Digital Services Project - Review  

 

# City Of York Council Internal Audit Memo

 
Service Area: Corporate Responsible Officer: Assistant Director: Customer Services and Digital 

Introduction and scope 
1.1 
 
The Executive approved plans for a new smart and responsive online service which 
will improve access for residents, visitors and businesses at the Executive meeting 
on Thursday 11 February 2016.   
 
1.2  
 
The first stage of the programme is to improve users' online experience with the council, 
with the new Customer Relationship Management (CRM) system aiming to: 
- 
Provide online access to more services and information. 
- 
Ensure the council is more efficient and easy to do business with on a 24/7 
basis. 
- 
Implement a 'My Account' system for residents offering a tailored access to 
council services. 
- 
Provide access via mobile devices and tablets, increasing accessibility for 
residents and other customers. 
- 
Allow residents and customers to track the progress of their requests and 
receive updates. 
1.3 
 
The programme is following the council's approved project management guidelines 
as its framework.  The purpose of this audit was to provide assurance to 
management that procedures and controls within the project management system will 
ensure that: 
 
- 
Project management principles have been applied to the programme of work and 
specific projects 
- 
Governance arrangements are in place and are at the correct level for the 
programme  
- 
Risk management is considered and reviewed throughout the programme 
 
1.4 
This audit was a desktop exercise and reviewed only information received by the 
Project Board.  An initial review was carried out in July 2016 and feedback was provided.   A follow-up was then carried out and this report summarises both pieces of work.  Veritau has also attended Board meetings since July in order to provide support, challenge and advice. 

## Findings

2.1 
Project Board information from January 2016 was reviewed for this audit.  All project 
documents were available within the specific folders on the council's network.  There was a clear folder structure and most documents were clearly labelled. 
 

## Project Management Arrangements

2.2 
There is a designated project team with a clear mandate and a project plan in place.  
This was all confirmed prior to the review period but is evidenced throughout the documentation.   
2.3 
The project is monitored through the meetings of the Project Board which occur at 
regular intervals (currently monthly) and the Project Board meetings are minuted and 
supported by documentation in line with those outlined within the All About Projects framework including highlight reports.   

## 2.4 The Highlight Report Gives The Current Status Of The Project.  There Is An Approved Communications Plan And All Key Stakeholders Have Been Invited To Attend The Project Board Meetings. Governance Arrangements

2.5 
There is a clear governance structure in place for the project.  There is a formal 
Project Board which has an approved Terms of Reference.  The Project Board represents all council services.  It provides a governance mechanism for managing the 
project providing assurance and reporting upwards to council's management team, 
Scrutiny and Executive.   
 
2.6 
The Project Board has also formally assigned the role of project assurance to the 
Programme Manager and they attend the Project Board meetings.  
 
2.7 
The project has documented this governance structure and has made provision for 
any time when board meetings do not align to key decision points.  The chair of the Project Board has, on those occasions, been delegated the following powers which would be ratified at the next board meeting: 
 
- To approve budget spend above £10,000. - To approve changes to the project milestones and scope. 
 
2.8 
It was suggested during the initial review that, it would be good practice to have at 
least three Project Board members (including project assurance) to take these decisions outside of the normal meetings, thereby the decisions are still subject to challenge by key board members.  In November, the chair invited key stakeholders to an extra meeting to make a decision on the deployment for the release for Street lighting and Street Cleaning (a Go Live decision).  The decision was made with a number of caveats - a copy of which was circulated to the full Project Board. 
 
2.9 
Minutes are produced for each board meeting and they are reviewed at the next board 
meeting for accuracy.  The review found that the content of the minutes could be improved.  The following main issues were identified: 
- The minutes were not produced on a timely basis. On the two occasions the minutes were requested after the Project Board (July and November), they were not available for over three weeks.  This has an impact on the project team who are required to check their accuracy and use 
them to inform the current project papers before circulating them to the Project Board before the next meeting. 
 
- The minutes do not include an action log (nor is one maintained separately). There is therefore no formal mechanism for ensuring that all actions arising from the board meetings were completed.  Questions raised within the minutes are not 
always answered in subsequent minutes or supplementary papers and 
information that was to be sought outside of the Project Board meeting is not always brought back to the Project Board at the next meeting, and therefore not followed up for the completeness of records.  These issues would be resolved by the implementation of an action log. 
 
- Decisions were not always formally recorded within the minutes and the basis on 
which the Project Board has made decisions was not always articulated or cross 
referenced to the supporting papers.   
 
A decision log was implemented in July and going forward attention will be 
placed on the wording of the decisions so that the articulate the specifics of what the board has agreed to. 
 
- It was not clear which documents had been circulated or presented to the Project 
Board. There were a number of versions of some documents available within the project folders at the time of review.  Not all documents had been saved as a PDF version with an appropriate label. 
 
 
Risk Management Arrangements 2.10 The project actively monitors risk and discussions are held at the Project Board 
meetings.  There are project specific risk registers (Phase One and Release Two) 
which were refreshed in October 2016.  The risk registers are maintained through the Council's risk management system - Magique.  This ensures that the corporate risk management matrix is used and that specific fields are completed. 
2.11 The risk register which was presented to the Project Board in January 2016 did not 
document the gross and net risks for the project - however this has been corrected and the current registers display both the gross and net risk scores. 
2.12  Risks are updated as and when required but the formal registers are being brought 
back to the Project Board on a bi-meeting basis.  As the format of the risk register is quite static, the Project Board has recently requested that all ongoing changes are highlighted.  This will allow them to quickly acknowledge any amendments within the controls and actions for the specific risks. 
2.13 An issues log for Phase One of the project has been established.  This is presented to 
the board along with the risk registers.  It should be noted that the critical success 
factors for the project have been documented and are monitored within the project. 
Conclusions and Recommendations  
3.1 
It was found that the arrangements for managing risk were good with few weaknesses 
identified. An effective control environment is in operation, but there is scope for further improvement. Our overall opinion of the controls within the project at the time 
of the review was that they provided **Substantial Assurance**. 
 
The key areas for improvement are: 
- The quality and timeliness of the meeting minutes should be addressed.  The 
review has confirmed that whilst discussions take place at the board meetings 
and decisions made, they are not always accurately reflected in the minutes. 
 
- An action tracking mechanism within the meeting minutes or an action log should 
be maintained.  This should be updated after all Project Board meetings to 
ensure that all actions are reviewed to ensure that they are actioned. 
 
- The decision log should be revised to ensure that it only contains decisions made 
at the board meetings (and not actions) and that the wording of the decisions articulates the decision made by the board. 

## Further Work

4.1 
Veritau will continue to attend the Project Board meetings and will confirm that the 
agreed actions have been completed. 

## Management Response

5.1 
The issues identified above were raised constructively at the time so we could take 
some remedial action.  The agreed actions can be seen in Appendix 1 

## Action Plan

Action 
Number
Issue 
Risk 
Agreed Action 
Priority* Responsible 
(Ref 
3.1) 
The quality and timeliness of the meeting minutes has been addressed.  A project resource will continue to produce the minutes with the support of the project manager, who will record all actions/decisions made for the respective logs. The aim is to have minutes produced within 3 working days of the meeting. 
Information may be lost or recorded incorrectly. 
1 
The minutes are not produced on a timely basis. 
An action log has been introduced. This cross references to any actions made within the meeting minutes and included timescales, responsible office and timescales.  The action log will re reviewed at the start of each meeting with the previous meetings minutes. 
Actions and outcomes may be lost, not followed up or reported back to the board. 
2 
The minutes do not include an action log (nor is one maintained separately). Decisions are not always formally recorded within the minutes and the basis on which the Project Board has made the decisions was not always articulated or cross references to the supporting papers. 
The decision log has been revised to ensure that it accurately reflects and contains all decisions made at the board meetings (and not actions). 
Decisions may not be recorded accurately.  
3 
The format has changed so that key information is captured within the log 
Officer 
Timescale 
Project 
Sponsor 
(Assistant 
Director: 
Customer 
Services and 
Digital) 
COMPLETED 
In effect from 
December 2016 
meeting 
2 
Project 
Sponsor 
(Assistant 
Director: 
Customer 
Services and 
Digital) 
From March 
2017 meetings 
3 
Project 
Sponsor 
(Assistant 
Director: 
Customer 
Services and 
Digital) 
From March 
2017 meetings 
3 

*The priorities for actions are:  

Priority 1: 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent  
 
 
attention by management. 
Priority 2: 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be 
 
 
addressed by management. 
Priority 3: 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 
 
Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.