## Elvington Ce Primary School City Of York Council Internal Audit Report 2016/17

P3 
P2 
P1 
Actions 
8 
0 
0 
Overall Audit Opinion 
Substantial Assurance 

 Business Unit: Children's Services, Education & Skills, Headteacher: L Collier Date Issued: 13/12/16 Status: Final Reference: 15691/001 
 

## Summary And Overall Conclusions Introduction

This audit was carried out on Tuesday 28th June and Wednesday 29th June 2016 as part of the Internal Audit plan for Education, Skills and Children's Services for 2016/17. 

## Objectives And Scope Of The Audit

The purpose of this audit was to provide advice to the Governors, Head Teacher and the Authority's Section 151 Officer about the financial management procedures and assurance that internal controls of the school were operating effectively to manage key risks, both financial and otherwise. The audit covered the following areas in accordance with the specification issued on 17th May 2016: - 
Governance;  

- 
Financial Management;  
- 
System Reconciliation; 
- 
Petty Cash 
- 
Contracts - Ordering, Purchasing and Authorisation;  
- 
Income;  
- 
Capital and Property; 
- 
Additional School Activity Provision; 
- 
Human Resources; 
- 
Payroll; 
 
- 
School Meals;  
- 
Pupil Numbers;  
- 
Voluntary Funds Monitoring Arrangements;  
- 
Data Protection and Information Technology;  
- 
Insurance and Risk Management;  
- 
Joint Use Facilities; 
- 
Inventory Records; 
- 
Security; and 
- 
Safeguarding Arrangements. 

## Key Findings

The key findings in the audit related to ensuring all current Governors have a declaration of interests in place, ensuring the schools financial delegations are up to date, evidencing the recording the receipt and opening of quotations, encryption of data storage devices, adoption of a publication scheme and completion of inventory checks. 

## Overall Conclusions

An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance 
 

## 1 Register Of Interests

Risk 
| The register of interests for governors was incomplete.     |
|-------------------------------------------------------------|
| influence the placing of contracts in which they have a     |
| personal interest and the school may be unable to fully     |
| account for purchasing decisions in the event of challenge. |

The register of governors Interests was reviewed. One current governor had not completed a declaration. The missing declaration related to a governor whose term of office commenced after the annual update of the register was completed. 

## Recommendatisreion

The school should ensure that all governors have a current declaration of interest including governors commencing their term of office after annual renewal of the register. Any relevant interest registered should be taken into account to avoid conflicts of interest. 

Agreed Action 1.1 
This has been completed. 
Priority 
3 
Responsible Officer 
Headteacher/Chair of Governors/Clerk of Governors 
Timescale 
Completed 
 

## 2 Budget Management Policy

Risk 
The review of the budget management policy, financial delegations and terms of reference was incomplete.  

The budget management policy had been partially reviewed at the Staffing, Finance and Premises Committee on 26th April 2016. The policy had not been approved by the full governing body pending update of the financial delegations and schedule of responsibilities. Terms of reference had been passed to the relevant committees for review but had not been approved by the Full Governing body 

The update of financial delegations and responsibilities should be progressed . Terms of reference should be reviewed and approved by the full governing body on an annual basis. The approved budget management policy to include  financial delegations and terms of reference should be signed and dated by the chair to confirm there have been no subsequent amendments. 

Agreed Action 2.1 
This has been agreed at Staffing and Finance committee and will also be approved at the next FGB. 
The budget management policy, financial delegation and terms of reference may not reflect the schools current requirements 
Priority 
3 
Responsible Officer 
Headteacher/Chair of Governors/Clerk to Governors 
Timescale 
Spring 2017 
 

## 3 Contract Review

Risk 

The school has compiled a schedule recording current contractual arrangements, costs and contract end dates. This has not as yet been presented to Governors. 

A contract schedule has recently been put together by the Bursar detailing all ongoing contractual arrangements at the school. Procurement of an IT managed service was being undertaken at the time of the audit. The schedule had not been presented to governors to evidence that the arrangements, including those through CYC services to schools are reviewed at least annually and that procurements are effectively planned where appropriate.  

The Schedule of contracts now in place should be presented to Governors finance Committee on at least an annual basis to evidence review of contractual arrangements and provide assurance to governors of effective procurement planning 

Agreed Action 3.1 
To be actioned. 
Best value may not be obtained from service contracts at the school. 

## 4 Procurement

Risk 
| The receipt and opening of quotations is not recorded.    |
|-----------------------------------------------------------|
| the event of challenge.                                   |

Recent procurement in excess of £5K was reviewed. The main procurement completed directly by the school was a 9.6K net spend for resurfacing in the playground. Only two quotations could be found. No opening record for quotations had been completed to evidence that quotations had been opened at the same time by two officers. 

A minimum of three quotations must be sought for expenditure in excess of 5k and below 100K. Quotations should be held securely until the notified opening date after which all quotations should be opened together. This should be evidenced on an opening record signed and dated by two officers present at the opening. A sample of quotation opening record has been sent to the School. 

## Agreed Action 4.1

Recent procurement for IT has had three quotes. Records are retained. 

## 5 Income

Risk 

The schools schedule of charges had not been updated on an annual basis. Charges to the Elvington Under 5's group had not been reviewed for a number of years. 

The school has a lettings policy and a schedule of charges. There was no evidence that the charges had been reviewed and approved by the Full Governing Body in the last 12 months. It was also noted that the agreement with the Elvington Under 5's Group had not been reviewed for a number of years and charges which had originally been set to cover costs to the school had remained the same. A copy of the agreement could not be found at the time of the audit. 

The schedule of charges should be reviewed and approved by the Full Governing Body on an annual basis. The agreement and charges to Elvington Under 5's Group should be reviewed and revised to ensue all costs to the school are covered. 

## Agreed Action 5.1

Charges may be insufficient to cover costs to the school. 

## 6 Data Protection & Information Technology

Risk 
The school may be holding unencrypted personal data on data storage devices which may be vulnerable to being lost or stolen. 

The school has an approved E Safety Policy which specifies that any personal data held on the hard drives of lap tops or on memory sticks should be held securely and removed as soon as necessary, however Lap tops and memory sticks and other data storage devices are not currently not encrypted.  Encryption is advised by the Information Commissioner and guidance is available on the ICO website. It is understoond that the school is currently re-letting their ICt contract and encryption is specified withing this contract.  

The school should ensure that all lap tops, memory sticks and other devices which may be used to hold personal data are encrypted. 

Agreed Action 6.1 
Completed. Recorded in Single Central Record. The new IT company have ensured new laptops are encrypted also. 
Statutory requirements may be breached. The ICO has powers to levy fines of up to £500,000 for the most serious 
breaches of the data protection act. 
Priority 
3 
Responsible Officer 
Deputy Headteacher 
Timescale 
Completed. 

## 7 Publication Scheme

Risk 
The school has not adopted the Information Commissioners Model Publication Scheme for Schools and associated Guide to Information. 

Schools are required by the Data Commissioner to adopt the Model Publication Scheme and associated guide to information. This had not as yet been actioned by the school.  

The Information Commissioners Model Publication Scheme should be adopted by the school and approved by the Full Governing Body. This can be obtained from the ICO website and must be adopted in full, unedited and promoted alongside the Guide to Information. The approved Publication Scheme should be made available to parents eg published on the schools website and where possible the information referred to in the schedule made available via the website. 

Agreed Action 7.1 
To be actioned 
Priority 
3 
The school may not be complying fully with the requirements under the Data Protection Act (DPA), Environmental 
Regulations (EIR) and Freedom of Information Act (FOIA) and statutory requirements may be breached. 
Responsible Officer 
Headteacher/School Business Manager Summer 2017 

## 8 Inventory

| Issue/Control Weakness                                                       |
|------------------------------------------------------------------------------|
| The school's inventory record has not been checked by an officer independent |
| of maintaining the record.                                                   |
| Items which have been lost or misappropriated may not be                     |
| highlighted and investigated.                                                |

A recent check of the school's inventory had been completed by the officer responsible for maintaining the inventory record. This check should be completed by an officer independent of maintaining the inventory. A review of the record highlighted that a number of items of furniture and lower value items are recorded  which are not required to be subject to full inventory controls (although the school may want to maintain a record of these items). Additionally, items which had been disposed of had not been removed from the record.  

It is suggested that the inventory record is reviewed to ensure only appropriate items are subject to full inventory controls. A deminis value for these items should be set at a level to ensure that, at minimum, all items over £200 in value are recorded and checked. However, the school should also consider recording some lower value items if they may be particularly suceptable to loss eg cameras. Items which have been disposed of can be removed from the record but the disposal notice should be retained. The printed  inventory showing the items verified at the last check should be signed by the checking officer, who should be independent of the offcer maintaning the record. The verified record be  should be held in school. 

Agreed Action 8.1 
To be completed. 

## Audit Opinions And Priorities For Actions

Audit Opinions Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. Our overall audit opinion is based on 5 grades of opinion, as set out below. 

Opinion Assessment of internal control 

| High Assurance                                                                                               |
|--------------------------------------------------------------------------------------------------------------|
|                                                                                                              |
| Substantial                                                                                                  |
| Assurance                                                                                                    |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |
| operation but there is scope for further improvement in the areas identified.                                |
|                                                                                                              |
| Reasonable                                                                                                   |
| Assurance                                                                                                    |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |
| environment is in operation but there are a number of improvements that could be made.                       |
| Limited Assurance                                                                                            |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |
| improvements required before an effective control environment will be in operation.                          |
| No Assurance                                                                                                 |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |
| key areas require substantial improvement to protect the system from error and abuse.                        |
|                                                                                                              |

 

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.