Project Management (follow-up)  

# City Of York Council Internal Audit Memo

 
Service Area: Corporate and Cross Cutting 

1.0 
Introduction and scope 1.1 
Veritau issued an internal audit report on Project Management on 25 May 2016. The overall 
opinion was Limited Assurance and four findings were raised including three at Priority 2. 1.2 
The audit examined project management arrangements within the council during a period of 
significant change1 and did not examine individual projects in detail.  The audit found that 
whilst the underlying principles of project management at the council remained unchanged there was evidence to support that there were weaknesses in key areas.  The audit also noted that since the audit had been undertaken there had been a considerable amount of work undertaken to ensure that a robust framework was in place and the council's management team (CMT) had mandated that all project managers use the new project 
management toolkit - All About Projects. 1.3 
As per Veritau's follow-up procedure, re-testing of all management agreed actions should 
be carried out where an audit opinion is Limited Assurance or lower.  Audit testing carried out was limited to the completion of actions and did not include an audit of the project registers or the content of the VERTO system.  
 
2.0 
Findings 
Finding 1.1 **- Formal ownership of project management** 2.1  
In July 2015, the re-wiring York transformation programme was placed back within 
directorates from the central transformation team.  In order to provide clear corporate 
instruction on how to manage projects successfully, a new project management toolkit was 
launched (All About Projects, AAP).   
 
2.2  
As a result of the significant change explained at 1.2 and to ensure the responsibilities and 
accountabilities remained clear, CMT agreed to identify a corporate programme management structure.  CMT acting as the overarching/corporate programme board meeting every two months.  To effectively manage the overarching programme, a programme lead for each Directorate was to be identified.  With CMT, the Directorate programme leads would manage the prioritisation process and ensure that the necessary documentation is in place for each programme.  CMT would also agree a reporting mechanism that will ensure that the Executive, Audit & Governance Committee and relevant scrutiny groups have information when required. 
Action taken 2.3 
CMT agreed to a new framework for project management which was approved by Members 
of the Audit & Governance Committee in May 2016.  Project Assurance leads were identified for each directorate and have established a schedule of monthly meetings.  These 
                                                           

## 

meetings have been strengthened by extending the group on a bi-monthly basis to include 
other key officers (Legal, HR and Finance).  A project support group has also been established.  This is open to all officers of the council involved in project management.  This group is run by one of the identified directorate leads and a member of CMT attends the 
session (commitments allowing). 2.4 
Recent audit testing confirmed that project management had been on the agenda in all 
Directorate Management Team (DMT) meetings since May 2016 and that reports have 
been taken back to CMT at least every two months.  Project management reports and updates have also been provided to Members and Committees as and when requested. 
Finding 2.1 - Project Management Toolkit: Risk Management 2.5 
The original audit reviewed the AAP toolkit including the information and templates for risk 
management.   It was found that these did not align to the council's approved risk management guidance. 
Action taken 
 
2.6 
Whist the audit was being finalised, the risk section of the AAP toolkit was revised to ensure 
that it was in-line with the councils risk management guidance.  Templates within VERTO 
(the Councils Project Management System) were also updated to reflect the corporate 
standards and links were embedded to the council's online Risk Management guidance. 
This was again confirmed during the recent follow up work. 


Finding 3.1 - Central Register for Council Projects 
 
2.7 
When the audit was conducted it was found that there was no overall register at corporate 
or directorate level for projects.  The VERTO system was not being used to record all projects although there was a programme to roll it out across directorates. 2.8 
It was agreed that DMTs would become responsible for establishing their directorate project 
register and the directorate lead would ensure that it was complete and up to date.  Each directorate would then maintain a register of projects within their directorate which will make up their directorate programme and feed into the corporate programme.  All medium and large projects would be held within VERTO as a corporate standard, making VERTO a central register for the council's significant projects.  Small projects would not necessarily be entered into VERTO but recorded and monitored within the directorate registers. 
Action taken 2.9 
All Directorate leads have established a project register.  The size of the project has been 
determined by the project matrix (included as part of AAP).  The project registers have been taken to DMTs to ensure completeness and all currently listed large and medium projects have been set up within the VERTO system.  Establishing a clear project register for each directorate has allowed DMT to have oversight on the number of ongoing projects and the resources required. 
2.10 All large and medium project managers have access to VERTO and are updating, where 
necessary with relevant project documentation.  Large projects have also been included on the corporate KPI Machine to give oversight to senior managers.  This is still a work in progress but clearly shows the direction of travel in the corporate overview and ownership 
of the corporate programme management structure. 
Finding 4.1 - VERTO, a council-wide standard approach  


2.11 At the time of the audit the VERTO system was only used a by key staff with the intention to 
open up the system to officers within directorates.  The audit found that there was no council specific user guide and no specific customisation of the system had been carried out to ensure that there were logical processes to follow within the system and that they aligned to the AAP toolkit.  There was also a lack of mandatory fields to ensure that the correct fields within the system were completed. 2.12 It was agreed that VERTO would be updated to reflect the AAP templates and gateways.  
Work would also be carried out within the system to make it easier to navigate and a user guide (in use at a different authority) would be revised as the system was to be rolled out.  
CMT also agreed as part of their overall approach to programme management, that resources for VERTO going forward would be considered. 
Action taken 2.13 The VERTO system has been configured so that it is aligned with the AAP processes and 
gateways.  A number of fields have been made mandatory and these are all listed at the 
end of the revised user guide.  The VERTO system has not been formally rolled out across 
directorates as outlined in the original audit, but all officers requiring access for the large 
and medium projects have access to the system, have access to a CYC tailored user guide 
and have one to one training available.  CMT are reviewing the corporate resource going forward. 
 
3.0 
Conclusions 
 
3.1 
Since the original audit was completed there has been a significant amount of work 
undertaken to ensure that all of the agreed management actions have been completed.  
Most of this work has been carried out by one of the directorate leads, the identified corporate assurance lead, which has made them a single point of control.  They have worked closely with Veritau to ensure all aspects of the agreed actions were implemented successfully. 3.2 
Going forward CMT need to continue to review the resources required to maintain the 
current level of progress at all levels of the business. 3.3 
All of the management actions raised within the May 2016 report are now considered 
complete. 
Where information resulting from investigation and/or audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.