Project Management  

## City Of York Council Internal Audit Report 2015/16

 Business Unit: Corporate and Cross Cutting Responsible Officer: Chief Executive Date Issued: 25/05/2016 Status: Final Reference: 19120/004 
 

P3 
P2 
P1 
Actions 
1 
0 
3 
Overall Audit Opinion 
Limited Assurance 

## Summary And Overall Conclusions Introduction

Projects are mechanisms for changing services and the organisation. They need to be well managed to ensure that they deliver their intended benefits, to time and to budget.  All projects involve risk and good project management identifies and manages the risks involved with projects undertaken. As part of the delivery of the council's priorities, transformational work and infrastructure projects, the council have a large number of programmes and projects.  These vary in scale from multi-million pound programmes and projects that operate at a corporate level, e.g. Rewiring, major infrastructure projects, to small scale projects within directorates. The council has adopted formal project methodologies for managing projects across the authority including Managing Successful Programmes (MSP) and Projects (PRINCE 2) and Agile for ICT. The council has also moved towards the use of a central ICT system that acts as a central point for all projects, VERTO.   
 

## Objectives And Scope Of The Audit

The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that: 
- 
The council's chosen project management methodologies have been embedded within the organisation, including the training of officers, 
- 
Individual projects are managed in accordance with the council's standard methodologies (specific to the individual project). This review did not include any programmes or projects that are under review from Mazars or the Audit and Governance Committee. 
 
Key Findings At the time of the audit (audit testing started in July 2015 and finished in early January 2016), a number of areas were identified as requiring 
attention.  These areas have either been addressed or are in the process of being agreed to ensure that the project management toolkit (All About Projects) is at the core of project management across the Council. 
- Amendments have been made to the toolkit which was first introduced at the December 2015 Audit and Governance Committee.  The 
toolkit was implemented on the recommendation of the council's external auditors as part of the audit on the Adult Social Care EPH project to ensure that all project and programme managers can properly initiate and plan their projects.  The toolkit introduced clarity around whether a project is the correct method of delivery for a specific issue, roles and responsibilities within and throughout the lifetime 
of the project and it introduced the concepts of gateways within a project.  Areas that have been strengthened since the audit was completed include the discovery phase of the project and the gateway process. 

- It was unclear at the time of the audit, whose responsibility the maintenance of the toolkit was going forward given the number of changes 
that have taken place regarding the Transformation Team and the Office of the Chief Executive.  This is in the process of being agreed as 
part of the corporate programme structure. 
- The toolkit itself has many templates and guidance documents.  It was found that the template for the risk register did not align to the 
council's Risk Management Guidance (October 2015).  This has been addressed in the revised version1  as well as including the council's 
Risk Management Guidance for reference within the toolkit links. 
- The council does not have an overall central register for projects.  Within the toolkit a project is clearly defined and a matrix must be 
completed to quantify the size of the project.  This will assist with the completion of a project register going forward and responsibility for directorate project registers will be formally assigned. 
- Whilst VERTO is the council's central project management system, there is no formal council-specific user guide and no mandatory 
information required when inputting into the system.  VERTO has recently been reconfigured to support the new toolkit.  Additional information/configuration will be addressed. 
- The Children's Social Care Records project was reviewed to ensure compliance with current project management guidance. The project 
was found to have all required documentation and governance arrangements but issues were found with the completeness of some documentation and the information recorded around the data migration process.  These issues are subject to a separate report. 

## Overall Conclusions

The audit examined project management arrangements within the council during a period of significant change and did not examine individual projects in detail.  Whilst the underlying principles of project management at the council remain unchanged, at the time of the audit there was evidence to support that there were control weaknesses in key areas.    Our overall opinion of the controls within project management at the time of the audit was that they provided **Limited Assurance**.  However, since the audit was undertaken there has been a considerable amount of work to ensure that a robust framework is in place and the Council's Management Team (CMT) has mandated that all Project Managers use the new project management toolkit. 

                                            
1 All about Projects (April 2016) 

## 1 Formal Ownership Of Project Management

Issue/Control Weakness 
Risk 

Compliance with the new corporate project management toolkit (All About Projects) will not be monitored and updates to the toolkit may not be made as and when required. 

Without central monitoring, projects may not follow the 
corporate project management toolkit and therefore may not be appropriately authorised at key points or may not be completed within planned timescales. The council may face negative publicity if projects are not appropriately managed. 

In July 2015, the re-wiring York transformation programme was placed back within directorates from the central transformation team.  It was therefore necessary for there to be clear corporate instructions on how to manage projects successfully.  A new Project Management toolkit (all About Projects) was launched by the Assistant Director Transformation and Change in December 2015 to ensure that all council officers had the necessary templates and guidance notes to manage successful projects and programmes of work.  It was also introduced in response to the recommendations made by the Council's external auditors as part of the audit on the Adult Social Care EPH project. The fixed term post of Assistant Director Transformation and Change ended on 31 March 2016 and since 1st April there is no longer an Office of the Chief Executive directorate.  With these significant changes occurring within the council it is important that the roles and responsibilities for overall project management are formally re-allocated to ensure that there is continuity in the corporate project management approach. Whilst in the process of finalising the audit, CMT were in discussions to identify a Corporate Programme Structure.  Once agreed this will form the framework of all ongoing project and programme work and responsibilities. 

CMT will identify the corporate programme management structure, with CMT acting as the overarching/corporate programme board meeting every two months. To manage the overarching programme, a programme lead will be identified for each Directorate.  With CMT, the Directorate programme leads will manage the prioritisation process and ensure that the necessary documentation is in place for each programme. CMT will agree a reporting mechanism that will ensure that the Executive, Audit & 
Governance and relevant scrutiny groups have the required information. 

Priority 
2 
Responsible Officer 
Chief Executive 
Timescale 
Implemented 
 

## 2 Project Management Toolkit - Risk Management Issue/Control Weakness Risk

Within the new project management toolkit the information and templates included for risk management do not align to the council's approved Risk Management Guidance. 

Project risks are not monitored and managed in line with the council's approved policy, strategy and guidance. 

A review of the new project management toolkit confirmed that the risk register is a document used to establish record, track and manage risks to the project. It also confirms that in listing the mitigations, stakeholders can be assured that the right support is in place to minimise any potential risks.  It notes that people within the project should identify potential risks using the council's Risk Management Guidance and provides a template to record this information for smaller projects.  For medium and large projects the risks will be recorded and managed through the VERTO project management system. The template included as part of the toolkit did not align itself to the council's corporate requirements of a risk register template (as defined in the Risk Management Guidance - October 2015).  This has subsequently been addressed in the revised version of All about Projects (April 
2016) as well as including the CYC Risk Management Guidance for reference within the toolkit links. 

The risk register section of the project toolkit (All About Projects) has been revised to ensure that it is in-line with the council's Risk Management guidance. Templates within VERTO and the toolkit have been updated. 

Priority 
2 
Responsible Officer 
Programme Manager 
Timescale 
Implemented 
 

## 3 Central Register For Council Projects Issue/Control Weakness Risk

There is currently no central register of all projects of the council is involved with. Directorate Management Teams (DMTs) do not have a record of all directorate projects and minutes are not taken of meetings to confirm which projects had been discussed. 

The council can not quantify the number and work of its 
projects or report on their significance to the overall corporate priorities/strategy. 

When the audit was conducted it was found that there was no overall register at corporate or directorate level for projects.  The VERTO system is not being used to record all projects, although there was a programme to roll it out across directorates.  DMTs did not record projects within a register or formally record their management team meetings where projects are discussed. The project assessment matrix which should to be completed as part of the Pre-Project phase of the new toolkit should form the basis of the project risk register going forward.  This assessment assists in judging the size of the project and the level of controls required to manage the project effectively.  The toolkit also gives a formal definition of a project (see annex A) which should be used going forward to clarify which tasks should be formally recorded as a project. 

DMTs will be responsible for the directorate project register and the Directorate lead will ensure it is complete and up to date. Each directorate will keep a register of projects within their directorate which will make up their directorate programme.  This will feed into the corporate programme. All medium and large projects will be held within VERTO as a corporate standard– making VERTO a central register for the Councils significant projects. Small projects will not necessarily be entered into VERTO but will be recorded and monitored within the directorate registers. 

Priority 
2 
Responsible Officer 
Directorate Leads 
Timescale 
30 September 2016 
 

## 4 Verto - A Council-Wide Standard Approach Issue/Control Weakness Risk

There will need to be standardisation of templates and information within the system as the system is rolled out to directorates including mandatory fields to ensure that the correct sections are completed on forms. 

The central corporate project management system is not maintained and information entered is not fit for purpose 
leading to gaps and incomplete reports being pulled from the system. 

In the December report on Project Management to the Audit and Governance Committee, it was reported that: 
 
'In order to complement the project management toolkit and to ensure a consistent, well managed approach to programme and project management, a new web based system is being rolled out. It is called Verto. Each phase of a programme or project is managed within the system and it provides a gateway process for the project manager to ensure that all requirements are met before moving to the next project phase.  All work from planning to risk management is controlled in the system and all involved in the projects have access to update and view the information where appropriate. This allows a wider oversight for all stakeholders involved in the projects and those involved in the quality assurance of the systems in place (such as internal audit).' It was found during the audit that there was no council-specific user guide for VERTO and no specific customisation of the system had been made to ensure that the information captured married up with the project toolkit/risk management requirements.  Work recently undertaken has aligned the All About Projects templates with the VERTO system and work is ongoing to add narrative into the system to ensure that there are logical processes to follow within the system.  Going forward, the system may require an assigned administrator to maintain the system but this will be reviewed as part of the overall programme management structure by CMT. 

The VERTO system has been updated to reflect the revised All About Projects templates - some work has also been carried out within the system to make it easier to navigate. There is a user guide available which has been put together by another local authority which will be revised as the system is rolled out. Resources for VERTO will be considered by CMT as part of the overall approach to programme management. 

Priority 
3 
Responsible Officer 
Programme Manager 
Timescale 
Implemented 
 

Definition of a project: A project is typically described as a 'temporary group activity designed to deliver one or more product, service or result according to a specified 
business case.' In other words: 
- 
A project is temporary - it has a clear start and end date, and therefore defined scope and resources  
- 
It has specified deliverables (services or products) that can be measured 
- 
It has a number of tasks to deliver those services or products 
- 
A project is unique - it is not a routine operation (business as usual), but a specific set of operations designed to accomplish one or more 
goals 
- 
A project team often includes people who don't usually work together - sometimes from different organisations but always with clear roles 
and responsibilities  

## Audit Opinions And Priorities For Actions Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

| Opinion                                                                                                      | Assessment of internal control                                                                      |
|--------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| High Assurance                                                                                               | Overall, very good management of risk. An effective control environment appears to be in operation. |
|                                                                                                              |                                                                                                     |
| Substantial                                                                                                  |                                                                                                     |
| Assurance                                                                                                    |                                                                                                     |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |                                                                                                     |
| operation but there is scope for further improvement in the areas identified.                                |                                                                                                     |
|                                                                                                              |                                                                                                     |
| Reasonable                                                                                                   |                                                                                                     |
| Assurance                                                                                                    |                                                                                                     |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |                                                                                                     |
| environment is in operation but there are a number of improvements that could be made.                       |                                                                                                     |
| Limited Assurance                                                                                            |                                                                                                     |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |                                                                                                     |
| improvements required before an effective control environment will be in operation.                          |                                                                                                     |
| No Assurance                                                                                                 |                                                                                                     |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |                                                                                                     |
| key areas require substantial improvement to protect the system from error and abuse.                        |                                                                                                     |
|                                                                                                              |                                                                                                     |

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to 
be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.