Digital Services Project Review
Source: data.gov.uk (2018-10-29)

CYC Internal Audit Reports 2017. These reports are presented to the Audit and Governance Committee for consideration, and are also included with the agenda papers for the [relevant meetings](http://democracy.york.gov.uk/ieListMeetings.aspx?CommitteeId=437). 

Reports are also grouped together by calendar year and published at this York Open Data platform. Reports for other years are available at the [__CYC Internal Audit Reports__](https://data.yorkopendata.org/dataset?q=internal+audit&sort=score+desc%2C+metadata_modified+desc) datasets.

Digital Services Project – Review  
 
City of York Council 
Internal Audit Memo 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Service Area: Corporate 
Responsible Officer: Assistant Director: Customer Services and Digital 
Date Issued: 14/3/2017 
Status: Final 
 
 

 
 
Introduction and scope 
 
1.1 
 The Executive approved plans for a new smart and responsive online service which 
will improve access for residents, visitors and businesses at the Executive meeting 
on Thursday 11 February 2016.   
 
1.2  
 The first stage of the programme is to improve users' online experience with the council, 
with the new Customer Relationship Management (CRM) system aiming to: 
• 
Provide online access to more services and information. 
• 
Ensure the council is more efficient and easy to do business with on a 24/7 
basis. 
• 
Implement a ‘My Account’ system for residents offering a tailored access to 
council services. 
• 
Provide access via mobile devices and tablets, increasing accessibility for 
residents and other customers. 
• 
Allow residents and customers to track the progress of their requests and 
receive updates. 
 
1.3 
 The programme is following the council’s approved project management guidelines 
as its framework.  The purpose of this audit was to provide assurance to 
management that procedures and controls within the project management system will 
ensure that: 
 
• 
Project management principles have been applied to the programme of work and 
specific projects 
• 
Governance arrangements are in place and are at the correct level for the 
programme  
• 
Risk management is considered and reviewed throughout the programme 
 
1.4 
This audit was a desktop exercise and reviewed only information received by the 
Project Board.  An initial review was carried out in July 2016 and feedback was 
provided.   A follow-up was then carried out and this report summarises both pieces 
of work.  Veritau has also attended Board meetings since July in order to provide 
support, challenge and advice. 
 
Findings 
2.1 
Project Board information from January 2016 was reviewed for this audit.  All project 
documents were available within the specific folders on the council’s network.  There 
was a clear folder structure and most documents were clearly labelled. 
 

 
Project Management Arrangements 
2.2 
There is a designated project team with a clear mandate and a project plan in place.  
This was all confirmed prior to the review period but is evidenced throughout the 
documentation.   
2.3 
The project is monitored through the meetings of the Project Board which occur at 
regular intervals (currently monthly) and the Project Board meetings are minuted and 
supported by documentation in line with those outlined within the All About Projects 
framework including highlight reports.   
2.4 
The highlight report gives the current status of the project.  There is an approved 
communications plan and all key stakeholders have been invited to attend the Project 
Board meetings. 
 
 
 
 Governance Arrangements 
2.5 
There is a clear governance structure in place for the project.  There is a formal 
Project Board which has an approved Terms of Reference.  The Project Board 
represents all council services.  It provides a governance mechanism for managing the 
project providing assurance and reporting upwards to council’s management team, 
Scrutiny and Executive.   
 
2.6 
The Project Board has also formally assigned the role of project assurance to the 
Programme Manager and they attend the Project Board meetings.  
 
2.7 
The project has documented this governance structure and has made provision for 
any time when board meetings do not align to key decision points.  The chair of the 
Project Board has, on those occasions, been delegated the following powers which 
would be ratified at the next board meeting: 
 
• To approve budget spend above £10,000. 
• To approve changes to the project milestones and scope. 
 
2.8 
It was suggested during the initial review that, it would be good practice to have at 
least three Project Board members (including project assurance) to take these 
decisions outside of the normal meetings, thereby the decisions are still subject to 
challenge by key board members.  In November, the chair invited key stakeholders to 
an extra meeting to make a decision on the deployment for the release for Street 
lighting and Street Cleaning (a Go Live decision).  The decision was made with a 
number of caveats – a copy of which was circulated to the full Project Board. 
 
2.9 
Minutes are produced for each board meeting and they are reviewed at the next board 
meeting for accuracy.  The review found that the content of the minutes could be 
improved.  The following main issues were identified: 

 
• The minutes were not produced on a timely basis.  
 
On the two occasions the minutes were requested after the Project Board (July 
and November), they were not available for over three weeks.  This has an 
impact on the project team who are required to check their accuracy and use 
them to inform the current project papers before circulating them to the Project 
Board before the next meeting. 
 
• The minutes do not include an action log (nor is one maintained separately).    
 
There is therefore no formal mechanism for ensuring that all actions arising from 
the board meetings were completed.  Questions raised within the minutes are not 
always answered in subsequent minutes or supplementary papers and 
information that was to be sought outside of the Project Board meeting is not 
always brought back to the Project Board at the next meeting, and therefore not 
followed up for the completeness of records.  These issues would be resolved by 
the implementation of an action log. 
 
• Decisions were not always formally recorded within the minutes and the basis on 
which the Project Board has made decisions was not always articulated or cross 
referenced to the supporting papers.   
 
A decision log was implemented in July and going forward attention will be 
placed on the wording of the decisions so that the articulate the specifics of what 
the board has agreed to. 
 
• It was not clear which documents had been circulated or presented to the Project 
Board. 
 
There were a number of versions of some documents available within the project 
folders at the time of review.  Not all documents had been saved as a PDF 
version with an appropriate label. 
 
 
Risk Management Arrangements 
2.10 The project actively monitors risk and discussions are held at the Project Board 
meetings.  There are project specific risk registers (Phase One and Release Two) 
which were refreshed in October 2016.  The risk registers are maintained through the 
Council’s risk management system – Magique.  This ensures that the corporate risk 
management matrix is used and that specific fields are completed. 
2.11 The risk register which was presented to the Project Board in January 2016 did not 
document the gross and net risks for the project – however this has been corrected 
and the current registers display both the gross and net risk scores. 

 
2.12  Risks are updated as and when required but the formal registers are being brought 
back to the Project Board on a bi-meeting basis.  As the format of the risk register is 
quite static, the Project Board has recently requested that all ongoing changes are 
highlighted.  This will allow them to quickly acknowledge any amendments within the 
controls and actions for the specific risks. 
2.13 An issues log for Phase One of the project has been established.  This is presented to 
the board along with the risk registers.  It should be noted that the critical success 
factors for the project have been documented and are monitored within the project. 
 
 
Conclusions and Recommendations  
3.1 
It was found that the arrangements for managing risk were good with few weaknesses 
identified. An effective control environment is in operation, but there is scope for 
further improvement. Our overall opinion of the controls within the project at the time 
of the review was that they provided Substantial Assurance. 
 
The key areas for improvement are: 
• The quality and timeliness of the meeting minutes should be addressed.  The 
review has confirmed that whilst discussions take place at the board meetings 
and decisions made, they are not always accurately reflected in the minutes. 
 
• An action tracking mechanism within the meeting minutes or an action log should 
be maintained.  This should be updated after all Project Board meetings to 
ensure that all actions are reviewed to ensure that they are actioned. 
 
• The decision log should be revised to ensure that it only contains decisions made 
at the board meetings (and not actions) and that the wording of the decisions 
articulates the decision made by the board. 
 
 
Further work 
4.1 
Veritau will continue to attend the Project Board meetings and will confirm that the 
agreed actions have been completed. 
 
Management Response 
5.1 
The issues identified above were raised constructively at the time so we could take 
some remedial action.  The agreed actions can be seen in Appendix 1 
 

 
Appendix 1 
Action Plan 
Action 
Number
(Ref 
3.1) 
Issue 
Risk 
Agreed Action 
Priority* Responsible 
Officer 
Timescale 
1 
The minutes are not 
produced on a timely basis. 
Information may 
be lost or 
recorded 
incorrectly. 
The quality and timeliness of the 
meeting minutes has been 
addressed.  A project resource will 
continue to produce the minutes with 
the support of the project manager, 
who will record all actions/decisions 
made for the respective logs. 
The aim is to have minutes produced 
within 3 working days of the meeting. 
2 
Project 
Sponsor 
(Assistant 
Director: 
Customer 
Services and 
Digital) 
COMPLETED 
In effect from 
December 2016 
meeting 
2 
The minutes do not include 
an action log (nor is one 
maintained separately). 
Actions and 
outcomes may 
be lost, not 
followed up or 
reported back to 
the board. 
An action log has been introduced.  
This cross references to any actions 
made within the meeting minutes and 
included timescales, responsible 
office and timescales.  The action log 
will re reviewed at the start of each 
meeting with the previous meetings 
minutes. 
3 
Project 
Sponsor 
(Assistant 
Director: 
Customer 
Services and 
Digital) 
From March 
2017 meetings 
3 
Decisions are not always 
formally recorded within the 
minutes and the basis on 
which the Project Board 
has made the decisions 
was not always articulated 
or cross references to the 
supporting papers. 
Decisions may 
not be recorded 
accurately.  
The decision log has been revised to 
ensure that it accurately reflects and 
contains all decisions made at the 
board meetings (and not actions). 
The format has changed so that key 
information is captured within the log 
3 
Project 
Sponsor 
(Assistant 
Director: 
Customer 
Services and 
Digital) 
From March 
2017 meetings 

 
 
 
*The priorities for actions are:  
Priority 1: 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent  
 
 
attention by management. 
Priority 2: 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be 
 
 
addressed by management. 
Priority 3: 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 
 
 
 
 
 
 
 
 
 
Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the 
understanding that any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone 
other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with 
the information. Where information is provided to a named third party, the third party will keep the information confidential.