# Concessionary Bus Passes City Of York Council Internal Audit Report 2016/17

 

## Summary And Overall Conclusions Introduction

The English National Concessionary Travel Scheme (ENCTS) was introduced in April 2008, providing free travel on local bus services to persons eligible on grounds of age or disability. City of York Council is the Travel Concession Authority (TCA) for the York area and is responsible for issuing bus passes, maintaining records relating to pass-holders, and reimbursing Bus Operating Companies (BOCs) for journeys originating within the city's boundaries. The Council is also part of a joint concessionary fares scheme with North Yorkshire County Council (NYCC). NYCC reimburses BOCs for crossboundary journeys that originate in York. NYCC charges the Council for these journeys. Payments to BOCs and NYCC total nearly £4.2 million per annum, the majority of which is paid to First York. There are around 40,000 active passes issued by the Council, of which 36,000 are age-related and 4,000 disability-related. Data for January - May 2017 suggests the majority of passes are rarely used: 21,000 had been used for an average of less than one return journey per week and 10,000 had not been used at all. Of the other 9,000, fewer than 100 had been used to make more than 10 return trips per week in that period. The audit considered the veracity of bus company claims for bus pass usage, as well as the issuance of bus passes and the accuracy of calculations for reimbursement. This was the first time that this area had been audited. 

## Objectives And Scope Of The Audit

The purpose of this audit was to provide assurance to management that procedures and controls within the system ensured that: - 
Bus passes were issued in line with criteria and up to date records are kept to minimise the risk of abuse or fraud; 
- 
The data returns provided by BOCs and NYCC were reliable and accurate; 
- 
Calculations for reimbursement were accurate and completed in a timely manner. 
 This audit included a visit to First Group because they are the main recipient of reimbursement from the Council. 

## Key Findings

It was found that Customer Services staff understood and had access to the eligibility criteria for passes. The Innovator system, which is used for issuing and recording passes, has mandatory fields that must be completed before an application can be processed. These include the pass type, date of birth (for age-related passes) and a drop-down list of 'evidence seen' for disabled passes. 

 
The first significant issue is that although Innovator contains a 'hot-listing' function used for marking passes that are no longer valid, 'hot-listing' is not currently in effect. This means that passes barred on the Innovator system (for example, as lost or stolen) can still be used on buses to make journeys. Analysis identified three such passes still in use xxxxxxxxxxxxx. It should be noted, however, that officers are currently in the process of implementing a version of 'hot-listing', which will go some way to addressing the issue. Furthermore, 'hot-listing' has only been implemented by some TCAs nationally. This is raised in more detail in Finding 1 below. Other findings related to issuing passes included that evidence for eligibility is not retained by Customer Services and that there is an available category of 'none' for 'evidence seen' that can be used when processing new applications. It was also found that Returns of Deaths have not been received from York Register Office for several months, so pass holders have not been marked as deceased. Overall, analysis of data returns suggests they are generally reliable and that calculations for reimbursement are accurate. Comparison of the Electronic Ticket Machines (ETMs) and Host Operator Processing Systems (HOPS) data for First York routes found a discrepancy of 2.33% in the total trip figures for April - December 2016. xxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxx There is also no written guidance for carrying out 'reasonableness' checks on the data returns provided by First and NYCC. A visit to First York was also conducted during the audit. This established the guidance provided to drivers regarding bus passes and what reports are sent to the Council. However, the process for extracting data from ETMs and assembling the reports was not discussed in detail. There is an allocation of time in the 2017/18 audit plan that will be used for further work in this area. Calculations for reimbursement were found to be accurate and completed in a timely manner. The purchase order for First York was properly authorised and there was an agreement in place for making advance payments, with monthly adjustments. These had been correctly calculated and paid. xxxxxxxxxxxxxxxx 

## Overall Conclusions

The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance. 

 

## 1 Implementation Of 'Hot-Listing' Issue/Control Weakness Risk

| 'Hot-listing' is not currently in effect xxxxxx    |
|----------------------------------------------------|
| Council.                                           |

It was known at the start of the audit that 'hot-listing' of passes currently was not in operation. Although passes can be 'hot-listed' on Innovator, this does not prevent them from being used on buses as it does not communicate with the smartcard readers. Testing of 30 passes 'hot-listed' on Innovator found 3 to still be in use despite replacements being issued. There are around 2,500 active 'hotlisted' passes. This suggests, therefore, that around 10% of passes 'hot-listed' in 2016/17 may still be in use. As passes last for up to 5 years, the total number may be higher because passes 'hot-listed' as far back as 2012 may still be valid. Usage data for the 3 passes still in use has been analysed and no fraud is suspected. xxxxxxxxxxxxxxxxxxxxxxxx Officers have indicated that a version of 'hot-listing' will be implemented, which will go some way to reducing the risk. The new system will contain a 'warm-list' of suspect passes issued by the Council. When used, these passes will be moved to a 'hot-list' and will no longer be accepted. The system will not hold 'warm-lists' of passes from outside the York area due to technological limitations on the buses and because most TCAs have not implemented 'hot-listing'.  

'Hot-listing' will be implemented soon for the existing system and will be part of the new system.  

2 xxxxxxxxxxxxxxxxxx 
Issue/Control Weakness 
Findings Agreed Action 2.1 

## 3 Guidance On 'Reasonableness' Checks Of Data Returns

| Issue/Control Weakness                      | Risk                                                  |
|---------------------------------------------|-------------------------------------------------------|
| 'Reasonableness' checks are not documented. | 'Reasonableness' checks are not conducted, leading to |
| overpayments by the Council.                |                                                       |

Discussion with the Public Transport Planner suggested that identifying discrepancies in trip figures from First York and NYCC relies on his experience and knowledge as there is no written guidance on carrying out reasonableness checks. xxxxxxxxxxx it may be advisable to compile written procedures on what checks to carry out should it become necessary for a less experienced person to conduct these checks. 

The Public Transport Planner will produce a document containing guidance on how data returns from First and NYCC can be checked for reasonableness. 

## 4 Evidence Of Eligibility

| Issue/Control Weakness                            | Risk                                  |
|---------------------------------------------------|---------------------------------------|
| Evidence to support applications is not retained. | Ineligible applications are approved. |

Discussions with officers found that evidence of eligibility is not retained by officers once applications have been processed, despite Innovator having a document upload function. It is not possible, therefore, to confirm that applicants are eligible, although it should be noted that Customer Service staff were aware of their responsibilities and the evidence required is listed on the application forms. Copying and uploading documentation would provide greater assurance that applications are valid and confirm evidence has been seen. Evidence of eligibility for disabled passes will be retained because evidence of disability has an expiry date and it is more likely there will be a need to refer to it. Despite the much greater number of age-related passes, age-related evidence will not be retained as it does not expire and it is much less likely there will be a need to refer back to it.  

Copies of evidence of eligibility for disability-related passes will be retained. Upon renewal, expired evidence will be removed and new evidence uploaded.  

## 5 'Evidence Seen' Field On Innovator Issue/Control Weakness Risk

Ineligible applicants are issued with passes. 

The Innovator system accepts 'none' as a valid category for 'evidence seen' when processing applications. 

Testing found that the Innovator system is designed in such a way that officers must enter certain details for applications to be approved. For disabled passes, it checks against a drop-down list of 'evidence seen'. This ensures that all relevant details are captured by the system. However, the 'evidence seen' field contains the valid category of 'none', which raises the possibility of applications being approved without valid evidence being seen. Although sample testing did not identify any that had 'none' as 'evidence seen', removing this category from the replacement system would prevent either accidental or deliberate use. 

The 'none' category will be removed from the evidence seen field as part of the new IT 
system. It will be ensured that only valid forms of evidence are included in this field. 

## 6 Guidance For Bus Drivers

| Issue/Control Weakness                                                 | Risk                                                    |
|------------------------------------------------------------------------|---------------------------------------------------------|
| Guidance is in place, but it is not known if the guidance is followed. | Guidance on checking passes is not followed by drivers, |
| allowing possible fraudulent use of passes.                            |                                                         |

Discussions held with representatives from First York found that there is reasonable guidance in place for drivers regarding their responsibilities when checking concessionary bus passes. This discussion does not, however, confirm that the drivers are actually aware of and carrying out their responsibilities. Independent verification that drivers are doing so would provide more persuasive evidence than simply relying on the discussion held with First York. Incorporating a check into the surveys conducted by the Transport team would provide some evidence that guidance is followed. 

Checks that drivers are following the guidance will be incorporated into the bus surveys conducted by Council staff. There will also be a general review of the form used for the surveys. 

## 7 Return Of Deaths Issue/Control Weakness Risk

Returns of Deaths are not being received from York Register Office, so pass holders are not being marked as deceased. 
Pass holders are not marked as deceased, leading to fraudulent renewals or use of passes by other persons. Sending out renewal letters to deceased persons may also 
cause distress to families and harm the Council's reputation. 

Of 15 individuals on the most recent Return of Deaths list who were positively identified as holding bus passes, 12 of them had not been marked as deceased. Discussions with Customer Services established that they had not received a report from the Register Office for several months and they had not been chased up, which is why these individuals had not been marked as deceased. A further 6 individuals could not be positively identified on Innovator because, although their names were on the system, they were registered at different addresses. The individuals may have moved house between receiving their bus pass and passing away. However, it is not possible to be sure about this without further information, such as a date of birth, which is not included in the report. Currently, marking individuals as deceased only prevents them from receiving renewal letters. It does not stop the pass from working because 'hot-listing' is not in effect. Therefore, it is of limited value as a control because another related control does not work. Once 'hot-listing' is implemented, however, it will become more important to ensure that records are accurate so that this control is effective. 

Customer Services will liaise with the Register Office to ensure Returns are sent regularly. They will also discuss sending the Returns electronically and review the information in the report to ensure it is sufficient. Finally, the missing Returns will be acquired and Innovator records updated. 

## Audit Opinions And Priorities For Actions

Audit Opinions Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

Opinion Assessment of internal control 

| High Assurance                                                                                               |
|--------------------------------------------------------------------------------------------------------------|
|                                                                                                              |
| Substantial                                                                                                  |
| Assurance                                                                                                    |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |
| operation but there is scope for further improvement in the areas identified.                                |
|                                                                                                              |
| Reasonable                                                                                                   |
| Assurance                                                                                                    |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |
| environment is in operation but there are a number of improvements that could be made.                       |
| Limited Assurance                                                                                            |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |
| improvements required before an effective control environment will be in operation.                          |
| No Assurance                                                                                                 |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |
| key areas require substantial improvement to protect the system from error and abuse.                        |
|                                                                                                              |

 

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.