## 

# York Financial Assistance Scheme (Yfas) City Of York Council Internal Audit Report 2015-16

 
Reference: 10320/010 
 

## Summary And Overall Conclusions Introduction

The York Financial Assistance Scheme (YFAS) is a scheme organised by the council to provide urgent assistance following an emergency or to support vulnerable adults move into or remain in the community. The scheme has a budget of £665k and since 1st April 2015 there have been nearly 600 applications to the scheme. 

## Objectives And Scope Of The Audit

The purpose of this audit was to provide assurance to management that procedures and controls within the scheme will ensure that: - 
There are effective guidance documents available to determine whether applications are successful and how much money can be paid to claimants. 
- 
Applications are approved or rejected in line with the documented criteria. 
- 
Payments are authorised by a suitable person. 
- 
The grants are spent on suitable items in line with the guidance. 
- 
The store vouchers that are given to successful claimants are kept in a secure location. 

## Key Findings

 The procedures for managing the YFAS scheme were generally found to be working satisfactorily. The guidance documents to assist were on the internet and contained all the necessary details to help applicants apply for grants on the YFAS scheme. The process for making applications to YFAS was working well except that evidence was not always being kept to support decisions to approve or reject the applications. It was also noted that users in the Benefits Transactional team could both create and approve applications up to certain values with no spot checks being done to identify instances where YFAS grants were awarded inappropriately. The security procedures for storing unused vouchers relating to the YFAS scheme were reviewed with no serious security breached being noted.  

## Overall Conclusions

It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 

## 1 Creating And Authorising Yfas Applications Issue/Control Weakness Risk

YFAS grants are paid out inappropriately. 

Staff in the Benefits Transactional Team can both create and authorise low level payments from the YFAS scheme.  No subsequent spot checks are carried out. 

## Findings

The details of the application are entered onto the YFAS portal on the Northgate benefits system with the application then being approved or rejected on this system by the YFAS assessor on duty. The application is then sent for payment unless it is over £500 for emergency and £1,500 for community payments when a second authorisation is needed. Currently there are 36 members of the Benefits Transactional team that have access to both create and then approve YFAS applications. 

Whilst it is accepted that it may be too onerous to require a second authorisation for all applications, spot checks could be subsequently carried out to confirm that the decision made to approve or reject the application was correct.  

## Agreed Action 1.1

YFAS claims will become part of the Quality Assurance process from 31/05/16. This is following the reintegration of the YFAS duty into the benefit transactional team. Technical Officers will perform random quality checks each week on YFAS claims, ensuring that each team member has some checks per month. These will look at quality, accuracy and decision making to ensure we are processing awards within the YFAS guidelines. We are in the process of devising a checking sheet to record the checks. 

## 2 The Lack Of Evidence To Support Decisions To Approve Yfas Applications Issue/Control Weakness Risk

Evidence to support decisions to approve YFAS applications was not always kept. 

## Findings

A sample of ten successful and unsuccessful applications to the YFAS scheme was taken to confirm the decision was appropriate. Although no inappropriate decisions were noted there was not always evidence kept on the case file to support this decision which was noted in five approved cases. Three of the five approved decisions didn't contain the evidence obtained from the DWP to support the decision. The other two cases were due to domestic circumstances with no evidence obtained from a support worker to confirm that the basis of the application was correct.  

## Agreed Action 2.1

As mentioned in action 1.1, Quality Checks will become part of the YFAS process and awards will be checked to ensure evidences and accurate notes are being kept to support decisions made. These will be recorded on a new YFAS Quality Assurance recording sheet. 

It is not possible to confirm whether decisions made to approve YFAS applications were made correctly. 

31/05/16 

## 3 Access To The Yfas Section Of The Northgate System Issue/Control Weakness Risk

YFAS applications are processed by unauthorised personnel. 

There are an excessive number of users to the YFAS area of the Northgate system. 

## Findings

There are currently 48 users with access to the YFAS area of the Northgate system. Of these users 36 work in the Benefits Transactional Team and 9 in the ICT team. These users can often perform multiple tasks on the system including create and authorising YFAS applications.  

## Agreed Action 3.1

Priority 
3 
Responsible Officer 
Benefits Transactional 
Team Manager 
Timescale 
30/06/16 
 

The user list and access levels for all users have been reviewed and changes have been applied. All transactional team members have remained unchanged as their access levels are correct for the access they require. The front end CSR's have had their access reduced so that they are no longer able to authorise YFAS awards. Their access now represents the access levels that they require to perform their YFAS duties. I have contacted the ICT team who have confirmed that they require the nine users to have access to the system so that the team can create new users when requested. The majority of access rights for staff in the ICT team are for admin tasks only, meaning they are not able to authorise payments. 

| Issue/Control Weakness                                                                        | Risk    |
|-----------------------------------------------------------------------------------------------|---------|
| xx.                                                                                           | xx      |
| Findings                                                                                      |         |
| The procedures for storing vouchers were reviewed with only one short-coming being noted. xx. |         |
| Agreed Action 4.1                                                                             |         |
| xx                                                                                            |         |
|                                                                                               |         |
Priority 
3 
Responsible Officer 
Customer Service Customer Service 
Contact Team Manager Contact Team Manager 
Timescale 
30/09/16 

## Audit Opinions And Priorities For Actions

Audit Opinions Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

Opinion Assessment of internal control 

| High Assurance                                                                                               |
|--------------------------------------------------------------------------------------------------------------|
|                                                                                                              |
| Substantial                                                                                                  |
| Assurance                                                                                                    |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |
| operation but there is scope for further improvement in the areas identified.                                |
|                                                                                                              |
| Reasonable                                                                                                   |
| Assurance                                                                                                    |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |
| environment is in operation but there are a number of improvements that could be made.                       |
| Limited Assurance                                                                                            |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |
| improvements required before an effective control environment will be in operation.                          |
| No Assurance                                                                                                 |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |
| key areas require substantial improvement to protect the system from error and abuse.                        |
|                                                                                                              |

 

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.