A Smith (Ataliwyd y cyfrif)

Dear Dudley Council,

Further to https://www.expressandstar.com/news/loca... please supply a copy of the report referred to.

Yours faithfully,

A Smith

Dudley Triggers, Dudley Council

Dear A Smith,

Information Access Request - Information Request DMBCIR:21269
Description : Payroll risks

I acknowledge your request for information received on 2019-08-19
10:24:00.

Your request is being considered and you will receive the information
requested within the statutory timescale of 20 working days (Freedom of
Information Act 2000/Environmental Information Regulations) or 1 month
from receipt (Data Protection access requests).

For your information, the Acts and Regulations define a number of
exemptions which may prevent release of the information you have
requested. There will be an assessment and if any of the exemption
categories apply then the information may not be released. In some
circumstances the decision to release information, or not, will be based
on a public interest test. You will be advised of any considerations,
subsequent decisions and your rights of appeal.

If the information you request contains reference to a third party then
they may be consulted prior to a decision being taken on whether or not to
release the information to you. You will be informed if this is the case,
including your rights of appeal.

Unless otherwise requested the information may be provided in electronic
format, paper copy, normal font size. If you require alternative formats,
e.g. language, audio, large print, etc. then please let me know.

There may be a fee payable for this information. This will be considered
and you will be informed if a fee is payable. In this event the fee must
be paid before the information is processed and released. The time limit
for responses is suspended until receipt of the payment.

If you have any queries or concerns then please contact the Information
Governance Officer at Dudley MBC, The Council House, Dudley, West
Midlands, DY1 1HF, telephone 0300 555 8283, e-mail
[Dudley Metropolitan Borough Council request email] .

Please remember to quote the reference number above in any future
communications.

Most of the information that we provide in response to Freedom of
Information/Environmental Information requests will be subject to
copyright protection. In most cases the copyright will be owned by Dudley
MBC. The copyright in other information may be owned by another person or
organisation, as indicated in the information itself. You are free to use
any information supplied for your own use, including for non-commercial
research purposes. The information may also be used for the purposes of
news reporting. However, any other type of re-use, for example, by
publishing the information or issuing copies to the public will require
the permission of the copyright owner.

For information where the copyright is owned by the Council details of the
conditions on re-use can be found on our website at www.dudley.gov.uk.

For information where the copyright is owned by another person or
organisation, you must apply to the copyright owner to obtain their
permission.

Yours sincerely,

The Information Governance Team
Council House
Priory Road
Dudley
West Midlands
DY1 1HF
[Dudley Metropolitan Borough Council request email]

A Smith (Ataliwyd y cyfrif)

Dear Dudley Triggers,

I would appreciate a response as this has now passed 20 working days and I would expect the information to be available.

Yours sincerely,

A Smith

Mail Delivery System,

2 Atodiad

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email address]
host mailcluster.dudley.gov.uk [193.105.48.24]
SMTP error from remote mail server after RCPT TO:<[email address]>:
550 5.1.1 <[email address]>: Recipient address rejected:
User unknown in relay recipient table

Information Governance, Dudley Council

1 Atodiad

  • Attachment

    Picture Device Independent Bitmap 1.jpg

    3K Download

 
Corporate Information Governance Team
3/5 St James’s Road, Dudley West Midlands. DY1 1HP
Tel: (01384) 815607  Fax: (01384) 815660
Email:[Dudley Metropolitan Borough Council request email]
[1]www.dudley.gov.uk
 

Our ref: 21269 Direct Line: 01384 816546 Date: 24/09/2019

 
 
Dear A Smith,
 
Freedom Of Information Act 2000 - Information Request 21269
 
I acknowledge your request for information received on 19/08/2019. Our
response is as follows.
 
Your Request
 
Further to
[2]https://www.expressandstar.com/news/loca...
 
please supply a copy of the report referred to.
 
Our Response
 
Your request for a copy of report referred to in the above link has now
been considered and it is not possible to meet your request.
 
This is because the Council is relying on an exemption – Section 36 (2)
(c) of the Freedom of Information Act, 2000.
 
Information to which this section applies is exempt information if, in the
reasonable opinion of a qualified person, disclosure of the information
under this Act would otherwise prejudice, or would be likely otherwise to
prejudice, the effective conduct of public affairs.
 
In accordance with the Freedom of Information Act 2000 this letter acts as
a Refusal Notice.
 
If this does not answer your question, then you may submit a further
request; it would be helpful if you could refine your request so that we
can advise what may be provided under the Freedom of Information Act and
any cost implications.
 
If you do have difficulty in accessing the information please contact
Dudley Council Plus on 0300 555 2345 who will be able to assist you.
 
If you are unhappy with the service you have received in relation to your
request and wish to make a comment or complaint, or request a review of
the decision, you should write to the Freedom of Information Officer at
Dudley MBC, The Council House, Dudley, West Midlands, DY1 1HF, telephone
0300 555 2345, e-mail [3][Dudley Metropolitan Borough Council request email]. 
 
Please remember to quote the reference number above in any future
communications.
 
If you are not content with the outcome of your complaint, you may apply
directly to the Information Commissioner for a decision.  Generally, the
ICO cannot make a decision unless you have exhausted the complaints
procedure provided by Dudley MBC.
 
The Information Commissioner may be contacted at:
 
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow 
Cheshire 
SK9 5AF
Telephone:   01625 545 700
[4]www.ico.org.uk
 
Most of the information that we provide in response to Freedom of
Information Act 2000 requests will be subject to copyright protection.  In
most cases the copyright will be owned by Dudley MBC.  The copyright in
other information may be owned by another person or organisation, as
indicated in the information itself.  You are free to use any information
supplied for your own use, including for non-commercial research
purposes.  The information may also be used for the purposes of news
reporting.  However, any other type of re-use, for example, by publishing
the information or issuing copies to the public will require the
permission of the copyright owner.
 
For information where the copyright is owned by the Council details of
the conditions on re-use can be found on our website at
[5]www.dudley.gov.uk.
 
For information where the copyright is owned by another person or
organisation, you must apply to the copyright owner to obtain their
permission.
 
 
Yours sincerely,
 
Steven Attwood
Information Governance Officer
Digital and ICT Services
Corporate Information Governance Team
Chief Executive’s Directorate
Tel: 01384 816546
Email: [6][email address]
 
 
This Email and any attachments contains confidential information and is
intended solely for the individual to whom it is addressed. If this Email
has been misdirected, please notify the author as soon as possible. If
this email has a protective marking of OFFICIAL – SENSITIVE, PROTECT or
RESTRICTED in its title or contents, the information within must be
subject to appropriate safeguards to protect against unauthorised or
unlawful processing and against accidental loss or destruction or damage.
OFFICIAL – SENSITIVE, PROTECT and RESTRICTED information should only be
further shared where there is a legitimate need. If you are not the
intended recipient you must not disclose, distribute, copy, print or rely
on any of the information contained, and all copies must be deleted
immediately. Whilst we take reasonable steps to try to identify any
software viruses, any attachments to this e-mail may nevertheless contain
viruses which our anti- virus software has failed to identify. You should
therefore carry out your own anti-virus checks before opening any
documents. Dudley Metropolitan Borough Council will not accept any
liability for damage caused by computer viruses emanating from any
attachment or other document supplied with this e-mail.

Please consider the environment - do you need to print this e-mail?

References

Visible links
1. http://www.dudley.gov.uk/
2. https://www.expressandstar.com/news/loca...
3. mailto:[Dudley Metropolitan Borough Council request email]
4. http://www.ico.org.uk/
5. http://www.dudley.gov.uk/
6. mailto:[email address]

A Smith (Ataliwyd y cyfrif)

Dear Dudley Council,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Dudley Council's handling of my FOI request 'Payroll risks'.

==================

Per information supplied in the freedom of information request https://www.whatdotheyknow.com/request/r... it is clear that considerable attention has been given to this area of the council by internal audit services in its 2018/19 audit work, included under the headings

* HR and Payroll Processes
* iTrent Exploitation
* ICT Audit: HR and Payroll Systems Review

It is also clear that this does not appear to be a new concern because the annual governance statement for 2018/19 states

5.4 Payroll Transactions
5.4.1 Internal Audit towards the end of 2017/18 highlighted a number of significant
issues with payroll transactional activity. As a result, a “Minimal” assurance
rating was given. The audit identified issues relating to the management of
overpayments, exception reporting, quality control, separation of duty,
reporting to the West Midlands Pension Fund, data quality and retention of
documentation. A follow up audit review has been undertaken and although
progress has been made to address the issues, it is considered insufficient
for the assurance rating to change.

At the time the area was overseen by Mr Adrian McCormick in the role of Chief Officer, who was also responsible for overseeing the project to install the new HR and Payroll system.

I would suggest that there is a public interest in understanding why at least two audits of this council area have produced an outcome of minimal assurance, as well as related questions such as how much the project cost and how much time (and further public money) has had to be spent auditing its failures.

If the council does not wish to reconsider sharing the report and its findings, which has already been subject to highlight in the press in the public interest, I feel that this should be taken up with the Information Commissioner's office and will do so.

I would also comment that the council appears to have entered into a damage limitation exercise, refusing to supply a copy of its risk register despite this being available to employees and a document usually shared by councils, as well refusing to supply information about audits that is already published in committee documents.

Having previously worked in public service myself I realise that there is an automatic reaction to close ranks. However:- sparing embarrassment and the CVs of employees, be they ex or current, is not sufficient justification for claiming an exemption on the grounds that providing information would prejudice the effective conduct of public affairs.

=====================

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/p...

Yours faithfully,

A Smith

Information Governance, Dudley Council

1 Atodiad

Dear Mr Smith

 

Re: Freedom of Information Request – 21269 – request for a review

 

Thank you for your email dated 28^th September 2019 requesting a review of
how the council has handled your request received on 19^th August 2019.

 

For the avoidance of doubt, you requested:

 

Further to
[1]https://www.expressandstar.com/news/loca...
please supply a copy of the report referred to.

 

Your original request was refused on the grounds that the exemption at
Section 36(2) of the Freedom of Information Act applied.  That is: the
disclosure of information would otherwise prejudice, or would be likely to
prejudice, the effective conduct of public affairs.

 

The application of this exemption must be based on the qualified person’s
reasonable opinion and, the public interest must be considered.

 

I confirm that in this instance, the qualified person who considered your
request was the Lead for Law and Governance, the Council’s Monitoring
Officer.  The opinion of the Monitoring Officer was provided on the 16^th
September 2019 and the opinion given was that the Audit report requested
engaged Section 36(2)(c).

 

The monitoring officer considered that prejudice would be likely to occur
as the general findings of the requested report have been reported to the
Local Authority’s Audit and Standards Committee. The report itself is
confidential and highlights weaknesses in controls. Disclosure of the
report would identify the weaknesses which could be exploited. Therefore,
in their view the disclosure would otherwise prejudice, or would be likely
otherwise to prejudice, the effective conduct of public affairs.

 

In addition to the opinion of the qualified person, the application of the
exemption requires the consideration of the public interest.  The audit
report in question was produced as part of the council’s internal audit
programme and due diligence process.  Officers use the report to give
advice to Directors and the Council’s Leadership team.  Directors and
other senior officers must be able to use the advice and information
gathered from the report to make a decision about the levels of risk they
accept, mitigate or control.  The report is, by its nature thorough and
individuals who have contributed to it must be able to be honest, open and
entirely candid.

 

The council considers that free and frank advice to Directors and other
senior officers could not be provided if this advice is likely to end up
in the public domain.  Internal audit reports rely on the full and frank
disclosure of information and the freedom to express opinions on matters
of significance and sensitivity to the Council.  The audit process also
relies on complete objectivity and the ability to access and examine
information that would often be considered confidential or commercially
sensitive. External parties such as contractors, suppliers and others with
a commercial stake in the information under scrutiny are expected to
cooperate with internal audit investigations.

 

Auditors provide advice to senior officers and to elected members on the
findings of their investigations and would expect to do so without the
competing demands of challenge from the press or the public on details of
their investigations. It would compromise the audit process in terms of
investigation and advice giving if, in specific cases or in general, such
reports were to become public.

 

At the time of the request a number of issues were still (and still are
ongoing) being discussed with the HR and Payroll software provider, some
of which are detailed within the audit report.

 

The disclosure would prejudice the authority’s ability to manage the
contractual relationship with the HR and Payroll software provider in the
best interests of the Council as the issues to be discussed would become a
matter of public or media enquiry. This would divert attention and
resources and potentially place the contractor in a difficult position.
Also, as the report details serious issues with the operation of the
Council’s HR and Payroll processes; if this information was disclosed it
does significantly increase the risk of fraud against the Council.

 

The report has only recently been issued as a final version and has not
been appropriately discussed by all relevant parties and future plans
agreed, the issues are therefore still live.  Disclosure at this time
would have an adverse effect on the council’s ability to offer an
effective public service or meet its wider service objectives or purpose.

 

You have commented that:

 

“…..there is a public interest in understanding why at least two audits of
this council have produced an outcome of minimal assurance, as well as
related questions such as how much the project cost and how much time (and
further pubic money) has had to be spent auditing its failures”.

 

However, the decision at this time is that the public interest is not
outweighed by what is considered to be the greater public interest in the
council having all the information it needs, clearly expressed and in
detail, I order for it to deliver its services effectively and
efficiently.  There is also a greater public interest in the council being
able to focus on addressing the findings in the audit report – and in
associated reports once completed – rather than having to divert resources
into fielding questions from external sources such as the media.

 

The conclusion of this review is therefore that the public interest lies
with maintaining the exemption under section 36(2)(c) on this occasion.

 

If you are not content with the outcome of your complaint, you may apply
directly to the Information Commissioner for a decision. Generally, the
ICO cannot make a decision unless you have exhausted the complaints
procedure provided by Dudley MBC.

 

The Information Commissioner may be contacted at:

 

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 01625 545 700

[2]www.ico.org.uk

 

Most of the information that we provide in response to Freedom of
Information Act 2000 requests will be subject to copyright protection. In
most cases the copyright will be owned by Dudley MBC. The copyright in
other information may be owned by another person or organisation, as
indicated in the information itself. You are free to use any information
supplied for your own use, including for non-commercial research purposes.
The information may also be used for the purposes of news reporting.
However, any other type of re-use, for example, by publishing the
information or issuing copies to the public will require the permission of
the copyright owner.

 

For information where the copyright is owned by the Council details of
the conditions on re-use can be found on our website at
[3]www.dudley.gov.uk.

 

For information where the copyright is owned by another person or
organisation, you must apply to the copyright owner to obtain their
permission.

 

Yours sincerely,

 

Lewis Bourne

Data Protection & Information Governance Manager

Corporate Information Governance

Finance & Legal

Tel: 01384 81 5608

 

 

 

This Email and any attachments contains confidential information and is
intended solely for the individual to whom it is addressed. If this Email
has been misdirected, please notify the author as soon as possible. If
this email has a protective marking of OFFICIAL – SENSITIVE, PROTECT or
RESTRICTED in its title or contents, the information within must be
subject to appropriate safeguards to protect against unauthorised or
unlawful processing and against accidental loss or destruction or damage.
OFFICIAL – SENSITIVE, PROTECT and RESTRICTED information should only be
further shared where there is a legitimate need. If you are not the
intended recipient you must not disclose, distribute, copy, print or rely
on any of the information contained, and all copies must be deleted
immediately. Whilst we take reasonable steps to try to identify any
software viruses, any attachments to this e-mail may nevertheless contain
viruses which our anti- virus software has failed to identify. You should
therefore carry out your own anti-virus checks before opening any
documents. Dudley Metropolitan Borough Council will not accept any
liability for damage caused by computer viruses emanating from any
attachment or other document supplied with this e-mail.

Please consider the environment - do you need to print this e-mail?

References

Visible links
1. https://www.expressandstar.com/news/loca...
2. http://www.ico.org.uk/
3. http://www.dudley.gov.uk/

A Smith (Ataliwyd y cyfrif)

Dear Information Governance,

Thank you for providing a summary of the concerns the council's legal officer and yourself have about releasing the report, which emphasises the severity of issues that have been identified.

Focusing on the key points:-

* there are serious issues with the operation of the Council’s HR and Payroll processes, exposing it to the risk of fraud and exploitation
* issues are being discussed with the HR and Payroll software provider (iTrent being a product of MHR, formerly MidlandHR or Midland Software) which are currently unresolved

In all honesty I agree and feel that this is sufficient evidence of management failures that the detail of the report would not add a great deal. You make a strong argument that this would put public funds and trust at risk further and that the council presently needs to focus on sorting out the mess.

As already noted, at the time the area was overseen by Mr Adrian McCormick in the role of Chief Officer, who was also responsible for overseeing the project to install the new HR and Payroll system.

In light of the situation I am not inclined to press for the release of this report or the several other audit reports that relate to the area. However, at some point in future there will need to be an assessment of the total costs and enquiry by members of the council's cabinet whose duty is to hold senior management to account, and that should not be allowed to take place behind closed doors. Local taxpayers need for it to be confirmed that the issues have been fully resolved.

Thank you again for the information supplied, and also for answering my wife's requests.

I will write again in due course.

Yours sincerely,

A Smith