## Internal Audit Report Pensions Administration January 2018

To:  
Assistant Chief Executive Strategic HR Lead 
Barnet Partnership Director, CSG Operations Director, CSG Business Manager, CSG HR Solutions 
Head of Business Assurance, CSG Employee Benefits 
Head of Public Sector Pensions, Capita 
 
Copied to:  
Director of Finance Head of Finance Head of Governance Governance Service Team Leader Operational Delivery Manager, CSG HR Director, CSG Operations Director, CSG 
 
From:  
Head of Internal Audit 
We would like to thank management and staff of Capita Employee Benefits for their time and co-operation during the course of the internal audit. 


## Cross Council Assurance Service


## Executive Summary

|                   |      |        | Assurance level     | Number of recommendations by risk category     |
|-------------------|------|--------|---------------------|------------------------------------------------|
| Critical          | High | Medium | Low                 | Advisory                                       |
| LIMITED ASSURANCE |      |        |                     |                                                |
| -                 | 2    | 6      | 1                   | -                                              |

## Scope

This report sets out the findings of our work undertaken in October and November 2017 to review the design and operating effectiveness of controls in place in relation to pensions administration, in line with our terms of reference agreed on 9 October 2017. The scope of work and controls identified are summarised in Appendix 3. 

## Summary Of Findings

The administration of London Borough of Barnet's pension fund ("the fund" or "the scheme") is outsourced to Customer Support Group ("CSG", part of Capita) who are responsible for working with scheme employers to ensure that the records are kept up to date and that members are supplied with correct information regarding their pension entitlements. The Council, as administering authority, is currently subject to scrutiny by The Pensions Regulator ("TPR") in light of concerns raised when it investigated the Council's failure to submit its 2016 annual return. Correspondence between the Council and TPR highlights several weaknesses in the control environment of the fund and the Council are in regular correspondence with them to provide evidence that controls have been developed and are being embedded. The Council issued CSG with a contractual remedy notice on 25 August 2017 in light of the issues being experienced with the service. The Council also agreed a service improvement plan in August 2017 with CSG as a result of these enquiries, covering the quality assurance, project management and communications improvements needed to ensure the scheme complies with TPR's requirements. Progress against this plan is being regularly monitored at monthly senior officer meetings.  It was reported to the Local Pensions Board that the 2017 scheme return was submitted on 10 November 2017, ahead of the 22 November 2017 deadline. We found that scheme member transactions are mostly well managed through Hartlink, the pension fund administration system, but that there are weaknesses in the processes which take place outside Hartlink, such as the annual benefits statement process, and governance of scheme administration.  A review of data quality has also identified significant issues and the arrangements with scheme employers means that the scheme currently has limited ways of encouraging compliance with scheme working practices. The scheme will need to invest in improving the quality of existing data and the data gathered in future. We acknowledge that this may be a costly exercise, however, the scheme has the ability to charge scheme employers for this data quality work both now and in the future under regulation 70 of The Local Government Pensions Scheme Regulations 2013, providing the reason for the rectification work is due to scheme employers failing to meet its obligations. Going forward, the scheme will also need to work more closely with employers, for example by engaging proactively when changes to membership are detected, and will need to consider both exercising its right to report employers to TPR if employers do not comply with legal requirements and charging additional costs incurred resolving issues to employers as permitted by the scheme regulations. 

This audit has identified **two high, six medium and one low risk** findings.  
We identified the following high risk-rated issues as part of the audit: 

- 
Scheme data quality (finding one) - A data quality review undertaken by CSG, on behalf of the Council, in October 2017 identified that the quality of data 
held to identify team members is below the standards expected by TPR, with 85% of records created before June 2010 containing missing information 
compared to a target of 95%. We also identified that a data quality review of the data used to calculate benefits and value the fund has not been undertaken, but a review is currently being scoped. We also found that there were issues in the data provided to CSG by employers for 60% of the employers reviewed and 
that there was no reporting on the nature and extent of data quality issues noted. This increases the risk of inaccurate data being held by the scheme and delays in preparing annual benefits statements not being identified.  

- 
Preparation of annual benefit statements (finding two) - We found that there were weaknesses in the project management of the annual benefits statement 
process which meant that the results of data quality checks for a number of employers, from whom data was received in May 2017, were not communicated until mid-July 2017 reducing the period available to resolve any issues from three months to one month. We also found that there were a number of active member records for which no benefit statement was prepared due to a lack of data. This led to some members receiving annual benefit statements after the statutory deadline of 31 August 2017, or not at all. This was an area of concern raised by TPR when it considered the 2015/16 annual benefit statements process. 
We identified the following medium risk-rated issues as part of the audit: 

- 
Retirement benefit calculations **(finding three)** - A number of retirees received their benefits over 30 days after they retired as a result of delays in notifying 
the scheme of their intention to retire, either by the employee or employer. We also found that annual benefit statements did not communicate the timescales involved in retirements leading to members not being aware of the timescales involved. There is a risk that retirees may not receive their benefits promptly leading to financial hardship. 
- 
Governance of scheme administration (finding four) - We found that contract monitoring meetings held to monitor the pension administration section of the 
CSG contract were not formally recorded by the Council and that the employer targets for the scheme administration strategy are not monitored. This could lead to the Council not identifying breaches of laws and regulations. 
- 
Communication strategy (finding five) - There was no scheme communication strategy or agreed fund administration strategy in place during the period 
under review. This could lead to scheme members having an expectation gap between what they expect and what is provided by the scheme or scheme records may be incomplete as a result of employers not working effectively with the administration team. 
- 
New members and impact on data quality (finding six) - The scheme does not follow up on new joiners identified outside of the usual notification process 
and there were duplicate records. This could lead to membership records being incomplete meaning that scheme liabilities could be understated. 
- 
Transfers (finding seven) - There were some delays in the payment of transfers out of the fund and issuing letters to scheme members once the transfer took 
place. This could lead to members not being aware of their entitlement or leading to breaches of legal requirements in relation to transfers out. 
- 
Breaches of law (finding eight) - The Council did not have a breaches of law policy in place until late October 2017 and does not receive reporting on 
possible breaches of law. TPR also identified that CSG did not report a breach of law when 2016 annual benefit statements were issued late. The Council may not report matters required to TPR leading to them being exposed to fines or other civil action by TPR. 
We identified the following low risk-rated issue as part of the audit: 

- 
Creation of new members records (finding nine) - A large number of records were created and authorised outside of the timespan stated in the scheme 
administration strategy. This could lead to the scheme's membership numbers and record of benefits earned being understated. 

## 2. Findings, Recommendations And Action Plan

Re
f 
Finding  
Risks 
Risk 
category 
Agreed action 
 

## 1. Scheme Data Quality

|                                     |                |
|-------------------------------------|----------------|
| Control design                      |                |
|                                     |                |
|                                     |                |
| HIGH                                | Agreed Action: |
| a) We will deliver the improvement  |                |
| If inaccurate or incomplete data is |                |
| held on scheme members, then        |                |
| benefits paid to members may be     |                |
| incorrect or members may be         |                |
| provided                            | with           |
| information                         | on             |
| entitlement.                        |                |

The Council's pension fund is required to hold a large amount of data on scheme members. This data is used to contact members and calculate benefits. The scheme is now a career revalued earnings (CARE) scheme, for benefits earned after 1 April 2014 which means that the scheme is required to hold data on pensionable pay for each year since that date to calculate each member's pension entitlements correctly. TPR expect that schemes review their data annually and implement improvement plans where poor quality or missing data is identified. Prior to this year, no reviews had been undertaken of data held. During the audit, we noted that: 

If inaccurate or incomplete data is 
provided to the scheme's actuary, 
the valuation of the scheme may be inaccurate which could lead to scheme employers being under or overcharged 
deficit 
reduction 
contributions. 

plan, as agreed with the scheme manager, to improve data quality so as to meet TPR's target standards. We will also consider recovering the cost of this from employers, where the reason for the data quality issues is their failure to fulfil their obligations to the scheme and if employers are unable to assist with the update of members' records we will consider if this is a breach of law reportable to TPR. 

b) We will review the quality of 
The extent of data quality issues may not be known leading to unexpected delays in providing information to scheme members. 

- 
One data quality review was undertaken by CSG on behalf of the Council during the period to identify whether data held by the scheme is complete. This 
focused on "common data", a dataset specified by 
TPR as being data required to uniquely identify scheme members. Data held passed for 85% of members for whom records were created before June 2010 and 91% for records created after June 2010. 
These are below TPR's target of 95% and 100% 
respectively. 
At 
the 
time 
of 
our 
fieldwork 
conditional data by 28 February 2018 as per the agreed service improvement plan and will update this data, as agreed with the scheme manager, prior to the triennial review of the fund due as at 31 March 2019. 
c) We will discuss how to complete 
(October/November 2017), the results were being communicated to the Council. CSG are currently working with the Council to agree a plan to resolve the data quality issues noted as part of the agreed service improvement plan. 

employer's end of year returns at 
the planned employers' forum to 
ensure that employers are aware 
of requirements. We will inform 
- 
There has been no recent review of the quality of 

Re
f 
Finding  
Risks 
Risk 
category 
Agreed action 

"conditional data", defined by TPR as being the data required to calculate pension benefits. The service improvement plan specifies that a review of conditional data quality will be completed by 28 February 2018. 

employers that they will need to sign a statement saying that what has been submitted is accurate, and that they have done their own checks prior to submission. We will also ensure scheme 

employers are aware of our ability to charge them the cost of undertaking work to rectify issues in their initial submissions.  
d) We will ensure analytical reviews 
are undertaken over contributions received and reported to ensure 
movements 
reported 
are 
In order to update data held by the scheme, CSG receives an annual submission from scheme employers which includes current full time equivalent salary, qualifying pay in the period and contributions deducted in the period. This return is used to update Hartlink and is used to prepare annual benefit statements. This exercise usually identifies data quality issues, for example, 12/20 employer returns that we reviewed identified new members who had not been notified to the scheme. For each of these employers, CSG wrote to employers to request the appropriate forms were supplied to allow CSG to create new member records. We found that: 

reasonable and reconciliations will be performed between amounts reported and the general ledger. We will consider if any further assurance is required over the accuracy of contributions received, considering 
whether 
sufficient 
- 
The pensions administration team does not have a detailed checklist of items it reviews for each submission which is retained with the submissions to evidence the completion of their review; 
assurance is provided by reviews undertaken by internal audit and external audit both at the Council and employers. 
e) We will create a checklist which 
- 
The pensions administration team does not perform a check on each employer submission to ensure that all employees who are logged as active members of the scheme for that employer have information provided;  
will be used to evidence the review of end of year returns. These 
checks 
will 
include 
reviewing whether data is provided for all active member records. 
f) We will log data quality issues 
- 
There is no monitoring and reporting of the nature and extent of data quality issues identified in the submissions made by employers, such as new members not notified to the scheme and unusual salaries, and the subsequent resolution of these issues; and 
- 
The pensions administration team does not undertake 
identified by type of issue and both record and monitor the number of 

Re
f 
Finding  
Risks 
Risk 

to ensure that the correct contributions have been deducted by employers for employees. This is due to employee contribution rates fluctuating month on month and this would require them to undertake a detailed review of monthly pay to confirm contributions are correct. It should be noted that responsibility for deducting the correct contributions lies with the individual employer. 

These data issues are most likely to affect the actuarial valuation of the scheme as most data held is validated with scheme employers before benefits are paid. However, for benefits earned after 1 April 2014, the start of the CARE scheme, this check may become ineffective as the period between benefits being earned and benefits paid increases.  

 

## 2. Preparation Of Annual Benefit Statements

Control design and operating effectiveness Annual benefit statements may not be issued promptly leading to reputational 
damage 
to 
the 
Council and fines from TPR.  

The scheme is required to issue annual benefit statements, which report each member's accumulated pension entitlements at the end of the financial year, by 31 August of each year. There are a number of steps involved in the process including, uploading of end of year returns and uplifting accumulated benefits in the CARE section of the scheme by the index. 

We noted the following control design deficiencies in the process to collect returns for the year-ended 31 March 

category 
Agreed action 
records not loaded to Hartlink. A summary of issues encountered 
will be presented annually to the Local 
Pension 
Board 
and 
employers. 
Responsible officer: 
 (Head of Public Sector Pensions, Capita) / (Head of Business 
Assurance, CSG Employee Benefits) 
Target date: 
a) 31st August 2018  
b) 28th February 2018 (analysis 
completed) / 31st March 2019 (data rectification complete) 
c) 
28th February 2018 
d) 30th June 2018 e) 30th April 2018 f) 
31st May 2018 


HIGH 
Agreed Action: 
a) We will prepare a detailed project 
plan for the provision of annual benefit statements, as well as the other 
key 
milestones 
in 
the 

Scheme Year Planner and the Triennial valuation, and this will be approved by the Council. Progress will be monitored and managed by 

Re
f 
Finding  
Risks 
Risk 
2017: 

- 
Chasing of late end of year returns by the pensions 
administration team took place one month after forms became due, reducing the time to resolve any data quality issues by 3½ months to 2½ months; 
- 
The vast majority of data quality issues required to be resolved by scheme employers were communicated to employers in mid-July 2017. Given that a large number of employers are schools, this makes it less likely that responses will be received in time to meet a 31 August 2017 deadline; 
- 
There is no documented process for reviewing and 
evidencing the review of the accuracy of calculations performed within Hartlink which are used to populate annual benefit statements; and 
- 
There is no formal monitoring and reporting to the Local Pension Board of the number of benefit statements not issued. 
We tested a sample 25 active member records to ensure that statements were issued on time. We found that: 

- 
4/25 statements were not issued before 31 August 2017 as a result of issues identified and being resolved with employers; and 
- 
5/25 statements were not issued as no end of year return data was held. This is thought to be due to employers not notifying the scheme of leavers. CSG management have identified that there are potentially over 1,000 such records. 
Through discussions with CSG management, we note that there is an intention to allocate specialist project managers to the 2018 annual benefits statement process. 

category 
Agreed action 
specialist 
project 
managers. 
Progress against the agreed plan 
will be reported to the monthly CSG 
pensions 
administration 

contract monitoring meetings.(see finding 5) 

b) We will introduce a process for 
reviewing calculations used to populate 
annual 
benefit 
statements. 
This 
will 
include 
sampling of calculations and also how this is evidenced 
c) We 
will 
work 
with 
scheme 
employers to close active records where no employment data has been reported in 2016/17. 
d) We will consider how we can 
change 
the 
relationship 
with 
employers 
and 
their 
payroll 
providers 
to 
encourage 
compliance 
with 
scheme 
requirements, such as reminding 
employers of the scheme's ability 
to recharge the cost of any rectification work undertaken by the fund, and reporting employers to TPR for breaches of law. 

Responsible officer: 
 (Head of Public Sector Pensions, Capita) / (Head of Business 
Assurance, CSG Employee Benefits) 
Target date: 
Re
Finding  
Risks 
Risk 
 

## 3. Timeliness Of The Notification Of Planned Retirements

Control design and operating effectiveness If benefits are not calculated correctly 
or 
paid 
to 
retirees 
promptly then retirees may suffer financial hardship and the Council 
may suffer reputational damage 

The draft fund administration strategy (see finding 6) states that scheme employers are expected to notify the pension administrations team at least 30 days before a scheme member's expected retirement. Scheme members are then issued with retirement option forms and these are returned before payment can be authorised. Final calculations are released within 10 working days of receipt of completed option forms. We noted the following: 

- 
There are no communications to scheme members regarding the requirement to notify the scheme, via their employer, of any intention to retire. This means that scheme members may not be aware of the time required to complete retirement processes. 

We reviewed a sample of 20 retirements in the period and found that: 

- 
10/20 retirees were paid lump sums more than 30 days after their retirement date. The root cause of the delays were one or a combination of: late notification by the employer; employers failing to promptly answer queries on information provided; or delays in receiving completed option forms from members. 
category 
Agreed action 
a) 31st March 2018 b) 31st May 2018 
c) 31st August 2018 d) 28th February 2018 


MEDIUM 
Agreed Action: 
a) Scheme members will be informed 
of 
retirement 
timescales 
by 
including 
this 
information 
in 
newsletters 
sent 
with 
annual 
benefit 
statements 
and 
other 
communications. 
b) We will remind employers of the 
need 
to 
promptly 
notify 
the 
scheme of potential retirements and use information provided by employers to proactively identify potential retirees. 
c) The 
scheme's 
communication 
strategy 
will 
include 
communicating 
with 
members 
nearing retirement to proactively engage with them regarding their retirement. 
Responsible officer: 
 (Head of Public Sector Pensions, Capita) / (Head of Business 
Assurance, CSG Employee Benefits) 
Finding  
Risks 
Risk 
category 
Agreed action 
Target date: 
a) 31st March 2018 
b) 28th February 2018 
c) 31st January 2018 

## 4.  Governance Of Scheme Administration

|     |     |     |
|-----|-----|-----|

## Control Design



MEDIUM 
Agreed Action: 
a) We will review the risk register at 
each governance meeting and ensure 
these 
meetings 
are 

The Council's Pension Fund Committee is the 'scheme manager' and as such has overall responsibility for the pension scheme. It has been agreed that the Local Pension Board will oversee the administration of the scheme, including the performance of CSG.  

minuted. 
If management information does not monitor compliance with the fund administration strategy then the Council may breach legal 
requirements leading to fines and further reputational damage. 
b) We 
will 
agree 
a 
Terms 
of 
Reference 
for 
the 
monthly 
governance meetings. 

CSG are responsible for managing the administration of the scheme. There is a group, comprising senior Council officers and CSG staff, who meet monthly to monitor the pensions administration part of the CSG contract. 

c) We will investigate how we can 

We found that: 

| report                            | on          | the    | compliance     |
|-----------------------------------|-------------|--------|----------------|
| employers and payroll providers   |             |        |                |
| with                              | the         | fund   | administration |
| strategy, once adopted and report |             |        |                |
| management                        | information |        |                |

- 
During the period under review, meetings of the group which monitors the pensions administration part of the CSG contract were not formally minuted by the Council; 

- 
A 
formal 
risk 
register 
reviewing 
scheme 
produced to the Local Pensions Board. 
Responsible officer: 

administration risks did not exist before August 2017 and was first reported to the Local Pensions Board on 11 September 2017; and  

a) and c) (Head of Public Sector 
Pensions, Capita) / (Head of Business Assurance, CSG 
Employee Benefits) 
b)  (Head of Business Assurance, 
CSG Employee Benefits) / 

- 
The draft fund administration strategy specifies certain targets to be met by scheme employers, including the provision of data to the administrator at the end of each scheme year and the provision of 
information regarding new members. Compliance 

Re
f 
Finding  
Risks 
Risk 
category 
Agreed action 
(Strategic HR Lead) 
with these targets is not monitored and reported to the Council or the Local Pensions Board. 
Target date: 
a) 11th January 2018 b) Complete 

There are also regular meetings between CSG, the Council and the Trade Union to discuss the actions being taken to address a number of issues the Trade Union has raised.  

c) 31st March 2018 
 

## 5. Communication Strategy

|                                            |                |
|--------------------------------------------|----------------|
| Control design and operating effectiveness |                |
|                                            |                |
|                                            |                |
| If                                         | there          |
| MEDIUM                                     | Agreed Action: |
| communication                              | strategy       |
| a) A                                       | communication  |
| including the provision of sufficient      |                |
| quality                                    | assurance      |
| communications                             | with           |
| scheme members then there may              |                |
| be an expectation gap between              |                |
| what members expect and what is            |                |
| provided leading to increased              |                |
| complaints.                                |                |
| and employers, will be developed           |                |
| and agreed by the Local Pensions           |                |
| Board.                                     |                |

The pension fund is required to communicate with its stakeholders, including scheme members and scheme employers. It is normal practice for key information on the fund to be held on the Council's website so that employers and scheme members, whether active, deferred or pension members, can access the information. TPR requires that the scheme has a strategy to communicate with members and identifies that members should receive information when they join the scheme and as scheme terms vary. 

b) A flowchart will be created for 

We found that: 

| retiring                                             | members                                            | to       | enhance    |
|------------------------------------------------------|----------------------------------------------------|----------|------------|
| If there is no clear communication                   |                                                    |          |            |
| strategy with employers, then                        |                                                    |          |            |
| scheme members may receive a                         |                                                    |          |            |
| below                                                | standard                                           | service  | or         |
| scheme                                               | records                                            | may      | be         |
| clarity around what they should                      |                                                    |          |            |
| expect to happen when.                               |                                                    |          |            |
| c) Responsibility will be agreed for                 |                                                    |          |            |
| inaccurate or incomplete leading                     |                                                    |          |            |
| to under or overpayments of                          |                                                    |          |            |
| benefits.                                            |                                                    |          |            |
| keeping the LGPS section of the                      |                                                    |          |            |
| Council's                                            | website                                            |          |            |
| updated                                              |                                                    |          |            |
| -                                                    |                                                    |          |            |
|                                                      | There is no strategy for communication with scheme |          |            |
| employers and members beyond requesting the          |                                                    |          |            |
| information required, such as the end of year return |                                                    |          |            |
| information. This has been identified within the     |                                                    |          |            |
| service improvement plan and is due to be agreed     |                                                    |          |            |
| and implemented before the start of 2018.            |                                                    |          |            |
| regarding the operation of the                       |                                                    |          |            |
| LGPS scheme and a process for                        |                                                    |          |            |
| ensuring this remains up to date                     |                                                    |          |            |
| will                                                 | be                                                 | included | in         |

communications strategy. 
- 
The LGPS section of the Council's website was last updated in 2014 and does not contain up to date information on the scheme or contact information for the current administration team. 
d) The fund administration strategy 
- 
There was no agreed fund administration strategy, 

## Re

Finding  
Risks 
Risk 

specifying what is expected of scheme employers, in place during the period under review. However, a draft strategy was approved, subject to consultation with employers, at the 11 September 2017 meeting of the Local Pension Board. 

- 
Annual benefits statements issued and scheme website do not give contact details of the CSG team responsible for pensions administration to allow them to raise any queries directly to CSG. 

category 
Agreed action 

will be finalised and issued to scheme employers. We will also ensure employers are aware of the scheme's ability to recover costs incurred through not complying with the administration strategy and that non-compliance with the strategy could be construed as a breach of law, reportable to TPR. 

e) We will ensure that annual benefit 
statements 
and 
the 
website 
include contact details for the CSG 
pensions administration team.  
f) We will change the format of the 
presentation of estimates so that the Annual Benefit Statements are easier to understand. 

Responsible officer: 

 (Head of Public Sector Pensions, Capita) / (Head of Business Assurance, CSG Employee Benefits) 

Target date: 
a) 14th February 2018 b) Complete c) 31st January 2018 d) 31st January 2018 e) 28th February 2018 f) 31st March 2018  
Re
f 
Finding  
Risks 
Risk 
category 
Agreed action 
 

## 6. New Members And Impact On Data Quality


## Control Design And Operating Effectiveness



MEDIUM 
Agreed Action: 
a) We will use monthly scheme 
If records are not created for new members identified then their entitlement to future benefits may not recorded. Duplicate records may lead to the 
fund's 
membership 
numbers 

Some scheme employers also provide CSG with a listing of employees and contributions paid each month. These are checked to ensure that all employees have records in Hartlink, the pension fund administration system. In addition, there is an interface between the payrolls administered by CSG and Hartlink. This is designed to identify potential duplicates and create new member records where new members are identified. 

being overstated and confusion for scheme members.  
returns to identify new members and potential leavers and record this in Hartlink, so as to create a task to request paperwork from employers to support the change in status of members.  

We found the following control deficiencies: 

b) We will review records created by 
the interface between the payroll system and Hartlink to ensure that duplicate entries are resolved before Annual Benefit Statements are issued. 

- 
There is no central log of new joiners identified from a review of monthly contributions paid to the scheme. This means that records for new members may not be created promptly, leading to issues with the annual end of year returns process. 

## Responsible Officer:

(Head of Public Sector Pensions, Capita) /  (Head of Business Assurance, CSG Employee Benefits) 

- 
We found that there is no review of potential duplicate records created when data is loaded to Hartlink by the interface with CSG managed payrolls. This can lead to duplicate member records, overstating the 
number of pension accounts.  

Target date: 
a) 31st January 2018 

We tested a sample of 25 new members records created in the period. We found that: 

b) 30th June 2018 

- 
1/25 records was a duplicate record. In this case, a record was created by the employer submitting a new member form and the second record by the interface between the payroll system and Hartlink. The duplicate has now been deleted. The agreement of pay and service before retirement ensures that members do not receive duplicate payments. 

 
Re
f 
Finding  
Risks 
Risk 
category 
Agreed action 
 

## 7. Transfers

|                                       |                |
|---------------------------------------|----------------|
| Operating effectiveness               |                |
|                                       |                |
|                                       |                |
| MEDIUM                                | Agreed Action: |
| a) Work will be allocated so that the |                |
| If transfers are not updated          |                |
| promptly then members may have        |                |
| inaccurate knowledge of their         |                |
| pension entitlements.                 |                |

Scheme members can transfer their benefits into and out of the scheme so that their benefits sit with their current employer's pension scheme. The Council's draft fund administration strategy states that tasks relating to transfers should be completed by CSG within 10 working days. 

targets set in the administration strategy, which are SLA targets, are achieved. 
b) We will work with third parties to 

We tested a sample of two transfers into the fund to ensure that the above timescales were met and found that: 

clear the backlog of transfers. 
If transfers out are not actioned promptly, then the scheme may be fined by TPR and the Council may suffer reputational damage. 
Responsible officer: 

- 
In both cases, letters were issued to fund members more than 10 working days after completion of the 
transfer. 

 (Head of Public Sector Pensions, Capita) / (Head of Business Assurance, CSG Employee Benefits) 

We tested a sample of five transfers out of the fund to ensure that the above timescales were met and found that: 

Target date: 
a) Complete b) 31st March 2018 

- 
In 2/5 cases, payments to other schemes were made after more than 10 working days. In one case, the transfer took over two months to be approved due to the size of the transfer. 
It should be noted that compliance with best practice turnaround times are monitored and reported to the Council and the Local Pensions Board. This best practice guidance is incorporated in the draft administration strategy which now form part of contractual SLAs. The most reporting to the Local Pension Board, as at the 31 October 2017, identified that there were 42 transfers which had yet to be completed which were over three months old. 4 of these related were awaiting Capita action and 38 of these were awaiting third party action. 

## 8. Breaches Of Law

 
Re
f 
Finding  
Risks 
Risk 
category 
Agreed action 

## Control Design



MEDIUM 
Agreed Action: 

It is a legal requirement that breaches of the law of material significance to TPR are reported to TPR. 

If members or officers of the 
Council 
or 
the 
pensions 

a) We will train members of staff at 
We found that: 

- 
The 
Pension 
Fund 
Committee 
approved 
the 
the Council and CSG on the scheme's policy on  breaches of law  
b) We will maintain a record of 

administration team are not aware of the need to report breaches of law then breaches may not be reported promptly which could expose the Council to fines or other civil action.  

identified breaches of law which will include any breaches of scheme 
requirements 
by 
employers which are breaches of law. This will be included in the 
monthly 
reporting 
to 
the 
governance meeting.  
scheme's policy on reporting breaches of law on 24 
October 2017 with no approved policy in place prior to this date. However, CSG staff use a Capita policy and procedure to identity breaches of law and assess them. The Capita policy is aligned to TPR's guidance 
and thus aligned with the Council's policy for 
identifying and assessing breaches. This means that 
Council staff may not have identified and reported issues as required;   
c) The Council will review breaches 
identified and report breaches considered to be of material significance to TPR. 
- 
TPR have concluded that CSG and the Council did not promptly identify that the failure to issue annual benefit statements on time in 2016 could be a reportable breach of law; and 

## Responsible Officer:

a) and b) (Head of Public Sector 
- 
The Council does not receive reporting of matters, such as delays in receiving contributions or late data returns from employers, to enable it to identify if potential breaches of law have occurred.  
Pensions, Capita) / (Head of Business Assurance, CSG Employee Benefits) 
c)  (Strategic HR Lead) 

## Target Date:

CSG expect that breaches identified will be reported through to the Council and the Local Pensions Board. Reporting of breaches would be made either immediately or after discussions with the Council, as scheme managers, depending on the severity of the breach. 

a) 31st January 2018 b) 11th January 2018 c) Ongoing and monitored through 
monthly reporting 
 
Re
f 
Finding  
Risks 
Risk 
category 
Agreed action 
 

## 9. Creation Of New Member Records

|                                       |                |
|---------------------------------------|----------------|
| Operating effectiveness               |                |
|                                       |                |
|                                       |                |
| If                                    | records        |
| LOW                                   | Agreed Action: |
| promptly,                             | then           |
| a) Employers will be reminded of the  |                |
| need to notify the scheme of new      |                |
| joiners promptly.                     |                |
| b) We will use data provided to us by |                |
| members and benefits due may          |                |
| be incomplete which could result      |                |
| in the scheme being undervalued       |                |
| at triennial revaluations.            |                |

The fund's draft administration strategy requires that the scheme's employers inform the pension administration team of new scheme members within 10 days of the employee becoming eligible or by the end of the month they joined, and new records should then be created within 10 days. These timescales are considered best practice for schemes. 

 
employers to identify potential new members of the scheme and log new 
members 
identified 
in 
Hartlink, pending paperwork. 

We tested a sample of 25 new members to confirm that new member records were established and authorised in Hartlink within 20 days of joining or 10 days of month end. 

Responsible officer: 

We found that: 

 (Head of Public Sector Pensions, Capita) / (Head of Business Assurance, CSG Employee Benefits)  
Target date: 
a) 28th February 2018 b) 31st January 2018  

- 
19/25 had records created outside of the period identified in the fund's draft administration strategy. This was due to delay by employers in informing the pensions administration team of new members with the correct paperwork to create new records and delays in processing the interface between the Council's payroll and Hartlink. Of these 12 of the new records related to members whose pay and 
pension arrangements are managed by CSG. 


## Appendix 1: Definition Of Risk Categories And Assurance Levels In The Executive Summary Risk Rating

Immediate and significant action required. A finding that could cause:  

## Critical

 
- 
Life threatening or multiple serious injuries or prolonged work place stress. Severe impact on morale & service performance (e.g. mass strike actions); or 
 
- 
Critical impact on the reputation or brand of the organisation which could threaten its future viability. Intense political and media scrutiny (i.e. front-page headlines, TV). Possible criminal or high profile civil action against the Council, members or officers; or 
- 
Cessation of core activities, strategies not consistent with government's agenda, trends show service is degraded.  Failure of major projects, elected Members & Senior Directors are required to intervene; or 
- 
Major financial loss, significant, material increase on project budget/cost. Statutory intervention triggered. Impact the whole Council. Critical breach in laws and regulations 
that could result in material fines or consequences. 

Action required promptly and to commence as soon as practicable where significant changes are necessary. A finding that could cause: 

## High

 
- 
Serious injuries or stressful experience requiring medical many workdays lost. Major impact on morale & performance of staff; or 
 
- 
Significant impact on the reputation or brand of the organisation. Scrutiny required by external agencies, inspectorates, regulators etc. Unfavourable external media coverage. Noticeable impact on public opinion; or 
- 
Significant disruption of core activities. Key targets missed, some services compromised. Management action required to overcome medium-term difficulties; or 
- 
High financial loss, significant increase on project budget/cost. Service budgets exceeded. Significant breach in laws and regulations resulting in significant fines and consequences. 

A finding that could cause: 

## Medium

 
- 
Injuries or stress level requiring some medical treatment, potentially some workdays lost. Some impact on morale & performance of staff; or 
 
- 
Moderate impact on the reputation or brand of the organisation. Scrutiny required by internal committees or internal audit to prevent escalation. Probable limited unfavourable media coverage; or 
- 
Significant short-term disruption of non-core activities. Standing orders occasionally not complied with, or services do not fully meet needs. Service action will be required; or 
- 
Medium financial loss, small increase on project budget/cost. Handled within the team. Moderate breach in laws and regulations resulting in fines and consequences. 

A finding that could cause: 
Low 
 
- 
Minor injuries or stress with no workdays lost or minimal medical treatment, no impact on staff morale; or 

- 
Minor impact on the reputation of the organisation; or 
 
- 
Minor errors in systems/operations or processes requiring action or minor delay without impact on overall schedule; or 
- 
Handled within normal day to day routines; or 
- 
Minimal financial loss, minimal effect on project budget/cost. 

## Level Of Assurance

Substantial 
There is a sound control environment with risks to key service objectives being reasonably managed. Any deficiencies identified are not cause for major concern. Recommendations will normally only be Advice and Best Practice. 
 
 
Reasonable 
 
An adequate control framework is in place but there are weaknesses which may put some service objectives at risk. There are Medium priority recommendations indicating weaknesses but these do not undermine the system's overall integrity. Any Critical recommendation will prevent this assessment, and any High recommendations would need to be mitigated by significant strengths elsewhere. 
 
Limited 
There are a number of significant control weaknesses which could put the achievement of key service objectives at risk and result in error, fraud, loss or reputational damage. There are High recommendations indicating significant failings. Any Critical recommendations would need to be mitigated by significant strengths elsewhere. 
 

## No 

There are fundamental weaknesses in the control environment which jeopardise the achievement of key service objectives and could lead to significant risk of error, fraud, loss or reputational damage being suffered. 

## Appendix 2 - Analysis Of Findings

| Critical                                                                 | High    | Medium    | Low       | Total    |
|--------------------------------------------------------------------------|---------|-----------|-----------|----------|
| Area                                                                     |         |           |           |          |
| D                                                                        | OE      | D         | OE        | D        |
| Managing risks                                                           |         |           |           |          |
|                                                                          |         |           |           |          |
| -                                                                        | -       | -         | -         | 1        |
| 1                                                                        |         |           |           |          |
| Administration - scheme record keeping                                   |         |           |           |          |
|                                                                          |         |           |           |          |
| -                                                                        | -       | 1         | -         | 1*       |
| 3                                                                        |         |           |           |          |
| Administration - providing information to members                        |         |           |           |          |
|                                                                          |         |           |           |          |
| -                                                                        | -       | 1*        | -         | 1*       |
| 3                                                                        |         |           |           |          |
| -                                                                        | -       | -         | -         | 1*       |
| 1                                                                        |         |           |           |          |
| Administration - providing information to and                            |         |           |           |          |
| receiving information from employers and other                           |         |           |           |          |
| admitted bodies                                                          |         |           |           |          |
|                                                                          |         |           |           |          |
| Resolving                                                                | issues  | -         | resolving | disputes |
| -                                                                        | -       | -         | -         | 1        |
| 1                                                                        |         |           |           |          |
| breaches of law                                                          |         |           |           |          |
| Governing the scheme - submitting returns                                |         |           |           |          |
| -                                                                        | -       | -         | -         | -        |
| -                                                                        |         |           |           |          |
| Total                                                                    | -       | -         | 2         | -        |
| *Includes finding relating to control design and operating effectiveness |         |           |           |          |

## Key:

- 
Control Design Issue (D) - There is no control in place or the design of the control in place is not sufficient to mitigate the potential risks in this area. 
- 
Operating Effectiveness Issue (OE) - Control design is adequate, however the control is not operating as intended resulting in potential risks arising in this area. 

Timetable Terms of reference agreed:  
Fieldwork commenced: 
Fieldwork completed: 
Draft report issued: 
Management comments received: 
Final report issued: 
9 October 2017 
9 October 2017 
8 January 2018 
1 December 2017 
5 December 2017 
9 January 2018 

## Appendix 3 - Identified Controls

Area 
Objective  
Risks 
Identified Controls 
Managing risks 
 
Governance arrangements may not support the Council effectively fulfilling pension administration requirements if:  
There are defined arrangements to ensure oversight over pension administration activity and the fulfilment of requirements. 
- 
Governance responsibilities, including key accountabilities, are not clearly defined; 
- 
Compliance with 
internal SLAs (for example between payroll and pensions) is not monitored to mitigate operational issues arising due to dependencies;     
- 
Management information is not accurate or is not produced to facilitate oversight and scrutiny; 
- 
Target timeframes are not in place to process transfers and compliance against targets is not measured. 
- 
Action plans to address wider issues identified through complaints are 
not formulated leading 
to underlying issues, 
- 
Scheme administration is overseen by the Local Pensions Board 
- 
There is a governance group, made up of members of the Council 
and CSG, who oversee administration of the scheme (see finding 4) 
- 
There is a clear scheme of responsibilities in the pensions administration team 
- 
There are SLAs in place for queries which are reported to the Local Pensions Board 
- 
Reporting includes compliance against SLAs and the number cases 
outstanding, and their ageing 
- 
Management information relating to task management is prepared in Hartlink and targets are embedded into task management 
processes **(see finding 4)** 
- 
A service improvement plan is in place to address issues identified 
- 
Actions are logged as part of governance group meetings (see finding 4) 
- 
A risk register exists and is reported to the governance group and 
the Local Pensions Board **(see finding 4)** 
 
 
Area 
Objective  
Risks 
Identified Controls 
such as inaccurate calculation of pension benefits, continuing; and 
- 
A comprehensive risk register does not exist or is not regularly updated. 
- 
Members information is supplied by employers and records created within 20 working days of starting or 10 days after the end of the 
month the employee joins the employer **(see findings 6 and 9).** 
Contributions made to the fund by employers and employees are accurate, timely and 
complete for all new joiners. 
Administration - scheme record 
keeping 
- 
Hartlink identifies potential duplicate records **(see finding 7).** 
 
- 
Inefficient processes may lead to applications not being processed on a 
timely basis resulting in a delay in members joining the scheme.  
Member information - scheme joiners 
 
- 
Inaccuracies in information supplied (such as salary details) may lead to an incorrect contribution rate upon enrolment leading to over or underpayments of contributions. 
- 
Duplicate members are not identified leading to 
members' pension 
entitlement not being calculated accurately. 
- 
Employers are notified in advance of the requirement to supply 
information and deadlines specified for the provision of data (see finding 2) 
Administration - scheme record keeping 
Data recorded on the pensions system in respect of active members (Hartlink) is accurate 
and complete. 
- 
Employers are chased to provide information if provided late (see finding 2) 
Data held on the system may not be accurate or up to date resulting in inaccurate data submissions to the regulator and inaccurate calculation of the scheme's funding status if: 
- 
Submissions are reviewed by CSG prior to data upload and queries 
on data returned to employers **(see findings 1 and 3)** 
Member information - updating active 
member 
- 
Information is not received 
from scheme employers in 
 
Area 
Objective  
Risks 
Identified Controls 
- 
Data is uploaded direct from spreadsheets to Hartlink 
records 
line with required timeframes;  
- 
Inaccurate or incomplete submissions are not identified and resolved; 
- 
Information is not uploaded accurately in to the underlying system; and 
- 
Membership records are lost and not promptly replaced. 
- 
Deaths identified/reported are recorded on Hartlink and pension 
payments blocked for these members 
Administration 
- scheme record keeping 
Data recorded on the pensions 
system in respect of pensioner members (Hartlink) is accurate 
and complete. 
- 
Results from the National Fraud Initiative and "Tell us once" are 
used to identify possible deaths 
- 
A lack of a systematic 
approach to updating the pension records may mean that pension payments may continue to be made in respect of deceased individuals. 
 
Member information - updating pensioner member records 
- 
Forms are received from employers containing final pay figures to enable pensions to be calculated 
Accurate and timely pension payments are made to retired 
scheme members. 
Administration - scheme record keeping 
- 
Calculations are reviewed to ensure that scheme rules are applied correctly 
- 
Final calculations are issued within 10 working days of receipt of 
relevant paperwork **(see finding 3)** 
Calculation of benefits payable 
- 
Use of incorrect final salary information and/or CARE pension account value may mean calculation of pension benefits to retirees is inaccurate leading to overor underpayment. 
 
- 
Exception reporting on pension increases proposed are reviewed before increases are approved  
- 
Delays in processing the retirement information may mean that payments to retirees may be inaccurate or delayed. 
- 
Inaccurate benefit 
Area 
Objective  
Risks 
Identified Controls 
payments are made as a result of draft information being used in benefit calculations 
- 
Inaccurate calculations of annual increases of pensions in payment are not detected leading to over- or underpayment. 
Transfers in and out of the pension scheme are processed accurately and in a timely manner.   
Administration - scheme record keeping 
- 
Data is requested to support transfers in using a standard template to enable the scheme to receive sufficient information to provide an indication of the size of benefits to members transferring into the scheme 
Transfers in/out 
 
Transfers may not be processed accurately and on a timely basis, leading to complaints from scheme members and/or 
inaccuracies in the financial records maintained by the fund if:  
- 
Transfer value received and information is used to calculate the value of benefits transferred in 
- 
Transfer out calculations are reviewed before these are issued to 
ensure they are accurate **(see finding 7)** 
- 
Insufficient information is not received/provided in a timely manner to support the transfer leading to inaccuracies in member records; and 
- 
Inaccurate calculations to support transfers out are not identified and resolved. 
- 
There is an annual scheme plan which sets out tasks to be completed in the period - this includes the requirement to produce annual benefit statements 
Accurate annual benefit statements are provided annually in line with scheme requirements. 
Administration - providing information to members 
Scheme members may not receive accurate information regarding their pension in a timely manner resulting in service user dissatisfaction if:  
 
 
- 
Annual benefit statement preparation is assigned to an officer at CSG 
 
- 
A plan to collect appropriate data and load data was in place (see finding 2) 
- 
Officers are not aware of scheme requirements in relation to annual benefit statements; 
- 
Data is taken from annual returns and added to CARE accounts 
- 
A sample of benefit statement calculations are reviewed to ensure 
accuracy before being issued **(see finding 2)** 
- 
Responsibility for 
producing annual benefit statements is 
Area 
Objective  
Risks 
Identified Controls 
not assigned;  
- 
Various entitlements of members are set out on benefit statements 
(see finding 3) 
- 
Staff are allocated to the pensions administration team during busy periods 
- 
Operational plans are not in place to ensure data required is provided in line with required timeframes; 
- 
Incorrect or incomplete figures are added to or held for members career average revalued earnings pension accounts leading to inaccurate benefit calculations; 
- 
Benefit statement calculations are inaccurate; 
- 
Benefit statements are insufficiently detailed to allow members to identify and report errors; and 
- 
Operational plans do not take account of seasonal workload fluctuations to ensure the service is sufficiently resourced at peak times. 
- 
The service improvement plan requires that CSG produces a 
communication strategy **(see finding 5)** 
Information about the scheme, such as changes to terms and conditions, are communicated to members.  
Administration - providing information to members 
Scheme members may not receive accurate information regarding their pension in a timely manner resulting in service user dissatisfaction if:  
 
- 
Officers are not aware of scheme requirements in 
Area 
Objective  
Risks 
Identified Controls 
relation to member communications; 
- 
Responsibility for producing communications is not assigned; and 
- 
Communications sent to members are inaccurate or not made in a timely manner. 
Information about the scheme, such as timeliness of data 
returns for new joiners, retirees or other changes are communicated and a comprehensive communication plan is in place for all stakeholders 
Administration - providing 
information to and receiving information from employers and other admitted bodies 
Scheme employers and other admitted bodies may not be 
aware of data requirements and timescales resulting in employer dissatisfaction with the scheme administration, over/underpayments, inaccurate benefits statements and reputational damage to the Council if: 
 
- 
Employers and other admitted bodies are not aware of scheme requirements in relation to member data;  
- 
Employers and other admitted bodies are not aware of key cut off dates for data returns (e.g. new joiners, actuarial review); and 
- 
Employers and other 
admitted bodies are 
not aware of changes 
- 
Templates are used to ensure data is provided in line with scheme requirements 
- 
Cut-off dates are communicated to employers in advance 
- 
Emails are sent to employers and payroll providers in the event of 
scheme changes **(see finding 5)** 
Area 
Objective  
Risks 
Identified Controls 
to the scheme. 
- 
Tasks relating to scheme members are actioned by CSG within 10 working days 
Scheme members are kept informed when they have raised a query. 
Resolving issues - resolving disputes 
Scheme members may not receive accurate information regarding their pension in a timely manner resulting in service user dissatisfaction if:  
- 
Casework levels are reported to team leaders using a live dashboard and reported in performance reporting to the Council and the Local Pensions Board 
 
- 
Queries and complaints are responded to in line with contractual SLAs 
- 
Communications to members are inaccurate or not made in a timely manner; 
- 
Meetings are held between trade union representatives and CSG to 
resolve any issues raised by members 
- 
Casework processing levels are not monitored; 
- 
Queries and complaints are not processed in a timely manner ; and 
- 
Queries and complaints are not resolved accurately and in a timely manner. 
- 
There is a breach of law policy for the scheme **(see finding 8)** 
Breaches of law are reported to regulators promptly and 
accurately. 
Resolving issues - breaches of law 
Breaches of law may not be reported in line with requirements resulting in regulatory action including fines and reputational damage if:  
- 
Officers are not aware of reporting requirements; and 
- 
Reportable breaches or errors are not reported promptly to the appropriate regulator. 
Area 
Objective  
Risks 
Identified Controls 
- 
There is an annual scheme plan which sets out tasks to be completed in the period - this includes the requirement to complete the annual return 
Accurate data is supplied in accordance with relevant deadlines to ensure compliance with scheme conditions.  
Data may not be provided in line with requirements resulting in regulatory action including fines and reputational damage if:  
Governing the scheme - submitting returns 
- 
Preparation of the annual return is assigned to an officer at CSG and is referenced in the allocation of staff. 
 
 
- 
Officers are not aware of scheme requirements in relation to data submissions; 
- 
Responsibility for producing the returns is not assigned; and 
- 
Operational plans are not 
in place to ensure data is provided in line with required timeframes. 

## Appendix 4 - Internal Audit Roles And Responsibilities Limitations Inherent To The Internal Auditor'S Work We Have Undertaken The Review Of Pensions Administration, Subject To The Limitations Outlined Below. Internal Control

Internal control systems, no matter how well designed and operated, are affected by inherent limitations. These include the possibility of poor judgment in decision-making, human error, control processes being deliberately circumvented by employees and others, management overriding controls and the occurrence of unforeseeable circumstances. Specifically we will not:  

- 
Provide assurance over controls in place around the investment of funds in relation to LGPS regulations.  
- 
Provide assurance over controls in place around the receipt of contributions, including controls monitoring the receipt of contributions on a timely basis. 
- 
Provide assurance over controls in place around the payment of pensioner payroll. 

## Future Periods

Our assessment of controls is for the period specified only.  Historic evaluation of effectiveness is not relevant to future periods due to the risk that: 

- 
the design of controls may become inadequate because of changes in operating environment, law, regulation or other; or 
- 
the degree of compliance with policies and procedures may deteriorate. 
Responsibilities of management and internal auditors It is management's responsibility to develop and maintain sound systems of risk management, internal control and governance and for the prevention and detection of irregularities and fraud. Internal audit work should not be seen as a substitute for management's responsibilities for the design and operation of these systems. We endeavour to plan our work so that we have a reasonable expectation of detecting significant control weaknesses and, if detected, we shall carry out additional work directed towards identification of consequent fraud or other irregularities. However, internal audit procedures alone, even when carried out with due professional care, do not guarantee that fraud will be detected. Accordingly, our examinations as internal auditors should not be relied upon solely to disclose fraud, defalcations or other irregularities which may exist.