# Main Accounting System City Of York Council Internal Audit Report 2015/16


## Summary And Overall Conclusions Introduction

The Financial Management System (FMS) is the fundamental financial accounting system used by the council. The system records all financial activity undertaken by the council. This includes gross expenditure on services, in 14/15, of £432m and total expenditure on capital schemes of £48.2m. 

The FMS also records all financial decisions made by the council in the form of a budget. The FMS is used to prepare the council's annual accounts, financial returns and for budgetary control. The FMS is made up of Civica Financials, which includes integrated modules for general ledger, debtors and creditors, and is integrated to the purchasing system Civica Purchasing. 

## Objectives And Scope Of The Audit

The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that: 

- 
Control accounts and bank reconciliations are carried out regularly.  
- 
Transactions are transferred accurately from feeder systems into Civica Financials. 
- 
The integrity and security of the main accounting system is maintained. 
- 
Responsibilities and processes for journal entries and year end processing are appropriately defined and allocated. 
- 
Transactions are accurately valued and allocated correctly within the general ledger. 
 This audit focussed on the arrangements for the overall governance of the system and the controls and risks related to the general ledger. The debtors and creditors (including purchasing) systems are audited as separate entities. 

## Key Findings

Overall, the majority of controls within the main accounting system were found to be operating effectively. Control accounts were being monitored and reconciled at regular intervals. It was noted that SAP, SMP and SPP (statutory adoption, maternity and paternity pay) control accounts were prone to variances in the majority of months. Furthermore, it was found that control account variances carried over from 2014/15 related to the 2011/12 financial year. It may be beneficial for a cut-off point to be incorporated for unexplained variances over a certain age. 

Cash receipting records had been reconciled against the general account and general ledger in sufficient depth and frequency. Payments accounts had also been reconciled with appropriate frequency. An in-year reconciliation of the general account is planned for the second half of the 2016/17 financial year, though this has not yet been formally planned. Journals were entered and authorised appropriately; however self-authorisation of journals (where an accountant or finance manager both enters and approves the journal) had jumped to 14% of all live journal entries from 1.5% in the 2014/15 financial year. Responsibilities for closedown were allocated and clearly defined. 

Feeder files were received from an appropriate source, entered and transferred into Civica promptly. All feeder files were reconciled, with the exception of Servitor; there was no reconciliation of Servitor files to check whether values did in fact go in correctly but there is a pre-upload check of control totals that was observed operating effectively. It was noted that the reconciliations for Yearsley and Energise are time consuming and cumbersome. User access was limited appropriately and the security and integrity of the main accounting system had been maintained. Suspense account balances were reasonable and detail codes were appropriately regulated and monitored. 

Testing identified two issues in relation to the use of virement codes and generic income codes. These issues, whilst not fundamental to the functioning of the main accounting system, nonetheless require management's attention. 

## Overall Conclusions

It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 

  
 

## 1 Virements Are Not Completed Appropriately In Accordance With Policy Issue/Control Weakness Risk

Virements are completed inappropriately. Failure to comply with financial regulations and policies could lead to reputational damage to the Council. 

## Virements Have Not Been Completed Using The Correct Transaction Code, In Accordance With The Virement Policy In Place At The Time Of Testing. Evidence Of Authorisation Is Not Available On Fms. Narrative Notes For Bulk Upload Virements Are Not Detailed As Per Virement Policy. Findings

A sample of ten bulk upload spreadsheets was reviewed to determine whether the narrative line included authorisation received, as per the Virement Policy. All ten bulk upload spreadsheets had narratives that did not make any reference to the approval received. In addition, a sample of ten virements and ten accounting adjustments (determined according to the transaction code used) were chosen to test whether FMS contained evidence they had been authorised correctly in accordance with the virement policy and financial regulations. With the exception of one virement and one accounting adjustment (which both referenced Executive approval dates), all virements and accounting adjustments reviewed did not have any information on FMS to evidence the approval received prior to completion.  
Four virements sampled (40%) had used the transaction code 'VRIRC' (RRV - Chief Officer approved), which is listed in the Virement Policy as appropriate 'up to the value of £100k'. However, the value of these virements were significantly higher (£200k-£950k). There were three virements over £500k for the 2015/16 financial year. All three were checked; one referenced director approval and the remaining two had chief officer approval. Financial Regulations state that all virements over £500k should be approved by the Executive. However, it should be noted that, for the sample tested, it was not clear whether the virements were indeed virements, or whether they were budget roll forwards, base budget building or accounting adjustments. This lack of clarity and consistency makes it hard to monitor and assess whether virements entered on FMS have been completed and authorised appropriately. A new virement policy was introduced in January 2016 to clarify the procedure and ensure consistency when completing virements, and to create a clear audit trail. The total number of transactional codes has been reduced. This places further onus on the directorate to record the virements and evidence their approval on a separate spreadsheet. 

## Agreed Action 1.1

A new virement policy has been circulated that simplifies the codes to be used.  In addition, a new system of recording virements is now in place that will allow easy access to view bulk upload virements. A check will be completed by the corporate finance team during the year to ensure virements are being processed in accordance with the agreed policy. 

## 2 Value Of Income Attributed To Miscellaneous Income Codes Issue/Control Weakness Risk

Income is not correctly recorded on the FMS. 

Use of miscellaneous codes has been reduced following an action point raised in the 14/15 audit; however c£0.5m of income is still without a meaningful detail code. Continued focus is necessary to ensure that these codes are not used where a more appropriate code could have been used instead. 

## Findings

A review of ledger codes conducted by the Corporate Finance team had focused on expenditure codes. The Principal Accountant advised that the intention was to work on miscellaneous income codes for the 2015/16 financial year. The general ledger was reviewed for 2015/16 and the value of both miscellaneous income and expenditure was found to be lower than the previous year. A total value of around £163k was attributed to miscellaneous expenditure, reduced from £624k in 2014/15.  
For miscellaneous income codes, the total value was £579k, reduced from around £750k in 2014/15. Of the income attributed to miscellaneous codes in 2015/16, the five largest were: £122k related to contract management fees; £55k related to grants; £45k pay-by-phone car parking income; £35k for utilities licensing and £28k related to Blue Badge administration fees. Although the miscellaneous income value is lower than in 2014/15, and shows some progress has been made in respect to limiting usage of the code, the figure is still a considerable value in comparison to miscellaneous expenditure. Further work is therefore necessary to ensure that the miscellaneous income code is not used where, if it is a regular source of revenue, a detail code could be set up or a more appropriate existing code could be used. 

## Agreed Action 2.1

The use of miscellaneous income codes will be kept under review to ensure income is coded as accurately as possible.   

## Audit Opinions And Priorities For Actions Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit. 

Our overall audit opinion is based on 5 grades of opinion, as set out below. 

| Opinion                                                                                                      | Assessment of internal control                                                                      |
|--------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| High Assurance                                                                                               | Overall, very good management of risk. An effective control environment appears to be in operation. |
|                                                                                                              |                                                                                                     |
| Substantial                                                                                                  |                                                                                                     |
| Assurance                                                                                                    |                                                                                                     |
| Overall, good management of risk with few weaknesses identified.  An effective control environment is in     |                                                                                                     |
| operation but there is scope for further improvement in the areas identified.                                |                                                                                                     |
|                                                                                                              |                                                                                                     |
| Reasonable                                                                                                   |                                                                                                     |
| Assurance                                                                                                    |                                                                                                     |
| Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control      |                                                                                                     |
| environment is in operation but there are a number of improvements that could be made.                       |                                                                                                     |
| Limited Assurance                                                                                            |                                                                                                     |
| Overall, poor management of risk with significant control weaknesses in key areas and major                  |                                                                                                     |
| improvements required before an effective control environment will be in operation.                          |                                                                                                     |
| No Assurance                                                                                                 |                                                                                                     |
| Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of |                                                                                                     |
| key areas require substantial improvement to protect the system from error and abuse.                        |                                                                                                     |
|                                                                                                              |                                                                                                     |

## Priorities For Actions

Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. 

Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 
Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.