## Internal Audit Report Accounts Receivable (Invoice Processing) Audit 2019/20


To:  
Director of Finance Deputy Director of Finance  
Head of Finance (Exchequer) 
Copied to:  
Assistant Finance Manager (AR) 
Council Management Team (CMT) 
Operations Director, Re 
Operations Director, CSG Education & Skills Director, Cambridge Education Head of Property Services & Valuation, CSG Street Scene Commercial Manager Group Manager, Licensing, Re Head of Performance and Risk, CSG and Re Finance Manager, Cambridge Education  
Education Welfare Manager, Cambridge Education 
Document Centre and Mailroom Manager, CSG Finance Manager- Family Services Head of Service, Hospitals and Health Partnerships - Adults & Communities Manager Community Financial Assessment Team 
 
From:  
Internal Audit Executive, LBB 
Head of Internal Audit LBB  
We would like to thank management and staff of the Accounts Receivable team and other teams in the Council / its partners for their time and co-operation during the course of the internal audit. 


## Executive Summary

|                   |      |        | Assurance level     | Number of recommendations by risk category     |
|-------------------|------|--------|---------------------|------------------------------------------------|
| Critical          | High | Medium | Low                 | Advisory                                       |
| Limited Assurance |      |        |                     |                                                |
| -                 | 1    | 6      | 1                   | -                                              |

## Scope

The Council issues invoices to its customers and clients to collect income for services provided for them. Invoice processing reviews will allow the income of the council to flow in without hindrances as the invoices are produced accurately and on a timely basis. The invoices should be issued at whatever intervals are agreed in the service agreement. The audit covered arrangements within the Council's central finance team as well as reviewing a sample of invoicing teams across the Council and three of its contracted partners (CSG, Re and Cambridge Education).  

## Summary Of Findings

This audit has identified 1 high, 6 medium and 1 low risk finding. We identified the following issues as part of the audit: 

- 
Income Collection manual invoicing (Spreadsheet) Process (high): We found within our sample that controls on manually produced invoices (through spreadsheet) are not adequate. The invoices are not checked or authorised by senior officers. 
- 
Income Collection and Debt Management Guidance (ICDMG) (medium): During fieldwork, we noted that most invoicing teams (6/8 (75%) that 
we tested) are not aware of the ICDMG. We identified that the ICDMG was not version controlled, the date of production, the producer and next 
review date were not included on the document.   
- 
Commercial Rents - CSG Estates (medium): During fieldwork, we identified 8 expired leases/rent contracts (40%) which had not been 
renewed. The contract renewal process is slow, we identified that 8 cases (40%) the renewal took between 5 months to 5 years.   
- 
Commercial Waste - Street Scene (medium): Waste contract management controls are not operating effectively; we identified 12 cases (48%) 
where Business Recycling & Waste Agreement Forms were not counter-signed by LBB.  
- 
Premises Licensing and Gambling (PLG) - Re (medium) In the process of the audit we established that 8/15 credits notes issued (53%) were 
issued to previous holders of licenses who were no longer in control of the premises and had not informed PLG of their change of circumstances, 5/15 (33.3%) were issued to suspended customers; while 2/15 (13%) credit notes were issued to correct duplicated invoices. Additionally, we found that 12 invoices that were supposed to be cancelled in 2017 were still outstanding in Integra as at October 2019. It is also noted that all the AR requests for approval to take recovery action had not been granted. Lastly, we found that the council's debt write-off process was not followed 
by the team. 
- 
Education Accounts - Cambridge Education (medium): We found three cases (30%) which had no source document for invoices issued. We 
noted 10 cases (100%) where the old location of the team was on the invoices instead of the new location. We identified that in 100% of the debt write-off process tested, the LBB process was not followed.  
- 
Document Centre and Mailroom - CSG (medium): There is no evidence of adequate separation of duties in the printing process, we identified 
that whereas there is a good, separate first level security control of ID and password for members of staff printing the invoices, the second level 
of security is not adequate as the two members of staff use the same code to print. 
- 
Overpayments - Family Services (low): We noted that the overpayments bad debts were due to delay in accessing the necessary information required to enable the team to confirm outstanding invoices and chase them before they become doubtful or bad.  
 
We followed up to confirm that the actions agreed as part of the 2018/19 Debt Management audit had been completed. The AR2 concerning "Age debt monitoring" has been implemented while AR3 regarding "Third party debt collections" is not yet fully implemented, although reasonable progress has been made (See appendix 4). 

## 2. Findings, Recommendations And Action Plan

|               |         |       |
|---------------|---------|-------|
| Ref           | Finding | Risks |
| Risk          |         |       |
| category      |         |       |
| Agreed action |         |       |

## 1 Invoices Procedure - Invoices Produced On Spreadsheet

High 
a) All manually loaded 

A sample of eight invoicing teams were selected for testing across the Council and three of its contracted partners: CSG, Re and Cambridge Education.  

If invoices and 
credit notes are not independently reviewed 
and 
approved 
then 
there is a risk of error or fraud.  
 

The review established that Council's invoices are produced in two main ways: manual and electronic. The electronic method is produced, checked and authorised on the Integra system, while the manual method involves production of invoices using spreadsheets. The spreadsheets are then sent to the Integra team for upload into the system. The testing confirmed that adequate controls authorisation is in place for the electronic invoice production method through Integra; invoices are checked and authorised by appropriate officers. 

spreadsheets must include documented approval by an appropriate authorised person to evidence that the spreadsheet has been independently checked for accuracy, in line with the Financial Regulations requirement that separation of 
duties must be in place for all financial transactions.  
 
If invoicing teams 
are not aware of 
the procedures in 
place **then**, there 
a 
risk 
that 
Responsible officers: 
inconsistent practices 
may 
 
occur 
and 
go 
a) All invoicing teams across the 
undetected. 

However, manually loaded spreadsheets (invoices) in the service areas reviewed established that those service areas do not comply with section 3.1.2 of the Financial Regulations which state: "There must be adequate separation of duties to ensure that no one officer is able to handle any financial transaction from start to finish without there being some mechanism for independent checking. By finish is meant the completion of the accounting for the transaction". 

 
Council and its partners. 
 
 
Target date: 
The testing established that: 
31 January 2020 
- 
There is not adequate segregation of duties in the manual invoicing process in the two service areas we reviewed that had used this method. One member of staff starts the process from beginning to the end. 
- 
The spreadsheets are produced and forwarded to the Integra team for upload by the same officer without any authorisation or approval by a senior officer. 
 
- 
There is no evidence that the spreadsheets were checked and 
signed by a senior officer or a manager.  
 
 
| Ref                                                                 | Finding                                                               |
|---------------------------------------------------------------------|-----------------------------------------------------------------------|
| Risk                                                                |                                                                       |
| -                                                                   | Unlike for teams invoicing via Integra, for manual spreadsheets there |
| is no control on the Integra system to ensure that a senior officer |                                                                       |
| approves the content of the spreadsheet on the system (see table    |                                                                       |
| below showing the invoicing teams sampled).                         |                                                                       |
Invoicing Teams Tested 
Team Using Integra 
Team Using Spreadsheet  Team Using Integra 
and Spreadsheet 
Public Protection (Re): 
Licensing and Gambling 
Adult Social Care: 
Social Care and Ad-hoc 
Property Services & Valuation (CSG): 
Commercial Rents 
Note: this team had not invoiced via spreadsheet during the period under review 
 
Street Scene 
Commercial Services: 
Commercial Waste 
Education Partnership & Commercial Services 
(Cambridge Education): 
Education Account. 
 
Adult & Health: Actual 
Billing (Community) 
 
 
Early Intervention & Prevention (Family 
Services): 
Overpayments 
 
 
Adult & Health: 
Residential Care Homes 
5 
2 
1 
 
category 
Agreed action 
 
|      |         |       |
|------|---------|-------|
| Ref  | Finding | Risks |
| Risk |         |       |

## 2. Invoicing Procedure - Income Collection And Debt Management Guidance (Icdmg)

There is an Income Collection and Debt Management Guidance (ICDMG) document in place. A sample of eight invoicing teams were selected for testing and our discussion with each team established that six teams (75%) are unaware of the guidance note. Our testing found examples of the guidance not being followed, e.g. with regards to Write Offs (see findings 4 and 5 below).  

The guidance is not version controlled as the date of production and next review dates were not indicated on the document. Although, the Assistant Finance Manager (AR) informed us that the guidance was reviewed last year, there is no evidence to confirm this as the document was not version controlled.   

 
category 
Agreed action 
 
Medium 
(a) Finance will ensure that all 
invoicing teams are aware of and understand procedures as 
set out in the Income Collection and 
Debt 
Management 
If invoicing teams 
are not aware of the procedures in 
place **then**, there 
a 
risk 
that 
Guidance (ICDMG). This may require a training session or a notification 
each 
time 
the 
inconsistent practices 
may 
guidance is updated. 
occur 
and 
go 
(b) Finance will ensure that a 
undetected. 
 
procedure note is produced 
and publish on the intranet. 
(c) Finance will ensure that the 
Income Collection and Debt Management 
Guidance 
If process and 
procedure documents used by the Council are not 
version 
controlled 
then 
(ICDMG) is version controlled to ensure teams can identify and are using the correct version. 
inconsistent practices 
may 
 
occur 
and 
go 
undetected 
as 
 
Responsible officer: 
various versions of the documents may 
be 
in 
Assistant Income Manager  
circulation. 
Target date: 31 January 2020 


|      |         |       |
|------|---------|-------|
| Ref  | Finding | Risks |
| Risk |         |       |

## 2. Commercial Rents - Csg Estates

The Commercial rents invoicing process was tested to ensure that the process and procedure comply with the Council's Income Collection and Debt Management Guidance. 20 invoices were randomly selected from year 2019/20 commercial rent list (portfolio) for our testing. The testing established that:  

- Contracts for eight out of 20 (40%) invoices selected are expired and 
are yet to be renewed. Effectively, the fees/charges have not been agreed and signed up to by the lessor. 
- The leases and rents renewal process is very slow.  Our testing 

confirmed that for eight out of 20 (40%) rents/leases reviewed, it took 
an average of between 5months to 5years for renewal. During the process of renewal, tenants were not invoiced leading to loss of income to the Council. The table below shows the analysis of delays detected in the tenancy and rents/leases renewal process. 
Number of 
Customer Number 
Expiry Date 
Years 
10043960 
12/02/2014  
5 years 
10004859 
30/06/2014 
4 years + 
10019650 
15/03/2015 
4 years 
10004620 
25/10/2016 
3 years + 
10060430 
1/10/ 2017 
2 years + 
10026742 
24/12/2017 
1.5 years 
10026754 
25/12/2018 
1 year 
10029515 
30/06/2019 
4 months 
 
 
category 
Agreed action 
 
Medium 
a) The Commercial Rents team will 
If 
lease/rents 
contracts renewal process 
is 
ensure that expired leases and rents are renewed promptly to 
improve the income and cash flow of the Council.  
b) The 
lease 
and 
rent 
renewal 
process will be reviewed for efficiency and effectiveness and changes 
implemented 
where 
necessary.  
unnecessarily 
delayed **then** the 
council could lose income, potentially leading to budget pressures 
and 
 
cash 
flow 
Responsible officer: 
problems. 
Head of Property Services & 
Valuation  
 
Property Services Officer  
 
Target date: 31st March 2020 
 
|                                   |         |       |
|-----------------------------------|---------|-------|
| Ref                               | Finding | Risks |
| Risk                              |         |       |
| category                          |         |       |
| Agreed action                     |         |       |
| a) The Commercial Waste team will |         |       |

## 3. Commercial Waste - Street Scene

|        |           |
|--------|-----------|
| If     |           |
|        | contracts |
| Medium |           |

Our testing of the commercial waste invoicing process revealed that records of transactions are maintained. However, the records are not complete and show evidence of lack of administrative/internal controls. 

agreements between 
the 

A sample of 25 invoices were obtained for testing and we established that: 

council and its clients 
are 
not 
ensure there are controls in place to certify that all waste contracts 
are reviewed for accuracy and correctness by making sure that all BRWA Form are countersigned by LBB staff and that signed copies of 
the 
form 
are 
retained 
appropriately. 
In 12/25 (48%) of the invoices tested, the "Business Recycling & Waste Agreement Form" (BRWA Form) were signed by the clients but not signed by LBB staff to show evidence of administrative and internal control; 
adequately documented and 
signed **then** there 
is 
a 
risk 
that 
Responsible officer: 
Street Scene Commercial Manager - 
In one case (4%), the BRWA Form was not signed by either of the two parties (i.e. representative of the Council and the client), which invalidates the contract; and 
 
charges for the 
Council's 
services to such clients 
might 
Finance& Performance Manager 
(Commercial Development Team) - S 
 
unenforceable, leading 
to 
the 
Target date: 31st March 2020 
council 
losing 
 
income, or lead to disputes 
should 
there 
be 
a 
misunderstanding or 
reason 
for 
litigation.  
a) The Premises Licensing and 

## 4 Premises Licensing And Gambling (Plg) - Re

|        |
|--------|
|        |
| Medium |

A sample of 15 credit notes were obtained for testing and we established that 15/15 (100%) were issued to clients who were no longer in control of the premises and did not inform PLG of their change of circumstances. We noted that: 

If necessary and 
timely information is not available to the right team at the 
right 
time 

- 
8/15 were issued to previous holder of licenses who were no longer in control of the premises and did not inform PLG of their change of 
circumstances 

then, there is a 
risk of delay in 
acting 
against 
Gambling team will review its processes in relation to termination and transfer of licences to ensure terminated clients are removed from the database for invoicing immediately.  Team to also review 
last 12 months to ensure these have been actioned. 
| Ref           |
|---------------|
| Risk          |
| category      |
| Agreed action |

b) The PLG team will cancel all 
- 
5/15 were issued to suspended customers 

debtors leading to loss of income or 
cash 
flow 
problems. 

- 
2/15 were issued to correct duplicated invoices (and this is an 
avoidable error) 

outstanding items coded 49 in the system to ensure that the balances 
available in the account are accurate and correct. 
 
 
c) The PLG team will raise a call with 
If credit notes are 
delayed 
then, 

Furthermore, our review found that all the12 invoices coded 49 by Team Leader (Licensing & Anti-Social Behaviour) on Integra on 8th August and 12th September 2017 are still outstanding as at end of November 2019.  Items coded 49 are supposed to be cancelled immediately but in this case the items were delayed without any reason.   

there is a risk that the 
account 
CST for any further bespoke reports that are required from Integra.  
balances 
might 

## Debt Recovery

| be                          | misleading    |
|-----------------------------|---------------|
|                             |               |
| d) Henceforth, the Premises |               |
| resulting                   | in            |
| overstated                  |               |
| income                      | which         |

The Premises Licensing and Gambling team stated they have no access to run the report that will enable them to obtain the necessary information required to act promptly against a licensing payments defaulter. The AR team provided evidence of the reports that they provide the PGR team with 
('PRL DEBT' report and 'PRL debts MH').  

Licensing and Gambling team will be routinely providing authorisation for the AR team to take recovery action against unpaid invoices when the premises ceased trading.  
would be reported by the council's external auditor. 

e) The Premises Licensing and 

 

Our discussion with the Team Leader (Licensing & Anti-Social Behaviour) confirmed their view that the reports received are not sufficient and the team is not configured to produce reports on Integra to enable it to effectively monitor its clients.  

 

Gambling team will explore the possibility of setting up direct debits for all its clients/customers to improve the council's income. 

 

f) The AR team will provide a direct 

 

Additionally, we noted that permission to take recovery action made by the AR for unpaid invoices where premises has ceased trading were not authorised by the Premises Licensing and Gambling Team (as the PLG team claimed they were unaware that authorisation is required) making it impossible for AR to pass the bad debt over for debt recovery and collection action.  

debit form with the correct address. 
 

## Direct Debits

 
 
g) The Premises Licensing and 
It is noted that updating customers' payment method to Direct Debit (DD)might reduce the debts and make it easier for the team to monitor payments effectively. The PLG team stated that their last attempt to update the customers' payment system to the direct debit method was not possible as the form provided by the AR team for the update carried the wrong 

Gambling team bad debts will be 
processed for approval in 
accordance with the Council's 
Financial Regulations.  The team 

 
| Ref                                                                       |
|---------------------------------------------------------------------------|
| Risk                                                                      |
| category                                                                  |
| Agreed action                                                             |
|                                                                           |
| will verify the required approval                                         |
| limits and comply with these.                                             |
| address (it carries the North London Business Park address instead of the |
| team's Colindale address).                                                |
 

## Write-Off

Responsible officer: 

Our review established that Premises Licensing and Gambling team wrote off bad debts annually with approval from the Commercial Premises Manager only. They were unaware of any other need for approval, as required by the Council's Financial Regulations. The team stated that the Commercial Premises Manager meets periodically with the AR team who had not provided any other process for the team to follow. However, the Financial Regulations form part of the Council's constitution which partners are required to comply with. The review confirmed that credit notes were raised to cancel outstanding invoices (effectively write-off bad debts). This method by-passes the process and controls put in place by management. 

 

## Note: Please Also Refer To Finding 1, Invoices Procedure - Invoices Produced On Spreadsheet And Its Associated Action Which Should Be Taken Forward By The Plg Team:

All manually loaded spreadsheets must include documented approval by an appropriate authorised person to evidence that the spreadsheet has been independently checked for accuracy, in line with the Financial Regulations requirement that separation of duties 
must be in place for all financial transactions.   
If there are no 
source documents 
for 
invoices 
issued 

5 
Education Welfare Accounts - Cambridge Education Ten invoices were randomly selected for our testing from the education penalty charges issued in the current financial year by the Education team. The invoices were issued to parents/guardians for unauthorised absenteeism from school. 

The testing established that: 

that the address on the invoices is changed to its current location from NLBP in accordance with the 
London Borough of Barnet Income Collection and Debt Management Guidance. 
then there is a 
risk that invoice disputes will be 
|                      |         |       |
|----------------------|---------|-------|
| Ref                  | Finding | Risks |
| Risk                 |         |       |
| category             |         |       |
| Agreed action        |         |       |
|                      |         |       |
|                      |         |       |
|                      |         |       |
|                      |         |       |
| difficult to resolve |         |       |
| and inconsistent     |         |       |
| practices            | might   |       |

- 
Three out of ten had no source document. Discussion with the officer indicated that the documents might have been shredded by the 
Education Welfare Manager. 

 
b) The Education team will ask 
be 
going 

- All the ten invoices tested had the team's old address of North London 

| schools                                                                 |
|-------------------------------------------------------------------------|
|                                                                         |
| undetected in the                                                       |
| system.                                                                 |
|                                                                         |
|                                                                         |
|                                                                         |
|                                                                         |
|                                                                         |
|                                                                         |
| documents/forms to the team and                                         |
| the scanned copies will be kept                                         |
| electronically until the end of the                                     |
| financial year when bad debts will                                      |
| be written off and forms erased.                                        |
|                                                                         |
| Business Park, Oakleigh Road South, N11 1NP whereas the team is         |
| currently located in Colindale. This is contrary to the information on  |
| page 5 of the London Borough of Barnet Income Collection and Debt       |
| Management Guidance which states "All invoices will be raised within    |
| 2 days of service delivery……, and will include clear, relevant and full |
| information as to: how to contact the Council if there is a query in    |
| relation to the invoice or in relation to making payment".              |
|                                                                         |
|                                                                         |
|                                                                         |
|                                                                         |
|                                                                         |
| c) Going forward, Education Account                                     |
|                                                                         |
|                                                                         |
|                                                                         |
|                                                                         |
|                                                                         |

Team's credits, bad debts and 
doubtful debts will be processed for 
approval in accordance with the Council's 
Financial 
Regulations 

 

 
Write-Off  
Our testing established that the Education Accounts team wrote off debts annually with the authorisation of the Education Welfare Team Manager only. The review confirmed that credit notes for a total sum of £41,400 were raised to cancel outstanding invoices and debts at the end of the last financial year without the list of write-offs subsequently being signed off formally by the head of service. A proportion of this debt related to credits raised for prompt payment by parents within 21 days as stated under the terms of the invoice. Both these prompt payment credits and other bad debt write offs require management approval. 

 

(Fin Reg).  The Team will verify the approval limits and comply with the provision of the Fin Reg. If an exception to the Fin Reg is required, this will be documented and 
approved 
by 
senior 


management and the Director of Finance.  

If 
credits, 
bad 
debts 
and 
Responsible officer: 

Note: Please also refer to Finding 1, Invoices Procedure - Invoices produced on Spreadsheet and its associated action which should be taken forward by the Education team: 

doubtful debts are processed without approval in 
accordance 
with the financial regulation 
provisions 
then 

All manually loaded spreadsheets must include documented approval by an appropriate authorised person to evidence that the spreadsheet has been independently checked for accuracy, in line with the Financial Regulations requirement that separation of duties must be in place for all financial transactions.   
there is a risk of 

|      |         |       |
|------|---------|-------|
| Ref  | Finding | Risks |
| Risk |         |       |

## 6 Document Centre And Mailroom - Csg

Our review/observation of the invoice production, compilation and postage process by the Document Centre & Mail team established that there are two levels of security to enable the two members of staff involved to print the invoices. The first level consists of ID and password and the second level is an access code. These two levels of security are supposed to be independent and distinct to ensure effective control and an efficient audit trail so that it is clear who printed the invoices. Our testing established that: 

- The first level of security for the two members of staff is satisfactory, 
each of them have distinct IDs and passwords; however: 
- the second level of security/control is unsatisfactory as the two staff 
members share one code instead of having distinct access. 

It is therefore not currently possible to confirm who has printed which invoices. The Document Centre and Mailroom Manager informed us that the CST- Helpdesk and Assistant Finance Manager (AR) have been informed of the problem but are yet to update the process. 

## 7 Family Services Finance Team (Overpayments)

The testing of the invoicing process by the Family Services (FS) Finance Team (Overpayments) is satisfactory.  

However, we observed that most of the bad debts that occurred in this area were due to a delay in accessing necessary information on the Integra finance system. The FS Finance Team is unable to produce aged debt reports from Integra to confirm outstanding invoices and chase these before they become doubtful or bad debts. 

category 
Agreed action 
misappropriation 
and fraud. 
a) The 
Document 
centre 
and 
Medium 
mailroom team will liaise with the CST-Helpdesk to ensure that the second level of printing security is separated 
between 
the 
two 
If adequate first 
level and second level of printing security is not put in 
place 
then, 
Document Centre & Mail team staff members responsible for printing. 
Responsible officer: 
Document Centre and Mailroom Manager 
there is a risk that the audit trail may not be clear and 
distinct in case of 
investigation. 
Target date: 31st March 2020 
 
a) The Family Services Finance 

Team (Overpayments) will liaise 
with the AR team and CST to 
ensure they are given Integra 
access that will enable it to run 
aged debt reports. This will allow 
greater visibility of status of the 
debts and will enable the FS 
Finance Team to share information 
with the AR team where possible 

## Ref Finding Risks Risk Category Agreed Action

The FS Finance Team (overpayment) currently receives information on nonpaying clients after the debt has become doubtful or bad.  
to reduce the risk of debts becoming bad. 

## Responsible Officer:

Finance Manager (Family Services) 
and ineffectiveness leading to loss of income to the council. 

Target date: 31st March 2020 
 
Whilst it is not the responsibility of the FS Finance Team to chase debts, having access to an aged debt Integra report would give them visibility of the status of outstanding debts and would allow them to share information with the Accounts Receivable (AR) team where possible to reduce the risk of debts becoming bad. 

 

## Appendix 1: Definition Of Risk Categories And Assurance Levels In The Executive Summary

Note: the criteria should be treated as examples, not an exhaustive list. There may be other considerations based on context and auditor judgement.  

## Risk Rating

Critical 

Immediate and significant action required. A finding that could cause: - 
Life threatening or multiple serious injuries or prolonged work place stress. Severe impact on morale & service performance (e.g. mass strike actions); or 
 
 
- 
Critical impact on the reputation or brand of the organisation which could threaten its future viability. Intense political and media scrutiny (i.e. front-page headlines, TV). Possible criminal or high profile civil action against the Council, members or officers; or 
- 
Cessation of core activities, strategies not consistent with government's agenda, trends show service is degraded.  Failure of major projects, elected Members & Senior Directors are required to intervene; or 
- 
Major financial loss, significant, material increase on project budget/cost. Statutory intervention triggered. Impact the whole Council. Critical breach in laws and regulations 
that could result in material fines or consequences. 

High 

Action required promptly and to commence as soon as practicable where significant changes are necessary. A finding that could cause: - 
Serious injuries or stressful experience requiring medical many workdays lost. Major impact on morale & performance of staff; or 
 
 
- 
Significant impact on the reputation or brand of the organisation. Scrutiny required by external agencies, inspectorates, regulators etc. Unfavourable external media coverage. Noticeable impact on public opinion; or 
- 
Significant disruption of core activities. Key targets missed, some services compromised. Management action required to overcome medium-term difficulties; or 
- 
High financial loss, significant increase on project budget/cost. Service budgets exceeded. Significant breach in laws and regulations resulting in significant fines and consequences. 

Medium 

A finding that could cause: - 
Injuries or stress level requiring some medical treatment, potentially some workdays lost. Some impact on morale & performance of staff; or 
 
 
- 
Moderate impact on the reputation or brand of the organisation. Scrutiny required by internal committees or internal audit to prevent escalation. Probable limited unfavourable media coverage; or 
- 
Significant short-term disruption of non-core activities. Standing orders occasionally not complied with, or services do not fully meet needs. Service action will be required; or 
- 
Medium financial loss, small increase on project budget/cost. Handled within the team. Moderate breach in laws and regulations resulting in fines and consequences. 

A finding that could cause: 
Low 
- 
Minor injuries or stress with no workdays lost or minimal medical treatment, no impact on staff morale; or 
 
- 
Minor impact on the reputation of the organisation; or 
 
- 
Minor errors in systems/operations or processes requiring action or minor delay without impact on overall schedule; or 
- 
Handled within normal day to day routines; or 
- 
Minimal financial loss, minimal effect on project budget/cost. 

## Level Of Assurance

Substantial 
There is a sound control environment with risks to key service objectives being reasonably managed. Any deficiencies identified are not cause for major concern. Recommendations will normally only be Advice and Best Practice. 
 
 
Reasonable 
 
An adequate control framework is in place but there are weaknesses which may put some service objectives at risk. There are Medium priority recommendations indicating weaknesses but these do not undermine the system's overall integrity. Any Critical recommendation will prevent this assessment, and any High recommendations would need to be mitigated by significant strengths elsewhere. 
 
Limited 
There are a number of significant control weaknesses which could put the achievement of key service objectives at risk and result in error, fraud, loss or reputational damage. There are High recommendations indicating significant failings. Any Critical recommendations would need to be mitigated by significant strengths elsewhere. 
 
No 
 
There are fundamental weaknesses in the control environment which jeopardise the achievement of key service objectives and could lead to significant risk of error, fraud, loss or 
reputational damage being suffered. 
 

## Appendix 2 - Analysis Of Findings

| Critical                | High    | Medium    | Low    | Total    |
|-------------------------|---------|-----------|--------|----------|
| Area                    |         |           |        |          |
| D                       | OE      | D         | OE     | D        |
| Process and procedure   |         |           |        |          |
|                         |         |           |        |          |
| -                       | -       | 1         | -      | 1        |
| 2                       |         |           |        |          |
| Invoicing process       |         |           |        |          |
| -                       | -       | -         | -      | -        |
| 5                       |         |           |        |          |
| Reconciliation process  |         |           |        |          |
| -                       | -       | -         | -      | -        |
| -                       |         |           |        |          |
| Access data restriction |         |           |        |          |
| -                       | -       | -         | -      | -        |
| 1                       |         |           |        |          |
| Follow up               |         |           |        |          |
| -                       | -       | -         | -      | -        |
| -                       |         |           |        |          |
| Total                   | -       | -         | 1      | -        |
|                         |         |           |        |          |
| Key:                    |         |           |        |          |

- 
Control Design Issue (D) - There is no control in place or the design of the control in place is not sufficient to mitigate the potential risks in this area. 
- 
Operating Effectiveness Issue (OE) - Control design is adequate; however, the control is not operating as intended resulting in potential risks arising in this area. 

 
Timetable Terms of reference agreed:  
Fieldwork commenced: 
Fieldwork completed: 
Draft report issued: 
Management comments received: 
Final report issued: 
Date 
Date 
Date 
Date 
Date 
Date 
23rd September 2019 
30th Sept 2019 
2-14th January 2020 
14th November 2019 
30th December 2019 
17th January 2020 

## Appendix 3 - Identified Controls

| Area                                                                | Objective     | Risks      | Identified Controls    |
|---------------------------------------------------------------------|---------------|------------|------------------------|
| Documented invoice process procedure in place.                      |               |            |                        |
| Process and                                                         |               |            |                        |
| Procedure                                                           |               |            |                        |
| Procedure available in electronic and hard copies.                  |               |            |                        |
|                                                                     |               |            |                        |
| There are adequate invoicing                                        |               |            |                        |
| processes and procedures in                                         |               |            |                        |
| place and they operate                                              |               |            |                        |
| effectively.                                                        |               |            |                        |
|                                                                     |               |            |                        |
|                                                                     |               |            |                        |
| Staff are aware of their role in                                    |               |            |                        |
| the invoice production process,                                     |               |            |                        |
| and perform their tasks                                             |               |            |                        |
| appropriately.                                                      |               |            |                        |
|                                                                     |               |            |                        |
| Procedure accessible to all members of staff involved in invoice    |               |            |                        |
| processing.                                                         |               |            |                        |
|                                                                     |               |            |                        |
| Procedure is reviewed and revised periodically.                     |               |            |                        |
|                                                                     |               |            |                        |
| Roles responsibilities and separation of duties information is well |               |            |                        |
| documented.                                                         |               |            |                        |
|                                                                     |               |            |                        |
| Next review date is documented on the procedure.                    |               |            |                        |
|                                                                     |               |            |                        |
| If                                                                  |               |            |                        |
| the current process is not                                          |               |            |                        |
| documented and approved,                                            |               |            |                        |
| there is a risk that inconsistent                                   |               |            |                        |
| practices may go undetected                                         |               |            |                        |
| and customers might not be                                          |               |            |                        |
| invoiced.                                                           |               |            |                        |
|                                                                     |               |            |                        |
| If                                                                  |               |            |                        |
| the procedures and the                                              |               |            |                        |
| process are not revised and                                         |               |            |                        |
| updated regularly, there is a                                       |               |            |                        |
| risk that the system may not                                        |               |            |                        |
| include adequate separation                                         |               |            |                        |
| of duties to reduce risk of                                         |               |            |                        |
| fraud or collusion.                                                 |               |            |                        |
|                                                                     |               |            |                        |
| If                                                                  |               |            |                        |
| the process and procedures                                          |               |            |                        |
| are not updated regularly, they                                     |               |            |                        |
| may                                                                 | not           | enable     | staff                  |
| understand their tasks or to                                        |               |            |                        |
| avoid overlapping tasks or                                          |               |            |                        |
| confusion.                                                          |               |            |                        |
|                                                                     |               |            |                        |
| Invoicing                                                           |               |            |                        |
| Process                                                             |               |            |                        |
| There are adequate controls in                                      |               |            |                        |
| place to ensure that the invoices                                   |               |            |                        |
| are                                                                 | produced      | correctly, |                        |
|                                                                     |               |            |                        |
| accurately and on time.                                             |               |            |                        |
| If                                                                  |               |            |                        |
| there is no documented                                              |               |            |                        |
| invoicing process in place,                                         |               |            |                        |
| there is a risk that income will                                    |               |            |                        |
| not be collected on a timely                                        |               |            |                        |
| basis leading to cash flow                                          |               |            |                        |
| problems.                                                           |               |            |                        |
| Staff assigned to check                                             |               |            |                        |
| arithmetical and other                                              |               |            |                        |
| accuracies of invoices are                                          |               |            |                        |
| aware of their responsibilities.                                    |               |            |                        |
| If                                                                  |               |            |                        |
| the invoice production                                              |               |            |                        |
| process is not monitored and                                        |               |            |                        |
| checked regularly, the                                              |               |            |                        |
| invoices might not be raised in                                     |               |            |                        |
| Documented and approved invoicing procedure is in place.            |               |            |                        |
|                                                                     |               |            |                        |
| Annual updates are carried out on electronic invoicing system.      |               |            |                        |
|                                                                     |               |            |                        |
| Test runs are carried out on the update to ensure that its accurate |               |            |                        |
| and such update should be signed off.                               |               |            |                        |
|                                                                     |               |            |                        |
| There is segregation of duties in place and an individual officer   |               |            |                        |
| cannot start and complete invoicing process.                        |               |            |                        |
|                                                                     |               |            |                        |
| Senior member of staff is delegated to check the accuracy of the    |               |            |                        |
| invoicing system and ensure that the content is correct.            |               |            |                        |
time or may be forgotten 
leading to loss of income. 
 
Checks are in place to ensure that mistakes are detected before its goes out of the council. 
If staff are not assigned to 
check the invoicing production 
process for accuracy, there is a risk that the inputting officer may not raise the invoices correctly or accurately or there may be errors or omissions in amounts invoiced. 
Reconciliation Process 
The suspense and unidentified accounts are monitored regularly and income moved appropriately or in to the correct accounts. 
If suspense and unidentified 
accounts are not reconciled regularly, there is risk of loss of income, fraud or misappropriated funds. 
If suspense accounts are not 
regularly reconciled and monitored, the council might be unable to trace or identify payees of income; 
There is segregation of duties between staff reviewing the suspense and unidentified accounts and staff given approval for movement of income to the appropriate accounts/codes. Reconciliations are performed on a regular basis between Accounts Receivable (AR) and the General Ledger (GL) to ensure mistakes and errors are detected on a timely basis. 
If income/payments are left in 
the suspense/unidentified accounts longer than necessary, there is a risk of having complaints from customers leading to bad publicity/image for the Council. 
Suspense accounts containing unidentified income or payments are monitored and reconciled weekly. Payments in the suspense account should be investigated and funds transferred to its appropriate code. There is a limit to numbers of days funds/payments could stay in the suspense account. Age analysis of suspense accounts items are produced on a monthly basis to determine if none of the items are over required limit. There is process in place for movement of funds in and out of the suspense account. Approvals are required for funds to be moved out of the suspense account. Monthly or weekly reconciliation in place and are checked and authorised by senior officers. 
If movements in and out of 
suspense/unidentified accounts are not monitored and approved, there is a risk of wrong accounts being 
debited in error or intentionally 
for fraudulent purposes; 
If reconciliation between AR 
and the GL is not carried out 
regularly, there is a risk that mistakes and errors will not be detected. 
Access Data Restriction 
There are controls in place to restrict access to data to prevent fraud and misappropriation of funds. 
 
Access to the invoicing system is restricted by ID and password. There is process in place to report leavers promptly to ensure deactivation of ID and password Audit trail of activities conducted by individual on the system should be retrievable in case of fraud investigation. 
There is sufficient audit trail in place 
to 
maintain 
and 
If access to the invoicing 
system is not restricted and leavers are not deleted on a timely basis, there is a risk that the undeleted access could be used to perpetrate fraud. 
demonstrate 
review 
and 
approval of invoices prior to production. 
If access to the invoicing 
system is not restricted and is being access by leavers, there is risk that the invoice history/audit trails might be untraceable, removed or eliminated to cover frauds and misappropriation. 
If there is an insufficient audit 
trail 
to 
maintain 
and 
demonstrate 
review 
and 
approval of invoices prior to production, there is a risk of lack of accountability which could lead to reputational 
damage. 

## Follow-Up Of Previous Audit Recommendations 2018-19 Accounts Receivable - Debt Management And Collection

| Ref                                                       | Finding     | Risks    |
|-----------------------------------------------------------|-------------|----------|
| Agreed action                                             |             |          |
| Debt                                                      | collection  |          |
| agencies are not                                          |             |          |
| engaged                                                   | in          | a        |
| timely                                                    | manner,     |          |
| AR3                                                       |             |          |
| Third Party Debt Collections                              |             |          |
| A sample of 25 instances of debts collected by third      |             |          |
| parties for the period 01/04/2018 - 31/10/2018 (per the   |             |          |
| Council's accounts receivable listing) was reviewed. Our  |             |          |
| audit noted:                                              |             |          |
| -                                                         |             |          |
| 1 / 25 instances where the Council has not performed      |             |          |
| leading to debts                                          |             |          |
| which might have                                          |             |          |
| been recoverable                                          |             |          |
| becoming                                                  |             |          |
| unrecoverable.                                            |             |          |
|                                                           |             |          |
| follow up procedures (or consulted with the Council's     |             |          |
| legal team) to seek recovery of a debt since December     |             |          |
| 2017, when initial recovery attempts were made by the     |             |          |
| Councils bailiff service at the time and the Council.     |             |          |
| The value of the debt was £1,641.                         |             |          |
| During the course of our testing we also noted that there |             |          |
| was not a valid current contract in place between this    |             |          |
| bailiff and CSG Finance.                                  |             |          |
|                                                           |             |          |
| Internal                |
|-------------------------|
| Medium                  |
| Agreed Actions:         |
| 1.                      |
| Ensure that the         |
| Assessment              |
| December 2019           |
| In Progress             |
| Reasonable progress     |
| has been made.          |
| lack of valid current   |
| contract with this      |
| bailiff is addressed    |
| and that the            |
| Council's Contract      |
| Procedure Rules are     |
| adhered to.             |
| 2.                      |
| Communicate             |
| The responsible officer |
| reported progress as    |
| follows:                |
|                         |
| Contract in place but   |
| not signed. High level  |
| consultation is         |
| expected to take place  |
| between Finance and     |
| Legal services to       |
| resolve some issues     |
| before final            |
| implementation.         |
|                         |
| and reinforce the       |
| requirements for third  |
| party debt collection,  |
| including where initial |
| recovery attempts       |
| made by the bailiff     |
| and the Council are     |
| not successful, to      |
| ensure that follow up   |
| procedures are          |
| performed, or the       |
| debt is written off if  |
| required.               |
| Responsible Officer:    |
|                         |
| Head of Finance         |
| (                       |
| Exchequer)              |
| Ref                                           | Finding     | Risks    |
|-----------------------------------------------|-------------|----------|
| Agreed action                                 |             |          |
| Where                                         | budget      |          |
| AR2                                           |             |          |
| Aged debt monitoring                          |             |          |
| Our audit noted:                              |             |          |
| managers do not                               |             |          |
| have                                          | sufficient  |          |
| -                                             |             |          |
| A sample of service managers advised that the |             |          |
| details of aged debt                          |             |          |
| and                                           | formal      |          |
| requirements                                  | for         |          |
| follow                                        | up          | and      |

monthly aged debt report is high level only, and is insufficiently detailed for effective review of aged debt. As such, it is used for summary purposes only rather than detailed debt monitoring; 

- Whilst departmental budget managers are expected to 

monitor and recover aged debt, there is no formal requirement for any actions to be taken by departmental budget managers upon receipt of the monthly aged debt report (i.e. to evidence that debt monitoring and appropriate follow up procedures have 
been completed); and 

recovery procedures are not in place, there is an increased risk that staff may not have enough oversight of 
aged debt in their service 
area. 
Further, 
debt 
- The 'Aged Debt Report' at February 2019 showed the 

sum of aged debt older than one month was £18.3m, of which £3.6m was older than two years. 

monitoring may not be carried out in a way 
that 
allows 
targeted collection of debt and early identification 
of 
issues 
with 
particular debtors, leading to financial 
loss for the Council. 
| Internal                | Audit     |
|-------------------------|-----------|
| Medium                  |           |
| Agreed Actions:         |           |
| Management will:        |           |
| Assessment              |           |
| December 2019           |           |
| 1.                      |           |
| Review the monthly      |           |
| Implemented             |           |
| The response from the   |           |
| responsible officer and |           |
| our review confirmed    |           |
| that:                   |           |
| In addition to a high   |           |
| level summary report    |           |
| being                   | produced  |
| aged debt reporting     |           |
| process. In             |           |
| conjunction with        |           |
| departmental budget     |           |
| managers, update        |           |
| and amend the           |           |
| format of the aged      |           |
| debt report to ensure   |           |
| that it is sufficiently |           |
| detailed to allow       |           |
| service areas to        |           |
| conduct effective       |           |
| review and follow up    |           |
| of aged debt            |           |
| balances.               |           |
| 2.                      |           |
| Develop and             |           |
| details of all invoices |           |
| are attached to the     |           |
| report.  One can drill  |           |
| down to a specific      |           |
| invoice by clicking on  |           |
| each                    | service   |
| debt.                   |           |
|                         |           |
| The main service areas  |           |
| such                    | as        |
| property                | services, |
| commercial              | waste,    |
| licencing, print room   |           |
| etc.                    | receive   |

implement a process to ensure that departmental budget managers have completed debt monitoring and follow up procedures. This may include responding to the monthly aged debt report with details of follow up procedures undertaken and (where required), weekly/monthly report which details only their specific service area 

| Ref                     | Finding     | Risks     |
|-------------------------|-------------|-----------|
| Agreed action           |             |           |
| actions to be taken to  |             |           |
| recover aged debt.      |             |           |
| and status of invoices  |             |           |
| and debts.              |             |           |
| 3.                      |             |           |
| Review existing         |             |           |
|                         |             |           |
| The                     | Integra     |           |
| development             | team        |           |
| report                  | has         | been      |
| improved and detail of  |             |           |
| the debt by cost centre |             |           |
| is now available to     |             |           |
| assist                  | each        | service   |
| aged debt balances      |             |           |
| to establish whether    |             |           |
| further debt recovery   |             |           |
| processes can be        |             |           |
| carried out, or         |             |           |
| whether write off of    |             |           |
| debt is required        |             |           |
| (particularly for debt  |             |           |
| which is older than     |             |           |
| two years).             |             |           |
| area / budget manager   |             |           |
| to                      | ensure      | effective |
| monitoring              | of          | their     |
| Responsible Officer:    |             |           |
|                         |             |           |
| Head of Finance         |             |           |
| (                       |             |           |
| Exchequer)              |             |           |
| debts.                  |             |           |
|                         |             |           |
|                         |             |           |

## Appendix 5– Internal Audit Roles And Responsibilities

Limitations inherent to the internal auditor's work We have undertaken the review of *Account Receivable Audit*, subject to the limitations outlined below. 

## Internal Control

Internal control systems, no matter how well designed and operated, are affected by inherent limitations. These include the possibility of poor judgment in decision-making, human error, control processes being deliberately circumvented by employees and others, management overriding controls and the occurrence of unforeseeable circumstances. Specifically, we will not:  

- 
be focusing on controls in place for debt management which has been carried out in 2018/19 audit 

## Future Periods

Our assessment of controls is for the period specified only.  Historic evaluation of effectiveness is not relevant to future periods due to the risk that: 

- 
the design of controls may become inadequate because of changes in operating environment, law, regulation or other; or 
- 
the degree of compliance with policies and procedures may deteriorate. 
Responsibilities of management and internal auditors It is management's responsibility to develop and maintain sound systems of risk management, internal control and governance and for the prevention and detection of irregularities and fraud. Internal audit work should not be seen as a substitute for management's responsibilities for the design and operation of these systems. We endeavour to plan our work so that we have a reasonable expectation of detecting significant control weaknesses and, if detected, we shall carry out additional work directed towards identification of consequent fraud or other irregularities. However, internal audit procedures alone, even when carried out with due professional care, do not guarantee that fraud will be detected. Accordingly, our examinations as internal auditors should not be relied upon solely to disclose fraud, defalcations or other irregularities which may exist.