CYC Public Health
Source: data.gov.uk (2018-10-29)

CYC Internal Audit Reports 2017. These reports are presented to the Audit and Governance Committee for consideration, and are also included with the agenda papers for the [relevant meetings](http://democracy.york.gov.uk/ieListMeetings.aspx?CommitteeId=437). 

Reports are also grouped together by calendar year and published at this York Open Data platform. Reports for other years are available at the [__CYC Internal Audit Reports__](https://data.yorkopendata.org/dataset?q=internal+audit&sort=score+desc%2C+metadata_modified+desc) datasets.

1 
  
 
     
 
 
 
 
 
CYC Public Health 
City of York Council 
Internal Audit Report 2016/17 
 
 
 
 
 
 
Business Unit: Public Health  
Responsible Officer: Director of Public Health 
Date Issued: 31 May 2017 
Status: Final 
Reference: 10845/007 
 
Overall Audit Opinion 
Reasonable Assurance 
Actions 
1 
0 
P3 
P2 
P1 
3

 
2 
  
 
Summary and Overall Conclusions 
 
Introduction 
Public Health responsibilities transferred from the NHS to local government on 1 April 2013. The council and Director of Public Health have 
statutory responsibility to provide mandated services which include: 
 
• 
Taking steps to protect the health of the population 
• 
Providing advice to NHS commissioners 
• 
Sexual health and contraception services 
• 
the National Child Measurement Programme 
• 
NHS Health Check Assessments 
• 
the national 0-5 Healthy Child Programme 
 
As well as these mandated services, others are discretionary and are guided by the Public Health Outcomes Framework, the local Joint Strategic 
Needs Assessment (JSNA) and the Joint Health and Wellbeing Strategy (JHWS).  The JSNA and JHWS are produced by the Health and 
Wellbeing Board (HWB), which brings together relevant local organisations. The Health and Wellbeing board is chaired by the Executive Member 
for Adult Social Care and Health and the Director of Public Health chairs the Joint Strategic Needs Assessment and Joint Health and Wellbeing 
Strategy Sub-group of the Board. 
 
The council received £8.63m of funding from the Department of Health in 2015-16 and £8.43m in 2016-17. 
 
Objectives and Scope of the Audit 
The 2014-15 audit of Public Health gave an opinion of ‘Limited Assurance’ and a number of actions were agreed to address the issues found. 
This audit followed up actions taken to address issues identified in the previous audit report, in order to confirm that actions have been 
completed.  
 
In addition, the areas outlined below were reviewed in order to provide assurance to management that procedures and controls within the system 
ensure that: 
 
• 
sound systems are in place to develop and implement Public Health contracts, including performance management of contracts; 
• 
performance monitoring takes place against public health outcomes and action is taken as appropriate; 
• 
a Public Health budget is produced in line with financial procedure and on a sound basis and effective in year budget monitoring takes 
place. 

 
3 
  
 
 
Key Findings 
There have been significant improvements within the council's public health service since the last audit was undertaken. There is now a full time 
Director of Public Health (DPH) who reports to the Corporate Director of Health, Housing and Adult Social Care and is accountable to the Chief 
Executive for delivery of statutory public health functions. The Director is a member of the council's senior leadership team and other senior 
posts have also been recruited in to. This has provided stability and leadership for the service. 
 
The procedures in place for contract management are more robust. A contract register is in place and the public health team work with the 
council's procurement section to plan future procurement activity. Regular contract performance information is reviewed and meetings are held 
with contractors and minuted. Some improvements could be made to the quality of the minutes and in identifying when any actions are required 
by the council or contractor. Staff have received training in contract management and seek and receive the support of the council's procurement 
team.  
 
Although contract management procedures are much improved there are areas that require addressing. Contracts are not formally risk 
assessed, with the result that supplier performance measures and contract management arrangements may not meet the council's requirements 
and be proportionate to the contract risks. In addition, there are no routine formal reviews of contracts or quality checks undertaken on the actual 
delivery of services.  
 
Performance indicators have been established for public health and a scorecard produced based on priority areas for the city. The scorecard 
indicators are reported alongside the national position as a benchmark and have a RAG rating and direction of travel to aid interpretation. The 
scorecard is reviewed monthly by the public health management team and reported quarterly to CMT, Executive and Scrutiny committee. 
 
The public health budget is formulated and approved appropriately. It is still largely based on the previous year’s budget and identification of the 
level of savings required. There is clear responsibility for producing and monitoring the budget and it is regularly reviewed and reported by the 
service, with support from finance officers. Contributions are made from the ring fenced public health grant to other council services (for example, 
air quality work and adult social care preventative services) as part of the overall budget setting process and these are focused on improving 
population health outcomes. 
 
Overall Conclusions 
 
The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation 
but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was 
that they provided Reasonable Assurance. 
 

 
4 
  
 
 
1 Contract Management - Formal procedures and risk management 
Issue/Control Weakness 
Risk 
Contracts risks are not formally assessed and contract management 
procedures are not proactively based on the council’s requirements. 
Contract management may not be effective and may also be 
inefficient if all contracts are managed in the same way, 
rather than based on an assessment of risk. 
Findings 
Overall, contract management has improved since they were previously audited. A contract register is in place, all contracts have an assigned 
contract manager and regular meetings with suppliers are minuted. The staff within the service have received training from the corporate 
procurement team and contracts themselves contain details of how each contract will be managed, including performance measures for each 
contract and details on the frequency of meetings with the suppliers. 
However, there is still some scope for further improvement. The service does not have formal contract management procedures and some staff 
were unaware of the council's contract management guidance. In particular, there is no formal process for identifying and assessing contract 
risks, with the result that contract management processes may not be effective or proportionate. 
Responses from the service indicated that any assessment of contract risks happens on a reactive basis. Ideally contract management 
procedures would be based on an assessment of risks (e.g. value of contract, new services, past performance of supplier, customer f eedback), 
with those assessed as higher risk having more frequent and/or in depth monitoring.  
Agreed Action 1.1 
Risks will be identified and assessed for each contract / service. This risk assessment will 
be used to determine the contract monitoring arrangements for each contract / service. 
Priority 
2 
Responsible Officer 
Director of Public 
Health 
Timescale 
June 2017 
 
 

 
5 
  
 
 
2 Contract Management - Minuting Outcomes and Actions from supplier meetings 
Issue/Control Weakness 
Risk 
Minutes of meetings with suppliers do not clearly identify what the outcomes 
and any actions arising from the meetings are. 
Contract performance issues may not be addressed or 
followed up and lack of detail in minutes may result in lack of 
rigour and in level of assurance management has regarding 
effective contract management. 
Findings 
Overall, contract management procedures have improved since they were previously audited. Regular meetings take place and are now 
minuted to show what was discussed and there was evidence that contract performance information was being received and reviewed at these 
meetings.  
However, minutes of these meetings do not always contain enough detail to show what was discussed and to give assurance that contract 
management is thorough and ensures that services are being delivered to the expected standard and opportunities for improvement are 
identified.  
In particular, the outcomes and any actions arising from the meetings are not clearly identified and recorded in the minutes so it was not always 
possible to see that actions have been agreed where required or followed up on in subsequent meetings. There were some good examples of 
minutes, with sufficient detail and clearly allocated actions, but these were infrequent. 
Agreed Action 2.1 
A standard operating procedure and tracker will be produced for contract monitoring. It will 
be ensured that contract meetings will be preceded by queries logs and followed up by 
action plans, which will be reviewed in subsequent meetings. 
Priority 
2 
Responsible Officer 
Director of Public 
Health 
Timescale 
June 2017 
 
 

 
6 
  
 
 
3 Contract Management - Formal reviews of contracts 
Issue/Control Weakness 
Risk 
No formal and detailed reviews of contracts are undertaken during the life of the 
contract. 
Issues with the quality or value for money of a contract may 
not be identified during the life of the contract. 
Findings 
Regular meetings do take place with the suppliers to monitor contract performance. However, these are conducted on an ongoing quarterly 
basis and do not provide evidence of detailed review of all aspects of the contract. There are no procedures in place for a more formal, periodic 
and detailed review of contracts.  
This could include site visits or quality checks on the delivery of the service and assessments of the value for money of individual contracts. It is 
recognised that this would not be suitable for all types of contract but for some large contracts for delivery of complex services this would 
provide greater assurance that the contract is delivering the required service quality, outcomes and value for money for the council. 
Agreed Action 3.1 
A quality assurance process will be developed and agreed by the public health 
management team. This will include case study, audit, complaints and compliments and 
value for money assessment. The extent of and frequency of quality assurance for each 
contract/service will be influenced by the risk assessment process. 
Priority 
2 
Responsible Officer 
Director of Public 
Health 
Timescale 
June 2017 
 
 

 
7 
  
 
 
4 Backing data for GUM cross-charging 
Issue/Control Weakness 
Risk 
Information to support the payment of invoices for GUM cross-charging is not 
retained. 
Insufficient audit trail and inability to check supporting data in 
the event of queries over invoices paid. 
Findings 
The public health team pays invoices for genito-urinary (GUM) services delivered to council residents outside of the council’s boundary. An 
agreement was reached by the Regional Directors of Public Health Network for Yorkshire and Humber on minimum information requirements 
for invoicing for these services. The minimum requirements in respect of the invoices themselves were met in all cases tested.  
However, the requirements of the regional policy also specifies supporting data that must be included to support the invoices, including LA 
code, partial postcode, attendance type, treatment type, appointment date, tariff. This data is checked by the public health team before 
processing invoices for payment but this could not be checked during the audit as it is not retained by the team once the purchase order and 
invoice are authorised for payment.  
The supporting data is the record that supports the invoice amount and confirms that invoices are only being paid for services that the council is 
responsible for so should be retained for a more complete audit trail and in the event of any queries about invoices that have been paid. 
Agreed Action 4.1 
Backing data for GUM cross-charging will be retained to the end of the current financial 
year plus one further year. 
Priority 
3 
Responsible Officer 
Public Health 
Specialist Practitioner 
Advanced 
Timescale 
Implemented 
 
 

 
8 
  
 
Annex 1 
Audit Opinions and Priorities for Actions 
Audit Opinions 
Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or 
error. Our opinion is based on the risks we identify at the time of the audit. 
 
Our overall audit opinion is based on 5 grades of opinion, as set out below. 
 
Opinion 
Assessment of internal control 
High Assurance 
Overall, very good management of risk. An effective control environment appears to be in operation. 
Substantial 
Assurance 
Overall, good management of risk with few weaknesses identified.  An effective control environment is in 
operation but there is scope for further improvement in the areas identified. 
Reasonable 
Assurance 
Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control 
environment is in operation but there are a number of improvements that could be made. 
Limited Assurance 
Overall, poor management of risk with significant control weaknesses in key areas and major 
improvements required before an effective control environment will be in operation. 
No Assurance 
Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of 
key areas require substantial improvement to protect the system from error and abuse. 
 
Priorities for Actions 
Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent 
attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to 
be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 
 

 
9 
  
 
 
Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that 
any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in 
relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where 
information is provided to a named third party, the third party will keep the information confidential.