# St Oswald'S Ce Primary School City Of York Council Internal Audit Report 2016/17

Business Unit: Children's Services, Education & Skills Date Issued: 24 July 2017 Status: Final Reference: 15691/006 
Overall Audit Opinion 
High Assurance 

## Summary And Overall Conclusions Introduction

This audit was carried out on 7th and 8th November 2016 as part of the Internal Audit plan for Children, Education and Communities for 2016/17. 

Schools are audited in accordance with a detailed risk assessment. 

## Objectives And Scope Of The Audit

The purpose of this audit was to provide assurance to Governors, the Headteacher and management that procedures and controls in the areas listed below are working adequately and are well controlled.  The audit covered the following areas in accordance with the specification issued on 
15th July 2016: 
 

 
Governance and Financial Management 
- 
School Meals 
- 
System Reconciliation 
- 
Pupil Numbers 
- 
Banking Arrangements 
- 
School Fund 
- 
Contracts, Purchasing and Authorisation 
- 
Data Protection and Information technology 
- 
Income 
- 
Insurance and Risk Management 
- 
Capital and Property 
- 
Joint Use Facilities 
- 
Extended Schools Provision 
- 
Inventories 
- 
Human Resources 
- 
Safeguarding 
- 
Payroll and Staff Costs 
 
Key Findings Systems at the school are operating well in all the areas reviewed. It was found that there is no documented independent check of the inventory undertaken on an annual basis. In addition, following on from the themed audit of Information Governance across York schools undertaken in 2015-16 it is recommended that procedures for dealing with breaches of data protection are put in place and notified to staff. It was noted that there was low attendance at some Governing body meetings such as the finance committee, which can make the Governing body's role, including overseeing the financial performance of the school more difficult. 

## Overall Conclusions

It was found that the arrangements for managing risk were very good. An effective control environment appears to be in operation. Our overall opinion of the controls within the system at the time of the audit was that they provided **High Assurance.**  

## 1 Data Breach Policy

| Issue/Control Weakness                                                   |
|--------------------------------------------------------------------------|
| The school do not have formally documented procedure for staff to follow |
| should a data breach occur.                                              |

## Findings

The school do not have a formally documented procedure or policy for staff to follow should a data breach occur. This could lead to staff not identifying and handling breaches of information security in the most appropriate way. 

## Recommendation

A procedure for management of data breaches should be in place and notified to staff. This may be part of a data breach policy and could be included in the staff handbook. 

Agreed Action 1.1 
Agreed 
Priority 
3 

  
 

A data breach may not be identified by the school and handled appropriately. 
Responsible Officer 
Head 
Timescale 
30th Sept 2017 
 

## 2 Inventory

| Issue/Control Weakness                                                        |
|-------------------------------------------------------------------------------|
| There is no signed record of an annual check of the inventory retained by the |
| school.                                                                       |

## Findings

The school maintain an inventory on an electronic inventory spreadsheet, which showed evidence of being kept up to date. However the school do not print off a copy on an annual basis and have a member of staff independent from the maintenance of the record complete a review.  

## Recommendation

The inventory check completed by an officer independent of maintaining the inventory record should be evidenced by retaining a paper or PDF copy of the verified inventory, recording the officer completing the check and the date the check was completed. If this is not a full check (eg a targeted check towards the most vulnerable items, higher value items or particular equipment) it should be clear from this record which items have been checked. 

Agreed Action 2.1 
Agreed 
Priority 
3 
Items which have been lost or misappropriated may not be identified and investigated and insurance claims may be affected. 
Responsible Officer 
Head 
Timescale 
30 Sept 2017 
 

## Audit Opinions And Priorities For Actions

Audit Opinions Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

Opinion Assessment of internal control 

| High Assurance                                                                                               |
|--------------------------------------------------------------------------------------------------------------|
|                                                                                                              |
| Substantial                                                                                                  |
| Assurance                                                                                                    |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |
| operation but there is scope for further improvement in the areas identified.                                |
|                                                                                                              |
| Reasonable                                                                                                   |
| Assurance                                                                                                    |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |
| environment is in operation but there are a number of improvements that could be made.                       |
| Limited Assurance                                                                                            |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |
| improvements required before an effective control environment will be in operation.                          |
| No Assurance                                                                                                 |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |
| key areas require substantial improvement to protect the system from error and abuse.                        |
|                                                                                                              |

 

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.