## Applefields School City Of York Council Internal Audit Report 2015/16

| Actions    |
|------------|
|            |
| 0          |
|            |
Overall Audit Opinion 
Substantial Assurance 

 Business Unit: Special Schools, Headteacher: A Booker Date Issued: 10/12/15 Status: Final Reference: 15666/005 
 

## Summary And Overall Conclusions Introduction

This audit was carried out on Thursday 14th May and Thursday 15th May 2015 as part of the Internal Audit plan for Education, Skills and Children's Services for 2015/16.  

## Objectives And Scope Of The Audit

The purpose of this audit was to provide advice to the Governors, Head Teacher and the Authority's Section 151 Officer about the financial management procedures and assurance that internal controls of the school were operating effectively to manage key risks, both financial and otherwise. The audit covered the following areas in accordance with the specification issued on 27th January 2015: - 
Governance;  

- 
Financial Management;  
- 
System Reconciliation; 
- 
Petty Cash 
- 
Contracts - Ordering, Purchasing and Authorisation;  
- 
Income;  
- 
Capital and Property; 
- 
Additional School Activity Provision; 
- 
Human Resources; 
- 
Payroll; 
 
- 
School Meals;  
- 
Pupil Numbers;  
- 
Voluntary Funds Monitoring Arrangements;  
- 
Data Protection and Information Technology;  
- 
Insurance and Risk Management;  
- 
Joint Use Facilities; 
- 
Inventory Records; 
- 
Minibus. 
- 
Security; and 
- 
Safeguarding Arrangements. 

## Key Findings

The key findings in the audit related to maintenance of a staff register of interests, completion of a tender opening record, confirmation of the correct application of VAT exemption for sports lettings, ensuring contractors and private users of the school have adequate public liability insurance cover, completion of pre-employment checks, recording return to work interviews, registration of the school fund with the Charity Commission and adoption of a model publication scheme. 

## Overall Conclusions

It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided **Substantial Assurance**  

## 1 Register Of Interests

Risk 

The school did not maintain a register of interests for staff with financial responsibilities and who could potentially influence purchasing decisions. 

It was noted that a staff register of interests was not maintained at the school as required by the CYC Scheme for Financing Schools. Staff with financial responsibilities may be in a position to influence the placing of contracts in which they have a personal interest and must therefore ensure that all significant interests are declared. 

A register of business interests for staff with financial responsibilities should be set up and reviewed on an annual basis. The register should be promptly updated to include any new staff and should include "nil" returns. 

The register of business interests for staff with financial responsibilities will be set up by 
30th October 2015. In future it will be updated to include any new staff and will include "nil" 
returns. 

The school may be unable to fully account for purchasing decisions in the event of challenge. 

Priority 
3 
Responsible Officer 
Headteacher 
Timescale 
30th October 2015 
 

## 2 Contract Procedures

Risk 

The school did not complete a tender opening record for the cleaning contract procurement. 

The cleaning contract procurement was reviewed to ensure compliance with the Council's Financial Regulations and Contract Rules. It was noted that there had been no tender opening record completed to record the date and time of tender opening, the officers present and the returned tender values.  

A tender opening record should be completed for all tendered contracts. A pro-forma record has been sent to the school. 

Tender opening records will be completed for all tendered contracts in the future using the pro-forma record supplied. 

The schools procedures for the procurement may be open to challenge. 

## 3 Contract Review Schedule

| Issue/Control Weakness                                                          |
|---------------------------------------------------------------------------------|
| There was no evidence that all service contracts at the school are periodically |
| reviewed.                                                                       |

Although contract documentation is available for individual service contracts at the school, a central record of all service contracts at the school was not in place. Services to schools are discussed annually and the review of individual contracts recorded in Governor Minutes. However, there was no evidence to confirm that all continuing contractual arrangements are periodically reviewed to ensure they meet current requirements, have been correctly costed (for budget purposes) and are programmed for re- tender where applicable. 

It is recommended that a central schedule of current contracts is maintained and contract review at the school is evidenced through review of this record. A pro-forma record has been sent to the school. 

A central record of all service contracts at the school has been prepared by the Site Manager and Office Manager in order to ensure that continuing contractual arrangements are reviewed periodically to ensure they meet current requirements and are programmed for re-tender where applicable. The Bursar will use this record to ensure that contractual arrangements are correctly costed in the budget. 

The school may fail to obtain best value on school service contracts.  
3 
Responsible Officer 
Site Manager/Office Manager and Bursar 
Timescale 
30th October 2015 

## 4 Insurance

Risk 

The school does not adequately ensure that all private users of the school (under lettings) and contractors directly commissioned to complete works at the school have current and adequate public liability insurance cover. 

A number of minor works (eg electrical works and window cleaning) were completed by contractors directly commissioned by the school. Although the adequacy of the contractors public liability insurance cover held by these contractors may have been initially verified, there was no current  insurance certificate held on file to confirm continuing  compliance with CYC insurance requirements .This was also the case for  longer term contracts at the school (such as ground maintenance). It was also noted that not all groups using the school under letting arrangements had a current public liability insurance certificate on file. For one group only evidence of employers liability cover had been obtained and for a second group the level of public liability insurance was £3m and not the £5m cover generally required.    

For all users of the school under lettings agreements and for contractors directly commissioned to carry out works at the school, a current copy of the contractor's public liability insurance certificate, evidencing cover of at least £5m should be requested and retained. If a contractor is used or a letting continues on a regular basis, a system should be in place to ensure that an up to date copy of the insurance certificate is obtained when the expiry date has been reached. 

The Office Manager has written to all those currently letting the school premises and hydrotherapy pool and has seen up to date public liability insurance certificates evidencing cover of at least £5m. The Site Manager has also written to contractors used on a regular basis and has now seen the same information. This information will also be requested for any contractors new to the school or any new lessees. 

Costs may be incurred by the school in the event of a claim. 

## 5 Vat

| Issue/Control Weakness                                                        |
|-------------------------------------------------------------------------------|
| VAT on lettings income received by the school may not be correctly charged or |
| accounted for.                                                                |

The Hydrotherapy Pool was being used by several organisations under lettings agreements with the school. No VAT was charged on the invoices raised. However, it was not clear whether these lettings met all the 7 requirements for VAT exemption in particular it was not clear whether all these groups could be categorised an affiliated club, school, association or an organisation representing an affiliated club. 

Lettings at the school should be reviewed to ensure that invoiced charges include VAT where the letting does not meet all the VAT exemption requirements. It is suggested that the lettee is required to confirm that all the requirements are met. 

All lettings at the school have been reviewed to ensure that invoiced charges include VAT where applicable. Lessees were asked to complete a form to confirm that they meet all the VAT exemption requirements at the start of the autumn term 2015. Invoices for those not meeting the requirement have been charged VAT with effect from 1st September. The school will calculate any VAT due on such lettings for previous periods and will liaise with the CYC Schools Business Support Team and VAT Officer regarding any VAT correction that is required for previous years. 

HM Revenue & Customs may penalise the school for failing to account for VAT correctly. 

## 6 Pre Employment Checks

| Issue/Control Weakness                                                       |
|------------------------------------------------------------------------------|
| Insufficient evidence may be held on file to confirm that all pre-employment |
| checks have been completed.                                                  |

Personal files for a small sample of new staff were reviewed. It was found that in one case documents used to confirm the right to work in the UK had not been copied and retained on file. For a second member of staff there was no evidence that relevant qualifications had been verified. 

Evidence used to confirm the right to work in the UK should be in accordance with Border Agency Guidance and copies of documents used retained on file. Checks to confirm relevant qualifications are held should also be adequately evidenced and it is recommended that copies of certificates are held on file. 

The Office Manager will ensure that, in future, evidence used to confirm the right to work in the UK is in accordance with Border Agency Guidance and that copies of documents used as evidence are retained on file. She will also ensure that evidence of relevant qualifications has been verified and copies of certificates will be retained on file. 

 

Unsuitable staff may be employed at the school and the school may be unable to demonstrate compliance with section 8 of the Asylum and Immigration Act 1996 which may 
result in fines of up to £10,000. 

## 7 Sickness Records

| Issue/Control Weakness                                                        |
|-------------------------------------------------------------------------------|
| Return to work interviews after a period of sickness were not being completed |
| and recorded on the Council's Self Certification Form.                        |

Self Certification Forms completed for a small sample of staff sickness absences were reviewed and it was noted that a return to work interview had not been recorded.  

Every period of absence should be followed up by a return to work interview with the line manager/supervisor, usually on the first day of the employee's return to work. This should be completed in accordance with HR Guidelines and recorded on the City of York Council Self Certification Form. 

With effect from 1st September the Headteacher has ensured that every period of absence 
is followed up by a return to work interview within three days of the employee's return to 
work. This is being completed in accordance with HR Guidelines and recorded on the City of York Council Self Certification Form. 
Failure to comply with HR policy and procedures. 
Priority 
3 
Responsible Officer 
Headteacher 
Timescale 
1st September 2015 
 

## 8 School Fund

Risk 
The Charity Commission had removed the school fund from the Charity Commission Register. 

Charity Commission Registration had been withdrawn after failure to submit annual returns by the due date. It was understood that the school was in the process of applying for a new registration. Additionally, although accounts to 31/3/15 had been independently audited the annual audited accounts had not been presented to Governors. 

The school should continue to progress registration of the school fund with the Charity Commission. It is suggested that the number of trustees of the school fund include, at minimum, the current members of the Finance Committee. The Trustees/Governors should be presented with the independently examined accounts and annual report at the end of every financial year and have the opportunity to discuss the items of income and expenditure and uses of the fund. 

The application to apply for a new registration for the School Fund has been submitted to the Charity Commission. Trustees of the School Fund have been appointed and will include members of the school's Resources Committee of the Governing Body. The accounts for the School Fund were presented to the Staffing and Resources Committee at its meeting on 30th September 2015. 

The school fund is not a registered charity and is operating without a formal governing document and the control of Trustees.  

## 9 Publication Scheme

Risk 
The school had not adopted the Information Commissioners Model Publication Scheme for Schools and associated Guide to Information. 

Schools are required by the Data Commissioner to adopt the Model Publication Scheme for School. There was no evidence at the school that this had been done.  

The Information Commissioners Model Publication Scheme should be adopted by the school and approved by the Full Governing Body. This can be obtained from the ICO website and must be adopted in full, unedited and promoted alongside the Guide to Information. The approved Publication Scheme should be made available to parents eg published on the schools website. 

The school will adopt the Information Commissioners' Model Publication Scheme. This will be presented to the Governing Body for adoption at a meeting during the Autumn term. The approved Publication Scheme will be made available to parents by publication on the school's website. 

The school may not be complying fully with the requirements under the Data Protection Act (DPA), Environmental Regulations (EIR) and Freedom of Information Act (FOIA) 
and statutory requirements may be breached. 
Priority 
3 
Responsible Officer 
Headteacher and Office Manager 
Timescale 
18th December 2015 
 

## 10 Minibus

| Issue/Control Weakness              | Risk                                                |
|-------------------------------------|-----------------------------------------------------|
| Pre-drive checks were not recorded. | Failure to comply with the Councils Health & Safety |
| requirements for the minibus (CN30) |                                                     |

The minibus was checked on a weekly basis and a record of checks maintained. Minibus drivers are also required to complete basic pre-drive checks before driving the minibus. These checks were not being recorded. 

Drivers should be reminded of their responsibilities to complete pre use checks and completion should be evidenced in either the mileage log book or other suitable record. 

The Site manager has reminded drivers of their responsibility to complete pre-drive checks before driving the minibus. This is now being recorded on the minibus daily seating plan.  

## Xxxxxxxxxxxxxxx

| Issue/Control Weakness                                              |
|---------------------------------------------------------------------|
| xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx |
| xxxxxxxxxxxxxxxx                                                    |

xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx 

xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx 
Agreed Action 11.1 
xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx 
xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx 
Priority 
xxxxxxxxxxxxxxxx 
Responsible Officer 
xxxxxxxxxxxxxxxx 
Timescale 
xxxxxxxxxxxxxxxx 
 

## Audit Opinions And Priorities For Actions

Audit Opinions Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

Opinion Assessment of internal control 

| High Assurance                                                                                               |
|--------------------------------------------------------------------------------------------------------------|
|                                                                                                              |
| Substantial                                                                                                  |
| Assurance                                                                                                    |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |
| operation but there is scope for further improvement in the areas identified.                                |
|                                                                                                              |
| Reasonable                                                                                                   |
| Assurance                                                                                                    |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |
| environment is in operation but there are a number of improvements that could be made.                       |
| Limited Assurance                                                                                            |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |
| improvements required before an effective control environment will be in operation.                          |
| No Assurance                                                                                                 |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |
| key areas require substantial improvement to protect the system from error and abuse.                        |
|                                                                                                              |

 

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.