Dringhouses Primary School
Source: data.gov.uk (2018-10-29)

CYC Internal Audit Reports 2017. These reports are presented to the Audit and Governance Committee for consideration, and are also included with the agenda papers for the [relevant meetings](http://democracy.york.gov.uk/ieListMeetings.aspx?CommitteeId=437). 

Reports are also grouped together by calendar year and published at this York Open Data platform. Reports for other years are available at the [__CYC Internal Audit Reports__](https://data.yorkopendata.org/dataset?q=internal+audit&sort=score+desc%2C+metadata_modified+desc) datasets.

1 
  
 
     
 
 
 
 
 
Dringhouses Primary School 
City of York Council 
Internal Audit Report 2016/17 
 
 
 
 
 
 
 
Business Unit: Children, Education and Communities:  
Headteacher: G. Williams 
Date Issued: 12 April 2017 
Status: Final  
Reference: 15691/003 
 
Overall Audit Opinion 
High Assurance 
Actions 
3 
0 
P3 
P2 
P1 
0 

 
2 
  
 
Summary and Overall Conclusions 
 
Introduction 
This audit was carried out on 20th and 21st November 2016 as part of the Internal Audit plan for Children, Education and Communities for 
2016/17. Schools are audited in accordance with a detailed risk assessment. 
 
Objectives and Scope of the Audit 
The purpose of this audit was to provide assurance to Governors, the Headteacher and management that procedures and controls in the areas 
listed below are working adequately and are well controlled.  The audit covered the following areas in accordance with the specification issued on 
15th July 2016: 
 
• 
Governance and Financial Management 
• 
System Reconciliation 
• 
Banking Arrangements 
• 
Contracts, Purchasing and Authorisation 
• 
Income 
• 
Capital and Property 
• 
Extended Schools Provision 
• 
Human Resources 
• 
Payroll and Staff Costs 
• 
School Meals 
• 
Pupil Numbers 
• 
School Fund 
• 
Data Protection and Information technology 
• 
Insurance and Risk Management 
• 
Inventories 
• 
Safeguarding 
 
Key Findings 
Systems at the school are operating well in all the areas reviewed. Recommendations for actions have been made regarding the reallocation of 
responsibility for the independent check of the inventory, which the school had identified themselves as needing action, as well as removing a 
Governor as a cheque signatory, which was identified during the themed audit of Procurement across all York schools undertaken in 2015-16. 
Following on from the themed audit of Information Governance in 2015-16 it is recommended that information regarding procedures for dealing 
with breaches of data protection be provided to staff in some way, perhaps in the staff handbook.  
 
During the audit advice was also given regarding the Child Protection training for the governor with Child Protection responsibilities being out of 
date. 
Overall Conclusions 
It was found that the arrangements for managing risk were very good. An effective control environment appears to be in operation. Our overall 
opinion of the controls within the system at the time of the audit was that they provided High Assurance.  
 

 
3 
  
 
1 Delegated Authority 
Issue/Control Weakness 
Risk 
A Governor who is not an employee of the school is an authorised cheque 
signatory. 
The Governing body is unable to fulfil its statutory 
responsibility. Officers who are not members of staff are not 
covered by the school’s fidelity guarantee insurance. 
Findings 
The school has approved a Governor to be an authorised cheque signatory. Governors have a statutory responsibility for the oversight of the 
financial management of the school and for ensuring adherence to the Authority’s Standing Orders and Financial Regulations and as such 
Governors (who are not employees of the school) should not be directly involved in operational procedures. Additionally, non staff members are 
not covered by the schools fidelity guarantee insurance. 
Recommendation 
The school should not include Governors who are not employees of the school as authorised cheque signatories.. The authorised cheque 
signatories should be revised accordingly. 
Agreed Action 1.1 
Agreed 
Priority 
3 
Responsible Officer 
Head 
Timescale 
Sept 2017 
 
 
 
 
 

 
4 
  
 
2 Inventory 
Issue/Control Weakness 
Risk 
The annual check of the inventory was not adequately evidenced or completed 
independently of the officer maintaining the inventory record.  
Items which have been lost or misappropriated may not be 
identified and investigated and insurance claims may be 
affected. 
Findings 
The school maintains an inventory on an electronic inventory spreadsheet, which showed evidence of being kept up to date. However the 
school did not evidence the annual check of the inventory record to the items in school. Assurance was given that the annual check had been 
completed however, this is currently undertaken by the member of staff responsible for the maintaining the inventory record and no 
independent check is completed. 
Recommendation 
The inventory check should be completed by an officer independent of maintaining the inventory record and should be evidenced by retaining a 
paper or PDF copy of the verified inventory, recording the officer completing the check and the date the check was completed. If this is not a full 
check (eg a targeted check towards the most vulnerable items, higher value items or particular equipment) it should be clear from this record 
which items have been checked. 
Agreed Action 2.1 
Agreed 
Priority 
3 
Responsible Officer 
Head 
Timescale 
Sept 2017 
 
 
 
 
 

 
5 
  
 
3 Data Breach Policy 
Issue/Control Weakness 
Risk 
The school does not have formally documented procedure for staff to follow 
should a data breach occur. 
A data breach may not be identified by the school and 
handled appropriately. 
Findings 
The school does not have a formally documented procedure or policy for staff to follow should a data breach occur. This could lead to staff not 
identifying and handling breaches of information security in the most appropriate way. 
Recommendation 
A procedure for management of data breaches should be in place and notified to staff. This may be part of a data breach policy and could be 
included in the staff handbook. 
Agreed Action 3.1 
Agreed 
Priority 
3 
Responsible Officer 
Head 
Timescale 
Sept 2017 
 
 
 
 

 
6 
  
 
 
 
Annex 1 
Audit Opinions and Priorities for Actions 
Audit Opinions 
Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or 
error. Our opinion is based on the risks we identify at the time of the audit. 
 
Our overall audit opinion is based on 5 grades of opinion, as set out below. 
 
Opinion 
Assessment of internal control 
High Assurance 
Overall, very good management of risk. An effective control environment appears to be in operation. 
Substantial 
Assurance 
Overall, good management of risk with few weaknesses identified.  An effective control environment is in 
operation but there is scope for further improvement in the areas identified. 
Reasonable 
Assurance 
Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control 
environment is in operation but there are a number of improvements that could be made. 
Limited Assurance 
Overall, poor management of risk with significant control weaknesses in key areas and major 
improvements required before an effective control environment will be in operation. 
No Assurance 
Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of 
key areas require substantial improvement to protect the system from error and abuse. 
 
Priorities for Actions 
Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent 
attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to 
be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 

 
7 
  
 
 
 
Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that 
any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in 
relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where 
information is provided to a named third party, the third party will keep the information confidential.