow up audit is scheduled in
the 2009/10 Audit Plan.
Page 3
APPENDIX C
DEPT
ASSIGNMENT
ORIGIN
STATUS AT
COMMENTS
(new in period 3 2008/09 in
28th February
bold)
2009
CYPS
Avonvale Road (period 1)
CYPS Finance
Completed
The Internal Audit review of internal control arrangements
surrounding the administration of the imprest account fol owing the
identification of a discrepancy in the funds held has now been
completed. The final report was issued on 11/12/2008 and it was
concluded that arrangements for the administration of the imprest
account needed improvement. As a result of the audit the Resources
Manager has taken a proactive approach to ensure that Audit
recommendations are implemented.
CYPS
FMSiS Assessments
DCSF
In Progress
These are schools that failed or were deferred from 2007/08 and not
included in the audit plan for 2008/09 as it was initial y thought that
they would pass in 2007/08. Assessments currently in progress.
CYPS
A Primary School (period 3)
CYPS Finance
Completed
At an audit in June 2007, internal control arrangements were initial y
found to be in need of improvement. A fol ow up audit was conducted
in October 2007 where the level of internal control was found to have
dramatical y improved. However, fol owing further concerns
expressed by CYPS Finance a further audit has been completed
where it was concluded that the internal control environment is stil in
need of improvement. Internal Audit are to complete a further review
in 2009/10.
NH
Errors in Making Housing Benefits Housing Benefits Completed
Two BACS payment schedules for four-weekly / monthly payments
BACS Payments Jul 08 (period 1) Manager
Period 2
were run twice in one week. The net effect was £3.286M being paid
25 days in advance. Loss of interest (£12.6K) and effects on HB
O/Ps & Subsidy: steps taken to minimise impacts, and controls put in
place to prevent this happening again
NH
User feedback original payments Drug Strategy
In Progress
Payment methods for people attending UFO meetings under review -
Bristol Partnership (period 2)
Team
currently has extraction of cheques without Audit approval
NH
Exempt under Section 40 - Personal Data and Section 31 - Law Enforcement
Page 4
APPENDIX C
DEPT
ASSIGNMENT
ORIGIN
STATUS AT
COMMENTS
(new in period 3 2008/09 in
28th February
bold)
2009
NH
Homelessness applicant - Dec Homelessness Completed
Audit assisted in carrying out various searches on applicant
08 (period 3)
Team
since it was believed that applicant was making a false
homelessness application. No evidence found to show
information was false.
RE
Procurement to Payment
Account Services Completed
Audit in advisory role to management pre-implementation of new
(2007/08)
(planned work system. Go-live date postponed to al ow greater testing of system.
in 08/09)
Further coverage to be planned for 09/10.
RE
Bank mandates authorisation
Internal Audit
In Progress
Dissemination of recommendations made as a result of Cash Office
levels
(period 1)
audit, requiring Management to review the appropriateness of the
level of authorisation given on each of the Council's bank accounts.
RE
Loans to Icelandic Bank (period Corporate
Completed
BCC has £8M invested with Icelandic banks. Review of compliance
2)
Finance
Period 3
with the Treasury Management Strategy in placement of these
Manager
investments. Report issued to senior management. Recovery of
funds not yet achieved.
RE
Counterfeit currency procedure
Finance &
Completed
Detailed guidelines on detection and handling of suspected
(period 2)
Business
Period 3
counterfeit currency. Guidance disseminated to appropriate sections
Support Group
of the Council, and also made available on The Source
Leader
RE
Creditors Cheques to Originator Internal Audit
In Progress
IA reviewing the number of cheques that have been raised on
(period 2)
Creditors and returned to the originator. This should only occur if
agreed by IA and there is a demonstrable need, to reduce the risk of
fraud.
RE
Land Dev Gbank query (period Member
Completed
Speculation in the local media that BCC Officers had
3)
Period 3
contravened their own policies in deciding to sell parcels of land
to a developer. Audit did not find evidence of fraud and
impropriety.
RE
Broadmead Grant - Audit
Finance &
In Progress
SWRDA Interim Grant Claim - Broadmead Streetscene
certificate (period 3)
Business
Support Group
Leader
Page 5
APPENDIX C
DEPT
ASSIGNMENT
ORIGIN
STATUS AT
COMMENTS
(new in period 3 2008/09 in
28th February
bold)
2009
RE
Exempt under Section 30 - Investigations and Proceedings
RE
Exempt under Section 30 - Investigations and Proceedings
RE
Chargeable Collections (period CSC Operations I n Progress
Concerns were raised that no reconciliation takes place for
3)
Manager &
services requested and paid for by the public via Customer
Financial
Services Centre. There have been a number of discrepancies
Management
between the service ordering system and the cash receipting
system. The overall consequence is that, for some services
carried out, it is possible that, either the authority has received
no payment , or, payment has been received but has not been
brought to account. Investigation continuing.
KEY TO DEPARTMENT CODES
BT
TRANSFORMATION
CD
CITY DEVELOPMENT
CORP CORPORATE
CYPS
CHILDREN, YOUNG PEOPLE &
SKILLS
DCX
DEPUTY CHIEF EXECUTIVE
HSC
HEALTH & ADULT SOCIAL
CARE
NH
NEIGHBOURHOODS
RE
RESOURCES
Page 6
APPENDIX D
STRICTLY PRIVATE AND CONFIDENTIAL
INTERNAL AUDIT 2008/09
FRAUD AND IRREGULARITY - RESPONSIVE WORK
DEPT
ASSIGNMENT
ORIGIN
STATUS AT
COMMENTS
(new in period 3
28th
2008/09 in bold)
February
2009
CD
Exempt under Section 30 - Investigations and proceedings and Section 31 - Law Enforcement
CD
Review of blue
Audit Comm. In progress Investigation into the use and possible abuse of Blue Disabled Parking badges. Issues
badge data (period
original y identified as part of the NFI 2006/07 exercise.
2)
CYPS
A Primary School
Internal Audit In progress Review of IT and data security arrangements fol owing the theft. To be linked to planned
(period 1)
audit review of mobile data security in CYPS. Audit review being concluded.
NH
Exempt under Section 40 - Personal Data
NH
Fencing contractor Anonymous In progress An old complaint that was investigated but found to be inconclusive. Recent Minor Works
(period 1)
complaint.
review prompted a further examination of this area which is in progress.
NH
Exempt under Section 40 - Personal Data
RE
Exempt under Section 30 - Investigations and proceedings
Page 7
APPENDIX D
DEPT
ASSIGNMENT
ORIGIN
STATUS AT
COMMENTS
(new in period 3
28th
2008/09 in bold)
February
2009
KEY TO DEPARTMENT CODES
BT
TRANSFORMATION
CD
CITY DEVELOPMENT
CORP
CORPORATE
CYPS
CHILDREN, YOUNG PEOPLE &
SKILLS
DCX
DEPUTY CHIEF EXECUTIVE
HSC
HEALTH & ADULT SOCIAL
CARE
NH
NEIGHBOURHOODS
RE
RESOURCES
Page 8
APPENDIX E
Internal Audit Follow-up Activity
2008-09
Situation at at 28/02/2009
The following were reported in previous periodic reports (appendix B) as areas where audit work suggested that controls are not
adequate with a 'Poor' or 'Needs Improvement' opinion and key audit where a number of 3* recommendation resulted from the review.
The current position is provided regarding the implementation of the recommendations.
(Key audits are shown in 'Bold')
DEPT.
AREA OF AUDIT
DETAILS
STATUS
REVIEW
RE
Debtors Interfaces
Account Services are working towards reducing the user accounts which
Follow up completed
do not force separation of duties. New system in place for setting up users, and satisfactorily
system now forces separation of duties. Some minor recommendations
resolved
made. The Adult and Community Care - Series X system which was lacking
an adequate business continuity arrangement was initially remaining in
South Gloucestershire, with transaction files held in Bristol for business
continuity purposes. The position has changed since being reported and
the Series X application is now based in Bristol. Planned audit to check
current position in 09/10.
RE
Payroll data security
Action has been taken to reduce/eliminate the IA concerns identified.
Follow up completed
Notably progress has been made in drawing up a data classification system and satisfactorily
which will be issued shortly, lockable cabinets are being acquired by
resolved
Payroll and sensitive electronic files are now encrypted before being
transferred outside of Bristol City Council
CD
PT&SD Partnerships
Fol ow-up currently in progress.
Fol ow up in progress
CYPS
Schools
Letters are being sent to schools requesting confirmation that recommendations Fol ow up in progress
included in their audit report have been fully implemented.
CYPS
Music Service
Fol ow up scheduled for quarter 2 of 2008/09 but deferred until Q3. Fol ow up
Fol ow up in progress
now nearing completion in Q4.
HSC
Paris application audit
Disaster Recovery test took place 26/01/09 through to 04/02/09 - outcome of test Fol ow up in progress
stil to be fol owed up.
Page 9
APPENDIX E
DEPT.
AREA OF AUDIT
DETAILS
STATUS
REVIEW
HSC
Departmental Payrol
Fol ow up scheduled for quarter 2 of 2008/09 but deferred. Fol ow up now nearing F
ol ow up in progress
completion in Quarter 4.
HSC
ACC budgetary control Follow up to be scheduled for Quarter 4 of 2008/09.
Follow up in progress
HSC
Windfal Income and
Fol ow up commenced in quarter 2 and stil in progress.
Fol ow up in progress
Memorandum Debt
RE
Creditors Interfaces
Confirmation is still awaited of the position with regards to the recommendations Fol ow up in progress
made in relation to the reconciliations of the e-trading system and the Anite
Housing Management system. Review in progress.
RE
Local Taxation - Refunds There was an absence of sufficiently robust controls in the areas of the levels at Fol ow up in progress
& Write off
which writes off may be authorised and an absence of an adequate level of
separation of duties. Some improvements were introduced before completion of
the audit. Fol ow up scheduled for Qtr 3 of 2008/09.
CORP
LAA baseline review
Due to the delay experienced in obtaining management comments, follow-
Previously reported,
target 5
up on the audit has been delayed until 2nd quarter of 2009/10.
but not yet followed up
C&L
Leisure Centre Contract
Fol ow up scheduled for 2nd quarter 2008/09
Previously reported, but
not yet fol owed up
CORP
Project Management
Follow-up complete. Some progress has been made, however there are still To be followed up as
some areas where further recommendations have been made and require
part of planned review
implementation. A further follow-up has been scheduled for 09/10.
CORP
Payment Card Industry
Audit continue to have concerns about the extent the Council complies with the
To be fol owed up as part
Payment Card Industry standard. Whilst we have received assurance that our
of planned review
corporate cash receipting system complies, responsibility for assessing our
compliance with the other 60 elements of the standard has not yet been allocated.
CYPS
Special Education Needs To be fol owed up in 2009/10
To be fol owed up as part
of planned review
CYPS
CYPS Partnerships and
Due to FMSiS priorities this audit is scheduled for fol ow up in 2009/10.
To be fol owed up as part
Joint Working
of planned review
Page 10
APPENDIX E
DEPT.
AREA OF AUDIT
DETAILS
STATUS
REVIEW
HSC
Newlands Road
To be fol owed up in 2009/10
To be fol owed up as part
of planned review
HSC
Bush RAC
To be fol owed up in 2009/10
To be fol owed up as part
of planned review
KEY TO DEPARTMENT CODES
BT
TRANSFORMATION
CD
CITY DEVELOPMENT
CORP
CORPORATE
CYPS
CHILDREN, YOUNG
PEOPLE & SKILLS
DCX
DEPUTY CHIEF
EXECUTIVE
HSC
HEALTH & ADULT
SOCIAL CARE
NH
NEIGHBOURHOODS
RE
RESOURCES
Page 11
Document Outline
