## Final Internal Audit Report Cash And Bank January 2020


To:  
Director of Finance Head of Finance:  Exchequer 
Assistant Finance Manager, Cashbook Interim Finance Manager Assistant Director - Estates Acting Facilities Manager 
Management Accountant, Integra Finance, LBB 
Acting Income and Cashier Manager Cashier Control Officer CSG Technical Support Engineer (Applications) 
 
 
From:  
Senior Audit Executive 
 
We would like to thank management and staff of Income and Cash Book for their time and co-operation during the course of the internal audit. 

## Executive Summary

Number of recommendations by risk category 
Critical 
High 
Medium 
Low 
Advisory 
- 
- 
7 
1 
- 

## Scope

Cash and Bank covers the: 

- 
receipting of cash/cheques by the Income team:  
- 
movement/transfer/collection of cash and cheques between locations by Royal Mail and Security Collections (SC), the Council's inhouse money courier; 
- 
the secure safekeeping of cash and cheques by Income and Security Collections; 
- 
the management of cash floats and addressing requests for cash from Services, for example for payments to asylum seekers and use at children centres; and 
- 
reconciliation, clearing and processing of bank transactions to Integra, the Council's finance system, to ensure the timely and accurate update of the general ledger by Cash Book. 
 
The review also included the follow-up of the 2017-18 audit of Purchase Cards, see **Appendix 4**. 

The Council's Finance team transferred back to the Council from CSG on 1st April 2019. It should be noted that the audit fieldwork coincided with a significant restructure within the Finance team. 

## Summary Of Findings Detailed Control Findings Are Set Out In **Appendix 3.**

We have raised seven medium and one low risk rated action as follows: 

1. **Direct debits management (medium)**: Roles and responsibilities relating to the management - authorisation and monitoring - of 
direct debits were unclear at the time of audit fieldwork. For instance, Finance review of direct debits - to ensure their ongoing validity - had not been undertaken since September 2018. 
2. **Administration: Complete listing of Bank Accounts (medium):** A complete listing of all Council bank accounts was not 
maintained centrally for administration purposes. One bank did not have the correct Council contact details.   
3. **System access (medium):** 
a. Integra, the Council's financial system: A review of the Integra end user access list showed 2 active accounts for officers who 
had left, 5 end users that did not require access and 5 officers who had access where this was considered unnecessary given our knowledge of their role in the organisation.  
b. PAY360, the Council's Income Management and cash/cheque receipting system: A review of PAY360 confirmed the use 
of a shared account at supervisor level which could be used by 7 users in the IT Applications Team. The use of shared accounts is inherently risky owing to the inability to identify the specific officer undertaking processing/updates to the system. 
4. **Bank Reconciliation (medium)**: The management review and sign-off of the bank reconciliation did not include the review and 
monitoring of the level of unallocated/unreconciled bank transactions, the monitoring of their resolution and therefore timely processing to the general ledger. 
5. **Cash floats and money management (medium)**: A £10k cash float held at Colindale. We noted 1/5 instances where the request 
for cash from the Service was not retained for referral, for example the e-mail request to Income for cash monies. There was no evidence of a periodic reconciliation of float cash top up requests to outgoings over a period and previous confirmed balance.   
6. **Physical security - cash offices (medium):** CCTV was not available in the locked room at Colindale where the safe holding the 
£10k float was held, meaning that there was a lack of visibility of officer activity in the room as would have been expected. Asylum seeker pay packets are also held and collected from the room. We understand that implementation of the CCTV in the room was planned. 
7. **Documented procedures (medium)**: Document procedures governing key processes were found to exist, however did not include 
all key aspects of operation.  
8. Cash/receipting (Axis Cash Receipting (ACR)) cash-up **(low)**: In 1/5 cash up reconciliations tested, it was not signed by the 
Acting Income and Cashier Manager as evidence of review. We were informed that there was a backlog of manager reviews of 
cash-up which meant that manager reviews to ensure that cash/cheques receipted matched the supporting documentation including the paying-in slip were not being undertaken on a timely basis, at the time of the cash-up. 

## Follow-Up Of The 2017-18 Purchase Cards Audit - All **Implemented** - See Appendix 4 2. Findings, Recommendations And Action Plan

| Ref                                            | Finding     | Risks    |
|------------------------------------------------|-------------|----------|
| Risk                                           |             |          |
| Category                                       |             |          |
| Agreed action                                  |             |          |
| Medium                                         |             |          |
| Roles and responsibilities for direct debit    |             |          |
| management will be clarified (see finding 6    |             |          |
| regarding                                      | documented  | policies |
| procedures).                                   |             |          |
| a. Arrangements for the authorisation of       |             |          |
| direct                                         | debits      | will     |
| If                                             |             |          |
| direct debits                                  |             |          |
| are invalid or do                              |             |          |
| not cease where                                |             |          |
| necessary                                      |             |          |
| then                                           |             |          |
|                                                |             |          |
| there is a risk of                             |             |          |
| ongoing                                        |             |          |
| collection                                     | of          |          |
| amounts                                        | not         |          |
| owed                                           | by          | the      |
| communicated to the relevant parties, the      |             |          |
| Finance teams in the Delivery Units / Service  |             |          |
| Areas.                                         |             |          |
|                                                |             |          |
| Council                                        | and         |          |
| financial loss.                                |             |          |
|                                                |             |          |
| b. Direct debits will be reviewed to ensure    |             |          |
| their ongoing validity. Corporate Finance will |             |          |
| provide a report of direct debits to Finance   |             |          |
| teams in Delivery Units periodically for them  |             |          |
| to confirm their ongoing validity.             |             |          |
| Responsible officer                            |             |          |
| :                                              |             |          |
| Assistant Finance Manager, Cashbook            |             |          |
|                                                |             |          |
|                                                |             |          |
| Target date                                    |             |          |
| : 03 February 2020                             |             |          |
|                                                |             |          |

1 
Direct debits management (design) 
We reviewed the process for management of direct debits, the Council authorisation of suppliers to collect amounts from Council bank accounts. At the time of the fieldwork, we were unable to clarify and test actual arrangements nor the level of direct debits in existence. Officers we interviewed were not aware of arrangements for the   authorisation of direct debits and periodic review of direct debits to confirm that they remained valid. Overall at the time of fieldwork there was a lack of clarity of processes and allocated responsibilities. It should be noted that the audit fieldwork coincided with a significant restructure within the Finance team. Subsequent to the fieldwork, evidence of Finance review of direct debits to ensure their ongoing validity in September 2018 was provided for our review, however it had not been undertaken since then. 

 
There should be an assessment of the ongoing validity of historic direct debits (e.g. a quarterly or sixmonthly review by business partners of all DDs). At the time of writing this report the Finance team had commenced this review and confirmed they had not identified any items of concern. 

| Ref                                               | Finding         | Risks                                     |
|---------------------------------------------------|-----------------|-------------------------------------------|
| Risk                                              |                 |                                           |
| Category                                          |                 |                                           |
| Agreed action                                     |                 |                                           |
| Budget monitoring arrangements do act as a        |                 |                                           |
| mitigating control in that the responsibility for |                 |                                           |
| monitoring all expenditure (which includes direct |                 |                                           |
| debit spend) against budgets is clearly defined.  |                 |                                           |
|                                                   |                 |                                           |
|                                                   |                 |                                           |
| 2                                                 |                 |                                           |
| Administration:                                   | Complete        | listing                                   |
| If                                                |                 |                                           |
|                                                   | all             | bank                                      |
| Medium                                            |                 |                                           |
| a) A complete list of                             |                 |                                           |
| all                                               |                 |                                           |
| Council bank                                      |                 |                                           |
| accounts                                          | have            |                                           |
| not                                               | been            |                                           |
| identified                                        |                 |                                           |
| then                                              |                 |                                           |
| accounts will be maintained including             |                 |                                           |
| signatories and who is responsible for            |                 |                                           |
| the day to day control of those                   |                 |                                           |
| accounts,                                         | including       | the                                       |
| will                                              | be              | reconciliation process.                   |
| b) Bank                                           | reconciliations | will                                      |
| leading                                           | to              | conducted,                                |
| appropriately authorised for all bank             |                 |                                           |
| accounts.                                         |                 |                                           |
| increased fraud                                   |                 |                                           |
| risk and potential                                |                 |                                           |
| qualification                                     | of              | c) The signatories list for every banking |
| the                                               | annual          |                                           |
| accounts.                                         |                 |                                           |
|                                                   |                 |                                           |
| provider used by the Council will be              |                 |                                           |
| updated where required and stored                 |                 |                                           |
| centrally.                                        |                 |                                           |
| d) The complete list of the Council's bank        |                 |                                           |
| accounts will be reviewed to confirm              |                 |                                           |
| what the accounts are for and whether             |                 |                                           |
| they are all still needed.                        |                 |                                           |
| e) Where required, the contact details for        |                 |                                           |
| each account will be confirmed and                |                 |                                           |
| updated (e.g. correct contact names               |                 |                                           |
| and postal address).                              |                 |                                           |

Accounts During the course of the audit we became aware, from another source, of other bank accounts not held with the Council's main provider, RBS. We had not been provided with the details of these bank accounts when the information was requested for the audit. Management have confirmed that all bank accounts are known however their details were not all held centrally for administration purposes. In addition to the list of bank accounts provided to audit, there are two collection accounts, two investment accounts and three Lloyds accounts that have LBB in their name but do not contain Council funds.  
 
At the time of the audit, Lloyds / Bank of Scotland did not have up to date contact details for the Council. 

Since the audit, finance have confirmed that the bank mandate requires updating for two of the accounts held with Lloyds / Bank of Scotland.  

| Ref                                   |
|---------------------------------------|
| Risk                                  |
| Category                              |
| Agreed action                         |
| f) The relevant observations from the |
| Accounts Payable Data Analysis        |
| review will be taken forward.         |
| Responsible officer:                  |
| Assistant Finance Manager, Cashbook   |

Accounts Payable Data Analysis observations As part of the Accounts Payable Data Analysis review undertaken by Internal Audit in February 2019 a number of observations were raised that are relevant to Cash & Bank including: 

- Evaluate the need of all bank accounts 
 
- Functionality to match bank transactions to the 
accounting system is currently underutilised 
 
- Bank account reconciliations not on individual 
transactional level 
 
The observations are included at Appendix 5. At present the responsibility for considering these observations sits with the Accounts Payable Business Partner (AP BP) with a deadline of 31 March 2020. However, the most recent update received confirmed that no progress has yet been made and the AP BP post is currently vacant. We would suggest that the responsibility for considering the observations be allocated to the appropriate officers in the Investments and Innovation team within Finance. The observations relating to Cash & Bank activity should be considered alongside the actions from this audit report.   
 

| Ref                                            | Finding      | Risks    |
|------------------------------------------------|--------------|----------|
| Risk                                           |              |          |
| Category                                       |              |          |
| Agreed action                                  |              |          |
| If                                             |              |          |
|                                                | unauthorised |          |
| Medium                                         |              |          |
| Integra                                        |              |          |
| staff                                          | have         |          |
| access to cash                                 |              |          |
| management                                     |              |          |
| functions                                      |              |          |
| then                                           |              |          |
| a. Finance Business Partners will review       |              |          |
| Integra access lists monthly to confirm the    |              |          |
| validity of user access in line with the end   |              |          |
| user roles and responsibilities, including     |              |          |
| leavers/movers (LBB and non-LBB staff).        |              |          |
| there is a risk of                             |              |          |
| invalid                                        | and          |          |
|                                                |              |          |
| inaccurate                                     |              |          |
| processing.                                    |              |          |
|                                                |              |          |
| Note                                           |              |          |
| :  Specifically, there should be a focus to    |              |          |
| ensure that role access to process payment     |              |          |
| and lodgement journals in Integra is           |              |          |
| restricted.                                    |              |          |
| Responsible officer:                           |              |          |
| If                                             |              |          |
| officers can                                   |              |          |
| undertake tasks                                |              |          |
| undetected                                     |              |          |
| then                                           |              |          |
|                                                |              |          |
| there                                          | is           | an       |
| Interim Finance Manager                        |              |          |
|                                                |              |          |
| inherent risk of                               |              |          |
| unauthorised                                   |              |          |
| and                                            | fraudulent   |          |
| Target date:                                   |              |          |
| 03 February 2020                               |              |          |
|                                                |              |          |
|                                                |              |          |
| processing/upda                                |              |          |
| tes.                                           |              |          |
|                                                |              |          |
| Pay360                                         |              |          |
| b. The use of shared accounts will cease.      |              |          |
| Users will be provided with their own account  |              |          |
| so that accountability for activity undertaken |              |          |
| in the system is clear.                        |              |          |
|                                                |              |          |
| Responsible officer:                           |              |          |

3 
System Access Integra Access Management (Cash Book related operations)  
 
We reviewed Integra access for Cash and Bank related functions. We reviewed the list of all end users who have access to the Cash Management Module for related functions in Integra (105 end users). Our expectation, based on the findings from the 2018/19 Integra Access and Program Change Management audit, was that on a monthly basis, LBB HR and Capita HR provide the Integra finance team with a list of leavers to remove from the system. We found: - 2 leavers had not been deactivated in Integra. Management confirmed that there had been no processing in the system after they had left. The two leavers were not direct employees and had therefore not been picked up by the monthly leavers lists provided by LBB HR. Management confirmed that since contract re-alignment, Capita leaver lists were no longer received. It was acknowledged that 

| Ref                                            | Finding     | Risks    |
|------------------------------------------------|-------------|----------|
| Risk                                           |             |          |
| Category                                       |             |          |
| Agreed action                                  |             |          |
| CSG                                            | Technical   | Support  |
| (Applications)                                 |             |          |
|                                                |             |          |
| Target date:                                   |             |          |
| 03 February 2020                               |             |          |
|                                                |             |          |
| Leavers                                        |             |          |
| c. The leavers identified will be de-activated |             |          |
| from the Integra and PAY360 systems.           |             |          |
| Responsible officer:                           |             |          |
| Management Accountant, Integra Finance,        |             |          |
| LBB                                            |             |          |
|                                                |             |          |
| CSG                                            | Technical   | Support  |
| (Applications)                                 |             |          |
|                                                |             |          |
| Target date:                                   |             |          |
| 03 February 2020                               |             |          |
|                                                |             |          |
|                                                |             |          |
| Leaver access management                       |             |          |
| d. In line with the ongoing action relating to |             |          |
| the Grant Thornton review of the Financial     |             |          |
| Management                                     | Relating    | to       |
| Purchase Order (CPO) Fraud, (GT4 -             |             |          |
| Managing access and authorisation rights on    |             |          |
| IT systems), in conjunction with the HR team,  |             |          |
| we will develop a process to ensure that IT is |             |          |

an additional control needs to be put in place to pick up any non-LBB staff (Capita, Agency, Interns etc). - No explanation could be provided as to why certain active users required Cash Management access. There was no record available of when/why these users were provided access. - One user confirmed that he was not aware of the access and had never required it. - One user who had access confirmed that she was not aware that she had that access or why she needed it. It was evident that the Cash Management system access in this instance was provided as part of another Integra role she had. Although the system access was confirmed as "Read-only" access, the overriding principle is that officers should not be provided with any access not required in terms of their role. - 2 starters were given enquiry access to the Cash Management Module when this was not required for their roles. Overall, our view is that a review of Cash Management access in Integra is required for update where necessary. Pay360 - Income receipting related operations  
 

| Ref           |
|---------------|
| Risk          |
| Category      |
| Agreed action |

We reviewed the management of end user access in Pay360 
the Council's web-based Income Management system. We noted the following: 

informed on a timely basis of any staff / 
agency workers that are leaving or moving within the Council and / or its partners. This could include a daily/weekly leavers / movers report that is sent to IT on an automated basis for the IT team to action. This will be picked up as part of HR's SLaM (Starters, Leavers and Movers) project. 
Responsible officer: 

- 
The use of a shared account at supervisor level which could be used by 7 users in the IT Applications Team. The use of shared 
accounts is inherently risky owing to the inability 
to 
identify 
the 
specific 
officer 

Management Accountant, Integra Finance, LBB 

undertaking 
processing/updates 
to 
the 

| CSG            |
|----------------|
| (Applications) |

system, compromising transparency and making accountability for specific actions in the system difficult or impossible to establish.       

 
Target date: In line with the delivery of the 
HR SLaM project, currently scheduled to 
complete by 30 June 2020. 
 

- 
There were 2 leavers who were showing as active in the system. Although we were informed that they were inactive on the network, as Pay360 is web-based it can be accessed without needing a Barnet laptop or access via the Barnet network, therefore the risk of unauthorised access remains.  
- 
We were informed that monthly reports of leavers were not provided for review for the immediate de-activation of leavers although the system was configured to lock/disable inactive accounts after 60/90 days. Our view is that there is potential for leavers to remain enabled on the system longer than necessary.  

| Ref           |
|---------------|
| Risk          |
| Category      |
| Agreed action |

Note: In line with the ongoing action relating to the Grant Thornton review of the Financial Management Relating to Compulsory Purchase Order (CPO) Fraud, (GT4 - Managing access and authorisation rights on IT systems) we are aware that the HR Service is involved a Starters, Leavers and Movers (SLaM) Project which will aim to develop a process for the timely disabling of leavers and movers (as appropriate) in Council systems. Our view is that all relevant officers and teams managing IT systems should engage with this project in the interests of finding an effective integrated approach to overall leaver / mover management. 

 

If 
bank 
transactions are not allocated / reconciled at the earliest 
stage 
Medium 
a. The monthly review of the bank reconciliation will include a review of the level of unreconciled balances by Management. Specifically, unreconciled amounts over 3 months will be monitored to ensure a continuous focus on such transactions for clearance.  
Responsible officer: 
Assistant Finance Manager, Cashbook 
then there is a 
risk of materially inaccurate accounts, particularly 
if 
 
they accumulate to 
more 
Target date: 03 February 2020 
significant levels over time. 
 

4 
Bank Reconciliation (design) 
We reviewed the process for the review and approval of the bank reconciliation. The Cash Book team clear bank transactions downloaded daily from the bank. Reports showing uncleared / unallocated transactions, requiring Cash Book investigation before they can be allocated to cost centres through payment and lodgement journals, are available to support the process. Unreconciled balances at 31 March 2019 and more recently, at the end of July and August 2019, for the General Fund and Payments Account, the 2 main Council bank accounts, were as follows: 

| Ref              | Finding     | Risks      |
|------------------|-------------|------------|
| Risk             |             |            |
|                  |             |            |
| General Fund     |             | Payments   |
| Lodgements       |             |            |
| (expenses)       |             |            |
| (income)         |             |            |
| Unreconciled     |             |            |
| transactions     |             |            |
|                  |             |            |
| 2018/19          | 31/03/2019  | 0.00       |
| 42,297.64        |             |            |
|                  |             |            |
|                  |             |            |
| 2019/20          | 31/07/2019  | 41,865.30  |
| 2,245,928.62     |             |            |
|                  | 31/08/2019  | 61,484.33  |
| 3,085,271.88     |             |            |
|                  |             |            |
|                  |             |            |
|                  |             |            |
|                  |             |            |
| Payments Account |             | Payments   |
| Lodgements       |             |            |
| (expenses)       |             |            |
| (income)         |             |            |
| Unreconciled     |             |            |
| transactions     |             |            |
|                  |             |            |
| 2018/19          | 31/03/2019  | 144,174.82 |
| 295,209.86       |             |            |
|                  |             |            |
|                  |             |            |
| 2019/20          | 31/07/2019  | 144,190.82 |
| 383,525.56       |             |            |
|                  | 31/08/2019  | 145,634.82 |
| 384,176.99       |             |            |
|                  |             |            |

The amounts at year end 2018/19 are not considered material.  Review of the unreconciled transactions by the Cash Book at 31 August is ongoing (business as usual), the main aim of the team being to have them allocated by year end. We noted an increasing trend from 31 July to 31 August showing potentially a growing level of unallocated transactions. The bank reconciliation each month was reviewed and signed off by the Head of Finance: Exchequer. It didn't involve a review of the level of unreconciled transactions, for example those older than 3 months. 

Category 
Agreed action 
 
 
| Ref           |
|---------------|
| Risk          |
| Category      |
| Agreed action |

Our view is that this should be done to ensure that there is sufficient ongoing scrutiny of any unreconciled balances across all bank accounts. 

 

Medium 
a. 
Independent 
reconciliations 
of 
top 
requests and Service payments relating to the £10k cash float will be done periodically, for example once a year, possibly on a 
surprise basis.  
If payments from cash floats cash are invalid then there is a risk of 
theft or financial loss. 
Responsible officer: 
 
Acting Income and Cashier Manager Target date: 03 February 2020 
If cash money payments 
are 
b. All Service requests for cash monies/ payments from the £10k float will be made in writing and retained for referral. 
not matched to Service requests then there is a risk 
of 
invalid 
payments  
c. The sign-off documentation supporting the collection and delivery of asylum seeker pay packets will be retained for referral. 
 
Responsible officer: 
If asylum seeker payments 
are 
Cashier 

5 
Cash Management: Cash float and courier (collection and delivery) of monies between Council sites and bank Cash floats There are 2 floats, a £10k float held in a safe and locked room in Colindale and a £20k emergency float for emergency payments by Emergency Planning held in a safe and locked room at NLBP. The £20k float remains intact and is only accessed in emergencies. Services make requests for cash from Income from the £10k float periodically. Income prepare the cash amounts for the requests for collection and periodically request and make top-up payments to maintain the balance. While requests for top-up payments to the £10k float were independently authorised, there was no evidence of independent review/management 

Target date: 03 February 2020 

oversight of related reconciliation, periodic 

 
reported lost/mislaid without evidence of collection and delivery 
to 

reconciliation of float cash top up requests to outgoings over a period and previous confirmed balance. Our view is that a periodic review to confirm the validity of all payments should be done. 

 

support resolution 
then 
| Ref                                                     | Finding                                        |
|---------------------------------------------------------|------------------------------------------------|
| Risk                                                    |                                                |
| Category                                                |                                                |
| Agreed action                                           |                                                |
| there is a risk of                                      |                                                |
| financial loss.                                         |                                                |
| Cash management and courier of monies around the        |                                                |
| borough                                                 |                                                |
|                                                         |                                                |
| We reviewed the arrangements for:                       |                                                |
| -                                                       | the preparation by Income of requests for cash |
| by Services from the £10k float held at                 |                                                |
| Colindale, for example, to pay asylum seekers           |                                                |
| or for use in child care centres;                       |                                                |
| -                                                       | the collection and delivery of related cash    |
| amounts by SC;                                          |                                                |
| -                                                       | the collection of monies from schools and      |
| libraries (done by SC), the transport of related        |                                                |
| monies to the bank, the transport of                    |                                                |
| cash/cheques receipted by income weekly to              |                                                |
| the Council's bank (Royal Mail) and the                 |                                                |
| related collection and delivery sign-off.               |                                                |
|                                                         |                                                |
| Arrangements which involved the use of sealed           |                                                |
| money bags and sign-off on collection of monies by      |                                                |
| couriers and delivery of the monies to banks were       |                                                |
| evident, however we noted the following exceptions:     |                                                |
|                                                         |                                                |
| 1/5: One Service request to Income for the              |                                                |
| preparation of cash monies was not available for        |                                                |
| inspection, a request for £1000.00 by Meadow Close      |                                                |
| Children's Home. E-Mail requests had been retained      |                                                |
| in 4/5 instances however the Income Officer             |                                                |
| indicated that this was likely in this instance to have |                                                |
| been related to a verbal request for which there was    |                                                |
| no record.                                              |                                                |
| Ref                                                  | Finding     | Risks    |
|------------------------------------------------------|-------------|----------|
| Risk                                                 |             |          |
| Category                                             |             |          |
| Agreed action                                        |             |          |
|                                                      |             |          |
| 1/5: The sign-off documentation confirming the       |             |          |
| collection and delivery of cash money relating to    |             |          |
| asylum seeker pay packets was not available for      |             |          |
| inspection. Sign-off documentation was available for |             |          |
| 4/5 other non-asylum seeker requests however         |             |          |
| responsibility                                       | for         | the      |
| documentation was unclear for asylum seeker money    |             |          |
| collection and delivery.                             |             |          |
|                                                      |             |          |
| Medium                                               |             |          |
| a. CCTV will be installed in the Colindale           |             |          |
| ground floor safe office                             |             |          |
| If                                                   |             |          |
| movements of                                         |             |          |
| monies into and                                      |             |          |
| out                                                  | of          | safes    |
| cannot                       | be    |
|------------------------------|-------|
| Responsible officer:         |       |
| observed                     |       |
| then                         |       |
|                              |       |
| Assistant Director - Estates |       |
| there is a risk of           |       |
| theft.                       |       |
| Acting Facilities Manager    |       |
b. Once the CCTV issue has been resolved that consideration be given to whether the EP safe should be moved to Colindale.  
Responsible officer: 
6 
Physical security - cash offices We reviewed the physical security controls over the £20k float in the safe at NLBP and the £10k float in the safe at Colindale. Overall physical controls were evident to ensure the security of monies held. CCTV was not available in the locked room at Colindale where the safe was held meaning that there was a lack of visibility of officer accessing the safe as would have been expected. We understand that implementation of the CCTV was planned. Note: The asylum seeker pay packets are now retained in the same locked room at Colindale and are accessed when asylum seekers arrive at Colindale to collect payment. 
| Ref                                                    | Finding                                    | Risks     |
|--------------------------------------------------------|--------------------------------------------|-----------|
| Risk                                                   |                                            |           |
| Category                                               |                                            |           |
| Agreed action                                          |                                            |           |
| Target date:                                           |                                            |           |
| 03 February 2020                                       |                                            |           |
|                                                        |                                            |           |
|                                                        |                                            |           |
|                                                        |                                            |           |
|                                                        |                                            |           |
| Management indicated that the requirement had          |                                            |           |
| already been escalated and that the budget for the     |                                            |           |
| installation of CCTV had been approved.                |                                            |           |
|                                                        |                                            |           |
| Income will escalate the lack of CCTV in the office at |                                            |           |
| Colindale holding the safe with the £10k float to      |                                            |           |
| Senior Finance Management and Estates for a            |                                            |           |
| decision on related implementation                     |                                            |           |
|                                                        |                                            |           |
| If                                                     |                                            |           |
| officers:                                              |                                            |           |
| Medium                                                 |                                            |           |
| Documented procedures subject to version               |                                            |           |
| control and dated - governing Cash and bank            |                                            |           |
| operation will be drafted, updated and                 |                                            |           |
| approved, for referral, as follows:                    |                                            |           |
| - do not follow                                        |                                            |           |
| agreed                                                 |                                            |           |
| processes                                              | and                                        |           |
| 7                                                      |                                            |           |
| Documented procedures                                  |                                            |           |
|                                                        |                                            |           |
| We reviewed for the existence of procedures            |                                            |           |
| governing cash and bank operations:                    |                                            |           |
|                                                        |                                            |           |
| tasks                                                  | correctly                                  |           |
| -                                                      | Cash/cheque receipting                     |           |
| -                                                      | Cash Book                                  |           |
| Cash Book                                              |                                            |           |
| and consistently                                       |                                            |           |
| or                                                     |                                            |           |
| -                                                      | Couriering of monies between council sites |           |
| and banks                                              |                                            |           |
| -                                                      | misuse                                     |           |
| a) Documented procedures will define all               |                                            |           |
| responsibilities                                       | relating                                   | to        |
| -                                                      | Schools debit/credit card arrangements.    |           |
| reconciliation                                         | review,                                    | including |
| debit/credit                                           |                                            |           |
| cards                                                  |                                            |           |
| then                                                   |                                            |           |
| there                                                  |                                            |           |
| is a risk of -                                         |                                            |           |
| processing error,                                      |                                            |           |
| monitoring of unallocated items and the                |                                            |           |
| maximum period for bank transactions to                |                                            |           |
| remain unallocated.                                    |                                            |           |
| -                                                      | delayed                                    |           |
| Responsible officer                                    |                                            |           |
| :                                                      |                                            |           |
| processing                                             |                                            |           |
| Assistant Finance Manager, Cashbook                    |                                            |           |
| -                                                      | inaccurate                                 |           |
|                                                        |                                            |           |
| records                                                |                                            |           |
| Target date:                                           |                                            |           |
| 31 May 2020                                            |                                            |           |
| - the embedding                                        |                                            |           |
| of bad practice in                                     |                                            |           |
|                                                        |                                            |           |
| Cash/cheque receipting and cash-up sign-off            |                                            |           |
|                                                        |                                            |           |
| Cash/cheque receipting procedures provided to us       |                                            |           |
| for review covered the cash up process however did     |                                            |           |
| not:                                                   |                                            |           |
| - specifically refer to manager sign-off/approval (see |                                            |           |
| Finding 7 below).                                      |                                            |           |
| - specifically refer to collection by Royal Mail for   |                                            |           |
| transfer to the bank.                                  |                                            |           |
|                                                        |                                            |           |
| Ref                                          | Finding         |
|----------------------------------------------|-----------------|
| Risk                                         |                 |
| Category                                     |                 |
| Agreed action                                |                 |
|                                              | operation and - |
| financial loss                               |                 |
|                                              |                 |
| Cash-up and cash/cheque receipting           |                 |
|                                              |                 |
| b) Cash/cheque receipting into Pay360 and    |                 |
| cash-up procedures will be updated to record |                 |
| manager review and sign-off of the cash-up   |                 |
| documentation and Royal Mail collection      |                 |
| arrangements.                                |                 |
|                                              |                 |
| Responsible officer                          |                 |
| :                                            |                 |
| Cashier                                      |                 |
| Target date:                                 |                 |
| 03 February 2020,                            |                 |
|                                              |                 |
| Security Collections                         |                 |

Our view is that the process document should include all key aspects of operation. Cash Book See Finding 2, above. Documented procedures should define all responsibilities relating to the bank reconciliation review, including the monitoring of unallocated items and the maximum period for transactions to remain unallocated, say 3 months. Security Collections There were detailed procedures governing SC operation. The Senior Security Collections Officer indicated that they were being updated at the time of the audit.  

c)  The update of SC procedures will be 
finalised. 
Responsible officer: 
Senior Security Collections Officer 
Target date: 03 February 2020 
Direct Debits d) Procedures governing the management, - request, 
authorisation 
and 
review 
/ 
monitoring of validity - of direct debits will be 
approved and communicated. 
| Ref                                          | Finding     | Risks    |
|----------------------------------------------|-------------|----------|
| Risk                                         |             |          |
| Category                                     |             |          |
| Agreed action                                |             |          |
| Responsible officer                          |             |          |
| :                                            |             |          |
| Head of Finance:  Exchequer                  |             |          |
| Target date                                  |             |          |
| : 03 February 2020                           |             |          |
|                                              |             |          |
| If                                           |             |          |
| reconciliation                               |             |          |
| anomalies                                    | or          |          |
| Low                                          |             |          |
| a. Management will review and sign-off all   |             |          |
| receipting reconciliations to bank paying in |             |          |
| slips at the time of the processing. Any     |             |          |
| reconciliation                               | review      | backlogs |
| reconciliation will be expedited.            |             |          |
| differences                                  |             |          |
| between                                      |             |          |
| amounts                                      |             |          |
| receipted                                    | and         |          |
| Responsible officer:                         |             |          |
| Senior Income Officer                        |             |          |
| amounts banked                               |             |          |
| are not identified                           |             |          |
| and                                          | corrected   |          |
| Cashier                                      |             |          |
|                                              |             |          |
| Target date:                                 |             |          |
| then                                         |             |          |
| there is a                                   |             |          |
| risk of delayed                              |             |          |
| general                                      | ledger      |          |
| 6 January 2020 (implemented)                 |             |          |
|                                              |             |          |
|                                              |             |          |
| processing,                                  |             |          |
| inaccurate                                   |             |          |
| accounting                                   |             |          |
| records                                      | and         |          |

8 
Cash/receipting (Axis Cash Receipting (ACR)) cash-up review We reviewed the arrangements for processing of cash and cheques in PAY360 (ACR), the Council's Income Management system, - by Income, the preparation of the related paying in slips and the reconciliation to system reports. In 1/5 cash up reconciliations tested for £48,466.11 (25/06/2019), it was not signed by the Income Manager as evidence of review. We were informed that there was a backlog of manager reviews of cashup which meant that manager reviews to ensure that cash/cheques receipted matched the supporting documentation including paying in slip were not being undertaken on a timely basis at the time of the cashup. 

 

process improvements not being made where necessary.  

## Appendix 1: Definition Of Risk Categories And Assurance Levels In The Executive Summary

Note: the criteria should be treated as examples, not an exhaustive list. There may be other considerations based on context and auditor judgement.  

## Risk Rating

Critical 

Immediate and significant action required. A finding that could cause: - 
Life threatening or multiple serious injuries or prolonged work place stress. Severe impact on morale & service performance (eg mass strike actions); or 
⚫ 
 
- 
Critical impact on the reputation or brand of the organisation which could threaten its future viability. Intense political and media scrutiny (i.e. front-page headlines, TV). Possible criminal or high profile civil action against the Council, members or officers; or 
- 
Cessation of core activities, strategies not consistent with government's agenda, trends show service is degraded.  Failure of major projects, elected Members & Senior Directors are required to intervene; or 
- 
Major financial loss, significant, material increase on project budget/cost. Statutory intervention triggered. Impact the whole Council. Critical breach in laws and regulations 
that could result in material fines or consequences. 

High 

Action required promptly and to commence as soon as practicable where significant changes are necessary. A finding that could cause: - 
Serious injuries or stressful experience requiring medical many workdays lost. Major impact on morale & performance of staff; or 
⚫ 
 
- 
Significant impact on the reputation or brand of the organisation. Scrutiny required by external agencies, inspectorates, regulators etc. Unfavourable external media coverage. Noticeable impact on public opinion; or 
- 
Significant disruption of core activities. Key targets missed, some services compromised. Management action required to overcome medium-term difficulties; or 
- 
High financial loss, significant increase on project budget/cost. Service budgets exceeded. Significant breach in laws and regulations resulting in significant fines and consequences. 

## Medium

A finding that could cause: - 
Injuries or stress level requiring some medical treatment, potentially some workdays lost. Some impact on morale & performance of staff; or 
⚫ 
 
- 
Moderate impact on the reputation or brand of the organisation. Scrutiny required by internal committees or internal audit to prevent escalation. Probable limited unfavourable media coverage; or 
- 
Significant short-term disruption of non-core activities. Standing orders occasionally not complied with, or services do not fully meet needs. Service action will be required; or 
- 
Medium financial loss, small increase on project budget/cost. Handled within the team. Moderate breach in laws and regulations resulting in fines and consequences. 

A finding that could cause: 
Low 
- 
Minor injuries or stress with no workdays lost or minimal medical treatment, no impact on staff morale; or 
⚫ 
- 
Minor impact on the reputation of the organisation; or 
 
- 
Minor errors in systems/operations or processes requiring action or minor delay without impact on overall schedule; or 
- 
Handled within normal day to day routines; or 
- 
Minimal financial loss, minimal effect on project budget/cost. 
Level of assurance 
Substantial 
There is a sound control environment with risks to key service objectives being reasonably managed. Any deficiencies identified are not cause for major concern. Recommendations will normally only be Advice and Best Practice. 
⚫ 
 
Reasonable 
⚫ 
An adequate control framework is in place but there are weaknesses which may put some service objectives at risk. There are Medium priority recommendations indicating weaknesses but these do not undermine the system's overall integrity. Any Critical recommendation will prevent this assessment, and any High recommendations would need to be mitigated by significant strengths elsewhere. 
 
Limited 
There are a number of significant control weaknesses which could put the achievement of key service objectives at risk and result in error, fraud, loss or reputational damage. There are High recommendations indicating significant failings. Any Critical recommendations would need to be mitigated by significant strengths elsewhere. 
⚫ 
No 
⚫ 
There are fundamental weaknesses in the control environment which jeopardise the achievement of key service objectives and could lead to significant risk of error, fraud, loss or reputational damage being suffered. 
 

## Appendix 2 - Analysis Of Findings

| Critical                                            | High    | Medium    | Low    | Total    |
|-----------------------------------------------------|---------|-----------|--------|----------|
| Area                                                |         |           |        |          |
| D                                                   | OE      | D         | OE     | D        |
| Cheque/Cash receipting (Axis Cash Receipting)       |         |           |        |          |
| -                                                   | -       | -         | -      | -        |
| 1                                                   |         |           |        |          |
| -                                                   | -       |           |        | 1        |
| 3                                                   |         |           |        |          |
| Bank reconciliation and clearance of unallocated    |         |           |        |          |
| bank transactions, including related Integra and    |         |           |        |          |
| PAY360 system access and direct debits              |         |           |        |          |
| -                                                   | -       |           |        |          |
| -                                                   |         |           |        |          |
|                                                     |         |           |        |          |
| -                                                   | -       | 3         | -      | -        |
| 3                                                   |         |           |        |          |
| Cash Management: Cash float and courier (collection |         |           |        |          |
| and delivery) of monies between Council sites and   |         |           |        |          |
| bank                                                |         |           |        |          |
| Policies and procedures                             |         |           |        |          |
|                                                     |         |           |        |          |
|                                                     |         |           |        |          |
| -                                                   |         |           |        |          |
|                                                     |         |           |        |          |
| -                                                   | 1       | -         | -      |          |
| 1                                                   |         |           |        |          |
| Total                                               | -       | -         | -      | -        |
|                                                     |         |           |        |          |
|                                                     |         |           |        |          |

## Key:

- 
Control Design Issue (D) - There is no control in place or the design of the control in place is not sufficient to mitigate the potential risks in this area. 
- 
Operating Effectiveness Issue (OE) - Control design is adequate, however the control is not operating as intended resulting in potential risks arising in this area. 

## 

Timetable Terms of reference agreed:  
Fieldwork commenced: 
Fieldwork completed: 
Draft report issued: 
Management comments received: 
Final report issued: 
Date: 02 August 2019 
Date: 09 August 2019 
Date: 23 October 2019 
Date: 21 January 2020 
| Date:               | Emerging    |
|---------------------|-------------|
| 2019                | findings    |
|                     |             |
|                     |             |
| 28 October 2019/ 1  |             |
| November 2019       |             |
|                     |             |
| 4 November 2019, 28 |             |
| November 2019       |             |
|                     |             |
| 14 January 2020, 21 |             |
| January 2020        |             |

## Appendix 3 - Identified Controls

| Area                                                          |
|---------------------------------------------------------------|
| Cheque/cash                                                   |
| receipting                                                    |
| All cheque/Cash payments                                      |
| received are correctly                                        |
| recorded, held securely and                                   |
| are banked.                                                   |
| Cash receipts may be                                          |
| misappropriated or                                            |
| cheques may be lost.                                          |
|                                                               |
| Inaccurate receipt                                            |
| processing                                                    |
| Receipting process governed by documented procedures,         |
| "QUALITY MANUAL, Quality Procedure, Processing                |
| Remittances through the ACR System"                           |
| (long standing process, has not changed per PP, this is       |
| consistent with walk through process done years back with     |
| the same officer)                                             |
|                                                               |
| Process managed by experienced Cashier officer                |
|                                                               |
| System input controls total individual receipts associated    |
| with an invoice automatically for comparison to invoice       |
| total, where invoice has more than one associated receipt.    |
|                                                               |
| Total cash/cheques input to Pay360 (ACR) is reconciled to     |
| control totals, system reports and paying in slips. For cash- |
| up processes tested, amounts reconciled to system reports     |
| and agreed to totals actually banked in the bank statement.   |
|                                                               |
| Manager authorisation of reconciliation of cheque/cash,       |
| receipting system documentation reports to paying in slip     |
|                                                               |
| Cheques/cash kept in a locked safe on 6th floor awaiting      |
| collection.                                                   |
|                                                               |
| Roles and responsibility clear and clear process for delivery |
| cheques and cash to PP for processing                         |
|                                                               |
| Pay360 - access:                                              |
|                                                               |
| - Authentication configuration for passwords                  |
- Accounts where password have not been changed for 60 days lock - Accounts not used for 90 days - de-activate and require Client to submit a request to portal. - User access request and leaver access requests are only actioned 
via 
the 
Self-Service 
portal 
requiring 
manager/supervisor approval. 
Bank reconciliation and clearance of unallocated bank 
transactions 
All bank accounts may not have been identified resulting in incomplete financial records. 
Discrepancies 
occur 
Financial records include all Council bank accounts and balances to ensure completeness 
All transactions are processed to the general ledger correctly and in a timely fashion. 
between the bank account and the general ledger due to error or misappropriation of funds. Reconciling items and long standing 
unidentified 
balances 
may 
not 
be 
investigated and cleared promptly 
resulting 
in 
inaccurate 
financial 
records. 
See above for daily receipting process (ensures that all receipts are processed to Pay 360 which interfaces to Integra). Clear record of all bank accounts for comparison to the 
accounts. RBS bank interfaces download information to bank transactions to Cash Management Module daily. These are matched to transactions by Cash Book staff for allocation to the G/L Bank account. Unallocated items are identifiable on the Reconciliation Reports generated periodically for review or another more user-friendly report, Cash Unallocated Report Integra, Council finance system, end-user access control for related Cash and Bank roles. Documented procedures defining related Cash Book process are available for referral. Historic review of direct debits for their ongoing validity 
Monies for collection or deposit at the bank are lost/stolen 
Cash 
Management: Cash float and courier 
of 
monies 
All monies requested by Services and collected by couriers are delivered and banked, where applicable The finance team are aware 
of all the emergency and petty cash balances held across the Council 
There is a strict receipt process for the collection and delivery of monies for banking. There 2 officers driving/collecting monies. Security Collections (SC, Council) and Clients sign for the collection of monies (cash/cheques) from Client sites, such 
as schools, libraries, signed by both in receipt book LOOMIS and Security Collections sign for the collection of above monies by Loomis for delivery to RBS Bank. For collections from schools who do not use RBS but LLoyds, Lloyds provides one receipt slip which is affixed to the Run Sheet. Lloyds stamps the run sheet as proof of 
receipt of monies by LLoyds Bank. Sign-off by SC and internal client confirming collection and receipt of monies requested by client The floats are held securely in safes in locked rooms, with CCTV, alarms. Float top-up requests for cash are approved by Senior Finance Management. Documented procedures govern money collection and delivery processes 
| Policies                                            | and         |
|-----------------------------------------------------|-------------|
| procedures                                          |             |
| Employees are not aware of                          |             |
| the policies and procedures                         |             |
| in place to support cash                            |             |
| handling                                            | and         |
| Documented procedures govern Cash Book, cash/cheque |             |
| receipting processes, money collection and delivery |             |
| processes and cash float top-up arrangements.       |             |
|                                                     |             |
| Documented procedures evident for School credit and |             |
| debit cards                                         |             |
| processes and therefore do                          |             |
| not                                                 | follow      |
| procedure                                           | for         |
| accurate                                            | and         |
| processing,                                         | recording,  |
| reconciling arrangements.                           |             |
| If                                                  | there       |
| Staff are aware of up to date                       |             |
| policies and procedures in                          |             |
| relation to cash and bank to                        |             |
| ensure that related                                 |             |
| processing is consistently                          |             |
| correct/accurate and that                           |             |
| monies are held securely                            |             |
|                                                     |             |
| Direct debits are                                   |             |
| appropriately authorised and                        |             |
| reviewed to ensure their                            |             |
| ongoing validity.                                   |             |
| policies relating to the use                        |             |
| of schools' debit and credit                        |             |
| cards, there is a risk that                         |             |
| these                                               | will        |
| inappropriate                                       | transaction |
| limits                                              | or          |
| transactions which are not                          |             |
| legitimate.                                         |             |
|                                                     |             |

## Appendix 4 - Follow-Up Of The 2017-18 Purchase Cards Follow-Up (Actions Reported As Outstanding At The Last Review 25 October 2017 And Audit Committee 19 April 2018)

Audit finding, date and recommendation  

## 1) Monitoring Procurement And Consideration Of Value For Money (Medium Risk) Value For Money

We found that there have been limited strategic considerations around the use of Purchase Cards to maximise value for money through the purchasing process, for example by reducing the amount of low value expenditure going through the AP system.  

## Monitoring And Oversight

There was no periodic reporting to facilitate oversight of the use of Purchase Cards and purchasing activity. Through performing analysis of expenditure through Purchase Cards we identified the following:  

- 
Where total supplier spend in year exceeds £10,000, there is a requirement to obtain three alternative competitor prices and wherever possible a contract should be put in place. However, on analysis of expenditure on all Purchase Cards from 01 April 2015 to 31 March 2016, we noted that there 
were eight suppliers, where spend was greater than £10,000 in the year [See **appendix 1 in Original Audit Report**] and we were unable to determine 
whether alternative options had been considered;   
- 
Purchase Card holders are set a monthly spend limit on each card. Through analysis of expenditure in the prior year, we noted that seven Purchase 
Card holders had breached their set monthly limits [See **appendix 1 in Original Audit Report** ]; and  
There was a lack of oversight and analysis of expenditure on Purchase Cards to ensure that expenditure was bona fide. Our analysis indicated that six Amazon Prime subscriptions [£474] had been purchased in 2015/16, which may indicate use that was not for a valid business reason. These transactions should be further investigated by management to ensure that there was a valid business rationale [See appendix 1 in Original Audit Report]. 

expenditure investigated as necessary. 

 
A review of the audit analysis will be undertaken and expenditure investigated as necessary. 

Responsible Officer:  
Head of Treasury, CSG  
 

## Original Target Date: 30Th November 2016

 
********** confirmed that a review was done in 2018 using data obtained by the team. (The original audit analysis was not provided to the team for their review). The comments below outline the analysis done by the team, or steps taken to demonstrate control. - 
Spend per supplier exceeds £10k:  analysis of spend per supplier was completed in June 2019 and there were 6 suppliers where we exceeded £10k per supplier. These were Argos, Tesco, Courts, Amazon, DVLA and Sainsburys. The Council could not have use alternative suppliers in the case of the Courts and DVLA. We are talking to the relationship manager at NatWest to look into the possibility of an Amazon business account to better understand and control this area of spend. Spend with the other suppliers is multiple small value transactions and the competitive tender route is not thought to be applicable in these instances. 
- 
Card holders exceeding monthly spend limit - card limits are contained in the March 19 Distribution List (Excel file). The card holder limit is correct at the date the report is run, but historic card holder limits are not retained. This makes it impossible to check spend limit breaches for prior months. However, the system should not allow 
the limit to be exceeded. If a card holder needs a higher limit for one month then their Budget Holder may contact ********** in writing to request a one-off increase. The bank carries out the temporary change and the following month the limit reverts back to the lower amount. - 
Analysis on Amazon subscriptions was done in August 2019 (see Amazon Subscriptions - Word file). In 15/16 there were 6 subscriptions totalling £474. We found these were purchased by 5 card holders. Of these: 

 
o 
1 was refunded 6 days after the transaction.  
o 
2 were annual subscriptions that did not repeat the following year.  

o 
2 of the annual subscriptions repeated for a second year but the card holders have left Barnet and their cards have been cancelled.  
o 
The final subscription ran for 3 years. This was purchased by a Children's Service Team Manager.  
o 
********** has been following up with cardholders but I do not have access to the emails.  
o 
********** has asked ********** to instruct all card holders that no subscriptions are permitted without Treasury approval and to provide a listing of all subscriptions currently in place.   

## Internal Audit Assessment Implemented

d) Monitoring of expenditure on Purchase Cards should be performed on a regular basis to ensure that breaches in procurement limits are noted and appropriately escalated. 

## Finance Response, September 2019

Action: Recommendation accepted, Purchase cards expenditure will be monitored to ensure that spend is appropriate and within procurement limits.  Monitoring will be reviewed by a senior officer. 

Responsible Officer:  

To review the suitability of the expenditure the budget holder has the ultimate control and can reject transactions if they are not suitable/ not recognised/ any of the details are incorrect.   

      Original target date: 30th November 2016 
 

Also, on a sample basis, the Senior Management Accountant, Treasury (**********) checks the monthly statements and upload file for Integra and emails cardholders about those transactions requiring clarification. Consideration is given to large values (e.g. over £500 - see email evidence: P-Card audit over £500) and the type of transaction / narrative for each card holder (relative to their job role and original business case). The monitoring is reported back to the Head of Treasury each month when the Payment Card Reconciliation is emailed to him to give visibility of the balances and trends (see P-Card reconciliation outstanding email). An annual review was carried out in 2018 and again in June 2019.  We now have an established process for reviewing p-card expenditure, both monthly and annually.  

Evidence was provided to support the management response above and monthly monitoring of P-Card expenditure.  

## 2) Approval Of Expenditure On Purchase Cards (Medium Risk) Control Design And Operating Effectiveness

Purchase Card holders code each expense transaction to relevant cost centres on Integra. These are pushed to the respective Budget Holders to authorise by the end of the month. Authorisation should occur on review of third party proof of purchase and corresponding narrative attached to each transaction on the system. We noted the following issues: 

## Retention Of Supporting Documentation

A sample of 25 expense transactions were sampled between 01 April 2015 and 31 March 2016, to verify that adequate supporting documentation was retained to support purchases through Purchase Cards. We found:   

- 
Purchase Card holders were unable to upload proof of purchase onto Integra due to technical issues with the system. Staff had been informed that they were required to keep relevant documentation to support purchases. However, it has not been possible to confirm that budget holders had reviewed this documentation prior to authorisation; and 
- 
In four out of 25 cases (16%) we noted that the supporting documentation retained consisted of internal purchase orders rather than third party proof of purchase such as a receipt or invoice. This was due to a misunderstanding of procedures in relation to Purchase Cards.  

## Timely Approval Of Expenditure

We obtained a reconciliation report of expenses on Integra as at 31 March 2016 and noted that £44.8k (11.5%) of a total annual spend of £389.6k was yet to be approved. Though reporting on items awaiting approval was performed to chase those awaiting approval, there was a lack of analysis performed to identify trends or long-outstanding items. 

a) The technical issue with Integra should be investigated 
and resolved to ensure supporting evidence can be attached to support Purchase Card expenses.  
 
be added to the log of required Integra developments; however implementation will depend on competing priorities. 
Responsible Officer:  
Assistant Director of Finance, CSG 
      Original target date: 
      To be logged - 7th October 2016 To be implemented - TBC based on the assessment of required Integra developments 

was visible to the budget holder when reviewing the transaction at the approval stage. 
However, we believe that this functionality isn't widely understood. To address this, a 
communication to staff to highlight this function is planned by ********** in September 2019. He is waiting for an appointment with a cardholder to do screen shots and prepare a small guidance note to demonstrate how to create a PDF file and upload it. He also plans to create a shared drive with a folder for every cardholder and will be asking for receipts to be stored in this central repository. This will be easier to access for audit and VAT purposes. We are also in talks with NatWest/RBS regarding moving the card transaction processing 
from Integra to their SmartData web-based service.  Related to this audit finding - 
receipts will be uploaded to SmartData for each transaction by the cardholder and will be visible to the approver. Further background information: using SmartData would entail a total overhaul of the current processes but it is believed that it would offer better control and functionality for the cardholder and budget holder and better monitoring and chasing emails for the P Card Administrator. A demo meeting with the bank was held on 11/09/2019 and a paper is being written for the S151 officer to seek approval to take the next steps. The timescale discussed is for roll out to be in December 2019. The new system would be used for all card processing - disbursements, approvals/rejections and amendments, and reporting. Monitoring/chasing emails can be automated. Transactions will be available for processing 48 hours after the transaction date rather than after the statement date. Related to both of the above points, a refresh of the P-Card Policy is starting in September 2019. This will cover in more detail the expectations on cardholders and approvers, 
appropriate and inappropriate spend, deadlines to action items, requirements for evidence of approval and VAT evidence, penalties for non-compliance and new approval routes. 
Internal Audit assessment 
Evidence was provided to support the management response above and resolution of the technical issue, supporting evidence for P-Card expenditure can be uploaded to Integra.  
b) Reporting on total expenses and outstanding items should 
Implemented 
be sent to Budget holders to allow them to oversee and investigate recurring trends in outstanding / rejected payments over the year. 
 
 
Finance response, September 2019 Reconciliation emails of outstanding transactions requiring intervention (either disbursement or approval) are sent to cardholders and budget managers on a weekly basis in the main (see attached email correspondence: P-Card disbursements and approvals outstanding weekly email). At year-end, the emails are sent daily. The analysis of spend awaiting authorisation is within the weekly email. This ensures that persistent issues are identified. The table embedded in the above email shows clearly if the same items have been left unaddressed for a number of weeks.  
Action: Recommendation Accepted 
Reporting on total expenses and outstanding items to be developed and circulated to budget holders on a monthly basis. 
Responsible Officer:  
Head of Treasury, CSG 
 

Original target date: 30th November 2016 
 
In addition to these emails, the team plans to send a report of the outstanding transactions to CMT each month to make sure that management have visibility of all of the transactions pending for their service.  

 Known issue - rejected transactions  

 3b) Analysis should be undertaken to ensure that historic issues and trends are identified and can be followed up. 3c) The reconciliation of outstanding unallocated transactions should be sent out to individual Budget Holders on a monthly basis. Budget Holders may then chase up unallocated purchases within their own respective departments. 

There is an issue with 'rejected' transactions. Up until recently a rejected transaction was 'stuck' in the system with nobody able to access. A change has been made so that on rejection the transaction now goes back to the cardholder to action. This leaves the transactions previously rejected which are still sitting in the 'black hole'. Finance are working through these and will be writing off around £4.5k as some of these transactions go back 4 or 5 years. Action for Closing and Monitoring team to write off, if approved, and Integra Finance to remove the transactions from the system. A rejected transaction that is returned to a cardholder cannot have the main fields edited. The user cannot edit the details on the GL code or value, only the narrative and VAT 
amount, so if the original values were keyed in were wrong there is nothing that can be done with the transactions. Integra have not been able to offer a solution. This is another motivating factor to move to SmartData because that system allows the cardholder to perform the required edits and resend the transaction for approval.  

Evidence was provided to support the management response above and the process for reporting outstanding P-Card items routinely for clearance. The process was also confirmed by the Head of Counter Fraud Operations who is a P- Card holder in Assurance. 
c) Analysis of spend awaiting authorisation should be 
Implemented 
Covered in 2b above.  
regularly performed to ensure that persistent issues are identified and escalated where appropriate.  
  

Evidence was provided to support the management response above and the process for reporting outstanding P-Card items routinely for clearance. The process was also confirmed by the Head of Counter Fraud Operations who is a P-
Card holder in Assurance. 

Original target date: 30th November 2016 
 

## Implemented New Finding 2: Budget Holder Self-Review (Control Design) - Medium Risk

Upon being uploaded to Integra, transactions are allocated to budget codes by the card holder for approval by the budget holder. We found that there are no controls within the Integra system to enforce segregation of duties when the card holder is also the budget holder. Effectively a card holder could allocate transactions to their own budget code and there would be no oversight, scrutiny and approval of the transaction. Currently no exception reports are run to detect such instances. As this represents a potential fraud risk, it is important that action is taken to address this, either by developing preventative controls within the system to enforce segregation of duties between cardholder and budget holder, or detective controls in the form of a monthly exception report. 

This has been highlighted as an issue in *Appendix 1*.  
Target date 31 December 2017 
 

## Update As At September 2019

Please refer to update provided in the table in appendix 1. 

Evidence was provided to support the management response above and implementation of the preventative control ensuring that P-Card holders are not able to approve P-Card expenses allocated to their own budget/cost centre. Operation was also confirmed with P-Card holder in Assurance, Head of Counter- Fraud Operations.  His allocations of P-Card expense line items from his P-Card to the cost centre of which he was the budget manager in terms of the Scheme of Financial Delegation were allocated to the Assurance Director for approval, however where he allocated the P-Card expense line item to an Elections cost centre, then it was allocated to the Head of Electoral Services for approval. 

## 3) Decommissioning Of Purchase Cards (Medium Risk) Control Design And Operating Effectiveness

Purchase Cards are decommissioned where no longer required or when the card holder leaves the Council's employment. We found that there was no formalised procedure in place to check a list of leavers in a given period to ensure that they did not still have a Purchase Card, which should be have been decommissioned. We obtained a listing of leavers from the Council between 01/04/2015 and 30/06/2016. Through cross-referencing this with the listing of card users at the date of the audit, we noticed that there were 9 leavers who were not known to the Treasury team. On scrutiny of the data from the Purchase Card system, we noticed one user, which had two transactions following their leave date. These transactions totalled £12 and were related to payments to Tesco for reduced delivery fees. In addition, we found that there was no formalised reporting on users' activity on Purchase Cards to ensure cards were being utilised and identify instances where cards may no longer be required. On analysing the expenditure on all Purchase Cards from 01 April 2015 to 31 March 2016, we noted that there were 20 (out of 89 cards in circulation), which had not been used in the past 90 days. In addition, there were 14 cards which had less than £250 spend, and 
15 cards with less than 5 transactions, in the year [See **appendix 1 in Original Audit Report**]. This may indicate cards which are in circulation unnecessarily. Where Purchase Cards were no longer required NatWest is informed to decommission the card. However, it was noted that the physical destruction of the card was not otherwise recorded to ensure destruction had taken place. 

b) Analysis of spend on Purchase Cards should be 

## Implemented

Finance response, September 2019 

regularly performed to ensure that cards with few transactions are identified and decommissioned where appropriate.  

The replacement cards received in March 2018 had been analysed and only those entitled to receive theirs were issued. Unused cards were closed. See supporting Excel files (Zero P Card activity from April 18-Feb 19 list). 

 
Action: Recommendation accepted, Purchase card spend 
will be reviewed on an annual basis and cards decommissioned where appropriate. 

Another review of valid card holders was conducted again in March 2019, see attached document: March 19 Distribution List. Unused cards were closed.  

## Responsible Officer:

Head of Treasury, CSG 

 

Annual spend was reviewed again by a Finance intern in June 2019 but a process needs to be put into place to close those cards - there is a pending action to close cards highlighted in the June 2019 review (this needs to be checked with ********** following his annual leave).  

     Original target date: 31st March 2017 

Card closures are also identified and addressed on an ad-hoc basis throughout the year, for example, the card for ********** in Procurement was closed in September 2019 because it was no longer required and a request was made by her line manager to close the card.  

Evidence was provided to support the management response above and the process for identifying cards with zero/low activity for potential 
decommissioning.  

## 4) Allocation Of Expenditure On Purchase Cards - Medium Risk Control Design

Transactions on Purchase Cards are uploaded onto the General Ledger 'Integra' from the NatWest online banking portal. Expenses on each of the Purchase Cards are automatically allocated to a suspense account for Purchase Card holders to code. Staff members are prompted to allocate costs on the General Ledger 'Integra' by automated email from the system. We obtained a reconciliation report of expenses on Integra as at 31 March 2016. We noted that £29.7k (7.6%) of a total annual spend of £389k was yet to be coded by Purchase Card holders. Without allocating the expense to a cost centre code, the expense cannot be authorised and recognised against the relevant ledger code and cost centre. Evidence of this monthly reconciliation is not consistently retained by management. Reporting is produced to chase Purchase Card holders to allocate spend on a regular basis. However, we found that there is no detailed analysis performed and it was not reviewed and signed off by senior management to ensure issues were appropriately escalated. 

Implemented 

a) Reconciliations between Integra and the banking system, 

Update as at September 2019 

and reporting on outstanding items, should be reviewed and signed off on a regular basis. 

Monthly BACS payments are coded by Cashbook and reconciled by ********** to check the bill payment is for the correct value. 

## Action: Recommendations Accepted A) All Reports And Reconciliations Will Be Reviewed And

signed off by a senior officer. 

A monthly reconciliation between Integra and the banking system was started in 2018 and has been done by **********, Closing and Monitoring Team (since Dec 18). She obtains the bank statements from the Treasury folders and matches them to Integra. Any queries go to **********, Senior Management Accountant, Treasury, who either emails the card holders to ask them to action the item/s or he emails the Budget Holder to request that they approve (if the disbursement stage has been completed). ********** saves the monthly file in his folder (P:\2019-20 Control accounts\August 19\Reconciliation\P card). These chasing reports are sent weekly and sometimes daily (e.g. at year-end) to authorisers to tell them if they have transactions awaiting authorisation. (As described 
above in 2d above).  
There is a Payment Card Reconciliation Page within Integra. This is checked every month by the Senior Management Accountant.  In terms of senior visibility, ********** is kept informed by ********** about movements in the reconciliation page (see email). There is also visibility of pending transactions throughout the business as the emails now go to budget holders.  

## Responsible Officer: Original Target Date: 30Th November 2016 Internal Audit Assessment

Evidence and discussion confirmed the update above and the reconciliation between total amount of the P-Card and the underlying transactions allocated and approved through the P-Card control account in the general ledger.  
Implemented 
b) Analysis should be undertaken to ensure that historic issues 
and trends are identified and can be followed up. 
 
b) Covered by annual review under 3b. 
Covered in 2b above.  
   
Update as at September 2019 
Responsible Officer:  
Head of Treasury, CSG 
 
N/A - covered in 2 b above 
Original target date: 30th November 2016  
Internal Audit Assessment As above Implemented 
c) The reconciliation of outstanding unallocated transactions 
 
Covered in 2b above.  
should be sent out to individual Budget Holders on a 
monthly basis. Budget Holders may then chase up unallocated purchases within their own respective departments. 
 
Update as at September 2019 N/A - covered in 2 b above 
Action: Recommendations accepted  
 
Internal Audit Assessment 
The reconciliation of outstanding unallocated transactions will be circulated to budget holders on a monthly basis, together with instruction as to the action to be taken.  
As above 
Responsible Officer:  
Head of Treasury, CSG 
Original target date: 30th November 2016  

## Appendix 1 - Additional Issues Identified

| Ref                                                     | Finding                    |
|---------------------------------------------------------|----------------------------|
| Risk                                                    |                            |
| 2                                                       |                            |
| Budget holder self-review (Control design)              |                            |
|                                                         | A cardholder who is also a |
| budget holder could self-                               |                            |
| authorise inappropriate or                              |                            |
| fraudulent transactions to                              |                            |
| avoid detection, resulting in                           |                            |
| losses to the Council.                                  |                            |
| Transactions are analysed and reviewed by the Senior    |                            |
| Management Accountant on a monthly basis prior to       |                            |
| being uploaded to the Integra general ledger system.    |                            |
| Upon being uploaded to Integra, transactions are        |                            |
| allocated to budget codes by the card holder for        |                            |
| approval by the budget holder. We found that there are  |                            |
| no controls within the Integra system to enforce        |                            |
| segregation of duties when the card holder is also the  |                            |
| budget holder. Effectively a card holder could allocate |                            |
| transactions to their own budget code and there would   |                            |
| be no oversight, scrutiny and approval of the           |                            |
| transaction. Currently no exception reports are run to  |                            |
| detect such instances.                                  |                            |
category 
Agreed action 
| Ref    |
|--------|
| Risk   |
category 
Agreed action 
In technical terms, within Integra the approval route is set by referencing a data table called 
'nmlorgccsec'. The nmlorgccsec fields are tested in 
the following order: NMLORGCCSEC.BUD_MAN  >> NMLORGCCSEC.BUD_HOLD >> NMLORGCCSEC.BDM_ASSISTANT_DIRECTOR. If the BPC card user name matches the nmlorgccsec field being assigned to the BPC approver then that nmlorgccsec field is skipped and the next field down is assigned until finally the NMLORGCCSEC.BDM_ASSISTANT_DIRECTOR field might become the BPC approver. Evidence: 'P Card Approval Route_Integra'. An example has been provided from March/ April 2018. This shows the cost centre 10603 which has **************** as the Budget Holder. Her own card transactions in this cost centre had previously gone to her for approval. The system fix meant they went to ************instead. Evidence: 'Budget Holder Self Review example' - an email between ***** and ****** containing a screenshot showing a highlighted transaction on 15/2/19 going to **********S01 and a later transaction on 29/3/19 shown correctly going to **********B01. Integra Finance can do an exercise on the security table showing who is the budget manager, holder and BDM AD, if that is needed. 
Exception report: there is an exception report that 
can be run on special request by Capita. As we have 
been able to enforce segregation of duties within 
| Ref    |
|--------|
| Risk   |
category 
Agreed action 
Integra we have not gone down the route of running this report on a monthly basis. 

## Action B)

Historic review of self-authorisation: We are aware of a cardholder who was able to selfauthorise. In this instance, the cardholder informed Treasury and/or Integra Finance to request for the approval route to be corrected. This was ********** ********** (shown in example). She also keeps separate, paper-based authorisations from the budget holders for each transaction. Another card holder called was unable to disburse 
three P-card payments and got an error message that stated that no budget was linked to the payment. His line manager wasn't correctly set up to approve the spend and once rectified the issue was resolved; there was no self-approval. ********** was the card holder, budget manager and budget holder. The system did not allow him to self-authorise. Integra Finance performed a review by running a report to identify instances (in the back-end tables) where the Disburser matched to the Approver profile, and made system changes on those that were found to be the same. 

Evidence was provided to support the management response 
above 
and 
implementation 
of 
the 
preventative control ensuring that P-Card holders are not able to approve P-Card expenses allocated to their own budget/cost centre. Operation was also confirmed with P-Card holder in Assurance, Head of Counter-Fraud Operations.  His allocations of P-Card 
expense line items from his P-Card to the cost centre 
of which he was the budget manager in terms of the 
Scheme of Financial Delegation were allocated to the 
| Ref                                                    |
|--------------------------------------------------------|
| Risk                                                   |
| category                                               |
| Agreed action                                          |
| Assurance Director for approval, however where he      |
| allocated the P-Card expense line item to an Elections |
| cost centre, then it was allocated to the Head of      |
| Electoral Services for approval.                       |
|                                                        |

## Appendix 5 - Observations From Payments Data Analytics And Matching Exercise, February 2019 Observations And Areas For Improvement During Our Work We Noted Several Observations. The Key Observations Are Noted Below. Functionality To Match Bank Transactions To The Accounting System Is Currently Underutilised The Integra Accounting System Has The Functionality To Upload Bank Account Statements Into The System, Which Enables The Matching Of Incoming And Outgoing Payments On An Individual Transaction Level To The Transactions In The Accounting System. We Noted That Bank Account Statements Are Uploaded For Only 4 Out Of The 28 Accounts We Looked At And That This Functionality Is Not Actively Used For Any Of The Accounts. Utilising This Functionality Could Make The Performance Of The Bank Account Reconciliations More Efficient And Effective And Provides Assurance That Transactions In The Ledgers In The Accounting System Accurately Reflect The Transactions On The Bank Statement. Bank Account Reconciliations Not On Individual Transactional Level Bank Account Reconciliations Happen On A Monthly Basis, But Are Only Reconciled On A Total Monthly Movement And Not At An Individual Transaction Level. This In Combination With The Above Finding Creates The (Fraud) Risk That The Ledgers Do Not Accurately Reflect The Actual Payments Made As Per The Bank Statements. Manual Journals Used For Correction Are Inconsistent We Noted In The Accounting System That Correcting Manual Journal Postings Are Made. These Journals Are Not Always Made On The Same Aggregation Level; Some Journals Reflect Individual Transactions, Some Roll Up To Weekly, And Some Up To Monthly Corrective Manual Journals. Additionally, It Is Not Always Directly Clear From The Manual Journal Description The Reason And Source Of The Corrections. Please Refer To Some Examples Of Correcting Journals On Different Aggregation Levels Below.

Journal Reference 
Voucher Type 
Amount (Posted) 
Narrative 
Journal Line 
0000014161 
JV01 
-8196.02 
DD rejection CTAX April -May 18 000004 
0000014360 
JV01 
-222.54 
DD rejection ref EBP 30239995 
000011 
0000014360 
JV01 
-115 
CORRECTING ENTRY 
000012 
0000014488 
JV01 
-4321.39 
Correction of posting 
000005 

 Integra only stores detailed information for transactions that originate in Integra Transactional information like payee information (vendor ID, name and associated bank account information) is not stored for transactions that originate / are initiated outside Integra. When implementing Integra the design decision has been made to only record the transaction in the accounting system, but not store any of the data associated to that transaction in Integra. This means that only about a quarter of the value paid out by Barnet Council can be analysed using Integra due to missing information. 

## 

'Payment Audit'-files only retained for 1 month The bank transactions alone don't provide all the information required to perform the analyses in this review, therefore additional data needed to be added from Integra. All required information is captured in the 'Payment Audit'-files within Integra but currently these reports are not stored automatically and are deleted on a monthly basis as part of system housekeeping to avoid latency and slowness in using Integra (which has been a problem in the past). Capita has verbally confirmed that this has now been amended and these specific reports will be retained on an ongoing basis. A lack of centralised knowledge on where payment information is held During our procedures we noted on multiple occasions that there was a general lack of knowledge on what data was held on the system and where. Before the review it was believed that the transactions for the 28 non-school LBB bank accounts on Bankline were held on Integra. Only during the course of the review it became clear that for only 15 out of 28 accounts the transactions are captured in Integra. At a very late stage it also became clear that from the 15 bank accounts held on Integra, only 1 account had the full supplier bank account details captured. It was noted that it is not easy to find where a transaction originated through Integra. Inconsistent naming convention We noted that there are either no clear rules around naming conventions in outgoing transactions, or that these are not adhered to. For example, in the one-time vendor transactions you see a large variation in payee names for the same recipient. The table below shows an example of 3 one time vendor transactions for the same individual, same bank account*, under varying naming conventions. 

| Payee Name             | Payment Amount                 | Supplier Bank    |
|------------------------|--------------------------------|------------------|
| Account                |                                |                  |
|                        |                                |                  |
| <Client bank account>* | Simpson Millar                 | £18,750.00       |
| Same as above          | Simpson Millar Client No 3 Acc | £1,100.00        |
| Same as above          | Simpson Millar LLP             | £2,025.00        |

*Anonymised Evaluate the need of all bank accounts There are a large amount of bank accounts of which some have a small amount of transactions associated with them. Misalignment of payment types between Bankline and Integra Payment types are misaligned between Integra and Bankline. We identified that Barnet's Bankline transactions contained 13 different payment types, however in the data from Integra there are 6 payment types used (there are a total of 10 defined in the system). Please refer to Appendix 2 for a full overview of payment types in Integra and Bankline. When performing our reconciliation between Integra and Bankline we noted that there is a many-to-many relationship for payment types between the two systems. This means that payment types in Integra can relate to multiple payment types in Bankline and those same payment types in Bankline can relate to multiple payment types in Integra. Because of this, there was no possibility to map transaction types between systems and therefore we did not proceed using payment type in our reconciliation. 

For illustration purposes see the example below. 

## Example: Payment Type A In Integra Could Consist Of Transactions Of Payment Types X And Y From Bankline, While At The Same Time Payment Type Y Can Also Be Integra'S Type B. Therefore There Is No Mapping Between Payment Types Possible Which Makes Might Not Impact Processing, But Makes Recognizing, Reconciling And Controlling Transactions Significantly More Complex. In The Figure Below See A Figurative Example Of The Classification Of 4 Transactions Between The Systems. Appendix 6 - Internal Audit Roles And Responsibilities Limitations Inherent To The Internal Auditor'S Work We Have Undertaken The Review Of 2019-20 Cash And Bank, Subject To The Limitations Outlined Below. Internal Control

Internal control systems, no matter how well designed and operated, are affected by inherent limitations. These include the possibility of poor judgment in decision-making, human error, control processes being deliberately circumvented by employees and others, management overriding controls and the occurrence of unforeseeable circumstances.  

## Future Periods

Our assessment of controls is for the period specified only.  Historic evaluation of effectiveness is not relevant to future periods due to the risk that: 

- 
the design of controls may become inadequate because of changes in operating environment, law, regulation or other; or 
- 
the degree of compliance with policies and procedures may deteriorate. 
Responsibilities of management and internal auditors It is management's responsibility to develop and maintain sound systems of risk management, internal control and governance and for the prevention and detection of irregularities and fraud. Internal audit work should not be seen as a substitute for management's responsibilities for the design and operation of these systems. We endeavour to plan our work so that we have a reasonable expectation of detecting significant control weaknesses and, if detected, we shall carry out additional work directed towards identification of consequent fraud or other irregularities. However, internal audit procedures alone, even when carried out with due professional care, do not guarantee that fraud will be detected. Accordingly, our examinations as internal auditors should not be relied upon solely to disclose fraud, defalcations or other irregularities which may exist.