## 

# Free Early Education Funding City Of York Council Internal Audit Report - 2016/17

Overall Audit Opinion 

 Business Unit: Children, Education & Communities Responsible Officer: Assistant Director, Education & Skills Service Manager: Head of Childcare Strategy Service Date Issued: 16/02/17 Status: Final Reference: 11140/008 

## Summary And Overall Conclusions Introduction

All 3 and 4 year old children are entitled to 15 hours of free early years education per week. The full 15 hours have to be taken over a minimum of two days per week. Between 2.5 and 10 hours can be taken in one day and the hours can be split over two providers. The entitlement of 15 hours per week covers a 38 week school year but this can be stretched across 48 or 51 weeks of the year. This equates to 11 hours over 51 weeks and 11.75 hours over 48 weeks. Eligible 2 year old children are entitled to the same hours as 3 and 4 year old children. As of September 2014 the eligibility criteria for 2 year olds was expanded to include those with disabilities or special educational needs, those who have been adopted and those who come from low income families. From April 2015, nurseries, schools, playgroups and childminders were able to claim extra funding for eligible 3 and 4 year old children accessing a free early education and childcare place to support their development, learning and care. This is called the Early Years Pupil Premium (EYPP.) Eligibility is based on receipt of certain benefits and also applies if a child that has been looked after by the local authority for at least one day, has been adopted from care, has left care through a special guardianship order, or is subject to a child arrangement order. The council awards providers funding based on the number of funded hours claimed by eligible children at their setting. In September 2016, York started implementing a trial of the provision of 30 hours of free early years education for eligible 3 and 4 year olds. 

## Objectives And Scope Of The Audit

The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that: 

 providers are claiming funding correctly;  payments made to providers are effectively controlled and overpayments are minimised;  national codes of practice are complied with;  data protection requirements are being met. 
 

## Key Findings

The systems in place for making payments to providers based on the information received from them were effectively controlled, with robust systems in place to ensure that overpayments were identified, minimised and rectified. One small concern was that the provider guidance needed updating to ensure the ICO website address was up to date. There were concerns that providers did not always have sufficient documentation in place to support their funding claims.  There was inconsistency in the adequacy of record keeping across the providers; for example there were a significant number who had failed to ensure parent declaration forms had been completed and signed by parents for the relevant term before funding was claimed. There was also an issue with dates of birth and identity of the children claiming not being validated. There was a lack of clarity in invoices raised by one provider in relation to identifying the free entitlement. This seemed to be an isolated case which was notified to the council's Early Years Funding Team who are liaising with the provider. Additionally, one provider was not aware of ICO registration and had not issued privacy notices to their registered children.  

## Overall Conclusions

The arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 

  
 

## 1 Record Keeping Issue/Control Weakness Risk

Providers did not have adequate records to support the funding claimed.  In particular Parental Declaration Forms (PD forms) are not always completed. 

Poor record keeping (by provider) reflects a poorly administered system, and prevents adequate audit processes. It also increases the chance that fraudulent 
claims could be made. 

## Findings

Early Years Free Education Funding cannot be claimed until a PD form has been completed and signed by either the parent or the child's legal guardian. The number of hours entered on the PD form must correspond to the number of funded hours claimed by the provider and funded by the Local Authority. Attendance for the funded hours should be monitored regularly by the provider and be in accordance with the funding claimed. The council should be notified of any relevant change to attendance as funding may be reduced. Of the ten providers visited one had accidentally disposed of the previous year's attendance register therefore attendance in accordance with funded hours could not be confirmed in this case. One provider had none of the requested records available for the auditor at the appointed visit and no checks were completed. Of the nine providers where checks could be completed, five could not provide an acceptable level of correctly completed PD forms for their funded 3 & 4 year olds, or for their funded 2 year olds. Issues ranged from no PD form being completed, the PD form being unsigned for the relevant term or not recording the hours claimed. 

## Agreed Action 1.1

Continue to highlight the importance of ensuring PD forms are completed for all children and updated where necessary, via the termly funding letter. (Next letter due out end March 

## 2 Validation Checks By Providers Issue/Control Weakness Risk

Date of birth and identity is not always validated by providers before a claim for funding is made. 

## Findings

For funded children providers are required to verify they have seen relevant documentation to confirm the child's name and date of birth, for example by signing their own registration form for new children. For seven of the ten providers visited, children's names and dates of birth had not been checked by the provider. There was therefore a risk that ineligible claims had been made. For example, a child could be too young to be eligible for funding or duplicate claims could be made in different names which may not be picked up by the council's own systems for identifying duplicates. 

## Agreed Action 2.1

Continue to highlight the importance of ensuring date of births are checked for 3 and 4 year olds accessing the universal 15 hours entitlement. (2 year olds and 3 and 4 year olds entitled to the extended 30 hours have to be approved by the funding team (or new national tax childcare system) and will receive a voucher code therefore date of birth checks by the provider are not required for these children. 

Ineligible and/or fraudulent claims could be made. This would lead to the council paying more in funding than is necessary. 
Priority 
2 
Responsible Officer 
Policy and Planning Manager 
Timescale 
31st March 2017 
 

## 3 Ico Registration

| Issue/Control Weakness                                                      | Risk                                            |
|-----------------------------------------------------------------------------|-------------------------------------------------|
| Not all providers were aware of their responsibilities as data controllers. | Lack of awareness could lead to breaches of ICO |
| requirements, and the mis-handling of sensitive data.                       |                                                 |

## Findings

With the exception of one provider, all settings visited were aware of their responsibilities as data controllers and had completed their ICO registration where applicable. Privacy notices had been issued or otherwise made available for all children registered. However, there was a concern raised by the lack of knowledge on the topic by one provider. This provider could not confirm they were registered with the ICO as a data controller, and subsequent checking of the ICO data controller register showed they were not registered. Privacy notices had not been issued.  All settings should be aware of these requirements and whether they are exempt from registration, which in this case the setting was not. It was noted that the ICO website address in the provider guidance is no longer operative and needs to be updated to direct to the relevant page on the website. 

## Agreed Action 3.1

Priority 
3 
Responsible Officer 
Policy and Planning Manager 
Update the link to the ICO website in the provider guidance. Send out email to all providers highlighting the findings of the audit and reminding providers to ensure that: 
- 
 PD forms are completed for all children 
Timescale 
28th February 2017 
- 
Date of birth of child is checked prior to a child accessing a funded place - only necessary for universal entitlement for 3 and 4 year olds. 
 
- 
Reminding them of their responsibilities as data controllers and ensure they have completed their ICO registration where applicable. 

 

## Audit Opinions And Priorities For Actions

Audit Opinions Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

Opinion Assessment of internal control 

| High Assurance                                                                                               |
|--------------------------------------------------------------------------------------------------------------|
|                                                                                                              |
| Substantial                                                                                                  |
| Assurance                                                                                                    |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |
| operation but there is scope for further improvement in the areas identified.                                |
|                                                                                                              |
| Reasonable                                                                                                   |
| Assurance                                                                                                    |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |
| environment is in operation but there are a number of improvements that could be made.                       |
| Limited Assurance                                                                                            |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |
| improvements required before an effective control environment will be in operation.                          |
| No Assurance                                                                                                 |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |
| key areas require substantial improvement to protect the system from error and abuse.                        |
|                                                                                                              |

 

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.