## Internal Audit Report

# Key Financial Controls Accounts Payable And Accounts Receivable December 2017

To:  
Deputy Chief Executive 
 
Director of Finance Head of Finance 
Finance Manager 
 
Copied to:  
Operations Director, CSG 
 
Finance Director, CSG Assistant Director of Finance, CSG Head of Exchequer Services, CSG 

## Cross Council Assurance Service Table Of Contents

| 1. Executive Summary                                                                    | 2    |
|-----------------------------------------------------------------------------------------|------|
| 2. Summary of results and assurance ratings                                             | 3    |
| 3. Detailed operating effectiveness results                                             | 4    |
| 4. Control design recommendations                                                       | 13   |
| 5. Follow-up on 2016/17 control design recommendations                                  | 16   |
| Appendix A: Definition of risk categories and assurance levels in the Executive Summary | 17   |
| Appendix B: Background and context                                                      | 18   |
| Appendix C: Internal Audit roles and responsibilities                                   | 19   |
|                                                                                         |      |
|                                                                                         |      |

## 1. Executive Summary Introduction

The review of key financial controls has been agreed in the Internal Audit, CAFT and Risk Management Plan 2017-18. This review focused on key controls in place across a number of financial systems that are integral to the Council's day to day operation. 

## Background & Context

As part of this review we confirmed and updated our prior year understanding of the key controls operating within Barnet's key financial systems to ensure our work is up to date and relevant. We then devised an overarching programme of testing across the different systems and processes to give assurance on the effectiveness of these key controls. This report summarises the audit work undertaken under Phase 1 of the 2017/18 Key Financial Systems audits, covering the period from 1 April 2017 to 31 October 2017 across the following areas: 

- 
Accounts Payable; and 
- 
Accounts Receivable; 
Pensions Administration has been subject to a full risk-based review in December 2017. Council Tax and NNDR have been reported separately as part of Phase 1. Our work has now been completed in line with the Terms of Reference. This report consists of the following sections: 

- 
Part 2: Summary of Results -  sets out an overview of the number of findings and assurance ratings for each individual system;  
- 
Part 3: Detailed Operating Effectiveness Results - explains in detail the exceptions we found for each test area where we found non-compliance with the 
intended controls;  
- 
Part 4: Control Design Recommendations - highlights the areas where the design of controls could be improved to enhance the control environment or to 
improve efficiency; and 
- **Part 5:** Follow up on 2016/17 control design recommendations - sets out in detail a control design issue raised in 2016/17 and confirms if the 
recommendation has been implemented.  
 

## 2. Summary Of Results And Assurance Ratings

| Number     | Department    | Overall Opinion 2017/18    | Overall Opinion 2016/17    |
|------------|---------------|----------------------------|----------------------------|
| Direction  |               |                            |                            |
|            |               |                            |                            |
|            |               |                            |                            |
| 1.         |               |                            |                            |
| Accounts   |               |                            |                            |
| Limited    |               |                            |                            |
|           |               |                            |                            |
|            |               |                            |                            |
| Reasonable |               |                            |                            |
|           |               |                            |                            |
|            |               |                            |                            |
| Payable    |               |                            |                            |
| 2.         |               |                            |                            |
| Accounts   |               |                            |                            |
| Reasonable |               |                            |                            |
|           |               |                            |                            |
|            |               |                            |                            |
| Reasonable |               |                            |                            |
|           |               |                            |                            |
|            |               |                            |                            |
| Receivable |               |                            |                            |
|            |               |                            |                            |
Number 
Controls where 
of 
Control design 
operating exceptions 
of Travel 
control
exceptions found 
Total exceptions found 
were found 
s tested 
8 
1 
1 
2 
0 
3 
1 
 
8 
2 
1 
1 
2 
3 
3 
 

## 3. Detailed Operating Effectiveness Results

1. Accounts Payable 
Control Ref 
Control Tested 
Exceptions Exception details 
No exceptions identified. 
AP1 
Reconciliation between Accounts Payable (AP) and General Ledger (GL) 
Reconciliations are performed between AP and GL which are reviewed and authorised. 
 
No exceptions identified.  
AP2 
Three-way match is performed 
Three-way match is performed: Automated three-way 
match, between Purchase Order (PO) or e-form payment request, goods receipt and invoice is completed before payment is made. 
 
There is an approved scheme of delegation that informs the limits set in Integra. Purchase orders are approved in line with the scheme of delegation.  
No exceptions identified. 
AP3 
Manual payments/Non-PO payments: 
An e-form is created and approved in line with the scheme of delegation.  
 
Manual payments are made in accordance with the approved criteria set out in procedure documents (e.g. Emergency payments, one off payments to suppliers).  
 

## Control Design - High Risk

AP4 
Potential Duplicate payments  
 
Automated controls are built into the system to mitigate duplicate payments. This includes identifying where attempts are made to progress duplicate invoice 
numbers for payment.  
We discussed the automated controls within Integra to prevent duplication of invoice details. Because these controls rely on data being entered correctly, they have historically not been very successful 
at automatically detecting duplicates, and although there are other 

| Control Ref                                              |
|----------------------------------------------------------|
| Note: there are no detective controls, outside of the    |
| annual National Fraud Initiative (NFI) data matching     |
| exercise, to identify potential duplicate payments made. |
| The service relies on the system alerting them to        |
| duplicates.                                              |
|                                                          |
secondary management do not consider them of sufficient robustness to prevent the processing of duplicate invoices.  

Every two years CAFT (Corporate Anti-Fraud Team) co-ordinate the relevant service uploads data to the Cabinet Office for the NFI data matching exercise.  In relation to a 'duplicate payments' match the Accounts Payable team upload the requested data from Integra directly to the NFI portal which results in the Cabinet Office sending matches back that relate to possible duplications.  However, a high volume of potential matches are received from the NFI making it difficult to identify any true duplicate payments and CAFT have found that the high number of false duplicates identified make it uneconomical to investigate these transactions. Due to the same data issues, the Accounts Payable team have not been able to perform their own review of data to identify duplicate invoices submitted for payment.  

1) CSG Finance will investigate the introduction of third-party 
software or fit for purpose automated controls will be built into the system to identify, report and prevent duplicate payments. This will include identifying where attempts are made to progress duplicate invoice numbers for payment and a formal exception reporting and resolution process.  
2) Working with relevant stakeholders, including Commissioning 
Group Finance, CAFT, CSG procurement and delivery units, a data cleanse of Integra vendor data will be performed to ensure that the data is of an appropriate quality to successfully support the automated controls (1) and also the NFI and/or other data matching exercises- including in house exercises. 
These actions (1) and (2) will be completed well in advance of the next NFI data uploads in September 2018  

Head of Exchequer Services, CSG 

| Control Ref                                                | Control Tested                   |
|------------------------------------------------------------|----------------------------------|
| AP5                                                        | New supplier form                |
| A new suppliers form is completed which is signed by an    |                                  |
| appropriate individual. E-forms have been introduced as    |                                  |
| an alternative method for the creation of suppliers.       |                                  |
|                                                           |                                  |
|                                                            |                                  |
| Access to supplier standing data is restricted, controlled |                                  |
| and monitored to ensure only limited people can add        |                                  |
| new suppliers and segregation is enforced.                 |                                  |
| AP6                                                        | Supplier bank account amendments |
|                                                            |                                  |
| A supplier bank account changes form is completed with     |                                  |
| evidence of the new account details attached.              |                                  |
|                                                           |                                  |
|                                                            |                                  |
| Access to supplier standing data is restricted, controlled |                                  |
| and monitored to ensure only limited people can amend      |                                  |
| supplier standing data and segregation is enforced.        |                                  |
 
Target Date: 
31/07/2018 No exceptions identified. 
No exceptions identified. 

| Control Ref    | Control Tested    | Exceptions Exception details    |
|----------------|-------------------|---------------------------------|

## Ap7 Bacs Reconciliation

BACs files authorised for payment have been checked to ensure that the BACs run being paid is the same as 
the BACs run raised from the AP system. 

## Control Operating Effectiveness - High Risk

Out of a sample of 25 BACS runs 25 exceptions were found. Each BACS run is prepared by the AP team and then sent to the Capita Group Payments team who confirm the total amount paid by email. While management were able to provide the confirmation emails from Capita, they were not able to provide us with evidence of the preparation of the BACS report or evidence that the BACS amount has been agreed to the confirmation email so we have been unable to confirm appropriate segregation of duties. 

1) We will retain evidence of the preparation of each BACS run to 
ensure that there is an audit trail to demonstrate appropriate segregation of duties.  

Head of Exchequer Services, CSG 

Target Date: 
30/4/2018 

| Control Ref                                              | Control Tested                         |
|----------------------------------------------------------|----------------------------------------|
| AP8                                                      | Policies, Procedures and Process notes |
| Policies, procedures and process notes are reviewed      |                                        |
| regularly to ensure they are accurate, complete and kept |                                        |
| up to date.                                              |                                        |
| Policies, procedures and process notes are clearly       |                                        |
| documented and communicated to staff.                    |                                        |
|                                                          |                                        |

## Control Design - Medium Risk

All policies and procedures are held in hard copy within a physical folder within the AP team work area at the Council. The majority of Accounts Payable processing is undertaken remotely in Sussex and Darlington; management should ensure all policies and procedures are uploaded to an appropriate shared drive so employees have remote access to all relevant documents. 

1) We will ensure that up to date procedure and process 
documents are made available to all relevant CSG and Capita staff.  

Head of Exchequer Services, CSG 

Target Date: 
31/03/2018 

| Control Ref                                          | Control Tested    |
|------------------------------------------------------|-------------------|
| No exceptions identified.                            |                   |
|                                                      |                   |
| AR1                                                  | Reconciliation    |
|                                                      |                   |
|                                                     |                   |
|                                                      |                   |
| Reconciliations are performed on a regular basis     |                   |
| between Accounts Receivable (AR) and the General     |                   |
| Ledger (GL). They are performed by an appropriate    |                   |
| member of the finance team and reviewed by a senior  |                   |
| member of the finance team.                          |                   |
| No exceptions identified.                            |                   |
|                                                      |                   |
| AR2                                                  | Invoice request   |
|                                                     |                   |
|                                                      |                   |
| There is segregation of duties between invoicing and |                   |
| recording payments which is enforced within Integra. |                   |

## Control Design - High Risk

| AR3                                                                      |
|--------------------------------------------------------------------------|
| Unallocated money received is placed in an account and                   |
| investigated on a timely basis.                                          |
| 24                                                                       |
| The Cashbook Team investigate the unallocated monies but because         |
| they do not directly deal with accounts receivable, their investigations |
| are limited to scanning relevant bank statements and following up        |
| individual items with the AR team. Items which can't be traced are left  |
| in the suspense account until a debtor calls the Council to query why    |
| the Council believes it has not paid its debt. In many cases this does   |
| not happen and items are not cleared.                                    |
|                                                                          |
| 25                                                                       |
| A sample of 25 unallocated receipts within the suspense account (total   |
| value £559k on 18/12/17) were checked for timely investigation:          |
|                                                                          |
| 100%                                                                     |
| In 19/25 (76%) of cases, there was no record indicating that the         |
| unallocated receipts had been investigated at all.                       |
| In 6/25 (24%) of cases, while there was some investigation of            |
| unallocated receipts this was not followed up or resolved.               |
| Therefore, testing was inconclusive and no assurance obtained.           |

1) We will remind Cashbook officers of the importance of 

| Control Ref                                                | Control Tested    |
|------------------------------------------------------------|-------------------|
| AR4                                                        | Refund            |
|                                                            |                   |
|                                                           |                   |
|                                                            |                   |
| Refund requests should be agreed to the original           |                   |
| transaction and then reviewed and authorised in line       |                   |
| with the allocated limits.                                 |                   |
| AR5                                                        | Credit notes      |
| Credit note requests should be agreed to the original      |                   |
| transaction and then authorised in line with the allocated |                   |
| limits.                                                    |                   |
|                                                            |                   |
|                                                           |                   |
|                                                            |                   |
investigating unallocated debtor amounts using account numbers in Integra, on a monthly basis. 
2) We will remind Accounts Receivable officers of the importance 
of supporting cashbook in investigating unallocated debtor amounts using their existing knowledge of debtors. 
3) We will discuss the possibility of introducing a monthly joint 
exercise between Cashbook and Accounts Receivable officers to clear off outstanding unallocated debtors in a timely manner.  

Head of Exchequer Services, CSG 
Target Date: 
30/4/2018 
No exceptions identified. 
 
 
No exceptions identified. 

| Control Ref                                              | Control Tested    |
|----------------------------------------------------------|-------------------|
| AR6                                                      | Aged debt chasing |
| An aged accounts receivable report is generated on a     |                   |
| regular basis. Overdue debts are investigated and follow |                   |
| the set chasing method dictated by the type of debt and  |                   |
| the age of the debt.                                     |                   |
|                                                          |                   |

## 16% Control Operating Effectiveness

A sample of 25 aged debtor items between 1 April 2017 and 31 October 2017 was checked for appropriate investigation. We found:  

- 
In 4/25 (16%) cases, the aged debtor items had not been investigated in accordance with the relevant chasing method.  
1) We will remind accounts receivable officers of the importance of 

## 

chasing overdue debtor items in line with the standard debt recovery procedure. 
Head of Exchequer Services, CSG 

## Target Date:

31/03/2018 

| Control Ref    | Control Tested    | Exceptions Exception details    |
|----------------|-------------------|---------------------------------|

## Ar7 Authorisation Of Write Offs

Debts are written off following appropriate review and 
authorisation with reference to the organisation's write 
off policy. 

## 8% Ar8 Policies And Procedures 

Policies and procedures are reviewed regularly to ensure they are accurate, complete and kept up to date. Policies and procedures are clearly documented and 
communicated to staff. 

## Control Operating Effectiveness

AR write offs happen on an annual basis as part of the year end AR process. We reviewed a sample of 25 write offs from 2016/17 and noted two exceptions: - 
In 1/25 (4%) cases, there was no preparer signature on the form so segregation of duties could not be confirmed. No preparation date was given so it could not be determined whether authorisation was performed after preparation.  
 
- 
In 1/25 (4%) cases the date of preparation of the write-off form 
was not stated, so it could not be determined whether authorisation was performed after preparation. 

1) We will remind accounts receivable officers of the importance 
of signing and dating the write off request forms.  

Head of Exchequer Services, CSG 
Target Date: 
31/03/2018 
No exceptions identified. 
 

## 4. Control Design Recommendations Identified In Phase 1 2017/18

Control 
Detailed finding  
Agreed action 
Ref 
High risk 
 
AP4 
Accounts Payable - Potential Duplicate Payments 
We discussed the automated controls within Integra to prevent duplication of invoice details. Because these controls rely on data being entered correctly, they have historically not been very successful at automatically detecting duplicates, and although there are other secondary controls management do not consider them of sufficient robustness to prevent the processing of duplicate invoices. Every two years CAFT (Corporate Anti-Fraud Team) co-ordinate the relevant service 
uploads data to the Cabinet Office for the NFI data matching exercise.  In relation to a 
'duplicate payments' match the Accounts Payable team upload the requested data from 
Integra directly to the NFI portal which results in the Cabinet Office sending matches back that relate to possible duplications.  However, a high volume of potential matches are received from the NFI making it difficult to identify any true duplicate and CAFT have found that the high number of false duplicates identified make it uneconomical to investigate these transactions. Due to the same data issues, the Accounts Payable team have not been able to perform their own review of data to identify duplicate invoices 
submitted for payment. 
Risk  
Responsible Officer 
Target date 
There is a risk that duplicate payment requests for the same invoice will be paid leading to financial loss to the Council, which may not be able to recover these monies.  
1) CSG Finance will investigate the introduction of 
third-party software or fit for purpose automated controls will be built into the system to identify, report and prevent duplicate payments. This will include identifying where attempts are made to progress duplicate invoice numbers for payment and a formal exception reporting and resolution process.  
2) Working with relevant stakeholders, including 
Commissioning Group Finance, CAFT, CSG procurement and delivery units, a data cleanse of Integra vendor data will be performed to ensure that the data is of an appropriate quality to successfully support the automated controls (1) and also the NFI and/or other data matching exercises- including in house exercises. These actions (1) and (2) will be completed well in advance of the next NFI data uploads in September 2018. 
Head of Exchequer Services, CSG 
31/7/2018 
| Control                                                                                          | Detailed finding     | Agreed Action    |
|--------------------------------------------------------------------------------------------------|----------------------|------------------|
| Ref                                                                                              |                      |                  |
| High risk                                                                                        |                      |                  |
| AR3                                                                                              |                      |                  |
| Control design - High risk                                                                       |                      |                  |
| The Cashbook Team investigate the unallocated monies but because they do not directly            |                      |                  |
| deal with accounts receivable, their investigations are limited to scanning relevant bank        |                      |                  |
| statements and following up individual items with the AR team. Items which can't be              |                      |                  |
| traced are left in the suspense account until a debtor calls the Council to query why the        |                      |                  |
| Council believes it has not paid its debt. In many cases this does not happen and items          |                      |                  |
| are not cleared.                                                                                 |                      |                  |
|                                                                                                  |                      |                  |
| A sample of 25 unallocated receipts within the suspense account (total value £559k on            |                      |                  |
| 18/12/17) were checked for timely investigation:                                                 |                      |                  |
| In 19/25 (76%) of cases, there was no record indicating that the unallocated receipts had        |                      |                  |
| been investigated at all.                                                                        |                      |                  |
| In 6/25 (24%) of cases, while there was some investigation of unallocated receipts this          |                      |                  |
| was not followed up or resolved.                                                                 |                      |                  |
| Therefore, testing was inconclusive and no assurance obtained.                                   |                      |                  |
| Risk                                                                                             | Responsible Officer  | Target date      |
| There is a risk that monies coming in to the Council remain unallocated. Therefore, debts remain |                      |                  |
| open and the Council incurs a cost to recover the funds inappropriately and potentially damages  |                      |                  |
| relationships with customers or residents.                                                       |                      |                  |
1) We will remind Cashbook officers of the 
importance of investigating unallocated debtor amounts using account numbers in Integra, on a monthly basis. 
2) We will remind Accounts Receivable officers 
of the importance of supporting cashbook in investigating unallocated debtor amounts using their existing knowledge of debtors. 
3) We will discuss the possibility of introducing 
a monthly joint exercise between Cashbook and Accounts Receivable officers to clear off outstanding unallocated debtors in a 
timely manner.  
Head of Exchequer Services, CSG 
30/4/18 

## 5. Follow-Up On 2016/17 Control Design Recommendations

| Detailed finding - January 2017                                                                                |
|----------------------------------------------------------------------------------------------------------------|
|                                                                                                                |
| 1. Unallocated receipts account                                                                                |
|                                                                                                                |
| We confirmed with the Income and Cashier Manager that the investigation and allocation of monies within the    |
| unallocated payments control account had not occurred in the period subject to testing. This was attributed to |
| staff turnover and an alternative officer not being nominated to perform the control. Therefore, we could not  |
| evidence that there had been appropriate review and investigation of the items within it.                      |
| Follow-up work performed - December 2017                                                                       |
|                                                                                                                |
| Conclusion                                                                                                     |
|                                                                                                                |

While there have been some changes to the operation of this control, which now sits with the Cashbook team (see AR4 above for details), we noted that in practice the control was not operating effectively and monies within the unallocated payments account had not been investigated or allocated effectively in the period under review.  

Detailed finding - January 2017 
Management Response 
2. Refunds 

We confirmed with the Income and Cashier Manager that the AR team do not have the appropriate system functionality to enable oversight of the refunds processed to allow for appropriate and effective monitoring. For example, the team is unable to review who has processed or authorised refunds issued. We were, therefore, unable to evidence that refunds were appropriately reviewed and authorised prior to payment. 

Follow-up work performed - December 2017 
Conclusion  

In the course of our testing (see AR4) management were able to demonstrate who had reviewed and authorised refunds. Management now have the appropriate system functionality to enable oversight of refunds.  

An officer has been appointed and the performance of this control has been allocated 
accordingly and is now in operation.   
Partially implemented 
Agreed actions: see AR4 above.  
Management will seek to resolve system access or system functionality issues to enable the AR team to review whether refunds have been appropriately reviewed and authorised prior to 
payment through the Integra User Group.  
Implemented. 

## Appendix A: Definition Of Risk Categories And Assurance Levels In The Executive Summary

Risk rating 
Immediate and significant action required. A finding that could cause:  
Critical 

 
- 
Life threatening or multiple serious injuries or prolonged work place stress. Severe impact on morale & service performance (e.g. mass strike actions); or 
 
- 
Critical impact on the reputation or brand of the organisation which could threaten its future viability. Intense political and media scrutiny (i.e. front-page headlines, TV). 
Possible criminal or high profile civil action against the Council, members or officers; or 
- 
Cessation of core activities, strategies not consistent with government's agenda, trends show service is degraded.  Failure of major projects, elected Members & Senior Directors are required to intervene; or 
- 
Major financial loss, significant, material increase on project budget/cost. Statutory intervention triggered. Impact the whole Council. Critical breach in laws and regulations 
that could result in material fines or consequences. 

Action required promptly and to commence as soon as practicable where significant changes are necessary. A finding that could cause: 
High 

 
- 
Serious injuries or stressful experience requiring medical many workdays lost. Major impact on morale & performance of staff; or 
 
- 
Significant impact on the reputation or brand of the organisation. Scrutiny required by external agencies, inspectorates, regulators etc. Unfavourable external media coverage. Noticeable impact on public opinion; or 
- 
Significant disruption of core activities. Key targets missed, some services compromised. Management action required to overcome medium-term difficulties; or 
- 
High financial loss, significant increase on project budget/cost. Service budgets exceeded. Significant breach in laws and regulations resulting in significant fines and consequences. 

A finding that could cause: 
Medium 

 
- 
Injuries or stress level requiring some medical treatment, potentially some workdays lost. Some impact on morale & performance of staff; or 
 
- 
Moderate impact on the reputation or brand of the organisation. Scrutiny required by internal committees or internal audit to prevent escalation. Probable limited unfavourable media coverage; or 
- 
Significant short-term disruption of non-core activities. Standing orders occasionally not complied with, or services do not fully meet needs. Service action will be required; or 
- 
Medium financial loss, small increase on project budget/cost. Handled within the team. Moderate breach in laws and regulations resulting in fines and consequences. 

A finding that could cause: 
Low 
 
- 
Minor injuries or stress with no workdays lost or minimal medical treatment, no impact on staff morale; or 
- 
Minor impact on the reputation of the organisation; or 
 
- 
Minor errors in systems/operations or processes requiring action or minor delay without impact on overall schedule; or 
- 
Handled within normal day to day routines; or 
- 
Minimal financial loss, minimal effect on project budget/cost. 

## Level Of Assurance

Substantial 
There is a sound control environment with risks to key service objectives being reasonably managed. Any deficiencies identified are not cause for major concern. Recommendations will normally only be Advice and Best Practice. 
 
 
Reasonable 
 
An adequate control framework is in place but there are weaknesses which may put some service objectives at risk. There are Medium priority recommendations indicating weaknesses but these do not undermine the system's overall integrity. Any Critical recommendation will prevent this assessment, and any High recommendations would need to be mitigated by significant strengths elsewhere. 
 
Limited 
There are a number of significant control weaknesses which could put the achievement of key service objectives at risk and result in error, fraud, loss or reputational damage. There are High recommendations indicating significant failings. Any Critical recommendations would need to be mitigated by significant strengths elsewhere. 
 
No 
 
There are fundamental weaknesses in the control environment which jeopardise the achievement of key service objectives and could lead to significant risk of error, fraud, loss or 
reputational damage being suffered. 
 

## Appendix B: Background And Context

As part of this review we confirmed and updated our prior year understanding of the key controls operating within Barnet's key financial systems to ensure our work is up to date and relevant. We then devised an overarching programme of testing across the different systems and processes to give assurance on the effectiveness of these key controls. Continuous Audit Methodology (CAM) is the process of on-going testing of key controls to assess whether they are operating effectively, and to flag areas and report transactions that appear to circumvent control parameters. We use a combination of manual testing and data mining tools to extract data from the IT system, using pre-determined parameters to check that controls are operating as designed. Phase 1 of the programme covered 4 systems in 2017/18 for a testing period of 01/04/2017 - 31/10/2017, which were all tested previously as part of CAM phase 1 in 2016/17: 

- 
Accounts Payable 
- 
Accounts Receivable 
- 
Council Tax 
- 
NNDR 
Council Tax and NNDR have been reported separately. 

CAM helps to provide regular and timely assurance over the financial systems and informs our opinion of the adequacy and effectiveness of these systems at the year end. Our testing under continuous auditing and monitoring provides the following benefits: 

- 
Gives management assurance over the operation of key controls during the year; 
- 
Control weaknesses can be addressed during the year rather than after the year end; and 
- 
The administrative burden on management is reduced when compared with a full system review, in areas where there is sufficient evidence that key controls are operating effectively.  
This approach has been agreed as part of the 2017/18 Internal Audit programme and developed in consultation with the owners and operators of the relevant systems. The controls we have tested have been identified through a combination of industry knowledge, historic audit findings and workshops with the key contacts and system owners. All controls have been identified using a risk-based approach. 

## Appendix C - Internal Audit Roles And Responsibilities

Limitations inherent to the internal auditor's work We have undertaken the review of *Key Financial Controls*, subject to the limitations outlined below. 

## Internal Control

Internal control systems, no matter how well designed and operated, are affected by inherent limitations. These include the possibility of poor judgment in decisionmaking, human error, control processes being deliberately circumvented by employees and others, management overriding controls and the occurrence of unforeseeable circumstances.  

## Future Periods

Our assessment of controls is for the period specified only.  Historic evaluation of effectiveness is not relevant to future periods due to the risk that: 

- 
the design of controls may become inadequate because of changes in operating environment, law, regulation or other; or 
- 
the degree of compliance with policies and procedures may deteriorate. 

## Responsibilities Of Management And Internal Auditors It Is Management'S Responsibility To Develop And Maintain Sound Systems Of Risk Management, Internal Control And Governance And For The Prevention And Detection Of Irregularities And Fraud. Internal Audit Work Should Not Be Seen As A Substitute For Management'S Responsibilities For The Design And Operation Of These Systems.

We endeavour to plan our work so that we have a reasonable expectation of detecting significant control weaknesses and, if detected, we shall carry out additional work directed towards identification of consequent fraud or other irregularities. However, internal audit procedures alone, even when carried out with due professional care, do not guarantee that fraud will be detected. Accordingly, our examinations as internal auditors should not be relied upon solely to disclose fraud, defalcations or other irregularities which may exist.