## Final Internal Audit Report

# Banking And Payment Arrangements - Accounts Payable (Ap) October 2019

 
 
To:  
Director of Finance, LBB Acting Head of Finance - Projects, LBB Finance Director, CSG 
Accounts Payable Manager, Accounts Payable, CSG CSG/LBB AP Business Partner  
 
Copied to:  
Deputy Director of Finance, LBB Assistant Director of Finance, LBB Accounts Payable Senior Manager, CSG Accounts Payable Team Leader, Accounts Payable, CSG Operations Director, CSG Head of Performance and Risk Management, CSG 


From:  
Head of Internal Audit LBB  
 
We would like to thank management and staff of the Accounts Payable team for their time and co-operation during the course of the internal audit. 

## Contents Executive Summary 1. Progress Against Relevant Actions From Grant Thornton'S 'Review Of The Financial Management Relating To Cpo Fraud' (Page 6) 2. Accounts Payable Audit - Findings, Risks And Action Plan (Page 16) 3. Appendix 5: Follow-Up Of Past Audits - Accounts Payable 2017-18 (Page 39) 4. Appendix 6.1: Outcome Of Detailed Testing From Payments Data Analytics And Matching Exercises' Reported In February 2019 (Page 43) 5. Appendix 6.2 Observations From Payments Data Analytics And Matching Exercises' Reported In February 2019. (Page 54)


## Executive Summary

|                   |      |        | Assurance level     | Number of recommendations by risk category     |
|-------------------|------|--------|---------------------|------------------------------------------------|
| Critical          | High | Medium | Low                 | Advisory                                       |
| Limited Assurance |      |        |                     |                                                |
| -                 | 2    | 4      | 1                   | -                                              |

## Scope

This review was undertaken as part of the 2018-19 Internal Audit and Anti-Fraud Strategy and Annual Plan approved by the Council's Audit Committee on 19 April 2018. The Council's Accounts Payable function is run by the Customer Support Group (CSG), a Capita function based in Chichester on behalf of the Council. This review identified the key controls over payments made by the Council (outside of the Treasury team) and tested the operation of processes to give assurance on the effectiveness of those controls. See Part 2 of this report for the outcome of the testing of key Accounts Payable controls. In December 2017, it came to light that potentially fraudulent transactions of *ca.* £2m had been made against the Council. An investigation was opened by the Council's Corporate Anti-Fraud Team (CAFT) and it was found that the transactions related to Compulsory Purchase Orders (CPOs). As a result of the alleged fraud the Chief Financial Officer (CFO) commissioned Grant Thornton (GT) UK LLP to undertake a review of the governance and financial control environment surrounding regeneration projects. In total, 32 recommendations were raised to enhance the financial control environment at the Council. As part of this audit we sought to verify that actions related to Accounts Payable from the Grant Thornton 'Review of the Financial Management Relating to CPO Fraud' have been completed and associated processes are now being complied with. The outcome of this testing is contained within Part 1 of this report. The review also incorporated the outcome of the separate 'Payments Data Analytics and Matching Exercises' reported in February 2019. This included an assessment of whether any further fraudulent payments had been made - to date no further fraudulent payments were found. See Appendix 6 of this report. Finally, we also followed up audit actions from previous audits in this area. See Appendix 5 of this report. Due to the far-reaching nature of this review, incorporating the response to the GT action plan, the fieldwork has been undertaken over an extended period from September 2018 to July 2019. 

## Summary Of Findings 1. Grant Thornton Review - Outstanding Actions, Gt15 And Gt16, Relevant To Ap Gt15

GT Recommendation: We recommend that the BACS process be reviewed for the adequacy of controls over new suppliers where there is no purchase order (such as E-form payments). Implemented For GT15, segregation of duties is now embedded in non-PO payments as follows: 

- 
API E-Form payments authorised by budget manager and independent payment checks (AP) for non-PO (purchase order) OTV (One Time Vendor) and non-PO, non-OTV payments;  
- 
supplier creation / supplier change requests (Service), related independent checks (AP) and related creation/change (CST, IT Integra Support Team) in Integra; 
- 
the separate authorisation of non-API non-PO payments; and 
- 
the provision of adequate supporting documentation for all non-PO payments. 
 Non-PO API payments are now governed by fit for purpose documented procedures which have been implemented. An API Exemption list has also been completed defining the types of payment and documentation that are exempt from the standard PO route. 

GT 16  
 
GT Recommendation: The Masterfile supporting the BACS payment process does not automatically identify and flag payments made to different suppliers/recipients that had the same bank account number. 

Implemented For GT16, the New Supplier and Supplier Amendment Process which has been implemented will: 

- 
mitigate the risk of fraudulent changes to bank details in the manner perpetrated in the recent fraud; and 
- 
mitigate the risk of the creation of fraudulent suppliers with the same bank account. 
 The creation of new suppliers and changes to vendor bank details are now done by E-Form, the process is segregated and is subject to independent checks by AP prior to update in the system by ICT. 

## 2. Accounts Payable Audit

This audit has identified 2 high, 4 medium and 1 low risk rated finding relating to the control design and operating effectiveness of the controls in place over Accounts Payable as follows:  

- 
Authorisation of Purchase Orders (POs) (High): We found that there was no reporting and review process for dual authorisation of purchase 
orders above £1m as required by the "Dual Authorisation for Payments over £1million Process Note V1.0". For 2/15 purchase orders tested, the related dual authorisation of the purchase orders above £1m was not attached in Integra as required.  
- 
Manual upload process (High): Payments, recently to the value of £101m annually, are made though Integra using a manual upload process 
defined in a process document "Manual Upload BACS Payments Process V1.0". The related process document is not clear as to the type of payments which may be made through the manual upload process and the schedule of manual payment authorisers, referred to in the document, 
was out of date as it referred to officers who had left the Council/Capita.  
- 
Duplicate payments (Medium): Arrangements to identify potential duplicate payments (non-PO and PO) using software, AP Forensics, searching 
by payment parameters such as value and payee name were in progress, however had not been implemented despite discussions being ongoing since 2018. There was evidence of an existing process being possible identifying duplicate payments, however this had only been run once pending implementation of the new software.     
- 
Missing supplier invoice (Medium): In 1/10 (10%) instances of our testing of standard PO payments, the invoice was not attached in Integra 
when the audit test was done. The invoice was subsequently found to be attached in Integra however only on 26 June 2019, a significant period 
after it was cleared 5/12/2018 for payment in Integra. We would have expected AP to reject a payment without a supporting invoice. 
- 
AP training and development (Medium): CSG Management indicated that a programme of training and development existed for the CSG AP 
team. The programme involved AP officers completing a training needs assessment in which they recorded their understanding of various related procedure documents. Gaps noted in what they recorded, as compared to the content and purpose of the document, informed their training. We do not have an issue on the design of the process. However, evidence of its operation had been requested by Internal Audit but had not been provided for our review. We can therefore not provide assurance over the effective operation of the control. 
- 
AP documented procedures (Medium): We reviewed 14 Intranet procedures relevant to AP processing, findings as follows: 
- 10/14 documents were out of date and had not been reviewed or updated in more than two years. - 4/14 documents had been updated in the course of 2018, but contained information which was out of date around the escalation route for AP Other issues and the current supplier request process. 

 
Other key documents such as the "New Supplier and Supplier Amendment Process V1.0 (16/8/2018)" Appendix 4: "Budget Managers and 
 
Superiors" was out of date, for example, it included officers who had left the Council.   
- 
BACS reconciliation (Low): Evidence of the daily BACS payment review processes was provided. However, although the process involved the 
review of payments over £35k and the Listing of BACS payments report was retained for referral, it was not clear how the process, by its design, could mitigate the risk of a fraudulent change(s)/alteration(s) to the BACS file after approval, the specific risk referred to in the agreed terms of reference for the audit. 

## 3. Follow-Up Of Previous Audit Actions, Refer To Appendix 5 For Detailed Findings

We followed up three recommendations made in the Accounts Payable 2017-18 audit. All actions were considered implemented/completed by 31 March 
2019. 

## 4. 'Payments Data Analytics And Matching Exercises' (Pdame) Reported In February 2019, Refer To Appendix 6 For Detailed Findings

At Audit Committee 22 November 2018 Members raised a query after the GT report was presented about the possibility of other fraudulent payments in Integra i.e. the possibility of similar financial failings occurring in other Services across the council. This prompted internal audit to undertake a data analytics and matching exercise for the LBB Payments Account which involved the identification of matches, for example payments to one vendor but to different bank accounts (such as in the recent fraud), which could relate to potentially fraudulent transactions in a financial environment where controls were weak. Where matches warranted further investigation in terms of being potentially fraudulent or where they highlighted poor data quality for vendor master data, they were referred to CAFT and AP for further review. A summary of the findings relating to the data matches, referred matches and review findings are set out in Appendix 6.1. The PDAME identified 11 datasets. Work has been completed with no issues on 5/11 datasets, with work ongoing and approaching completion on 6/11 datasets. The data matches identified seven bank accounts that had received fraudulent payments; these were already known to CAFT as part of an ongoing fraud investigation. No further transactions reviewed to date have been found to be fraudulent. 

## 

The Data Analytics review also raised a number of Observations to be considered which are included within this report at Appendix 6.2. It has been agreed that the AP Finance Business Partner  will review the observations as a basis for implementing changes in Integra, in current or future versions/updates based on a risk/cost/benefit analysis.  

## 1. Progress Against Relevant Actions From Grant Thornton'S 'Review Of The Financial Management Relating To Cpo Fraud'

GT Ref 
Recommendatio n 
Recommendation detail 
Priority 
Action 
Status reported to Audit Committee 
22nd November 
2018 
GT15 
BACS Process for new suppliers 
High, immediate 
We recommend that the BACS process be reviewed for the adequacy of controls over new suppliers where there is no purchase order 
(such as E-form payments). 
CSG to review process for onetime vendors, propose improve ments 
and impleme nt. 
The process has been submitted and verified, however it has not been possible to test the operating effectiveness of this control, as the control design was 
not finalised in the testing period. Further testing is required 
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July 
(GT15) 2019 
Not Implemented 
This action is currently rated as Not Implemented due to no assurance having yet been obtained over the operating effectiveness of the associated controls in place. Transaction listings were requested from Accounts Payable to allow 
Internal Audit to verify the operating effectiveness of new controls in place for one time vendors, however there were delays 
in 
the 
appropriate 
listings being provided and as a result it has not yet been possible to carry 
out the 
Implemented 
 
a.  Non-PO payment including API E-Forms Non-Purchase Order (Non-PO) transactions include payments to: - One Time Vendors - suppliers paid only once and  
- suppliers that may be paid more than once where no purchase order is required. Where a OTV is paid more than once, the payee will now need to be created as a supplier on the Vendor Master File in Integra. A non- Purchase Order Exemption list has been approved by Finance and communicated to Accounts Payable (AP) defining payments which are exempt from the normal purchase order process. These payments are now processed via electronic API E-forms in the 
Council's 
accounting 
system, 
planned testing. Prior to Audit Committee Internal Audit will undertake testing against the agreed processes in place, review evidence and discuss with Capita; subject to the outcome of that testing, the rating will be reviewed. Verbal update to be provided. 
Integra. They are authorised in terms of Integra workflow which is set up to ensure approval in line with the Schemes of Financial Delegation, 
schemes 
reviewed 
routinely and available on the Intranet for referral. Supporting 
documentation 
matching 
the 
GT 
Ref 
Recommendatio
n 
Recommendation 
detail 
Priority 
Action 
Status reported to Audit Committee 22nd November 
2018 
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 
payments must be attached with the Integra API E-Form by the Service. AP reject payments not using the Integra API E-form. They are also required to ensure that supporting documentation matches the API E- form detail, including the bank details, in terms of the API E-Form Vendor Process V1.0 and reject payments which do not comply. Evidence was provided to us confirming that Accounts Payable (AP) were undertaking the API E- Form checks for API payments they were required to undertake in terms of the "API E-Form Vendor 
Process V1.0" process document. 
Our sample testing confirmed that bank details per the supporting documentation matched the bank details in Integra. Other types of non-PO payments were also reviewed, for example those made through the ControCC and Mosaic interface - the social care systems in Family Services and Adults and Communities - into Integra. These were authorised and 
supported 
by 
sufficient 
documentation. 
 
b. New Suppliers 
 
GT 
Ref 
Recommendatio
n 
Recommendation 
detail 
Priority 
Action 
Status reported to Audit Committee 22nd November 
2018 
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 
Where suppliers are paid more than once, a vendor account needs to be created in the Integra Vendor Master File. Creation of the new vendor or changes to the vendor details are governed by the 
"New 
Supplier 
and 
Supplier 
Amendment Process V1.0". A Supplier E-Form is: - created in the Service with supporting 
documentation 
including bank details,  
- completed by AP after they have conducted 
detailed 
supplier 
checks in terms of the above document and then - created in the system by ICT. Evidence was provided to us that AP were undertaking the new supplier and change in bank detail checks they were required to 
undertake in terms of the "New 
Supplier and Supplier Amendment Process V1.0" process document. Our testing confirmed that bank details 
per 
the 
supporting 
documentation provided with the supplier E-Form matched the bank details in Integra. 
Summary 
For GT15, segregation of duties is 
now 
embedded 
in 
non-PO 
payments as follows: 
GT 
Ref 
Recommendatio
n 
Recommendation 
detail 
Priority 
Action 
Status reported to Audit Committee 22nd November 
2018 
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 
 
- 
API 
E-Form 
payment 
authorised 
by 
budget 
manager and independent payment checks (AP) for non-PO (purchase order) OTV (One Time Vendor) and 
non-PO-non 
OTV 
payments and  
- 
supplier creation / supplier change 
requests 
(Service), 
related 
independent checks (AP) and 
related 
creation/change (CST, IT Integra Support Team) in Integra 
- 
the separate authorisation of 
non-API 
non-PO 
payments 
- 
the provision of adequate supporting documentation for all payments. In terms of the recent fraud where the fraudster changed the bank account details of an existing master file vendor (a solicitor) to his own, this would not be possible through the AP route as the change in bank details would be subject to independent check by AP in terms of the "New Supplier and Supplier Amendment Process 
V1.0"  
 
GT 
Ref 
Recommendatio
n 
Recommendation 
detail 
Priority 
Action 
Status reported to Audit Committee 22nd November 
2018 
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 
Related PDAME outcomes - refer to Part 4 for detailed 
findings 
on 
matches 
and 
referral findings/progress The PDAME identified matches relating to bank details that were referred to CAFT and AP for 
further review. 
1.1 
Vendors 
Receiving 
Payments into Multiple Bank 
Accounts (non OTV) - matched 
items related to low risk changes in bank sort code. Matches were not escalated to CAFT/AP for further review. 
2.1 Amendments to Supplier 
Bank Details - 13/52 matches 
were referred to AP and 7/52 matches to CAFT for further review, AP: Confirmation of validity of bank account changes resolved for 4/13, in progress for 9/13 CAFT: 
Investigations 
7/7 
completed without issues. 
GT 
Ref 
Recommendatio
n 
Recommendation 
detail 
Priority 
Action 
Status reported to Audit Committee 22nd November 
2018 
GT16 
Duplicate banking details 
The Masterfile supporting the BACS payment process does not automatically identify and flag 
payments made to 
different suppliers/recipien ts that had the same bank 
account number. 
There was also no manual control in place to identify BACS and CHAPS payments made to different suppliers which had the 
same bank 
accounts. We 
recommend that this control be considered as an addition to the new Treasury Payment Procedure. 
The process has been submitted and verified, however it has not been possible to test the operating effectiveness of these controls, as the control design relating to one-time vendors was not finalised in the 
testing period, and the e-form used to set up new suppliers within Integra was not yet live within the system. Internal audit has reviewed the process as agreed with GT, but have not yet been able to test this independently. No issues were noted with the operating effectiveness of the checks carried out over the validity of supplier details within the Treasury Payment Process. 
Medium 
Put in place controls to identify BACS and CHAPS payment s made to different 
supplier s with the same bank account s and update the Treasur y Paymen t Procedu re accordin gly. Any exceptio ns need to be clearly docume nted and 
assuran
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 
Implemented 
 
a. Duplicate banking details (payments to different vendors with the same bank account) The New Supplier and Supplier Amendment Process which has been implemented should support mitigation of the risk of creating fraudulent/ fictitious vendors in Integra (many suppliers with the 
same one bank account of the potential 
fraudster 
in 
this 
Partly Implemented The recommendation as written does not reflect the fact that CHAPS and BACS payments are processed differently. CHAPS payees are not set up as suppliers within Integra, whereas BACS payees should be set up as suppliers unless they are processed as one-time 
vendors. We have completed testing for CHAPS payments and are satisfied that the action is Implemented for these types of payments. However, for BACS payments our testing is still ongoing (see also GT15). Audit will review further evidence and discuss with Capita. 
instance). The creation of new suppliers is now done by Vendor E-Form, is segregated and is subject to independent checks by AP prior to update in the system by ICT in line with the process. The robust process should therefore deter the creation of fictitious vendors in Integra in the first instance. Supporting 
detective 
reporting 
identifying where payments made to different suppliers/vendors with the same bank account details will be achieved once the software package AP Forensics has been implemented. Commissioning and implementation of the software is being 
overseen 
by 
the 

Council/Capita AP Task Group responsible for improvements in the financial control environment 

GT 
Ref 
Recommendatio
n 
Recommendation 
detail 
Priority 
Action 
Status reported to Audit Committee 22nd November 
2018 
ce provided around the controls relating to those process es. 
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 
for payments.  We understand that procurement and implementation of the software is imminent. The first demonstration of the software has confirmed that such detective reporting will be possible 
Related PDAME outcomes - refer to Part 4 for detailed findings 
on 
matches 
and 
referral findings/progress  
 
The PDAME identifying matches relating to different vendors having a common bank account were referred to CAFT and AP for 
further review. 
1.2 Multiple Vendors Receiving Payments 
into 
Common 
Accounts 
- 
55/101 
matches 
referred to AP and 7/55 suppliers covering 3 bank accounts were referred to CAFT AP: Investigations resolved no issues for 3/55, In progress 52/55 CAFT: Investigations resolved with no issues for 4 suppliers covering 2 bank accounts, In progress for 3 suppliers covering 1 bank account. 
2.2 Multiple Vendors Sharing a 
Common Bank Account 
Referred 284 / 296 matches to AP 
GT 
Ref 
Recommendatio
n 
Recommendation 
detail 
Priority 
Action 
Status reported to Audit Committee 22nd November 
2018 
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 
and 8/296 covering 2 bank accounts to CAFT AP:  138/284 already resolved 
deactivated, 146/284 in progress. 
CAFT: 8 suppliers 2 bank 
accounts in progress, further information has been submitted to AP for review. 
4.3 
One 
Time 
Vendors 
Receiving 
Payments 
into 
Common Accounts - CAFT have 
completed checks on Integra. There are some matches which remain unverified and have been escalated to AP for further review and for them to respond with any suspicions. 
b. Misuse of the One-Time- Vendors) OTV process There will be occasions when undertaking Council business that one-off 
payments 
to 
persons 
(OTV) may be required. To ensure that officers do not use the One Time Vendor process excessively 
to 
bypass 
the 
standard PO and vendor creation processes, 
Integra 
now 
recognises when an OTV payment is made to a bank account used for 
an OTV payment before. In this 
GT 
Ref 
Recommendatio
n 
Recommendation 
detail 
Priority 
Action 
Status reported to Audit Committee 22nd November 
2018 
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 
case the OTV payment will be rejected and the supplier will then be required to be set up as a vendor in Integra as part of the Vendor Master Data. The creation of the vendor will be subject to the various 
independent 
checks 
referred to in GT 15 above. Where OTV payments are paid by cheque or to different accounts, the above bank account rejection 
will 
not 
apply. 
This 
will 
be 
addressed by the introduction of AP Forensics which will allow the rejection of payments based on OTV payee name too. For cheque payments, in the interim, Finance, following discussion with Cash Book 
team, 
will 
investigate 
whether 
the 
CSG 
team 
responsible for producing Integra cheque runs will identify where payees paid by cheque have previously been paid by BACS or cheque. The action is under ongoing review by the Capita/Council AP Task group responsible for improving the 
control 
environment 
over 
Council payments. 
Action: 
 
GT 
Ref 
Recommendatio
n 
Recommendation 
detail 
Priority 
Action 
Status reported to Audit Committee 22nd November 
2018 
Status reported to Audit 
Committee 31st January 2019 
Status verbally reported to Audit Committee May (GT16) and July (GT15) 2019 
AP Forensics meeting all user reporting 
needs 
will 
be 
commissioned and implemented.  
Responsible officer: 
Acting Head of Finance - Projects Head of Financial Systems, 
Capita  
Target date: 
31 August 2019 
 
Related PDAME outcomes - refer to Part 4 for detailed findings 
on 
matches 
and 
referral findings/progress  
 
4.1 One Time Vendors (OTVs) Receiving 
More 
than 
One 
Payment - in progress, resolved 
for 
CAFT 
no 
issues 
(bank 
accounts correct in relation to suppliers) 
4.2 
One 
Time 
Vendors 
Receiving 
Payments 
into 
Multiple Bank Accounts - in 
progress, CAFT have requested further information from AP 

## 2. Accounts Payable Audit - Findings, Risks And Action Plan

|                                                |         |       |
|------------------------------------------------|---------|-------|
| Ref                                            | Finding | Risks |
| Risk                                           |         |       |
| 1                                              |         |       |
| Authorisation of purchase orders (PO)          |         |       |
| Location 6 payments (Standard PO transactions) |         |       |

The Dual Authorisation for Payments over £1million Process Note V1.0 requires the dual authorisation of purchase orders over £1m. The process document referred to the quality checking as follows: "Quality Checks: A report will be run on a monthly basis for payments over £1million to check the requisitions have the necessary form attached." We found that there was no reporting and review process as stated. 

 

We tested a sample of 15 payments through location 6 in Integra for which purchase orders were raised. The 3-way match of invoice, goods receipt and PO was evident, however the dual authorisation of 2 / 15 purchase orders was not attached in Integra as required by Dual Authorisation for Payments over £1million Process Note V1.0. 

  
 
 
Location 4 (non- standard PO approval) - Office Depot 

Payments in Integra through this location for stationery are low in value. Once POs are raised, related requisitions are charged through Electronic Data Interchange (EDI) invoices. The acquisitions are not subject to a goods receipting process by the Service. We understand that there is an automated goods receipting process within Integra, however this increases the risk that payments may be made for goods not delivered, including theft, as there is no formal confirmation of receipt. One Office Depot transaction (reference: 0040002817) was for an amount of 

category 
Agreed action 
High 
Capita (non-AP): a(i): A list of purchase orders raised in 
Integra above £1m will be provided to Council Finance monthly. 
If planned expenditure 
doesn't support the 
Council's objectives or is not aligned with business 
needs 
Responsible officer: 
through the lack of appropriate 
scrutiny 
Integra team 
and 
challenge, 
for 
Target date: 31 October 2019  
example, 
if 
dual 
Council Finance 
authorisation is not obtained 
for 
expenditure, 
where 
necessary **then** there 
is 
a 
risk 
of 
misallocation 
of 
finances, 
budget 
overspends 
and 
a(ii): Finance will ensure that the Dual 
Authorisation form is completed for all POs above £1m on the monthly list. Finance will ensure that the form is completed correctly in line with the Council Constitution and is attached in Integra for referral. 
resident dissatisfaction.  
Responsible officer: 
 
Acting Head of Finance - Projects 
Target date: 
31 October 2019 
Council Finance 
If payments are made 
for office stationary that is not received through a lack of a formal 
receipting 

b(i): 
Finance will ensure that process **then** there is a risk of financial loss and budget overspends. 

expenditure with Staples, the supplier replacing Office Depot, is set up in Integra to follow the standard PO route, so the 3-way match of PO, Goods Receipt and invoice, with purchase 
   

|                                                                      |         |       |
|----------------------------------------------------------------------|---------|-------|
| Ref                                                                  | Finding | Risks |
| Risk                                                                 |         |       |
| £3,556.80. We would have expected goods receipting for an invoice of |         |       |
| this value.                                                          |         |       |

We tested a sample of 8 payments ranging from £50 to £3600 in 2018- 19 and 2019-20. In 2/8 cases the PO was not approved by the budget manager referred to in the prevailing Financial Scheme of Delegation (FSoD).   

## 

Although the transactions are low value, the finding suggests that the Integra approval workflow may potentially not be aligned with the relevant approved SoFD at all times. 

At the time of this report the Council's stationery supplier was due to change to Staples from Office Depot.  

## Family Services Authorisation Limits In Controcc

In Family Services, we noted that Heads of Service were able to authorise services up to £181,302 as stated in the Family Service Financial Scheme of Delegation within the Children's Service Scheme of Delegation in the Constitution. However, in LCS, the Family Services social care system, the Heads of Service limit for approving services was set at £250,000. This did not affect our sample tested as commitments selected were all below the £181,302 limit in the Constitution. Family Services Finance provided us with a document, "Authorising spend - what you need to know", which they used together with the Children's Service Scheme of Delegation and which referred to the limit of £250,000. Our initial view is that the limits set in ControCC need to be updated at the Head of Service level so that they align with the Constitution and that Finance should review the validity of the document. We have not tested the commitment cost approval levels in Mosaic, the Adults social care system, as our testing related to authorisation at the 

category 
Agreed action 

## Order Approval In Integra In Line With The Financial Scheme Of Delegation. Responsible Officer: Acting Head Of Finance - Projects Target Date:

31 October 2019 

## Accounts Payable (Ap) B(Ii): Thereafter, Staples Invoices Will Be Released For Payment Following The Standard Po Route, The 3-Way Match Of Invoice, Goods Receipt And Po. Responsible Officer: Accounts Payable Manager, Accounts Payable, Csg Target Date:

31 October 2019 

## Council Finance

c. Finance will review the authorisation limits as stated in the "Authorising spend - what you need to know" document, governing the authorisation levels of social care management for approving cost commitments in LCS, the Family Services social care system - set in ControCC, the Family Services financial system - to ensure that they are consistent with the Council's Constitution. Authorisation limits will be 



Ref 
Finding  
Risks 
Risk 
invoice level and matching to commitments. However, a review of the position in Adults and Communities should also be undertaken to ensure 
that the SoFD and related limits in Mosaic are aligned.  
 

## 2. Manual Upload Process (Control Design And Operating Effectiveness)

There is a documented procedure for the manual upload process, the 'Manual Upload BACS Process V1.0'. It is estimated that the money spent via this route annually is circa £100m. The payments are made in Integra in location 2. A review of the document indicated that: - the preamble in the process document was vague in that it stated "'This method of paying suppliers is restricted to specific types of payments, and cannot be used to circumvent the standard AP procedures', however 

category 
Agreed action 
updated 
in 
ControCC 
where 
applicable. A similar exercise will be 
done 
confirming 
that 
limits 
for 
approving 
cost 
commitments/care 
packages in Mosaic for Adults and Communities are in line with the Constitution. 
Responsible officer: 
Acting Head of Finance - Projects 
Target date: 
 Implemented (as per management) 
High 
Council Finance 
If a payment process 
facilitates 
the 
circumvention 
of 
approved 
payment 
limits **then** there is a 
risk 
of 
invalid 
a.(i)The Manual upload process will be reviewed and updated to ensure clarity over when this approach is permissible for payments, so which payments may follow the manual upload process.  
payments 
and 
financial loss. 
(ii)The process document will be kept up to date. The related authorisation sheet will be reviewed, updated and provided to AP on a quarterly basis as a minimum. AP will be notified of 
changes 
to 
the 
authorisations 
immediately, 
for 
example, 
where 
|      |         |       |
|------|---------|-------|
| Ref  | Finding | Risks |
| Risk |         |       |

the list of the 'specific types of payments' or the rationale as to why this method needs to be used in each case was not specified.  
-  The Manual Upload BACS Process V1.0 (16/8/2018), paragraph 6, "Master List of Approvers Allowed to Certify" was out of date as it included leavers, for example, xxx, xxx and xxx It is not clear how this list of approvers would be updated or by whom. - We are aware of a number of payments initiated on 14/9/18 via this route which were >£25k that had been authorised by someone who only had £25k limit as per this list. Therefore, the payments should not have been made by AP. 

 
category 
Agreed action 
Finance 
become 
aware 
that 
authorising officers have left the 
Council. (iii)The 
Manual 
upload 
process 
document 
will 
emphasize 
that 
authorising officer limits must align with the total value of the manual upload payment, referring specifically to the situation where the manual upload is broken down into various payments across more than one budget manager and cost centre.     
Responsible officer: 
Acting Head of Finance - Projects  
Target date: 31 October 2019 AP 
AP will reject manual upload requests which do not comply with the updated manual upload process above, for example, where officers authorise total payments outside their defined limits. 
Responsible officer: 
Accounts Payable Manager, Accounts Payable, CSG  
Target date: 
31 October 2019 


Ref 
Finding  
Risks 
Risk 

## 3. Duplicate Payments

We tested for duplicate payments within our sample across various Integra pay locations since Integra was implemented in 2014. None were noted. Since the GT review, there is now a process in Integra for automatically identifying One Time Vendor (OTV) BACS payments that have been paid to the same bank account in the past. Such payments are rejected and assessed for inclusion of the related payee/supplier in the Integra Master Vendor List to prevent misuse of the OTV payment route by Services.  
Crystal reporting introduced in September 2018 identifies "fuzzy matches" around supplier number, invoice reference, value and date on a daily basis for potential duplicate payments - refer to **Part 3** (Appendix 
5) follow-up of past audits - AP 2017-18 (AP4). As part of this audit, we requested evidence of daily duplicate payment reviews, however CSG Management indicated that the report had only been run once when AP undertook, at the Council's request, a one-off exercise to identify potential duplicate payments. This report was supplied to the Council along with a comment that AP were unable to fully complete this task as the data included interfaces of which AP have no input. Processes to identify duplicate payments on a wider scale across Integra through the commissioning and procurement of software, AP Forensics, is in progress, however has not yet been implemented despite being discussed since 2018. Implementation is being overseen by the Council and Capita AP Task Group established to improve financial controls over 

category 
Agreed action 
 
 
Medium 
Council Finance 
If duplicate payments 
are made for invoices or activities that have been paid in the past 
then there is a risk of 
overpayments, budget 
overspends 
and 
a. The implementation of software, AP Forensics (APF), will be expedited in line with Council requirements, to identify potentially duplicate payments 
based on a variety of agreed criteria such as value, name and bank details. . 
The 
Head 
of 
Counter 
Fraud 
resident 
dissatisfaction 
Operations will be engaged as part of the implementation of the software, as a potential end user of the application.` b. 
Processes 
for 
identification, 
escalation and investigation, clarifying roles and responsibilities and the timing of reports will be documented and communicated. c. Pending implementation of APF, Finance will arrange for the download of the last 3 years of Council payments at the Council through AP Forensics software 
to 
identify 
potentially 
duplicate payments for investigation.  

Responsible officer: 

|      |         |       |
|------|---------|-------|
| Ref  | Finding | Risks |
| Risk |         |       |

payments. We understand that the software will allow the identification of duplicate payments through various criteria, for example, value, name and bank details, the full user requirements still to be defined. Pending implementation of AP Forensics, reports identifying duplicate payments are not being run as frequently as necessary in our view. An AP Forensics Demo exercise, involving Council Finance, was undertaken 6 August 2019 to demonstrate its functionality and capabilities. We requested input to assess whether functionality addressed areas below, relevant to AP and GT findings:   

1. Robust reviews for duplicate payments on a variety of criteria 2. Identifying repeat OTVs, based on criteria other than OTV BACS 
payments to the same bank account (currently in place) 
3. Detective reporting identifying where payments are made to 
different suppliers/vendors with the same bank account details, the gist of GT16 
4. Detective reporting identifying payments to the same supplier 
with different bank accounts, so similar to the fraud.  
Finance confirmed that the AP Forensics tool should meet the above requirements.  

 

## 4. Missing Invoice

We tested 10 invoices in location 1 in Integra (Standard POs) for the three-way match of invoice, good receipting and PO. In 1/10 (10%), the invoice (value £858k) was not attached in Integra when the audit test was done. The invoice was subsequently attached 26 June 2019, a significant period after it was cleared, 5/12/2018. We would have expected AP to reject a payment without a supporting invoice, particularly one of such a significant amount. We have reviewed to confirm that the invoice and payment were valid. 

category 
Agreed action 
Acting Head of Finance - Projects liaising with Head of Financial 
Systems, Capita Head of Counter Fraud Operations (engage with the AP Forensics implementation process as a potential end user of the software) 
Target date: 
Medium 
AP 
The availability of supplier invoices in Integra will be monitored as part of AP reconciliation 
audit 
processes. 
If payments are not 
matched to supplier invoices and attached in Integra as evidence of accurate payment 
then there is a risk of 
supplier overpayments 
and 
financial loss  
Supplier invoices will be attached in Integra in all cases, where applicable. AP will reject payments where no invoice has been provided and refer them back to the Service. 

 



Ref 
Finding  
Risks 
Risk 

## 5. Ap Training And Development Ap (Csg)

CSG Management indicated that a programme of training and development existed for the CSG AP team. The programme involved AP officers completing an assessment in which they recorded their understanding of various related procedure documents. Gaps noted in what they recorded informed their training. We do not have an issue on the design of the process. Evidence of its operation, for example, the courses assessed, how evaluated and the resulting training identified had been requested by Internal Audit, however at the time of this report had not been provided for our review. Internal Audit has right of access to all records governing the Council operations in terms of the Financial Regulations of the Constitution.  
 

## Council

We found that new starters in Council Finance 1 January to date had 
attended mandatory Integra training which included AP related courses. 
category 
Agreed action 
Responsible officer: 
Accounts Payable Manager, Accounts Payable, CSG  
Target date: 
31 October 2019 
Medium 
AP 
Evidence 
of 
AP 
training 
and 
development relevant to AP payment 
processing will be provided for Internal Audit review. AP management will review current training plans and will respond with a proposal for review 
If gaps in training and 
development are not 
identified **then** there is 
a risk of processing errors, processes not being followed and payments not being rejected 
where 
 
necessary.  
Responsible officer: 
Accounts Payable Manager, Accounts Payable, CSG Accounts Payable Team Leader, CSG 
Target date: 
31 October 2019 


Ref 
Finding  
Risks 
Risk 
 

## 6. Documented Ap Procedures

a. The following documents relevant to AP processing were noted during the AP review: 
- 
API E-Form Vendor Process V1.0" (non-PO transactions) 
- 
The API Exemption List (non-PO transactions) 
- 
"New Supplier and Supplier Amendment Process V1.0" (non-PO and PO transactions) 
- 
the Integra User Guide (PO transactions) 
We reviewed 14 Intranet procedures relevant to AP - refer to Appendix 4 for detailed review, findings as follows: 
- 10/14 documents were out of date at the date of testing (07/11/2018) and had not been reviewed or updated in more than two years. - 4/14 documents had been updated in the course of 2018, but contained information which was out of date around the escalation route for AP issues and the current supplier request process. b. We also noted that documents signposted within other documents were not held on the intranet. These included a Requisitions User Guide and some Integra e-forms which aren't in use at Barnet. 

c. The "New Supplier and Supplier Amendment Process V1.0 
(16/8/2018)" Appendix 4: "Budget Managers and Superiors" was out of date, for example, it included leavers such as xxx, xxx, xxx, xxx and xxx. 

category 
Agreed action 
If 
outdated 
AP 
Medium 
Council Finance  
procedure documents or 
procedure 
a. All AP procedures will be reviewed, updated and communicated to the relevant 
finance 
officers. 
The 
documents that are no longer relevant are referred 
to 
by 
responsible 
officers 
Frequently Asked Questions (FAQ) 
document referring to AP payment arrangements will be finalised and published. 
then there is a risk of 
processing 
errors, 
processes not being followed 
and 
b. AP process documents no longer relevant will be removed from the Intranet. 
payments not being rejected 
where 
necessary.  
If officers are not 
aware of all systems interfacing 
with 
c. Finance will engage with the relevant Capita teams to produce flowcharts mapping all Integra interfaces with other systems, for example, Mosaic and ControCC and defining related operation,  
Integra 
which 
may 
 
Note: 
impact AP processes meaning, for example, that 
relevant 
reconciliation processes 
between 
those systems are not 
applied **then** there is a 
risk 
of 
inaccurate 

Process documents should not include embedded documents which may be subject to change periodically, for example, budget manager lists. The documents should have links to sign 

|                                                                              |         |       |
|------------------------------------------------------------------------------|---------|-------|
| Ref                                                                          | Finding | Risks |
| Risk                                                                         |         |       |
|                                                                              |         |       |
| d. The Manual Upload BACS Process V1.0 (16/8/2018), paragraph 6,             |         |       |
| "Master List of Approvers Allowed to Certify" was out of date as it included |         |       |
| leavers, for example, xxx, xxx and xxx.                                      |         |       |
|                                                                              |         |       |

e. We were unable locate a document mapping all systems interfacing with Integra, specifically impacting AP. We satisfactorily tested interface reconciliations between Integra and Mosaic - the Adults Social Care system - and ControCC - the Family Services Social Care system. We were however unclear, for example, around the Council's Integra interfaces with other systems such as those used in Housing.    

 

## 7. Bacs Reconciliation (Design)

Evidence of the daily BACS payment review processes was provided. However, although the process involved the review of payments over £35k and the Listing of BACS payments report was retained for referral, it was not clear how the process, by design, could mitigate the risk of a fraudulent change(s)/alteration(s) to the BACS file after approval, the specific risk referred to in the audit term of reference, without evidence of a formal reconciliation between BACS summary reports and the related Integra payment files. Our expectation was that BACS summary reports would be reconciled to relevant payment files after release, similar to the payroll control process where the BACS payroll file is reconciled the Net Pay system file. 

category 
Agreed action 
payments 
and 
liabilities in Integra.   
posted documents which are also available on the Intranet.   
 
Responsible officer: 
Acting Head of Finance - Projects, liaising with Capita officers where necessary. 
Target date: 31 October 2019 
 
Low 
Council Finance 
If the BACS payments 
file is altered/changed prior 
to 
release 
without authorisation 
then there is risk of 
overpayments 
and 
financial loss.   
The BACS file review will include a process to ensure that the BACS file has not been altered after approval, for example, a check that the amount taken from the bank account matches the amount of the approved payment run. 
Responsible officer: 
Acting Head of Finance - Projects 
Target date: 
| Ref           |
|---------------|
| Risk          |
| category      |
| Agreed action |

## Appendix 1: Definition Of Risk Categories And Assurance Levels In The Executive Summary

Note: the criteria should be treated as examples, not an exhaustive list. There may be other considerations based on context and auditor judgement.  

## Risk Rating

Critical 

Immediate and significant action required. A finding that could cause: - 
Life threatening or multiple serious injuries or prolonged work place stress. Severe impact on morale & service performance (eg mass strike actions); or 
 
 
- 
Critical impact on the reputation or brand of the organisation which could threaten its future viability. Intense political and media scrutiny (i.e. front-page headlines, TV). Possible criminal or high profile civil action against the Council, members or officers; or 
- 
Cessation of core activities, strategies not consistent with government's agenda, trends show service is degraded.  Failure of major projects, elected Members & Senior Directors are required to intervene; or 
- 
Major financial loss, significant, material increase on project budget/cost. Statutory intervention triggered. Impact the whole Council. Critical breach in laws and regulations 
that could result in material fines or consequences. 

High 

Action required promptly and to commence as soon as practicable where significant changes are necessary. A finding that could cause: - 
Serious injuries or stressful experience requiring medical many workdays lost. Major impact on morale & performance of staff; or 
 
 
- 
Significant impact on the reputation or brand of the organisation. Scrutiny required by external agencies, inspectorates, regulators etc. Unfavourable external media coverage. Noticeable impact on public opinion; or 
- 
Significant disruption of core activities. Key targets missed, some services compromised. Management action required to overcome medium-term difficulties; or 
- 
High financial loss, significant increase on project budget/cost. Service budgets exceeded. Significant breach in laws and regulations resulting in significant fines and consequences. 

Medium 

A finding that could cause: - 
Injuries or stress level requiring some medical treatment, potentially some workdays lost. Some impact on morale & performance of staff; or 
 
 
- 
Moderate impact on the reputation or brand of the organisation. Scrutiny required by internal committees or internal audit to prevent escalation. Probable limited unfavourable media coverage; or 
- 
Significant short-term disruption of non-core activities. Standing orders occasionally not complied with, or services do not fully meet needs. Service action will be required; or 
- 
Medium financial loss, small increase on project budget/cost. Handled within the team. Moderate breach in laws and regulations resulting in fines and consequences. 

A finding that could cause: 
Low 
- 
Minor injuries or stress with no workdays lost or minimal medical treatment, no impact on staff morale; or 
 
- 
Minor impact on the reputation of the organisation; or 
 
- 
Minor errors in systems/operations or processes requiring action or minor delay without impact on overall schedule; or 
- 
Handled within normal day to day routines; or 
- 
Minimal financial loss, minimal effect on project budget/cost. 

## Level Of Assurance

Substantial 
There is a sound control environment with risks to key service objectives being reasonably managed. Any deficiencies identified are not cause for major concern. Recommendations will normally only be Advice and Best Practice. 
 
 
Reasonable 
 
An adequate control framework is in place but there are weaknesses which may put some service objectives at risk. There are Medium priority recommendations indicating weaknesses but these do not undermine the system's overall integrity. Any Critical recommendation will prevent this assessment, and any High recommendations would need to be mitigated by significant strengths elsewhere. 
 
Limited 
There are a number of significant control weaknesses which could put the achievement of key service objectives at risk and result in error, fraud, loss or reputational damage. There are High recommendations indicating significant failings. Any Critical recommendations would need to be mitigated by significant strengths elsewhere. 
 
No 
 
There are fundamental weaknesses in the control environment which jeopardise the achievement of key service objectives and could lead to significant risk of error, fraud, loss or 
reputational damage being suffered. 
 

## Appendix 2 - Analysis Of Findings

| Critical         | High    | Medium    | Low    | Total    |
|------------------|---------|-----------|--------|----------|
| Area             |         |           |        |          |
| D                | OE      | D         | OE     | D        |
| Accounts Payable |         |           |        |          |
|                  |         |           |        |          |
| -                | -       | 1         | 1      | -        |
| 7                |         |           |        |          |
| Total            | -       | -         | 1      | 1        |
|                  |         |           |        |          |

## Key:

- 
Control Design Issue (D) - There is no control in place or the design of the control in place is not sufficient to mitigate the potential risks in this area. 
- 
Operating Effectiveness Issue (OE) - Control design is adequate, however the control is not operating as intended resulting in potential risks 
arising in this area. 

 
Timetable 
Fieldwork commenced: 
Fieldwork completed: 
Draft report issued:  
 
Terms of reference agreed:  
Management comments received: 
Final report issued: 
 
 
14 August 2018 
12 August 2019 
01 October 2019 
03 September 2018 
25 July 2019 
 
22 August 2019 / 3 September 2019 / 4 September 2019 (AP) Various responses 13 August 2019 - 23 August 2019 / 3 September 2019 (Council Finance) 17 September 2019 (Exit meeting) 

## Appendix 3 - Identified Controls

Area 
Objective  
Risks 
Identified Controls 
Liabilities are accurately and 
completely 
recorded 
in 
the 
Manual posting error to the 
general ledger 
Accounts Payable 
underlying accounts Automated 
posting 
errors 
occur 
between 
the 
two 
interfaces 
Three-way check of invoice, goods receipting documentation and 
POs An API Exemption List has been developed defining the type of payments which may bypass the standard PO process, including the expected supporting documentation and criteria, including value, which AP should expect, failing which payment will be rejected. API E-Form Process payments specifying AP checks to supporting documentation. AP checks of API payments to supporting documentation Monthly reconciliation of AP control account to AP creditors ledger, including independent review Reconciliations between Integra and ControCC/Mosaic interface payment files Council/Capita AP Task group has been set-up, responsible for improving overall financial controls relating to payment processing. 
 
See above  
 
All liabilities are correctly valued and 
relate 
to 
legitimate 
expenditure-related transactions 
Expenditure may be incurred for goods or services that have not been received and/or do not pertain to the organisation 
Fraudulent payments may be 
made by staff for unauthorised goods and services 
All expenditure incurred relates 
to legitimate services or goods, and evidence exists to verify that these services or goods have been provided 
Processing errors are not identified and remedied in time to prevent financial loss to the Council 
Note: testing will cover the whole transaction lifecycle i.e. that the transaction has been appropriately 
raised 
and 
 
authorised within the delivery unit in question 
Non-procurement 
payments 
are made without appropriate authorisation 
Three-way match of PO payments Non-PO payments, OTV and non-OTV, are governed by communicated fit for purpose documented procedures and followed. BACS reconciliation reviews by Integra Finance involve the independent checks of payments over £35k. API E-Form payments governed by API E-Form Vendor process. Authorisation is done by the SoFD budget managers. 
Council/Capita AP Task group has been set-up, responsible for improving financial controls relating to payment processing. 
 
 
Potential duplicate payments 
are identified and investigated 
Duplicate payments are made 
resulting in financial loss 
Commissioning and implementation of AP Forensics in progress, 
managed by the Council/Capita AP Task group responsible for improving financial controls relating to payment processing. Existing crystal reporting of "fuzzy" matches 
Invoices and payments relate to valid suppliers 
Fictitious suppliers have been created or duplicate suppliers have been set up Changes to supplier details, including bank details, are erroneously or fraudulently made Repeat suppliers are not appropriately set up as suppliers within the system 
Fit for purpose documented communicated process for creating and changing supplier details in Integra, New Supplier and Supplier Amendment Process V1.0". The process referred to the creation of new suppliers and changing bank details. New Suppliers now requested via E-Form and follow a segregated creation process with supporting documentation. AP checks being done on new suppliers and change to bank details in line with the above process document, refer to GT 15 summary, above. OTV BACS payments made to suppliers more than once and paid to the same bank account are identified by Integra, investigated and 
escalated for creation as a supplier in Integra (Vendor Master Data) 
 
 
Payments are accurately made 
Changes to the BACs 
payment runs are fraudulently made The migration of the BACs payment could be corrupted in transfer from one system to the other Suppliers are not paid or are paid late, leading to damaged supplier relationships 
BACS reconciliation process involves the check of payments over 
£35k and the retention of the BACS files. There is a late payment KPI within the contract, subject to monitoring by the Performance Team. FI PI 33: Ninety-five per cent (95%) of local companies are paid within ten (10) Business Days and all other companies within thirty (30) Business Days: Target 95%, June 2019 (Actual: 93.7%), trend target missed 
FI PI 33b: Ninety-five per cent (95%) of all other companies within thirty (30) Business Days: Target 95%, June 2019 (Actual: 100%), trend is target achieved The Corporate Performance team has the residual risk of "Supplier Non-Payment" (non-or late payment) at score 8 and there is an improvement place which is being monitored. General controls ensuring accurate payments noted above Three-way check of invoice, goods receipting documentation and POs An API Exemption List has been developed defining the type of payments which may bypass the standard PO process, including the expected supporting documentation and criteria, including value, which AP should expect, failing which payment will be rejected. API E-Form Process payments specifying AP checks to supporting 
documentation. AP checks of API payments to supporting documentation 
 
The following documents relevant to AP processing were noted during the AP review: 
 
Staff are aware of up to date 
policies and procedures in relation to Accounts Payable 
- 
This guidance has been replaced with " API E-Form Vendor Process V1.0" 
Employees are not aware of 
the policies and procedures around the accounts payable process and therefore do not follow the correct procedure 
- 
The API Exemption List 
- 
"New Supplier and Supplier Amendment Process V1.0"  
- 
the Integra User Guide (PO transactions) The process documents cover the non-PO and PO AP processes. The AP control reconciliation process is referred to in the Control 
Account process document (referred to in the General Ledger audit, 2018-19) 
Payments are authorised within feeder systems which should not be authorised 
 
Accounts Payable feeder systems are clearly mapped and access to them is appropriately restricted 
Feeder systems are not reconciled to the AP subledger and general ledger 
GT15 involved the review of Mosaic/ControCC payments. Invoices are reconciled by Adults and Family Services Finance teams to authorised commitments in the relevant social care system. In Family Services, commitments are independently authorised by social care managers/Heads/Directors of Service in social care system in line with limits before transfer to ControCC, the Family Services Payment system.  In Adults, the commitment costs are independently approved by senior Social Care Managers (at Panel) before commitments transfer to Mosaic for the system for paying invoices. Responsibility for reconciliation between ControCC/Mosaic and Integra is clear and allocated. There was evidence that reconciliations were undertaken. 
The workflow in Integra is designed to ensure that non-PO payments and purchase orders are approved by the budget manager in line with the prevailing Financial Scheme of Delegation (query raised above)  
 
All payments are requested and authorised in line with the Scheme of Delegation and Financial Authorisation 
Payments are fraudulently or accidentally authorised by people who should not be able to authorise them 
 
E-form design and use supports efficiencies in payment processing 
The API E-Form and New Supplier and Supplier Amendment E-Form is referred to in related procedure documents. The process embedded checks of validity by AP. 
If e-forms are badly designed or misused, payments may be authorised or made inappropriately and records of transactions may not be appropriately maintained. 

## Appendix 4 - Accounts Payable Procedure Documents Review Ap Process Documents On The Intranet Were Reviewed To Ensure That They Were Accurate.

  
Title 
Date 
Comments 
Status at the date of the AP draft report and action 
1 Changes to 
16/10/2014 This process is out of date, as the team responsible for processing 
 **Action**: The process will be 
updated as necessary and communicated, 
including 
the supplier payment process 
invoices once they've been scanned by the mailroom are no longer based at Barnet and are instead based in Chichester. This page outlines the interim processes in place in 2014, and as such should be replaced with an updated supplier payment process.  
saving it to the Council's 
Intranet 
  
Title 
Date 
Comments 
Status at the date of the AP 
draft report and action 
2 Integra 2 - 
11/08/2015  The e-forms guidance references multiple e-forms which aren't used 
This 
guidance 
has 
been 
E-Forms 
Guidance  
by LB Barnet staff: - New Vendor Request Form - Set up a new vendor on the system 
in order to raise PO's (this has only been available to staff since 
05/11/18) - New Contract/Contract Variation Form - Create a new or vary an existing 
contract 
on 
Integra 
replaced with " API E-Form 
Vendor Process V1.0" and 
"New Supplier and Supplier 
Amendment Process V1.0" 
Action: Process documents 
no longer relevant will be removed from the Intranet. 
- Framework Order Form - Set up profiled payments for a particular vendor There is a section on the API e-forms which states that users need to 
check: 
- Does the requirement appear on the exemptions list? 
- 
Will 
the 
requirement 
be 
a 
one-off 
payment? 
- Can the requirement be paid by an alternative method, i.e. P-card or 
Purchase 
Order 
The API workflow is shown as USER > LINE MANAGER > PROCUREMENT > ACCOUNTS PAYABLE, which is in line with known 
process.  
The guidance is limited to this and telling people how to access the forms in Integra. The guidance has not been updated for more than three years, and does not reflect the current available e-forms.  
3 API Debit E-
11/08/2015 This is a step by step guide to using the API debit e-form, and is in 
This 
guidance 
has 
been 
Form Guidance 
line with process. However, it doesn't give any information to the user about when it is appropriate to use an API debit e-form. The guidance has not been updated for more than three years and is currently under review.  
replaced with "API E-Form Vendor Process V1.0". An API Exemption list has been approved, documented and 
communicated 
to 
all 
relevant parties, including AP. 
  
Title 
Date 
Comments 
Status at the date of the AP 
draft report and action 
Action: Process documents 
no longer relevant will be 
removed from the Intranet. 
4 FAQs 
03/02/2016 This was guidance issued at the point of the 2016 relocation of the 
 **Action**: The process will be 
updated as necessary and communicated, 
including 
Accounts Payable service to ensure staff knew what the changes would entail. The information about the complaints procedure states that any escalation should be referred to xxx. As such, this guidance needs to be updated in the wake of his departure.  
saving it to the Council's 
Intranet 
5 Supplier 
03/02/2016 This process is out of date and has been superseded by the supplier 
This 
guidance 
has 
been 
Adoption 
replaced with "New Supplier 
and 
Supplier 
Amendment 
Process V1.0" 
Action: Process documents 
no longer relevant will be removed from the Intranet. 
creation process linked below. It references a 2015/16 pilot of an e- Form within Integra, and describes the process for using this and states that the e-form will supersede paper forms as of 01/04/2016 if the pilot is successful. However, as paper forms are still in place at the date of this audit (October 2018), it does not seem that the pilot was successful. As such, this page should have been removed from the intranet at the point where it was decided that the e-form would not be used.  
  
Title 
Date 
Comments 
Status at the date of the AP 
draft report and action 
6 No PO, No 
03/02/2016 The Council's No PO, No Pay policy reflects the requirements of the 
Pay 
 **Action**: The process will be 
updated as necessary and 
communicated, 
including 
Council's financial regulations around POs. The only exceptions 
noted are around SWIFT payments from Family Services and Adult Social 
Care 
and:  
saving it to the Council's Intranet 
- contracts under seal or documented by the Head of Legal/Director of HB Law (joint Legal Service) which do not require subsequent orders 
to 
be 
placed 
- gas, water, electricity, telephones, periodical payments and annual subscriptions - cash purchases properly defrayed from loan accounts or advances from petty cash This document does not cover other forms of no PO transactions (like those on the exempt list), and has not been updated since February 
2016. 
7 Electronic 
03/02/2016 This is the covering note for the guidance which was created at the 
API and Debit Notes 
point of the roll-out of the electronic API form. It states that any queries should be referred to xxx. As such, this guidance needs to be updated in the wake of his departure.  
This guidance has been replaced with "API E-Form Vendor Process V1.0". An API Exemption list has been approved, documented and communicated to all relevant parties, including AP. 
Action: Process documents 
no longer relevant will be removed from the Intranet. 
  
Title 
Date 
Comments 
Status at the date of the AP 
draft report and action 
8 Vendor Set-
03/02/2016 The supplier e-form process map describes the e-form process in 
Up E-Form 
Process Map 
This guidance has been 
replaced with "New Supplier 
and Supplier Amendment Process V1.0" 
place for new suppliers. There are limitations with the process, as it 
does not include any verification of whether the supplier is a duplicate supplier. Additionally, the process was not adopted at the point where this process map was made, and until now, new supplier setup has taken place on paper forms. This process map has not been updated since February 2016 and may therefore be out of date in the new Integra system. A new process has been instituted, and as such this may need to be re-mapped.  
9 New Vendor 
03/02/2016 This is a step by step guide to using the new vendor e-form. 
This 
guidance 
has 
been 
E-Form 
User Guide 
replaced with "New Supplier 
and 
Supplier 
Amendment 
However, the use of the new vendor e-form was not rolled out across 
the council at this time. The guidance has not been updated for more than three years, and a new process has been instituted for vendor set-up (see Supplier Creation below). As such, this has been superseded.  
Process V1.0" 
Action: Process documents 
no longer relevant will be removed from the Intranet. 
10 Accounts 
01/06/2018 While this page has been recently updated, it names xxx as key 
contact for queries and issues and as such needs to be updated in the wake of her departure.  
 **Action**: The process will be 
updated as necessary and communicated, 
including 
Payable - New Processes 
saving it to the Council's 
Intranet 
11 Supplier 
02/07/2018 This is the paper-based process for the creation of new suppliers. It 
This 
guidance 
has 
been 
Creation 
was superseded by e-forms for supplier set-up on 05/11/18 
replaced with "New Supplier and 
Supplier 
Amendment 
Process V1.0" 
Action: Process documents 
no longer relevant will be removed from the Intranet. 
  
Title 
Date 
Comments 
Status at the date of the AP 
draft report and action 
12 New Vendor 
02/07/2018 This is the paper-based form for the creation of new suppliers. It was 
Form 
superseded by e-forms for supplier set-up on 05/11/18 
This guidance has been 
replaced with "New Supplier 
and Supplier Amendment Process V1.0" 
13 API 
13/09/2016 This list is not linked to on the Accounts Payable pages, and was 
exemptions list 
An API Exemption list has been approved, documented and communicated to all relevant parties, including AP. 
Action: Process documents 
no longer relevant will be removed from the Intranet. 
found by searching the intranet. It is held within the Procurement pages. The Accounts Payable team at Chichester did not have access to a copy. The form states that it can be used for "small value one-off vendors", but does not define small value. It can be assumed that this is lower than £25k, at which point a contract is required under the Contract Procedure Rules, but it's not clear whether the cut-off is as low as £10k, the highest value at which no evidence of multiple competitive quotations is required.  
14 Integra FAQ 
04/07/2018 This document responds to FAQs. The document is out of date as it 
0.2 
does not reflect the new supplier request process, and names xxx as 
a key contact for escalation. It also refers users to a Requisitions User Guide which is not linked to on the intranet.  
 **Action**: The process will be 
updated as necessary and communicated, including 
saving it to the Council's 
Intranet 

## Appendix 5: Follow-Up Of Past Audits - Accounts Payable 2017-18

| Ref                         | Finding              |
|-----------------------------|----------------------|
| Risk                        |                      |
| rating                      |                      |
| Recommendation              |                      |
| Responsible                 |                      |
| officer                     |                      |
| Due date                    | Outcome of follow-up |
| Head                        | of                   |
| Accounts                    | Payable              |
| Potential                   | Duplicate            |
| High                        | 1) CSG Finance       |
| will investigate the        |                      |
| introduction                | of                   |
| Payments                    |                      |
|                             |                      |
| We                          | discussed            |
| Exchequer                   |                      |
| Services,                   |                      |
| CSG                         |                      |
| automated controls within   |                      |
| Integra                     | to                   |
| duplication                 | of                   |
| third-party                 |                      |
| software or fit for         |                      |
| purpose                     |                      |
| automated                   |                      |
| controls                    | will                 |
| built                       | into                 |
| details. Because these      |                      |
| controls rely on data       |                      |
| being entered correctly,    |                      |
| they have historically not  |                      |
| been very successful at     |                      |
| automatically               | detecting            |
| system to identify,         |                      |
| report and prevent          |                      |
| duplicate                   |                      |
| payments. This will         |                      |
| include identifying         |                      |
| where                       | attempts             |
| are                         | made                 |
| progress duplicate          |                      |
| invoice                     | numbers              |
| duplicates, and although    |                      |
| there are other secondary   |                      |
| controls management do      |                      |
| not consider them of        |                      |
| sufficient robustness to    |                      |
| prevent the processing of   |                      |
| duplicate                   | invoices.            |
| for payment and a           |                      |
| formal                      | exception            |
| reporting                   | and                  |
| (Corporate                  | Anti-Fraud           |
| Team) co-ordinate the       |                      |
| relevant service uploads    |                      |
| data to the Cabinet Office  |                      |
| for the NFI data matching   |                      |
| exercise.  In relation to a |                      |
| 'duplicate                  | payments'            |
| match                       | the                  |

Payable team upload the requested data from Integra directly to the NFI portal which results in the Cabinet Office sending matches back that relate 

| 31/07/2018 In interviews with the AP team, it was    | Complete    |
|------------------------------------------------------|-------------|
| confirmed that the fuzzy match is now in             |             |
| place within the AP workflow, and that               |             |
| potential duplicates are investigated before         |             |
| any payments are released. We requested              |             |
| copies of the fuzzy match for given dates            |             |
| and were provided with these. We verified            |             |
| that the creation date of the reports                |             |
| matched the dates requested, and that the            |             |
| report included a column to record the               |             |
| outcome of the assessment by the AP                  |             |
| team of whether the potential matches                |             |
| were real duplicates or not. We reviewed             |             |
| the parameters of the fuzzy match, and               |             |
| agreed that they are sufficient to identify          |             |
| potential duplicates. This meets the                 |             |
| requirement                                          | within      |
| recommendation                                       | for         |
| automated control within the system.                 |             |
| Discussions about the use of AP Forensics            |             |
| are                                                  | ongoing.    |

 We were provided with evidence that a historic fuzzy report was completed for both Barnet and Cambridge Education in August 2018. This identified duplicate payments for Barnet (£11k) and for CE (£0.5k) and the recovery process has been started for these by the Accounts Payable Team. 
Note: AP Forensics has still not been implemented therefore we have raised this as a medium risk rated finding above, refer to paragraph 3 (Finding 3) 
to possible duplications.  
However, a high volume of potential matches is received from the NFI making it difficult to 

2) Working with 
relevant stakeholders, including Commissioning 
Group 
Finance, 
CAFT, CSG 
procurement and delivery units, a data cleanse of identify any true duplicate and CAFT have found that the high number of false duplicates identified make it uneconomical to investigate these Integra vendor data will be performed to ensure that the data is of an transactions. Due to the same data issues, the Accounts Payable team have not been able to perform their own review of data to identify appropriate quality to successfully duplicate invoices support the submitted for payment.  
automated controls (1) and also the NFI and/or other data matching exercisesincluding in house exercises. These actions (1) and (2) will be completed well in advance of the next NFI 
data uploads in 

September 2018. 
Head 
of 
AP7 
BACs 
Reconciliation 
Control 
operating 
High 
1) We will retain evidence 
of 
the 
preparation 
of 
Exchequer Services, 
CSG 
effectiveness - High risk 
Out of a sample of 25 BACS runs 25 exceptions 
each BACS run to ensure that there is 

Management were able to demonstrate that a historic exercise has been carried out by the Accounts Payable team to identify and investigate suppliers who share bank details. This exercise found 
286 bank accounts which were attached to more than one supplier. An investigation was carried out into the root cause of the duplication, which revealed that a large number of these potential duplications were legitimate cases of multiple suppliers sharing a bank account (e.g. multiple family members using a single bank account), but that there were instances where supplier accounts had been duplicated. 

Additionally, a report was run of suppliers not used in the last 18 months. As a result of these two exercises, a list of 88 duplicate and 134 dormant suppliers to be deleted from Integra has been generated. 

However, no evidence was provided to show that the agreed cleansing has taken place. Management confirmed that this has now been approved and stated that a data cleansing exercise will be carried out as soon as possible. We have seen evidence that the NFI data upload took place on 18/10/18. As a result, this data cleansing exercise will be too late to influence the efficiency of the NFI data matching exercise.  

| 30/04/2018 We have reviewed a process note, which    |
|------------------------------------------------------|
| demonstrates that the Operational Team in            |
| CSG Finance receives an e-mail from                  |
| Integra Team at Capita Local Government              |
| Services advising that the PRL610 (which             |

an audit trail to demonstrate appropriate segregation of duties.  
were found. Each BACS 
run is prepared by the AP team and then sent to the Capita Group Payments team who confirm the total amount paid by email. 

While management were able to provide the confirmation emails from Capita, they were not able to provide us with evidence of the preparation of the BACS report or evidence that the BACS amount has been agreed to the confirmation email so we have been unable to confirm appropriate segregation of duties. 

is the BACS run) has been run and is ready to check.  A member of the Operational Team runs a report showing the total BACS run and another showing payments to suppliers which include invoices over 
£35k.  The invoices over £35k are printed and both reports are given to one of the approved signatories in CSG Finance to check and sign.  The Operational Team then reply to Integra Team at Capita Local Government Services advising that the BACS has been checked and is ok to process. A copy of the BACS report is printed, signed and then retained in a folder maintained by the CSG Finance team. We reviewed evidence that this process was followed on a sample of named days and were provided with evidence that the process is operating in accordance with the process note and that supporting 

information is retained. July 2018 Audit Committee update: Management confirmed that evidence now remains within the Integra system and that there is inbuilt segregation of duties due to the separate teams that are involved in file transmission. 
Additionally, 
once 
the 
Payment Production Report/Update has been run in Integra it cannot be amended. 
Note: We have raised a low risk rated 
action for BACS reconciliation above, 
paragraph 3 Finding 7.   
 

| Medium 1) We will ensure    |
|-----------------------------|
| Exchequer                   |
| Services,                   |
| CSG                         |
| that up to date             |
| procedure and               |
| process                     |
| documents are               |
| made available to           |
| all relevant CSG            |
| and Capita staff.           |
| AP8                         |
| Policies, Procedures        |
| and Process notes           |
|                             |
| All policies and            |
| procedures are held in      |
| hard copy within a          |
| physical folder within the  |
| AP team work area at the    |
| Council. The majority of    |
| Accounts Payable            |
| processing is undertaken    |
| remotely in Sussex and      |
| Darlington; management      |
| should ensure all policies  |
| and procedures are          |
| uploaded to an              |
| appropriate shared drive    |
| so employees have           |
| remote access to all        |
| relevant documents.         |
| 31/03/2018 Key Accounts Payable and Treasury    | Complete    |
|-------------------------------------------------|-------------|
| processes have been through an                  |             |
| extensive update and approval process in        |             |
| 2018. These are:                                |             |
| * Treasury Payment Process                      |             |
| * Manual Uploads for BACS Payments              |             |
| * New Supplier and Supplier Amendments          |             |
| * API process                                   |             |
| The documents have been shared with             |             |
| staff as they have gone live, and as such,      |             |
| this action is deemed complete.                 |             |
|                                                 |             |
| Note: We have raised a medium risk              |             |
| rated action for the review and update of       |             |
| policies                                        | and         |
| paragraph 3, Finding 6, as some                 |             |
| procedures are out of date at the date of       |             |
| the draft report.                               |             |

## Appendix 6.1: Outcome Of Detailed Testing From 'Payments Data Analytics And Matching Exercises' (Pdame), Reported In February 2019:

ToR ref 
Test name 
Data Analysis exceptions 
Summary of testing 
Referred to AP 
291 of 4758 unique vendor numbers (6.1%) 
Manual review of all transactions carried out, which identified that all changes of account number have been correctly identified through the testing for 2.1 (see below).  
1.1 
Vendors Receiving Payments into Multiple Bank Accounts (excluding one-time vendor supplier codes, where 
this is expected) 
The remaining items identified for review are due to changes to sort code. These changes are part of a national exercise where major banks have changed 
sort codes to ringfence business from personal banking. We used an online sort code checker to verify that where the first two digits of the sort code (the bank identifier) were not the same, these were still the same entities. https://www.sortcodes.co.uk/checker.html Manual review carried out to verify whether multiple suppliers using the same bank accounts is appropriate. 
101 of 6515 unique vendor 
numbers (1.6%) 
1.2 
Multiple Vendors Receiving Payments into Common 
Accounts 
AP 55 potentially duplicate suppliers sharing 27 bank accounts have been referred to AP for further investigation and deletion if found to be genuine duplicates. CAFT Where suppliers who do not have any clear link are identified, refer to CAFT for further investigation in 
case accounts are fraudulent. CAFT to verify the 
Referred to CAFT 
Agreed Action September 2019 
N/A 
N/A - all changes are sort code changes and in line with expectations. 
N/A - no changes need to be referred to CAFT which haven't already been referred under 2.1. 
AP 
7 suppliers across 3 bank accounts 
55 potential duplicate suppliers across 27 bank accounts 
a. Resolved (no fraud implications), 2 bank accounts covering 
4 
suppliers 
AP to resolve for deletion, where applicable, the remaining 52 matches. 
b. In progress: For 1 
bank 
account 
covering 
3 
suppliers, 
below, 
Resolved: 3/55 suppliers deactivated in Integra 
request sent to AP for 
further 
In progress: 
52/55  
information, 
awaiting response: 
AP to respond to further request for information from CAFT in 
relation to the one 
ToR 
ref 
Test name 
Data Analysis 
exceptions 
Summary of testing 
Referred to 
AP 
ownership of the bank accounts referred and to use POCA legislation where appropriate. 
 
Payments relate to fostering and adoption.  
 
1.3 
Vendors Receiving Payments into Bank Accounts Linked with Council or Capita 
Employees* 
2 of 6515 unique bank account numbers 
(0.01%) 
Manual review of all exceptions carried out. 
52 of 306 changes to 
2.1 
Amendments to 
Supplier Bank Details 
CAFT 
Referred to 
CAFT 
Agreed 
Action September 2019 
 
- 
Goldsmith 
Personnel Ltd 
outstanding bank account.   
 
- Aventis Solutions Limited 
Responsible officer: 
- MidCo Care Ltd 
Accounts Payable Manager, Accounts Payable, CSG 
 
Target date: 
 
1 October 2019 N/A  
N/A 
Payments 
to 
2 
bank accounts to confirm that two employees 
are 
foster carers/adopters and 
therefore 
entitled to ongoing payments. CAFT 
have 
completed investigation - no 
issues noted  
Amendments 
to 
AP 
Amendments to bank 
bank accounts for 
7 suppliers 
AP to confirm 
that changes 
ToR 
ref 
Test name 
Data Analysis 
exceptions 
Summary of testing 
Referred to 
AP 
bank accounts 
details (17.0%) 
Referred 7 suppliers with temporary bank account changes, where payments were made, to CAFT to confirm that they were to accounts held by the individuals/organisations linked with them. AP Where there was no supporting documentation demonstrating that this is a valid change that has been requested by the supplier (totalling 24 bank 
detail changes), AP asked to confirm directly with the 13 suppliers that the current bank details in the system are correct. All bank accounts shared by 3 or more vendors were reviewed in detail including a review of payments made in the period. 
2.2 
Multiple Vendors Sharing a Common 
Bank Account 
For 
all 
bank 
accounts 
with 
2 
suppliers, 
296 of 11,318 distinct supplier numbers in master data 
(2.6%) 
names/addresses were reviewed to assess whether reasonable. The volume of such suppliers makes it not 
practical to review them at transaction level if there's a 
clear link by name or address between them. 
Referred to 
CAFT 
Agreed 
Action September 2019 
 
accounts for 13 Suppliers 
a. 
Resolved: 
Amendments 
to 
to bank details for 9/13 suppliers are correct in Integra.   
bank details of 7/7 suppliers considered 
valid 
Responsible officer: 
and non-fraudulent 
 a. Amendments to bank details for 4/13 resolved as 
correct by AP. 
Accounts 
Payable Manager, Accounts Payable, CSG 
 
Target date: 
 
1 October 2019 
 
 
b. Confirmation by AP that changes to bank details were correct for 9/13 suppliers still in progress.  
AP 
Referred 8 suppliers across 2 bank accounts, 6 vendors share one account and 2 vendors share one account. 
Referred 284 potential duplicate or dormant suppliers who should be made inactive. 
a. 8 suppliers 
across 2 bank 
AP to confirm that deactivation where appropriate for 
146/284 
vendors 
sharing 
ToR 
ref 
Test name 
Data Analysis 
exceptions 
Summary of testing 
Referred to 
AP 
Referred to 
CAFT 
Agreed 
Action September 2019 
AP 
common bank accounts.  
a. 138/284 already deactivated. 
AP to respond to 
further 
b. 146/284 in progress. 
request 
for 
Final 
queries. 
accounts in progress. CAFT have requested further information from AP, Investigations cannot continue until this is received 
 
information from CAFT in relation to two 
outstanding bank accounts. 
Responsible officer: 
If either name or address is clearly linked, accounts are less likely to be suspicious/fraudulent but may be unnecessary duplicate or dormant accounts. These potential duplicate / dormant suppliers (284 suppliers across 135 bank accounts) were referred to AP. AP have identified that although many suppliers do appear to be duplicates, the majority of them are payments to care homes on behalf of individuals. For 
example, 5 suppliers with bank one bank account are all individuals but where the bank account is for the care home they are in. We had previously identified many of these but as these payments, in the vast majority, refer to Interface payments to individuals, AP were not able to review any backup to posted documents. CAFT 
Accounts Payable Manager, Accounts Payable, CSG 
Target date: 
1 October 2019 
Where there is no clear link between either name or address these were referred to CAFT for further investigation (8 suppliers across 2 bank accounts). 
N/A 
N/A 
N/A 
2.3 
Multiple Vendors Sharing one or more Email Addresses/Telephone 
Numbers 
Based on an initial review of the outputs of this test, the majority of shared email addresses were generic emails at companies and there was a clear link between the suppliers sharing contact details. There were no indications that an investigation of shared contact details would provide additional information on top of the testing carried out on 1.2 and 2.2, where vendors shared bank accounts.  
3140 (email addresses) and 2586 (telephone numbers) of 11,318 distinct supplier numbers in master data 
(27.7% and 
ToR 
ref 
Test name 
Data Analysis 
exceptions 
Summary of testing 
Referred to 
AP 
Referred to 
CAFT 
Agreed 
Action September 2019 
22.8% respectively for email addresses and telephone 
numbers) 
N/A 
12 supplier matches 
 
Any false matches (i.e. Building Society paying in accounts shared by multiple vendors/staff) were removed.  
198 of 4761 vendor numbers 
(4.2%) 
AP 
 
12/12 
resolved no 
issues  
3.1 
Vendors Sharing Either: Bank Accounts, Email 
Addresses or Telephone Numbers with Council or Capita Employees (On 
Transactional Data)* 
1 supplier match / to verify with originating service 
that payments made to the one vendor are legitimate due to them being a care leaver.  
12 suppliers were identified as also being employees or sharing bank accounts with employees but had not been paid through this route since 2016 (at the latest) or had not been paid at all. To minimise the risk of fraudulent activity, these dormant suppliers should be deactivated in Integra.  
Resolved no 
issues 
CAFT Payments were reviewed to assess whether they should be investigated further by CAFT. One vendor was referred to CAFT for them to verify that the payee is a care leaver 
 
389 matches  
389 matches  
AP 
4.1 
One Time Vendors (OTVs) Receiving 
389 of 2919 
OTV 
 
Of the 389 'OTVs' receiving multiple payments, the 
number of repeat payments were RAG rated as follows: 
a. 389 /389 
resolved - covered 
AP to confirm 
which matches 
have been set 
ToR 
ref 
Test name 
Data Analysis 
exceptions 
Summary of testing 
Referred to 
AP 
More than One 
Payment 
transactions 
(13.3%) 
 More than 6 
33 
 Between 3 and 5 
112 
2 
244 
Total 
389 Internal Audit work on GT15 confirmed that at the time there were no controls in place to prevent repeat one-time vendor transactions or to verify the validity of OTV payee bank details. AP 
AP asked to confirm which of the 389 'OTVs' have 
now been set up as suppliers. CAFT CAFT to review 389 matches, checking for any names already known to CAFT and that related bank accounts do belong to the same supplier. CAFT to review the outcome of the AP analysis (i.e. 
which 'OTVs' have not yet been set up as a supplier 
which involves more stringent controls).    
Referred to 
CAFT 
Agreed 
Action September 2019 
No feedback at the date of the draft 
report. 
up as suppliers and escalate related suspicious activity to CAFT where 
applicable. 
in 4.3. - no issues, for example OTV, that were identified as having two names to one account were checked and have links so no issues. 
Responsible officer: 
Accounts Payable Manager, Accounts Payable, CSG 
Target date: 
1 October 2019 
Some fraudulent payments that CAFT were already aware of as part of different Fraud investigation show up in this 
match. 
 
ToR 
ref 
Test name 
Data Analysis 
exceptions 
Summary of testing 
Referred to 
AP 
Referred to 
CAFT 
Agreed 
Action September 2019 
 
AP 
8 bank accounts  
 
4.2 
One Time Vendors Receiving Payments into Multiple Bank 
Accounts 
AP to complete the review of 
52 matches   
96 of 2152 unique bank accounts receiving payments 
(4.5%) 
52 bank accounts not checked by IA 
 
72 bank accounts referred to CAFT consisting of 20 reviewed as part of the sample 44 and 52 not part of the sample reviewed 
by Internal Audit. 
Responsible officer: 
Accounts Payable Manager, Accounts Payable, CSG 
Target date: 
a. OTV payments to 9/72 bank accounts resolved no issues. Further 5 already known to be Fraudulent as part of on-going CAFT investigation 
1 October 
2019 
Of 96 unique bank accounts used, Internal Audit (IA) reviewed a sample of 44 (46%) and 52 (54%) were not reviewed 22 (50%) were due to an inputting error having been made (e.g. an incorrect digit in a bank account number). We confirmed that no successful invalid payments had been made as a result. AP 8 (18%) were referred to AP to confirm that invalid payments were not made (totalling £3,996 in value). AP were able to provide assurance over £325 of this 
amount but for the remaining three payments 'All 
payments were done via a OTV & were processed as API's / pre-authorised payments. AP not advised of any BACS rejects' For 52 bank accounts not checked by IA, AP asked to provide any information available from when vendors were set up.  
a. Matches relating to 8 bank accounts covering £325 / £3,996 (8%) resolved - no issues as to validity of payments (2 bank accounts), remaining 6 bank accounts referred to CAFT 
b. OTV payments covering remaining 58 bank accounts may need to be checked pending AP response if any raise suspicions of Fraud 
Note: CAFT 8/8 referred to AP, above, were also referred to CAFT to confirm that the accounts belonged to the same payee.  CAFT to review the outcome of the AP analysis (i.e. any supporting documents from when 'OTVs' were set up).  
 
b. Matches 
relating to 52 bank 
ToR 
ref 
Test name 
Data Analysis 
exceptions 
Summary of testing 
Referred to 
AP 
Referred to 
CAFT 
Agreed 
Action September 2019 
CAFT 
requested 
If there is no evidence via that route, then CAFT to consider 
use 
of 
the 
POCA 
powers 
and 
if 
accounts - in 
progress. 
further information from 
AP. 
Explanation to be provided as to why one supplier has more 
than 
one 
account. 
To 
provide 
evidence 
for each supplier 
as Integra does not show invoices. 
possible/practical, for example, under a financial investigation, to obtain relevant information. 14 (32%) were referred to CAFT to confirm that the accounts belonged to the same payee. The remaining 52 unique bank accounts used, which were not reviewed by Internal Audit in detail, were 
referred to CAFT to confirm that the accounts belonged to the same payee.  
 
AP 
N/A 
77 bank accounts shared by 260 OTVs reviewed  
Matches were reviewed and excluded those clearly to the same vendor (i.e. minor spelling differences, shared family name, acronym used instead of full business name).  
4.3 
One Time Vendors Receiving Payments into Common 
Accounts 
a. 
Resolved 
no 
CAFT 
AP to complete the review of remaining 
13 
398 of 2152 unique bank accounts receiving payments 
(18.5%) 
issues 56/77 - links between 
vendors 
with 
different 
bank accounts and 
escalate 
names 
were 
established, 
for 
any suspicions 
to CAFT.   
example 
an 
The remainder 77/398 bank accounts relating to 260 OTVs were referred to CAFT for investigation, these include some names that were previously known to 
CAFT. 
 
individual OTV was a director of the related 
company 
Responsible officer: 
OTV, so having the same 
bank 
account for each was 
considered 
satisfactory. 
Accounts Payable Manager, Accounts Payable, CSG 
 
Target date: 
ToR 
ref 
Test name 
Data Analysis 
exceptions 
Summary of testing 
Referred to 
AP 
Referred to 
CAFT 
Agreed 
Action September 2019 
b. 7/77 - Already known 
to 
be 
1 October 2019 
fraudulent as part of 
an 
ongoing 
 
Fraud investigation c. 
1/77 
- 
one 
transaction appears to have 
been paid to a different supplier in error. 
This 
has 
been reported to AP d. 
13/77 
–The 
majority 
are 
unexplained 
and 
need 
to 
be 
explained 
by 
Finance as to why there are several names against one account 
(for 
example 
Barnet 
Homes 
bank 
account 
has 
several suppliers).  
CAFT 
have 
completed checks on Integra. There 
are some matches 
which 
remain 
ToR 
ref 
Test name 
Data Analysis 
exceptions 
Summary of testing 
Referred to 
AP 
Referred to 
CAFT 
Agreed 
Action September 2019 
unverified 
and 
have 
been 
escalated to AP for further review and for them to respond with 
any 
suspicions. 
All payments were reviewed for reasonableness. 
N/A 
N/A 
16 matches investigated 
16/26 Payments which required further investigation 
were referred to CAFT. 
4.4 
One Time Vendors Receiving Payments into Bank Accounts 
Linked with Council 
or Capita Employees* 
26 of 2152 unique bank accounts 
receiving payments 
(1.2%) 
Resolved 16/16 - no issues, mainly for verification of season ticket repayments and 
council tenancies,  
 
*Capita employee data not received and therefore not yet performed. 

Appendix 6.2 Observations from Payments Data Analytics and Matching Exercises' reported in February 2019. As part of the PDAME, the following system observations were noted which if implemented could potentially improve financial processes. Our view is that these observations must be considered by officers with the appropriate expertise for potential current and future upgrades to Integra and related processes.  

| Agreed Action                                                                                    |
|--------------------------------------------------------------------------------------------------|
| CSG/LBB AP Business Partner                                                                      |
| Council / CSG Finance management will review the observations as a basis for implementing        |
| changes in Integra, in current or future versions/updates based on a risk/cost/benefit analysis. |
| 31 March                                                                                         |
| 2020                                                                                             |
|                                                                                                  |
| Observations which further mitigate fraud risk will be prioritised for assessment.               |

## Observation

1. Functionality to match bank transactions to the accounting system is currently underutilised  
 
The Integra accounting system has the functionality to upload bank account statements into the system, which enables the matching of incoming and outgoing payments on an individual transaction level to the transactions in the accounting system. We noted that bank account statements are uploaded for only 4 out of the 28 accounts we looked at and that this functionality is not actively used for any of the accounts. Utilising this functionality could make the performance of the bank account reconciliations more efficient and effective and provides assurance that transactions in the ledgers in the accounting system accurately reflect the transactions on the bank statement. 

2. Bank account reconciliations not on individual transactional level Bank account reconciliations happen on a monthly basis, but are only reconciled on a total monthly movement and not at an individual transaction level. This in combination with the above finding creates the (fraud) risk that the ledgers do not accurately reflect the actual payments made as per the bank statements. 

3. Manual journals used for correction are inconsistent We noted in the accounting system that correcting manual journal postings are made. These journals are not always made on the same aggregation level; some journals reflect individual transactions, some roll up to weekly, and some up to monthly corrective manual journals. Additionally, it is not always directly clear from the manual journal description the reason and source of the corrections.  
4. Integra only stores detailed information for transactions that originate in Integra Transactional information like payee information (vendor ID, name and associated bank account information) is not stored for transactions that originate / are initiated outside Integra. When implementing Integra, the design decision has been made to only record the transaction in the accounting system, but not store any of the data associated to that transaction in Integra. This means that only about a quarter of the value paid out by Barnet Council can be analysed using Integra due to missing information. 

5. Payment Audit'-files only retained for 1 month The bank transactions alone don't provide all the information required to perform the analyses in this review, therefore additional data needed to be added from Integra. All required information is captured in the 'Payment Audit'-files within Integra but currently these reports are not stored automatically and are deleted on a monthly basis as part of system housekeeping to avoid latency and slowness in using Integra (which has been a problem in the past). Capita has verbally confirmed that this has now been amended and these specific reports will be retained on an ongoing basis. 

## 

6. A lack of centralised knowledge on where payment information is held During our procedures, we noted on multiple occasions that there was a general lack of knowledge on what data was held on the system and where. Before the review it was believed that the transactions for the 28 non-school LBB bank accounts on Bankline were held on Integra. Only during the course of the review, it became clear that for only 15 out of 28 accounts the transactions are captured in Integra. At a very late stage it also became clear that from the 15 bank accounts held on Integra, only 1 account had the full supplier bank account details captured. It was noted that it is not easy to find where a transaction originated through Integra. 7. Inconsistent naming convention We noted that there are either no clear rules around naming conventions in outgoing transactions, or that these are not adhered to. For example, in the one-time vendor transactions you see a large variation in payee names for the same recipient. The table below shows an example of 3 one time vendor transactions for the same individual, same bank account*, under varying naming conventions. 

## 8. Evaluate The Need Of All Bank Accounts There Are A Large Amount Of Bank Accounts Of Which Some Have A Small Amount Of Transactions Associated With Them.

9. Misalignment of payment types between Bankline and Integra Payment types are misaligned between Integra and Bankline. We identified that Barnet's Bankline transactions contained 13 different payment types, however in the data from Integra there are 6 payment types used (there are a total of 10 defined in the system). Please refer to Appendix 2 for a full overview of payment types in Integra and Bankline. 

When performing our reconciliation between Integra and Bankline we noted that there is a many-to-many relationship for payment types between the two systems. This means that payment types in Integra can relate to multiple payment types in Bankline and those same payment types in Bankline can relate to multiple payment types in Integra. Because of this, there was no possibility to map transaction types between systems and therefore we did not proceed using payment type in our reconciliation. For illustration purposes see the example below. Example: Payment type A in Integra could consist of transactions of payment types X and Y from Bankline, while at the same time payment type Y can also be Integra's type B. Therefore, there is no mapping between payment types possible which makes might not impact processing, but makes recognizing, reconciling and controlling transactions significantly more complex. 

 

## Appendix 7 - Internal Audit Roles And Responsibilities

Limitations inherent to the internal auditor's work We have undertaken the review of *Banking and Payment Arrangements (Accounts Payable)*, subject to the limitations outlined below. 

## Internal Control

Internal control systems, no matter how well designed and operated, are affected by inherent limitations. These include the possibility of poor judgment in decision-making, human error, control processes being deliberately circumvented by employees and others, management overriding controls and the occurrence of unforeseeable circumstances.  

## Future Periods

Our assessment of controls is for the period specified only.  Historic evaluation of effectiveness is not relevant to future periods due to the risk that: 

- 
the design of controls may become inadequate because of changes in operating environment, law, regulation or other; or 
- 
the degree of compliance with policies and procedures may deteriorate. 
Responsibilities of management and internal auditors It is management's responsibility to develop and maintain sound systems of risk management, internal control and governance and for the prevention and detection of irregularities and fraud. Internal audit work should not be seen as a substitute for management's responsibilities for the design and operation of these systems. We endeavour to plan our work so that we have a reasonable expectation of detecting significant control weaknesses and, if detected, we shall carry out additional work directed towards identification of consequent fraud or other irregularities. However, internal audit procedures alone, even when carried out with due professional care, do not guarantee that fraud will be detected. Accordingly, our examinations as internal auditors should not be relied upon solely to disclose fraud, defalcations or other irregularities which may exist.