Draft
Internal Audit Report
Follow Up Report on
Areas Requiring Improvement
Devon County Council
September 2013
Restricted
Auditing for achievement
AUDIT FOLLOW UP REPORT ON AREAS REQUIRING IMPROVEMENT
1. INTRODUCTION
1.1 At the 28th June 2013 Audit Committee meeting Members were provided with the Annual Internal Audit report for the Council. Appendix 2 of that report provided a summary of the audits undertaken during 2012/13, along with our assurance opinion. Where a "high" or "good" standard of audit opinion was provided we confirmed that, overall, sound controls were in place to mitigate exposure to risks identified; where an opinion of "improvement required" was provided then issues were identified during the audit process that required attention. We provided a summary of some of the key issues reported that were being addressed by management and pointed out that we were satisfied that management were appropriately addressing these issues.
1.2 Members discussed the report and requested a detailed report to a future meeting updating the Committee on the "improvement required" areas highlighted in Appendix 2 to the report.
1.3 To provide the assurance that Members required, Devon Audit Partnership has undertaken follow up audit reviews, where possible, and the results from this process are contained in this report at Appendix 1, along with any further follow up activity on audits that remained as assurance opinion 'improvements required' in August 2013.
2. PROCESS
2.1 For each service area where an audit opinion of "improvements required" was provided at the end of 2012/13 we completed a follow up review. The follow up review was undertaken to provide assurance to management and those charged with governance, that the agreed actions identified at our initial audit visit had been implemented, or suitable progress is being made to address the areas of concern.
2.2 Our approach was to initially write to the appropriate service manager to obtain an update on progress being made against agreed audit recommendations. The level of assurance we requested was dependant upon the priority of the agreed recommendation.
2.3 For recommendations of "low" priority we required written confirmation that the action had been enacted upon, or an update on the progress being made.
2.4 For "medium" priority recommendations we required written confirmation that the action has been enacted upon, or an update on the progress being made, plus some evidence to support this.
2.5 For "high" priority recommendations we required written confirmation that the action had been enacted upon, or an update on the progress being made, plus some evidence to support this (as above) plus, and depending upon the nature of the recommendation, we considered a physical visit to confirm that the recommendation was operating as expected and that the identified risk had been reduced to an acceptable level.
2.6 Following the completion of our review we considered the progress made against all of the agreed recommendations. This then enabled us to reconsider our assurance opinion against each of the risk areas identified, and has enabled us to review our overall assurance opinion enabling an updated opinion to be provided where appropriate.
2.7 It should be noted that this updated opinion is based upon the assumption that systems and controls as previously identified at the original audit remain in operation and are being complied with in practice. The purpose of our follow up exercise has not been to retest the operation of these previously assessed controls, but to consider how management have responded to the agreed action plans following our previous work.
2.8 Appendix 1 shows the results of this exercise and the associated inherent risk for each audit area.
3 FINDINGS
3.1 Overall we can report that progress is being made against the agreed recommendations following our initial audit and this is shown in the direction of travel in appendix 1 to this report. A significant number of opinions remain unchanged at this time although this does not necessarily reflect lack of action.
3.2 It should be noted that in a number of instances recommendations are being actioned but this is ongoing and therefore we have been unable to form a new overall assurance opinion. It is acknowledged that the need to make changes to some processes can take time to achieve, and as a consequence not all recommendations have been completed, but this is as expected.
3.3 In some instances we were unable to obtain a full response from the service area due to employees taking their annual leave entitlement; we will ensure that once staff have returned from the holiday period that we complete the follow up process, and confirm that the service area is on track to implement agreed recommendations. Any areas where issues or concerns are noted will be flagged to senior management for further consideration and resolution.
3.4 During our initial audit work we have made reference to areas where risk exists; however in some cases it is either not economically appropriate to address this risk, or technical solutions are not yet available. In such cases management agree to accept this risk, and use other monitoring arrangements to ensure that the risk is kept to a minimum. In such cases we are unable to provide an improved audit opinion, although we fully recognise that the risk is identified, monitored and management will resolve the issue as and when opportunities arise.
3.5 Appendix 1 of this report set out the audits at the end of 2012/13 which were identified as "improvements required". The appendix shows the current (updated) assurance opinion following our follow up work, and a "direction of travel". We have also provided some more detailed commentary on progress being made.
4 CONCLUSION
4.1 Overall we conclude that progress has been made against the agreed audit recommendations. Improved assurance opinions have been provided in a number of areas, and the direction of travel is showing as improving in the majority of areas (see appendix 1); this should provide assurance to those charged with governance.
4.2 We would like to acknowledge and offer our thanks to all those who have assisted with this process. We understand that the work was undertaken at a traditionally difficult time for management (due to the summer holiday season) and their help in providing the information for this review is appreciated.
Robert Hutchins
Head of Devon Audit Partnership
September 2013
Appendix 1
Table to show updated Audit Assurance Opinion after completion of follow up work to end of August 2013
The Inherent Risk from audit needs assessment is shown for each audit area.
Corporate Services
| Audit Area | Audit Assurance Opinion as at 31 March 2013 | Updated Audit Assurance Opinion as at 31 August 2013 | Direction of Travel | Commentary |
| County Treasurer | ||||
| Treasury Management 2012/13
(Inherent Risk - Low) | Improvements Required (Draft) | Good Standard |
| Although the opinion remained 'Improvements Required' for the final report, a number of the recommendations made have now been implemented, or are in the process of being implemented. The opinion has therefore been updated to 'Good Standard'.
|
| Cheque Printing Error 2012/13
(Inherent Risk Low)
| Improvements Required | Improvements Required |
| Progress has been made and the recommendations have been largely addressed which has been reflected in the direction of travel. Further improvement would be achieved through the development of a specific checklist for system testing and hence the updated assurance opinion remains as 'Improvements Required'.
|
| Audit Area | Audit Assurance Opinion as at 31 March 2013 | Updated Audit Assurance Opinion as at 31 August 2013 | Direction of Travel | Commentary |
| Human Resources | ||||
| Payroll 2012/13
(Inherent Risk Medium)
| Improvements Required (Draft) | Improvements Required (Draft) |
| A draft report meeting was held after the year end, resulting in additional work being undertaken. Although this is now complete, the final report has not yet been agreed.
Initial management responses indicate that arrangements are being made to implement a number of recommendations; however there are some significant areas which remain outstanding.
The direction of travel is therefore positive, but the opinion remains 'Improvements Required'.
|
| Appendix E 2011/12
(Inherent Risk Low)
| Improvements Required | Improvements Required |
| Due to other higher priority projects, the majority of recommendations have not yet been actioned. Responses from management suggest that changes to processes and the claim form have been made and this is reflected in the direction of travel, however we have been unable to obtain evidence to verify this within the committee timescales. A review of the policy is planned, which along with the move away from the current Car Plan system will address the remaining recommendations.
|
| Audit Area | Audit Assurance Opinion as at 31 March 2013 | Updated Audit Assurance Opinion as at 31 August 2013 | Direction of Travel | Commentary |
| Pay Slip Production 2011/12
(Inherent Risk Low) | Improvements Required | Improvements Required |
| The direction of travel reflects the on-going project to implement on-line pay advices and mitigate the remaining residual risks, however the assurance opinion remains 'Improvements Required' until the on-line pay advice process has been successfully implemented. Internal Audit is working with the project team and Information Governance as part of the 2013/14 audit plan to ensure that risks in the new process are identified and addressed.
|
| Business Strategy and Support | ||||
| Contracts and Tendering Children's Centres
(Inherent Risk Low) | Improvements Required | Improvements Required |
| Response outstanding and thus unable to report on status of the agreed actions or update the assurance opinion.
|
| Audit Area | Audit Assurance Opinion as at 31 March 2013 | Updated Audit Assurance Opinion as at 31 August 2013 | Direction of Travel | Commentary |
| ICT Network Management
(Inherent Risk Medium) | Improvements Required | Improvements Required |
| Since the issue of the original report, technologies and solutions have changed and are in the process of being introduced. However, it is likely that the recommendations in the report still apply and will be reviewed along with the technological changes as part of the 2013/14 audit plan. Thus we are unable to update the assurance opinion at this time.
|
| Database Administration (Finest) 2012/13
(Inherent Risk Medium) | Improvements Required | Improvements Required |
| The main area of concern remains around the medium term sustainability of the Software AG Finest business application and the associated database and technical infrastructure. These concerns have been recognised within the recent Financial Systems Review undertaken within DCC and mitigating strategies have been identified within the resultant report. It is anticipated that a project to review and improve financial systems will contain work streams that will assist in mitigating some of the risks associated with the sustainability of Finest.
|
| Website and Web Services 2012/13
(Inherent Risk Medium) | Improvements Required | Improvements Required |
| The final report for this piece of work has only just been recently issued. There is no update on progress as yet.
|
| Storage Area Network (SAN) 2012/13
(Inherent Risk Medium)
| Improvements Required | Improvements Required |
| Since the start of this audit, significant progress has been made in addressing the key issues identified by management when the audit commenced. The Storage Array Network (SAN) in place in the main data centre at County Hall is still currently running at approximately 70% capacity, and capacity needs to be significantly further extended to cope with present and future demand. It is estimated that data storage capacity requirements will increase at some 50% compound for the foreseeable future. Action has now been taken to acquire an additional parallel Storage Array Network that will significantly improve current capacity levels, and assist in removing existing processing bottlenecks. This was commissioned in January 2013, with an on-going roll-out extending over two to three months.
However, we have been unable to meet with management within the Audit Committee timescales to ascertain the latest progress in relation to the recommendations made, and cannot provide an updated audit assurance opinion or direction of travel at this time.
|
Place
| Audit Area | Audit Assurance Opinion as at 31 March 2013 | Updated Audit Assurance Opinion as at 31 August 2013 | Direction of Travel | Commentary |
| Highways and Traffic Management | ||||
| Dangerous Trees 2012/13
(Inherent Risk Medium) | Improvements Required | Improvements Required
|
| A follow-up review was carried out in 2012/13 and it was confirmed that some progress has been made with regards to improving the reporting capabilities of the commercial software.
Time has been included in this year's plan to carry out a more detailed review of the Environmental Landscape Management System (ELMS) in the second half of the year. |
| Civil Parking Enforcement Validation of agency claims 2011/12
(Inherent Risk Medium)
| Improvements Required | Good Standard
|
| Following our review, new operating arrangements have been agreed which require district council colleagues to provide a full narrative of overheads which exceed an agreed de-minimus figure. The Highway Management Team has also commissioned a full external review of the operation which is likely to provide a catalyst for further change and improvement. |
People
| Audit Area | Audit Assurance Opinion as at 31 March 2013 | Updated Audit Assurance Opinion as at 31 August 2013 | Direction of Travel | Commentary |
| Mental Capacity Act
(Inherent Risk Medium) | Improvements Required | Improvements Required |
| Management have responded positively to the report and been proactive in creating a risk register to incorporate actions required based on the recommendations. This positive response is reflected in the direction of travel. However, a number of recommendations remain outstanding and thus the assurance opinion remains unchanged at this time. A follow up audit is due in the latter half of the 2013/14 financial year. |
| Personalisation 2011/12
(Inherent Risk High) | Improvements Required | Improvements Required |
| Management have started to transform systems, processes, staff and services to ensure they are in-line with the Personalisation agenda. However, our audit identified that significant progress still needs to be made to enable it to meet the target of all social care users having an 'authentic' personal budget, with the majority on direct payments.
Uptake of direct payments remains relatively low, resulting in targets having to be revised.
A follow up audit is due in September 2013. |
| Audit Area | Audit Assurance Opinion as at 31 March 2013 | Updated Audit Assurance Opinion as at 31 August 2013 | Direction of Travel | Commentary | |||
| DASH, DAPH, DAG, SHAD Budgets
(Inherent Risk Low)
| Improvements Required | Improvements Required |
| We have been unable to meet with management within the Audit Committee timescales to ascertain the latest progress in relation to the recommendations made, and cannot provide an updated audit assurance opinion or direction of travel at this time. | |||
| Devon Personalised Learning Service 2011/12
(Inherent Risk Medium) | Improvements Required | Improvements Required |
| Action plan in place.
Moving to Academy status in November 2013.
| |||
| Care Leavers 2011/12
(Inherent Risk Low) | Improvements Required | Improvements Required |
| We have been unable to meet with management within the Audit Committee timescales to ascertain the latest progress in relation to the recommendations made, and cannot provide an updated audit assurance opinion or direction of travel at this time. | |||
| Fostering 2012/13
(Inherent Risk High)
(Inherent Risk Medium)
| Fundamental Weaknesses - ICT
Good Standard Staff resourcing
| Fundamental Weaknesses - ICT
Good Standard Staff resourcing
|
| A project to bring about improvements to business process and data integrity has commenced. The first stages towards the use of CareFirst as the core information system has been completed and all Adoption staff attended CareFirst training and are now using the system. A plan has now been agreed for migration of all remaining systems and spreadsheets that are suitable for transfer to CareFirst before the end of the current financial year. Reporting requirements (both statutory and operational) are being considered as part of each stage of system migration. | |||
| Administrative Support 2012/13
(Inherent Risk Low) | Improvements Required | Improvements Required |
| We have been unable to meet with management within the Audit Committee timescales to ascertain the latest progress in relation to the recommendations made, and cannot provide an updated audit assurance opinion or direction of travel at this time.
| |||
| Residential Care Homes 2012/13
(Inherent Risk Low)
Daw Vale
Greenfields
Whipton Barton
Kenwyn
|
Fundamental Weaknesses
Improvements Required
Improvements Required
Improvements Required
|
Good Standard
Good Standard
Good Standard
Good Standard |
| Establishment audits, based around the key financial systems.
Recent audit showed significant improvements in systems and procedures in place from time of previous audit.
Further to the audit of residential care homes in 2013/14 a summary audit report was issued detailing findings and themes. Senior management have tasked the relevant accountant to ensure her team implement changes as necessary in conjunction with recommendations and good practice detailed within the report. | |||
| Adoption Services
(Inherent Risk High) | Fundamental Weaknesses | Improvements Required |
| Confirmation has been received that actions and improvements are ongoing. In addition a joint project involving Adoption and Fostering has been established to address the remaining agreed actions and further improve the service area. However this has not been evidenced and as such the overall assurance opinion cannot be further improved at this time. The direction of travel reflects the status of actions as described by management.
| |||
| Residential Homes Performance
(Inherent Risk Medium) | Improvements Required | Improvements Required |
| A Quality Improvement Board has been established who are monitoring progress and implementation of actions relating to the audit report. The overall assurance opinion remains unchanged due to the ongoing nature of the action plan, however the direction of travel acknowledges improvements already achieved and the creation of a Service Continuous Improvement Plan.
An audit of the QIB is planned during the 2013/14 financial year. |