Waverley Borough Council

AUDIT COMMITTEE

2nd March 2020

Title:
PROGRESS ON THE IMPLEMENTION INTERNAL AUDIT RECOMMENDATIONS

Lead Councillor:	Councillor Peter Marriott, Chairman of the Audit Committee

Head of Service:	Graeme Clark, Strategic Director

Key decision:	Yes

Access:	Public

1. Purpose and summary
Purpose and summary of the report. To inform the Audit Committee of Senior Management’s progress in implementing the recommendations raised by Internal Audit following a review in their service areas. This report will enable the Committee to consider what action is required in respect of those that are overdue or appear likely to be implemented later than the original agreed implementation date.

2. Recommendation
2.1 It is recommended that the Committee considers the information contained in Annexe 1 and, following discussion at the Audit Committee meeting identifies any action it wishes to be taken. 2.2 It is recommended that the Committee considers the Head of Service(s) justification for a change in the due date for the recommendations listed in Annexe 2 and agree an appropriate implementation date(s).

3. Reason for the recommendation
To enable the Audit Committee to be informed of the status of recommendations accepted by Heads of Service but not yet implemented or progress made to implement by the agreed implementation date.

4. Background
4.1 This report provides the Audit Committee with the latest position regarding the implementation of Internal Audit recommendations.

5. Relationship to the Corporate Strategy and Service Plan
5.1 A financially sound Waverley, with infrastructure and services fit for the future

6. Implications of decision
6.1 Resource (Finance, procurement, staffing, IT) Internal audit work helps management in achieving good value for money and, individual recommendations may have value for money implications.
6.2 Risk management There is a risk that where weakness or non-compliance identified as part of audit reviews, if not actioned to strengthen the controls will not assist to prevent the materialising of the risks identified.
6.3 Legal There are no direct legal implications, although good governance and probity are strengthened by attending to the matters raised in audit recommendations.
6.4 Equality, diversity and inclusion There are no direct equality, diversity or inclusion implications in this report. Equality impact assessments are carried out when necessary across the council to ensure service delivery meets the requirements of the Public Sector Equality Duty under the Equality Act 2010.
6.5 Climate emergency declaration There are no direct implications in this report

7. Consultation and engagement
7.1 Heads of Service

8. Other options considered
8.1 N/A

9. Governance journey
9.1 The minutes of the meeting will be included on the Council agenda.

Annexes:

Annexe 1 – provides the current position on recommendations due for completion at the end of the month of the Audit Committee date.

Annexe 2 – provide a justification from the Heads of Service requesting an extension to the originally agreed implementation date.

Background Papers

There are no background papers, as defined by Section 100D (5) of the Local Government Act 1972).

CONTACT OFFICER:

Name:	Gail Beaton

Position:	Internal Audit Manager

Telephone:	01483 523260

Email:	gail.beaton@waverley.gov.uk

Agreed and signed off by:

Legal Services: 10 February 2020

Head of Finance: 11 February 2020

Strategic Director: 11 February 2020

Portfolio Holder: N/A

ANNEXE 1

Audit Recommendations overdue or due within the end of the month after the AC 31 March 2020 Generated on: 20 February 2020

Action Status Cancelled Overdue; Neglected Unassigned; Check Progress Not Started; In Progress; Assigned Completed

Head of Service Allum, David

Action Code & Description	IA20/05.001 Policies and Procedures
No documented policies or procedures are in place to monitor and control the stocks and collection of income relating to the Restaurant or the Borough Hall Vending Machines	Exit Meeting Date	29-Nov-2019
Due Date	29-Feb-2020
Risk Level	Medium Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	Documented procedures to be developed and cascaded to all members of staff involved in the process. These should be held in an area so that they are readily available for all staff with responsibilities to enable them to be followed, particularly where a key members of staff are not available due to illness or annual leave, ensuring that consistency of operating processs is applied.
Status	Check Progress	Progress	10%	Head of Service	David Allum
All Notes

Action Code & Description	IA20/05.002 Stock Records
Borough Hall vending machine is stocked by the Borough Hall Manager, who also collects and banks the income: - No records are maintained to record the stocks put into the vending machine as these are taken from the Borough Hall bar stock. The Restaurant staff stock and collect the income from the vending Machine on the 1st floor link corridor. Although a “Vending Machine Balance sheet” is completed this is not accurately completed or reconciled. This sheet is not fully completed with no indication of the period it covers or who has been involved in the counting and collection of the cash. The accuracy of completeness cannot be relied upon re the audit observation completed as part of the review.	Exit Meeting Date	29-Nov-2019
Due Date	29-Feb-2020
Risk Level	Medium Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	Forms will be enhanced to including evidence of who has completed them, with signatures of those involved in the process. DA-Agreed in stock terms however we will be looking to go cashless to avert issues in that area. Daily stock records will be maintained to accurately record the items put into any of the vending machines. This record will detail the number/s of items stocked into the machines, who completed the stocking of the vending machine and date. DA-Agreed.
Status	Check Progress	Progress	15%	Head of Service	David Allum
All Notes

Action Code & Description	IA20/05.003 Safeguarding Cash and Stocks
At no point in the operation of the vending machine stocking up or collecting/counting the income, are there two people present when the vending machine is opened. Each member of staff independently completes their own part of the process, one dealing with stock and another collecting and counting the income. However, both have access to the machines cash collection box when completing their different tasks.	Exit Meeting Date	29-Nov-2019
Due Date	29-Feb-2020
Risk Level	High Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	We will need to address this. I am hoping that our stock procedures will be resilient enough to negate the need for this to be a two person job as this is not a good use of resources.
Status	Check Progress	Progress	25%	Head of Service	David Allum
All Notes

Action Code & Description	IA20/05.004 Access to Vending machine Cash and Stocks
We were advised that one member of staff counts the cash collected and a member of staff from facilities counter signs to confirm the value being banked. However, this is after the person emptying the machine has had sole access to the vending machine income. This does not provide assurance that all income has been banked without the risk of appropriation occurring before the banking sheet is provided for the second signature from the facilities team. Testing was carried out on 10 Vending Machine Banking Sheets and we found that one had not been checked by a second person (usually facilities team) before being presented to exchequer services for banking. It was also noted that there is also no indication on the Banking sheet of the value of the float that remains in the Vending machine, although this is shown on the “Vending Machine Balance Sheet” although no signatures are retained of the officer/s completing this form or a second dependent check that this value is indeed the float of £15 contained in the Vending machine. Having the second independent check of the cash collected and the cash float retained in the machine at each cash empting exercise protects staff against allegations should any discrepancies be identified.	Exit Meeting Date	29-Nov-2019
Due Date	29-Feb-2020
Risk Level	Medium Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	DA - To be averted by a move to a cashless electronic process. The Facilities Manager has been in touch with the Vending Machine Supplier and contactless payments are compatible with the vending machine currently in use.
Status	Check Progress	Progress	50%	Head of Service	David Allum
All Notes	The cashless facility is being installed on the vending machines w/c 24th February this will produce a report of the sales activity for the period and agreed to the income received via the appropriate merchant number. (GB On behalf of DA).	20-Feb-2020

Action Code & Description	IA20/05.005 Access to Cash Collection Box
Anyone with access to the vending machine key also has the opportunity to access the cash collection box. Therefore due to the fact that there are circumstances where only one person is involved in either stocking the vending machine and another separately removes and counts the cash provides an opportunity for income to be vulnerable or miss appropriated. The viability of purchasing a lockable receptacle for the vending machines should be considered. Only those with access to the dedicated key to this area will have access to the vending machine income when two people will be present. This can be purchased from the supplier as per the instructions manual.	Exit Meeting Date	29-Nov-2019
Due Date	29-Feb-2020
Risk Level	High Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	DA-To be averted by a move to cashless electronic functionality
Status	Check Progress	Progress	50%	Head of Service	David Allum
All Notes	The cashless facility is being installed on the vending machines w/c 24th February this will produce a report of the sales activity for the period and agreed to the income received via the appropriate merchant number. (GB On behalf of DA).	20-Feb-2020

Action Code & Description	IA20/05.006 Stock Records
Current the record completed to show the stocks put into the vending machine is manually recorded. During testing it was confirmed that this is not accurately completed and lead to errors or omissions. The vending machines purchased do have the functionality to register and record the sales made, change provided or failures to deliver if the programming had been setup at installation. A review of the programming functionality and the printing of reports from the vending machines would assist in verifying activity and providing assurance that all income generated has been collected and banked.	Exit Meeting Date	29-Nov-2019
Due Date	01-Mar-2020
Risk Level	High Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	DA – Ideally this would be resolved by utilising or enhancing programme functionality.
Status	Check Progress	Progress	20%	Head of Service	David Allum
All Notes

Action Code & Description	IA20/05.007 Accuracy of records completed
The Restaurant staff collect the income from the vending Machine on the 1st floor link corridor. Although a “Vending Machine Balance sheet” is completed. During testing of the process it was found that no reliance could be made on the records maintained to confirmed that the cash collected agreed to the cash recorded as taken by the Vending machine, or that the stocks put into the vending machine or items sold from the vending machine are accurate data. The Vending Machine balance sheet is dependent on it being accurately completed by those putting the items into the machine but audit checks confirmed that these are not accurately recorded. The vending machine has this facility as per the instructions provided by the facilities manager. No accurate reconciliations can be completed as there are insufficient records to facilitate this to establish if all sales money/stocks has been accurately accounted for, re wastage and foreign coinage and promptly banked.	Exit Meeting Date	29-Nov-2019
Due Date	01-Mar-2020
Risk Level	High Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	DA-Vending Machine functionality to be utilised
Status	Check Progress	Progress	10%	Head of Service	David Allum
All Notes

Action Code & Description	IA20/05.008 Cash Collected
From our review of vending machine under the responsibility of the Restaurant we found that cash is collected from the vending machine on average every 7 weeks. Therefore the counting and banking of income is not carried out frequently. The average number of days between banking of income for the last 3 years in shown below:- 2019-20 1,422.05 to date (Oct /19) Average number of days to bank income 49 days, average daily takings £6.39 2018-19 1,959.10 Average number of days to bank income 56 days, average daily takings £6.85 2017-18 4,143.05 Average number of days to bank income 34 days, average daily takings £12.45 The decline in banked values is worrying as the restaurant vending machine is replenished daily and average daily takings have now gone from £12.45 (17-18) to £6.85 (2018-19).	Exit Meeting Date	29-Nov-2019
Due Date	29-Feb-2020
Risk Level	High Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	DA-to be averted by a move to a cashless electronic system The frequency of emptying the vending needs to be increased until the cashless facility is operational. To be agreed with the Internal Audit Manager (GB)
Status	Check Progress	Progress	40%	Head of Service	David Allum
All Notes	The cashless facility is being installed on the vending machines w/c 24th February this will produce a report of the sales activity for the period and be reconciled monthly to the income received via the appropriate merchant number. GB On behalf of DA.	20-Feb-2020

Action Code & Description	IA20/05.009 Pricing Policy
The costing and profit schedule is not accurately maintained and kept up to date. An analysis of the items included on this schedule confirmed that not all items are included. Profit elements are not accurately calculated as some of the quantities and monetary value of purchased is not accurately reflected when comparing Booker invoices paid to the detail on the schedule. Previously mentioned in Finding 8 above is that income is down from previous years. It was however found that one of the vending machines best sellers “Shortbread” is being sold £0.18p below the purchase price. Other items are being sold above the Recommended Retail Price which might be putting staff off purchasing these items. A pricing policy should be adopted to ensure that purchase costs including VAT where applicable are recovered. Any profit elements should be agreed in the policy	Exit Meeting Date	29-Nov-2019
Due Date	01-Mar-2020
Risk Level	Medium Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	DA – Agreed pricing Policy to be developed
Status	Check Progress	Progress	20%	Head of Service	David Allum
All Notes

Action Code & Description	IA20/05.010 Vending Machine Balance Sheet
‘Vending Machine Balance sheet’ is not accurately maintained, utilising excel to complete the analysis is not effective as the functionality on the spreadsheet is corrupted as it is not adding up the rows correctly which in turn means that any reconciliation completed will be flawed. The full information on the currently utilised Vending Machine Balance Sheet is not fully completed to show the period it covers who has completed the sheet and who has checked the sheet and the income collected back to the actual income to be banked. Training on excel should be provided to those members of staff involved in the process, including those that would cover for others if they were absent.	Exit Meeting Date	29-Nov-2019
Due Date	01-Mar-2020
Risk Level	Medium Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	Agreed
Status	Check Progress	Progress	20%	Head of Service	David Allum
All Notes

Action Code & Description	IA20/05.012 Costing Master Sheet
“Vending machine costing master “– was previously provided by the restaurant manager on the 16/09/2019 however a subsequent version of this form was provided on 15/10/2019 as the manager stated this was the one that they use – this was completely different to the version previously supplied. The restaurant manager could not however locate the updated version in sharepoint environment even though all the previous versions were present. Nevertheless the auditor assessed this updated sheet and confirmed that this sheet does not contain accurate information relating to the cost of items. (For example “kitkat is shown as 48 packet size but it is currently supplied in a box of 24 not 48 therefore the price inclusive of VAT should be (£8.99x20%=£1.798+£8.99=10.79&divide;24=0.45p.) therefore 45p is the cost price including VAT and it is sold at 70p which provides a profit of 25p and not 48p as detailed). Kitkat is a vatable item shown as B on an invoice. If the correct cost is not recorded on the item sheet, items are sold at a loss i.e. Walkers shortbread (W/P invoice 3562452 no VAT) actual cost is .58p but being sold at 40p therefore a loss of 0.18p per item sold is being borne by WBC therefore reducing income. Stock figures and costs need to be accurately recorded when purchased. Then the vending machine can be accurately updated to change the appropriate sales price. The Borough Hall Vending Machine pricing also needs to be reviewed to ensure that cost of goods are covered and profit elements are inaccordance with the agreed pricing policy and Vat where applicable.	Exit Meeting Date	29-Nov-2019
Due Date	01-Mar-2020
Risk Level	High Priority	Risk RAG
Audit Report Code and Description	IA20/05 Vending Machines
Agreed Action	DA - Comes within the parameters of the pricing strategy discussed earlier.
Status	Check Progress	Progress	20%	Head of Service	David Allum
All Notes

Head of Service Vickers, Peter

Action Code & Description	IA20/04.004 Key reconciliations elements omitted from Accountancy Team Procedures
Accountancy Team Procedures handbook does not refer to all the key reconciliation procedures as stated on page 12 of the Financial Regulations. The key reconciliation procedures contained in the Financial Regulations but absent from the Accountancy Team Procedures handbook are: 1. All reconciliations shall be reviewed and countersigned by the Financial Services Manager or delegated officer 2. All unreconciled items shall be resolved as soon as practically possible, fully investigated and explained 3. Reconciliation of income between the Finance system and external information, Terriers, charging schedules or other databases shall be undertaken monthly by the officers responsible for service delivery The Council’s key reconciliation procedures may not be adhered to by Accountancy service resulting in incomplete reconciliations and errors in Council’s key financial systems being unreported, leading to potential financial loss to the Council. Breach of financial regulations.	Exit Meeting Date	07-Feb-2020
Due Date	30-Mar-2020
Risk Level	Medium Priority	Risk RAG
Audit Report Code and Description	IA20/04 Reconciliations of key financial systems
Agreed Action	The key reconciliation procedures contained in the Financial Regulations that are absent from the Accountancy Team Procedures handbook will be copied over and included in the Accountancy Team Procedures Handbook.
Status	In Progress	Progress	95%	Head of Service	Peter Vickers
All Notes

Action Code & Description	IA20/04.009 Access
For one of the key financial systems selected in our audit sample the officers who prepare and review the reconciliations have open access to edit the data within the key financial system being reconcilied. Data entry errors in the key financial system being reconciled that could be detected by a reconciliation may be altered by a data entry to the key financial system by the reconciling officer.	Exit Meeting Date
Due Date	30-Mar-2020
Risk Level	Low Priority	Risk RAG
Audit Report Code and Description	IA20/04 Reconciliations of key financial systems
Agreed Action	Access to be reviewed and updated (Benefits)
Status	Assigned	Progress	0%	Head of Service	Peter Vickers
All Notes

Head of Service Wagstaff, Hugh

Action Code & Description	IA20/01.002.1 Re-inspections
The Asbestos Management Plan states that properties where asbestos has been detected should receive a Management Inspection every 12 or 60 months, depending on the severity of the risk rating given at the time of the last inspection. Present policy, however, is to treat all properties which are known not to have had a Management Inspection as priority, but there is currently no mechanism in place to ensure properties which have been inspected since 2013 and found to have asbestos present are flagged for re-inspection in line with their current risk ratings. RISK: Properties which are known to have asbestos present are not re-inspected in line with recommendations made in the Asbestos Management Plan, and therefore any potential deterioration in the safety of detected asbestos will not be acted upon in a timely manner.	Exit Meeting Date	09-Aug-2019
Due Date	31-Mar-2020
Risk Level	Medium Priority	Risk RAG
Audit Report Code and Description	IA20/01 Management of Asbestos
Agreed Action	2.1 The Asbestos re-inspection programme is to be added to the Keystone service inspection module. This software will prompt re-inspections when due and allow for accurate reporting in order to monitor progress.
Status	In Progress	Progress	50%	Head of Service	Hugh Wagstaff
All Notes	• We are currently working with the Asset team to create an accurate list of property’s and their last management surveys for upload into KSI where the system will prompt when surveys are due. This will make it easier to track and monitor the progress of re-inspections. • At current there are no high risk materials listed in Keystone, a process has been put in place to generate a monthly report of high risk items this will capture any changes and prompt a re-inspection or removal.	07-Oct-2019