## Debtors City Of York Council Internal Audit Report 2016/17


## Summary And Overall Conclusions Introduction

The Debtors team sits within the Directorate of Customer and Business Support Services, and is responsible for: 

 Issuing invoices to customers for services provided by the council;  Taking recovery action to ensure invoices are paid. 
 Ensuring payments received are correctly recorded in the debtors system on Authority Financials.  
 This is a fundamental financial system, and the high value and number of transactions means that it is inherently a high risk system, and as such, should be audited every year. In the last financial year, there were approximately 45,000 invoices issued, with a total value of approximately £76,000,000. 

## Objectives And Scope Of The Audit

The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that: 

 Systems comply with the council's financial regulations, relevant legislation, and other appropriate guidance;  Accounts are raised promptly and accurately to notify customers of any amounts due;  Income is correctly credited to customers' accounts;  Appropriate action, including write off of debts, is undertaken to recover debts where invoices are not paid within specified timescales;  Performance is monitored and effectively managed. 
 During the 2016/17 financial year, the council will be collecting monies on behalf of the Business Improvement District, using the council's debtor invoice system. The Business Improvement District is an initiative to collect a levy from all businesses within the city centre, to improve the aesthetic value of the area and to help attract custom. The audit confirmed that the procedures involved in raising these invoices are adequate and appropriate. Housing benefit payments and council tax collection was not covered by this audit, as they are covered in detail in other audit engagements. 

## Key Findings

Overall, the management of the debtors system is good. Accounts are raised promptly and accurately with income being correctly credited to customer accounts. There were no issues found with recovery and write-off of outstanding arrears.  
 
The only issue identified during the audit was the performance management of the section was still being developed. Outstanding arrears reports are being created from FMS to analyse all outstanding invoices on a monthly basis, which should help identify problematical debtors who need specific attention. One other point to note was that, at the time of testing, the current Income and Corporate Debt policies were not available on the intranet. The version on the intranet was published in 2011. This has been brought to the attention of the service area and the issue is in the process of being rectified. 

The process for collecting monies on behalf of the Business Improvement District was reviewed but given that this was the first year the scheme was being run it was too early to comment on whether there were any system weaknesses that need to be rectified. The system for collecting monies from city centre businesses will be reviewed in next year's audit once it has been running for a complete year so that the recovery process for collecting outstanding arrears can be audited in full.  

## Overall Conclusions

The arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 

  
 

## 1 Performance Analysis Issue/Control Weakness Risk

Performance analysis is not comprehensive enough resulting in debtors with long term, high value arrears not being identified. 

## Findings

Current performance monitoring consists of analysing the value of invoices raised and the value of payments each month. However, these figures do not match as the payments might relate to invoices raised during previous months and therefore doesn't show the proportion of each month's invoices that have been paid. There is no analysis of specific aged debts, and therefore no way for the debtors team to inform service areas of debtors with large arrears for long periods of time, that could benefit from having their provision of services suspended until they have paid their outstanding arrears.  

## Agreed Action 1.1

An aged debtor report is now run using FMS. This shows each outstanding debtor and the amount they owe, stratified by the time period the debt has been outstanding. This report will be run once a month in order to identify specific debts that need attention. This will enable appropriate action on high priority debts.  
Without analysis of aged debt, council services could be provided to debtors with large and long-term arrears which would result in the council accruing more debt that may not get paid. 

## Audit Opinions And Priorities For Actions

Audit Opinions Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

Opinion Assessment of internal control 

| High Assurance                                                                                               |
|--------------------------------------------------------------------------------------------------------------|
|                                                                                                              |
| Substantial                                                                                                  |
| Assurance                                                                                                    |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |
| operation but there is scope for further improvement in the areas identified.                                |
|                                                                                                              |
| Reasonable                                                                                                   |
| Assurance                                                                                                    |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |
| environment is in operation but there are a number of improvements that could be made.                       |
| Limited Assurance                                                                                            |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |
| improvements required before an effective control environment will be in operation.                          |
| No Assurance                                                                                                 |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |
| key areas require substantial improvement to protect the system from error and abuse.                        |
|                                                                                                              |

 

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.