# Performance Management City Of York Council Internal Audit Report 2017/18

 Business Unit: Customer and Corporate Services Directorate Responsible Officer: Director, Customer & Corporate Services Service Manager: Head of Human Resources & OD 
Date Issued: 20thMarch 2018 
Status: Final  
Reference: 11040/011 
 

## Summary And Overall Conclusions Introduction

City of York Council is committed to developing confident, capable people, working positively for York.  As part of that commitment, all staff are entitled and encouraged to reflect on their performance and discuss future aspirations and work goals through regular one to ones and an annual Personal Development Review (PDR). The annual PDR takes place between May and July.  A six monthly update around December is strongly recommended to check on progress and make any adjustments needed. It is estimated that around 2,400 PDRs would be undertaken across the council with around 75% of PDRs being completed for staff during 2016/17. 

## Objectives And Scope Of The Audit

The guidelines and procedures for completing PDRs was updated for 2017 and the audit only reviewed PDRs that were completed between May and July as part of the updated procedures for 2017. The purpose of this audit was to provide assurance to management that procedures and controls within the system ensure that: 

 There are suitable guidelines to ensure PDRs are done appropriately.  The PDR was done on time and in line with council guidelines.  The PDR discussed the previous year's performance and confirmed whether targets agreed as part of the previous PDR had been met.  The PDR set objectives for the coming year that were in line with team and council objectives with training and development needs being 
undertaken where necessary. 

## Key Findings

The overall approach to Performance and Development Reviews at the council has improved compared to previous years, with completion rates in August 2017 (41%) approximately 30% higher than in August 2016. However, guidance states that 1st August marks the closure of the PDR 
window and therefore 41% is a low completion rate. By December 2017, completion rates were considerably higher, with 88% complete and some of these simply awaiting authorisation. Of those PDRs completed by August 2017, around 70% had been carried out using the iTrent system with the remaining 30% using a paper version of the PDR. Although iTrent PDRs are desirable for all employees, the logistics of some service areas were thought to be better suited to completing PDRs using the paper template. There is currently a good level of guidance available to staff, to support both employees and managers in what should be considered during the review and how this should then be uploaded to iTrent. However, there is currently only limited guidance available to support PDRs carried out offline or, furthermore, in a group format. The guidance surrounding PDR exemptions is also unclear because it may not be appropriate to undertake PDRs for temporary staff, those with low hours or new members of staff who had recently started their post. Those PDRs that had been completed on iTrent, were found to be of generally good quality, where aspects were mostly completed in detail. Most of the PDRs in the sample that were completed on iTrent, reviewed the individual's performance against previous targets and offered a comprehensive review summary. However, those PDRs tested that were carried out outside of iTrent were not as consistent in their completion. Several bespoke paper PDRs were received, where the form available on the intranet was not used. Paper versions of the PDRs were not completed to the same level as those on iTrent with sections not being completed or objectives not being set. It was also noted that individual objectives on the PDR were not being linked to team or council objectives even though there was a section on iTrent for recording it. 

## Overall Conclusions

The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance. 

 
  
 

## 1 Pdr Completion Rate Issue/Control Weakness Risk

Over half of council employees did not complete a PDR during the review period. 

The guidance states that all PDRs should be carried out between May and July. However, at the time of the audit, only 41% of staff had undertaken a PDR during this window. This therefore means that over half of council employees had not participated in a review within the advised time. 

Reminders to be sent to Grade 9 managers to ensure that they are completing employee 
PDRs during the May to July PDR window. 

Employees are left without a PDR and their performance and development are difficult to monitor. 

## 2 Paper Pdrs Issue/Control Weakness Risk

| The paper form is not the same as the form used on iTrent.    |
|---------------------------------------------------------------|
| date because a paper version of the PDR was used that was     |
| created by the service.                                       |

The paper template available for download on the intranet is not identical to the PDR form completed using iTrent. These differences include the performance rating by manager and the prompt to attach an objective to a beneficiary: individual, team or organisation. It was also noted that five of the sixteen paper PDRs that were viewed during the audit were not completed on the paper template on the intranet but were instead bespoke PDR forms that had been produced by the service. There is currently nothing in the guidance to inform staff that any PDRs completed on paper must be scanned and included on iTrent. Currently paper versions of the PDRs are not scanned onto iTrent and of the sample of 20 paper versions that were requested, four were not received from the service, meaning it was not possible to confirm whether these four PDRs were completed satisfactorily. Overall, there were significantly more errors in those PDRs completed on paper, compared to those completed using iTrent. The results from the paper PDR testing showed that out of sixteen paper PDRs that were viewed: - 
Seven did not assess previous year's performance  

- 
Six did not set any Learning and Development needs. 
- 
Two did not set learning and development objectives 
- 
Four did not give an overall rating of performance 
- 
Eight were without a summary of discussion 
- 
Seven were not signed by both the employee and manager (six by the employee only and one by the manager only) 

Performance & Change HR Manager 
Continue to roll out Employee Self Service and People Manager to employees who currently do not have this facility. In turn, encourage these new users to complete PDRs online by holding training sessions and issuing guidance for both employees and their managers. 
1 September 2018 

Issue guidance to managers who will be carrying out paper PDRs at the start of the 2018 PDR cycle. Ensure that the paper template is the most up-to-date version and is reflective of the PDR process carried out on iTrent. Finally, make this paper template available and accessible for all relevant managers in time for the 2018 PDR cycle. 

Performance & Change HR Manager 1 May 2018 

## 3 Objectives Issue/Control Weakness Risk

Objectives are not been set for all employees, weakening the purpose of a PDR and making it difficult for both staff and management to monitor progression. 

Progress made by staff is not being monitored against suitable targets. 

Objectives were not always being set during the cases reviewed in the sample. Three out of the ten PDRs that were completed on iTrent had not set objectives at the time of the review. Although objectives can be uploaded separately following the completion of a PDR none had been added at the time of the audit. Of the sixteen paper PDRs that were reviewed during the audit, only nine had objectives that included both a detailed narrative and a target date and another three PDRs that were viewed had narratives but no target dates. The paper PDRs were not in a standard format and in three cases the PDR form did not include a section for completing objectives, whilst in the final case the section for objectives had been left blank.  
 
In previous years, objectives set on iTrent, were able to be linked to the overarching council plan priorities by using an 'objective linked to' 
option. However, this was something that needed to be updated every time the council plan changed and the decision was made to make this feature redundant as too much time was taken updating iTrent. Currently, the PDRs carried out on iTrent are not being linked to council plan priorities, but this is something that could be done using the description box. 

Review and update guidance around setting objectives and include the requirement of at least one objective to be set at the time of PDR. Promote the updated guidance and ensure managers receive training, to include objective setting, in time for the 2018 PDR cycle. 

Performance & Change HR Manager 1 May 2018 

## 4 Exemptions To The Pdr Process Issue/Control Weakness Risk

There is not enough guidance surrounding the exemptions of the PDR process. 

Employees are not completing PDRs when required to do so. 

There is currently only limited guidance available to staff informing of any exemptions to the PDR process - this appears only in the FAQs section and not in specific PDR guidance notes. These published exemptions currently include temporary staff but there is no mention of staff on low-hour contracts or those who have recently started in their post. There is information available in the FAQs to state that group PDRs are an option where there are common objectives across a team. However, there is no template available to support the completion of group PDRs. Five out of sixteen paper PDRs were completed using a form designed for group PDRs. There were discrepancies between these forms as each had been manually created by each of the service areas. At the time of the audit 1,063 PDRs had been completed and of these, 326 had been completed offline. Paper PDRs are necessary at this point in time, due to the logistics of some off-site work areas having access to the iTrent Human Resources system. 

Review and clarify the exemption criteria and agree this with the Directorate Management Teams. Advise Business Intelligence of the agreed exemptions to enable the criteria to be taken accurately into account when reporting on completion rates. Ensure the exemption criteria is made available to all staff. 

 

## Audit Opinions And Priorities For Actions

Audit Opinions Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

Opinion Assessment of internal control 

| High Assurance                                                                                               |
|--------------------------------------------------------------------------------------------------------------|
|                                                                                                              |
| Substantial                                                                                                  |
| Assurance                                                                                                    |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |
| operation but there is scope for further improvement in the areas identified.                                |
|                                                                                                              |
| Reasonable                                                                                                   |
| Assurance                                                                                                    |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |
| environment is in operation but there are a number of improvements that could be made.                       |
| Limited Assurance                                                                                            |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |
| improvements required before an effective control environment will be in operation.                          |
| No Assurance                                                                                                 |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |
| key areas require substantial improvement to protect the system from error and abuse.                        |
|                                                                                                              |

 

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.