This is an HTML version of an attachment to the Freedom of Information request 'All The Information Herts CC Hold On Audit No M 4110/12/003'.


 
 
 
 
 
 
 
Draft Internal Audit Report 

 
 
Hertsmere Borough Council – 
Tree Preservation Orders 
 

 
16 November 2012 
 
 
  
 
 
Issued to: 
Polly Harris-Gorf – Head of Planning and Building Control 
 
Mark Silverman – Policy and Transportation Manager 
 
Sajida Bijle – Director of Resources 
 
 
Report Status: 
Draft Report – Private and Confidential 
 
 
Reference: 
M4110/12/003 
 
 
Overall Assurance: 
Substantial  
 

SIAS    
 
 
 
 
                    Tree Preservation Orders 2012/2013 
INDEX
 

 
Section
 
Page
 
 
1. Executive 

Summary 

2.  Assurance by Risk Area 

3. Audit 
Commentary 

 
Appendix A – Management Action Plan 

Appendix B - Definitions of Assurance and Recommendation Priorities  
20 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2 of 19 

SIAS    
 
 
 
 
                    Tree Preservation Orders 2012/2013 
1  EXECUTIVE 
SUMMARY 
 
Introduction 
 
1.1  A review of Tree Preservation Orders (TPO) has been requested by the Director of 
Resources at Hertsmere Borough Council (HBC). This will serve to provide 
independent assurance to the Council that the making and administration of TPO’s is 
compliant with the law. 
 
1.2  The law on TPOs is in Part VIII of the Town and Country Planning Act 1990 and in the 
Town and Country Planning (Trees) Regulations 1999, which came into force on 2 
August 1999. The latter were subsequently amended by the Town and Country 
Planning (Trees)(Amendment no. 2)(England) Regulations 2008. The latest Town and 
Country Planning (Tree Preservation)(England) Regulations 2012 came into force in 
April 2012. 
 
1.3  A TPO is an order made by a local planning authority (LPA) in respect of trees or 
woodlands. The principal effect of a TPO is to prohibit the cutting down, uprooting, 
topping, lopping, wilful damage or wilful destruction of trees without the LPA's consent. 
LPAs may make a TPO if it appears to them to be expedient in the interests of amenity 
to make provision for the preservation of trees or woodlands in their area. 
 
1.4  The Register of Tree Preservation Orders maintained by HBC indicates that 30 TPO’s 
were made in 2010, two in 2011 and three in 2012 to date.  
 
Overall Audit Opinion 
 
1.5  Based on the work performed during this audit, we can provide overall substantial 
assurance that there is a largely sound system of control and that the register 
complies in all material aspects with the legislation, but there are some minor 
weaknesses, which may put a limited number of the system objectives at risk. 
 
1.6  The audit opinion was formed from management assurances given in response to our 
enquiries, plus examination of appropriate evidence relating to tree preservation 
orders. 
 
1.7  Please see definitions for the overall assurance levels at Appendix B, as well as the 
Assurance by Risk Area below. 
 
 
 
 
 
3 of 19 

SIAS    
 
 
 
 
                    Tree Preservation Orders 2012/2013 
Summary of Recommendations 
 
1.8  We have made six recommendations, one classified as Medium and five as Merits 
Attention, to strengthen the internal controls. 
 
1.9  Please see the Management Action Plan at Appendix A for further detail. 
 
Annual Governance Statement

 
1.10  This report provides a good level of assurance to support the Annual Governance 
Statement. 
 

ASSURANCE BY RISK AREA 
 
2.1  Our specific objectives in undertaking this work, as per the Terms of Reference, were 
to provide the Council with assurance on the adequacy and effectiveness of internal 
controls, processes and records in place to mitigate risks in the following areas: 
 
Risk Area  
None
Limited 
Moderate 
Substantial
Full 
Register of TPO’s (physical and 
electronic records) – completeness, 
timeliness, accuracy and validity of 
 
 
 
 
 
the maintenance and administration 
 
 
of the register in compliance with 
legal requirements. 
Making and confirmation of TPO’s 
in compliance with legal 
requirements and good practice as 
 
 
 
 
 
published by the Department of 
Communities and Local 
Government. 
 
Overall 
 
 
 
 
 
 
2.2  See definitions for the above assurance levels at Appendix B. 
 
3. AUDIT COMMENTARY 
 
3.1  Paragraphs 3.2 to 3.19 have been included to provide additional commentary on the 
agreed risk areas as per the Terms of Reference. 
 
4 of 19 

SIAS    
 
 
 
 
                    Tree Preservation Orders 2012/2013 
The Council’s TPO Register – compliance with legislation and good practice 
 
3.2  Internal Audit has been asked to comment on the existence and format of the TPO 
register maintained under the Council’s statutory duties as the Local Planning 
Authority (LPA), its availability for the public to view, and to confirm whether it complies 
in all material respects with legislative requirements. 
 
3.3  The law on TPOs is in Part VIII of the Town and Country Planning Act 1990 ('the Act') 
and in the Town and Country Planning (Trees) Regulations 1999 ('the 1999 
Regulations') which came into force on 2 August 1999. The ‘Tree Preservation Orders: 
A guide to the Law and Good Practice’, or “Blue Book”, published in 2000, brings 
together the Department of Communities and Local Government’s guidance and policy 
advice on the subject of TPO’s. It is the latter that Internal Audit utilised as the basis 
for its work on the TPO Register. 
 
3.4  The preface to the “Blue Book” states that “…local planning authorities can run the 
system in line with good administrative practice. Authorities are not required to follow 
the advice given; the Guide imposes no new burdens on them. But for many 
authorities the Guide is a useful point of reference which is relevant to their day-to-day 
work.” 
 
3.5  Internal Audit concurs with Planning management that the TPO Register is comprised 
of a series of files for each individual TPO, containing details of the Order, subsequent 
applications, appeals, correspondence, plans and other relevant documentation. 
These are filed by TPO number going chronologically back to the 1960s, rather than 
by address, which would be less practical as the same TPO can cover multiple 
addresses. These TPO files are maintained in lockable cabinets within the Planning 
team, but are available to view, as relevant and appropriate, should a request be made 
concerning a particular TPO. 
 
3.6  There is a ‘Green Folder’, entitled ‘Register of Tree Preservation Orders’, which is not 
part of the statutory register, and which contains individual sheets headed ‘Hertsmere 
Borough Council - Register of Tree Preservation Orders’. Each individual sheet 
contains data on key milestones and dates, including the unique TPO number, the 
date of making the order, objections received (28 days from the date of the notice) and 
date of confirmation. ‘The Green Folder’ serves as a summary, or index, for the 
individual TPO files described at paragraph 3.5, and has been provided to the public 
when a request has been made to view the Council’s register. The ‘Green Folder’ 
should not be viewed as standing in isolation, nor should it be viewed as “the 
Register”, despite the title on the folder and constituent sheets, as it is an integral part 
of a wider system of files. A finding on the ‘Green Folder’ has been raised in the 
attached Management Action Plan at Appendix A. 
 
3.7  In addition to the above, the Planning System database (on Microsoft Access) is also 
5 of 19 

SIAS    
 
 
 
 
                    Tree Preservation Orders 2012/2013 
used for internal purposes to maintain data on TPO’s. This electronic data duplicates 
that held on the ‘Green Folder’ and the individual TPO files, but due to technological 
and security limitations with the database, is not made available to view by the public.  
It is understood that new case management software for the entire Planning and 
Building Control Unit is being installed in 2013, and this may facilitate changes to the 
way that the TPO register is made available to the public in the future. 
 
3.8  Planning also maintain lever arch files, entitled ‘Register of Tree Preservation Orders 
Applications’, which contain hard copies of all refusal and consent forms issued. These 
files serve internal departmental administrative purposes, and do not constitute part of 
the TPO Register. 
  
3.9  Under paragraph 9.10 of the “Blue Book”, LPA’s are required to keep available for 
public inspection a register of all section 211 notices. The Council maintains separate 
lever arch files containing the Public Register (Section 211 notices), and these are not, 
and should not, be considered part of the TPO Register. Trees in conservation areas 
which are already protected by a TPO are subject to the normal TPO controls, but the 
Town and Country Planning Act 1990 also makes special provision for trees in 
conservation areas which are not the subject of a TPO. Under section 211 anyone 
proposing to cut down or carry out work on a tree in a conservation area is required to 
give the LPA six weeks' prior notice (a 'section 211 notice').  
 
3.10  Internal Audit has concluded that the Council’s TPO register complies in all material 
respects with the legislation and the “Blue Book”. Paragraphs 3.21 and 3.43 of the 
“Blue Book” both indicate that the LPA must make a copy of the TPO available for 
public inspection at the offices of the LPA, and it is noted that the Council makes these 
available on request.  
 
3.11  Paragraph 6.43 of the “Blue Book” states that the “… LPA are required to keep a 
register of all applications for consent which must be made available to the public at all 
reasonable hours. The register should include details of every application under the 
TPO and the LPA's decision.” Paragraph 7.15 indicates that the “… LPA should, when 
they receive an appeal decision, record the outcome on the public register which they 
are required to keep.” This information is maintained on the individual TPO files, which 
form part of the Council’s TPO Register. 
 
Comparison of TPO Register with other Councils 
 
3.12  Internal Audit enquiry of the Planning department at Welwyn Hatfield Borough Council 
indicated that members of the public making enquires to view the TPO Register are 
directed to the Council's website. Locations of TPOs have been entered on to the 
Council's Geographical Information System (GIS) accessible through the Planning 
pages on the Council's website. Searches can be performed using area maps, or 
directly using the TPO number, if known.  
6 of 19 

SIAS    
 
 
 
 
                    Tree Preservation Orders 2012/2013 
 
3.13  TPO files containing documentation linked to the individual Orders are not presently 
available to view using the GIS system, but electronic scanned files exist on Welwyn 
Hatfield Borough Council’s Planning system, which can be provided on request. Work 
is in development to make electronic files available via the GIS system in the near 
future. It was stated that TPO files will have all personal data removed, before these 
are made available to the public due to the requirements of the Data Protection Act 
1998. 
 
3.14  Planning Management has stated that Hertsmere Borough Council’s tree officers, who 
are shared with Aylesbury Vale District Council (AVDC), have advised that the 
Council’s TPO Register is maintained in the same manner as that at AVDC i.e. a 
series of files for each TPO containing details of the Order, subsequent applications 
and appeals, etc.  
 
3.15  A finding, for consideration, on making the TPO Register available electronically 
available via the Council’s website has been raised in the attached Management 
Action Plan at Appendix A. 
 
Making and Confirming TPO’s  
 
3.16  Internal Audit conducted detailed testing on a sample of four TPO’s to ensure that 
these had been made and confirmed in compliance with legal requirements and good 
practice as published by the Department of Communities and Local Government 
(DCLG). 
 
3.17  The testing identified one instance where an emergency TPO had been served before 
a site visit had been undertaken. Internal Audit was requested to comment on the 
validity of actions taken in this case, and whether it contravened legislation and best 
practice.  
 
3.18  The “Blue Book” states at paragraph 3.7 that ‘the LPA may in circumstances decide to 
carry out the visit without entering the land. They may consider that the risk of felling 
justifies the making of a TPO before they have been able to assess fully the amenity 
value of the tree. This should not, however, prevent them from making a preliminary 
judgement on whether a TPO would appear to be justified on amenity grounds, nor 
from making a more considered assessment before the TPO is confirmed.' 
 
3.19  The decision to serve an emergency TPO before a site visit was done, in this instance 
did not contravene best practice as outlined by the DCLG. 
 
 
      
 
7 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
 
 
 
 
 
 
1. 
Making the ‘Green Folder - Register of 
 
 
 
 
 
Tree Preservation Orders’ available for 
 
 
 
 
viewing by the public 
 
 
 
 
 
 
 
 
 
The Council maintains a ‘Green Folder’, 
Merits 
Internal Audit recommends that 
Responsible Officer: 
 
Attention 
entitled ‘Register of Tree Preservation 
members of the public are clearly 
 
Orders’, which contains individual sheets 
informed as to the nature and 
headed ‘Hertsmere Borough Council - 
purpose of the ‘Green Folder’, 
Register of Tree Preservation Orders’. 
entitled ‘Register of Tree 
  
Preservation Orders’, when 
‘The Green Folder’ serves as a summary, 
provided access as part a request 
or index, for the individual TPO files 
to view the Council’s TPO 
comprising the TPO Register, and has 
Register. 
been provided to the public when a 
 
request has been made to view the 
The public should be made aware 
Council’s register.  
that, where required and 
 
appropriate, they should request 
As described at paragraph 3.6 in the main 
access to the individual TPO files 
body of the report, the ‘Green Folder’ 
for full documentation linked to an 
should not be viewed as standing in 
entry in the ‘Green Folder’. 
isolation, nor should it be viewed as “the 
 
Register”, despite the title on the folder 
Planning should also give 
and constituent sheets, as it is an integral 
consideration to renaming the 
part of a wider system of files.  
‘Green Folder’ to avoid any 
 
misinterpretation or 
8 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
Associated risk 
misunderstanding linked to the 
 
impression that it is in fact the 
The title of the folder and its contents may 
TPO Register. 
be misleading to members of the public, 
who are provided with the ‘Green Folder’, 
when making a request to view the TPO 
Register, and may be unaware that the 
TPO Register is in fact comprised of a 
large number of individual files linked to 
the entries in the ‘Green Folder’. This 
may contribute to misunderstanding and 
miscommunication with the public. 
 
 
 
 
 
 
 
2.  
Maintenance and administration of the 
 
 
 
‘Green Folder - Register of Tree 
 
 
 
Preservation Orders’ 
 
 
 
 
 
 
 
1. Use of correction fluid 
 
 
 
 
 
 
 
Review of the ‘Green Folder’ identified 
Merits 
The officer responsible for 
Responsible Officer: 
that there were a number of historic 
Attention 
making hand written entries in the   
entries that had been changed using 
 
‘Green Folder’, entitled ‘Register 
 
correction fluid. This has not been done 
 
of Tree Preservation Orders’ 
since 2007.    
 
should cross through errors made 
 
 
when correcting information, 
9 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
The use of correction fluid was 
 
rather than apply correction fluid 
particularly common in the 1980’s, and 
 
to entries. 
was considered a normal response to 
 
 
error correction.  
 
 
 
 
 
Internal Audit enquiry of Planning and 
 
 
Human Resources indicated that only 
 
 
three officers have been responsible for 
 
 
maintenance of the ‘Green Folder’ and 
 
 
the individual TPO files comprising the 
 
 
TPO Register from 2005 to date. These 
 
 
include the 
 
 
 
from 2005 to January 2011, the 
 
 
(later 
 
 
) from 
 
 
January 2011 to October 2011, and 
 
 
from November 
 
 
2011 to date. 
 
 
 
 
 
2. Removal and duplication of pages  
 
 
 
 
 
Review of the ‘Green Folder’ identified 
Merits 
Consideration should be given to 
that one page had been replaced by a 
Attention 
making components of the TPO 
photocopy when the folder had been 
 
Register available to the public to 
viewed by a member of the public, and 
 
view electronically, e.g. via the 
that there was a separate duplicate page 
 
Council website. See 
10 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
that had been produced as a result of a 
 
recommendation three below. 
page going missing previously and 
 
 
subsequently being rediscovered.   
 
 
 
 
 
3. Accuracy of entries (1) 
 
 
 
 
 
Examination of the ‘Green Folder’ found 
Merits 
a)  The officer responsible for 
that there was an incorrect entry 
Attention 
making hand written entries in 
supporting the date that the TPO was 
 
the ‘Green Folder’, entitled 
certified and the notice served.  This had 
‘Register of Tree Preservation 
no bearing on the validity of the TPO 
Orders’ should be reminded of 
itself.  
the importance of entering 
 
details on the register 
Review of the actual TPO on the 
correctly.  
individual TPO file confirmed that the date 
 
should have been 11/8/2005, and not 
b)  Corrective action should be 
11/8/2004. This was also confirmed 
taken and the errors on the 
through review of the Planning database 
‘Green Folder’ should be 
(Access), which had the correct date 
adjusted, using the guidance 
entered. 
above so that the correction is 
 
transparent. 
This was identified as human error and is 
 
considered to be an isolated historical 
c)  Periodic review of the ‘Green 
instance, which had been completed by 
Folder’ should be conducted 
an officer that has since left the Council.  
by an officer independent of its 
 
maintenance as part of a 
11 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
 
quality control process to 
4. Accuracy of entries (2) 
ensure that it complies with 
 
expected standards. 
Internal Audit testing of a sample of four 
TPO’s identified that two had Letters of 
Confirmation whose dates did not 
correspond with entries on the ‘Green 
Folder’.  This did not affect the validity of 
the TPOs themselves.  
 
Associated risks 
 
Alterations or anomalies on documents 
made available to the public to view can 
lead to confusion on the part of anyone 
requesting to view them.  Impacts include 
time and cost of responding to enquires 
regarding alterations and reduced 
confidence in the data held. 
 
As the ‘Green Folder’ has been made 
available to the public to view, the public 
may not be able to place reliance on the 
information presented therein. This may 
affect decision making by external users 
of the information, and impact on the 
12 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
Council’s accountability and reputation.. 
  
 
 
 
 
 
 
3. 
Electronic or web-based TPO Register 
 
 
 
 
 
 
 
 
The Council’s TPO Register is a paper 
Merits 
Consideration should be given to 
Responsible Officer: 
based system maintained in a number of 
Attention 
making the TPO Register 
 
files and folders in lockable cabinets 
available electronically through 
within the Planning team. 
the Council’s website in a similar 
 
manner to planning applications. 
Internal Audit enquiry of a neighbouring 
authority (Welwyn Hatfield Borough 
Council) indicated that they are in the 
process of introducing an electronic, web-
based TPO Register accessible through 
their Council website. Please see 
paragraphs 3.12 to 3.15 in the main body 
of the report for further detail. 
 
Associated risk / opportunity  
 
There is an opportunity to free up 
valuable storage, and rationalise the 
number of paper documents held by 
placing TPO records online where they 
are available to members of the public at 
all times, including outside of normal 
13 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
office hours. 
 
It is important to inject a note of caution to 
this, in that records may need to be 
cleansed of personal data that may lead 
to an infringement of the Data Protection 
Act 1998, prior to being made available to 
the general public through the Council’s 
website.  
 
 
 
 
 
 
 
4. 
Omissions of data from the Planning 
 
 
 
 
 
database (Access) 
 
 
 
 
 
 
 
 
 
Review of a sample of data extracted 
Merits 
a)  Consideration should be given  Responsible Officer: 
 
from the Planning database (Access) 
Attention 
to locking fields on the 
 
 
identified two instances of missing data 
Planning database (Acolaid), 
 
from fields linked to individual TPO’s. 
or the incorporation of a user 
 
Both instances were over 10 years old. 
prompt that asks for 
 
 
confirmation that the action of 
One TPO had an empty address field, 
deletion is desired. 
while the other did not have an Order 
 
date.  
b)  Corrective action should be 
 
taken on the identified missing 
Internal Audit investigation found that 
data, and consideration should 
fields can be edited and potentially 
be given to an examination of 
14 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
deleted in error. This was provided as an 
the Planning database 
explanation for the missing entries.  
(Access) to identify the 
 
number of missing data fields 
The missing entries did not compromise 
and populate these as 
adequate cross-referencing to other TPO 
necessary.   
data sources, especially the individual 
 
TPO file, and the missing data was 
available on the ‘Green Folder’ and the 
individual TPO file .  
 
Associated risks 
 
Reports generated from the Planning 
database (Access) may be incomplete 
and inaccurate, not serve the purpose 
intended, and obtaining missing data from 
paper files may be difficult and time-
consuming. 
 
Data held electronically in respect of 
TPO’s may be deleted in error. 
 
 
 
 
 
15 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
 
 
 
 
 
 
5. 
Making and Confirmation of TPO’s – 
 
 
 
 
 
Completeness of the TPO  
 
 
 
 
 
 
 
 
 
Internal Audit review of a sample of four 
Medium 
a)  Officers preparing documents  Responsible Officer: 
TPO files, all of which were found to be 
and serving TPO’s should be 
 
valid and correctly served, identified:  
reminded to check all 
 
document components that 
a)  One instance where notice of the TPO 
form the TPO Order are 
had been served, but a copy of 
complete and have been 
Schedule 1 had not been placed on 
copied for the file.  
the individual TPO file forming part of 
 
the TPO Register. Discussion with the 
b)  The TPO checklist should be 
did not 
completed in all cases and 
confirm that this was actually sent out. 
should be redesigned to 
However, the information on the 
include the initials of the 
schedule was itself clearly recorded on 
officer that has checked the 
the TPO plan and the TPO itself was 
TPO.  
valid. It was mentioned that a duplicate 
 
schedule can be produced from the 
c)  A new section should also be 
Planning System, however the one 
added to indicate that all 
created from the Planning database 
component parts of the TPO 
(Access) was incomplete and did not 
Order have been sent and 
provide full details of the tree subject 
copied for the file. 
to a TPO. 
 
 
 
16 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
b)  The same file does not contain a TPO 
 
Checklist to indicate the date and 
 
method of delivery of the TPO. 
 
 
c)  The Checklist does not currently 
contain a section to support the 
separate component documents that 
form the TPO. 
 
Risk 
 
Tree Preservation Orders have the 
potential to be invalid due to incorrect 
process being followed.    
  
 
 
 
 
 
 
6. 
Making and Confirmation of TPO’s – 
 
 
 
Documenting Conversations 
 
 
 
 
 
 
 
Internal Audit has identified that 
Merits 
A suitable method of 
Responsible Officer: 
conversations between officers and 
Attention 
documenting or recording 
 
members of the public are not routinely 
conversations concerning TPO’s 
documented, even for contentious or 
between officers and customers 
controversial TPO’s, with records not 
should be explored and put in 
maintained and entered on the Planning 
practice, e.g. hard copy notes or 
database (Access) or recorded using any 
narrative added on the Planning 
17 of 19 

Appendix A - Management Action Plan    
                                              Tree Preservation Orders 2012/2013 
No.  Finding / Associated Risk 
Priority 
Recommendation 
Management Response 
Target Date 
other method.  
system to support conversations.  
 
 
It was noted that the advice generally 
given when a call is received from a 
customer, is to ‘put it in writing’. 
 
Risk 
 
Adequate records may not exist to 
support telephone conversation between 
members of the public and the Council, 
and no source of reference will exist if 
needed at a later date, to support advice 
or information given to the public by the 
Council. 
 
There may be an impact on the Council’s 
reputation and staff morale if allegations 
are made that incorrect information or 
advice was given to a member of the 
public.  
 
18 of 19 

Appendix B - Definitions of Assurance and Recommendation Priorities 
 
 
                    Tree Preservation Orders 2012/2013 
Levels of assurance 
 
Full Assurance 
There is a sound system of control designed to achieve the system objectives and manage 
the risks to achieving those objectives. No weaknesses have been identified. 
Substantial Assurance 
Whilst there is a largely sound system of control, there are some minor weaknesses, which 
may put a limited number of the system objectives at risk. 
Moderate Assurance 
Whilst there is basically a sound system of control, there are some areas of weakness, which 
may put some of the system objectives at risk. 
Limited Assurance 
There are significant weaknesses in key control areas, which put the system objectives at 
risk. 
No Assurance 
Control is weak, leaving the system open to material error or abuse. 
 
Priority of recommendations 
High 
There is a fundamental weakness, which presents material risk to the objectives and requires 
urgent attention by management. 
Medium 
There is a significant weakness, whose impact or frequency presents a risk which needs to be 
addressed by management. 
Merits Attention 
There is no significant weakness, but the finding merits attention by management. 
 
 
 
 
19 of 19