Concessionary Bus Passes
Source: data.gov.uk (2018-10-29)

CYC Internal Audit Reports 2017. These reports are presented to the Audit and Governance Committee for consideration, and are also included with the agenda papers for the [relevant meetings](http://democracy.york.gov.uk/ieListMeetings.aspx?CommitteeId=437). 

Reports are also grouped together by calendar year and published at this York Open Data platform. Reports for other years are available at the [__CYC Internal Audit Reports__](https://data.yorkopendata.org/dataset?q=internal+audit&sort=score+desc%2C+metadata_modified+desc) datasets.

1 
  
 
     
 
 
 
 
 
Concessionary Bus Passes 
City of York Council 
Internal Audit Report 2017/18 
 
 
 
 
 
 
Business Unit: Economy and Place 
Responsible Officer: Director, Economy & Place 
Service Manager: Head of Transport, Parking, Major Transport Projects 
Date Issued: 8/12/2017 
Status: Final 
Reference: 10670/002 
 
 
P1 
P2 
P3 
Actions 
0 
0 
7 
Overall Audit Opinion 
Substantial Assurance 

 
2 
  
 
Summary and Overall Conclusions 
 
Introduction 
The English National Concessionary Travel Scheme (ENCTS) was introduced in April 2008, providing free travel on local bus services to persons 
eligible on grounds of age or disability. City of York Council (CYC) is the Travel Concession Authority (TCA) for the York area and is responsible 
for issuing bus passes, maintaining records relating to pass-holders, and reimbursing Bus Operating Companies (BOCs) for journeys originating 
within the city's boundaries.  
 
CYC is also part of a joint concessionary fares scheme with North Yorkshire County Council (NYCC). NYCC reimburses BOCs for cross-
boundary journeys that originate in York. NYCC charges CYC for these journeys. Payments to BOCs and NYCC total nearly £4.2 million per 
annum, the majority of which is paid to First York. There are around 40,000 active passes issued by CYC, of which 36,000 are age-related and 
4,000 disability-related.  
 
The audit built upon work undertaken in the 2016-17 audit (final report attached at Annex 2). It focused on the methods used by First York and 
NYCC in data collection and processing, as well as analysing heavily-used passes for possible misuse.  
 
Objectives and Scope of the Audit 
The purpose of this audit was to provide assurance to management that procedures and controls within the system ensured that: 
 
• The data processing methods used by First York were reliable and produced accurate returns; 
• The data processing methods used by NYCC were reliable and produced accurate returns. 
 
The audit also included analysis of heavily-used passes for evidence of possible misuse, building upon previous work performed in relation to 
hot-listing of passes. 
 
Key Findings 
It was found that data processing at First York is largely automated, with little manual intervention. There are checks in place to ensure that data 
is downloaded from Electronic Ticket Machines (ETMs). However, there does not appear to be any control totals or checks to confirm that the 
data has transferred correctly and completely between First's three computer systems that are used to produce the monthly return. This is 
explained in more detail in Finding 1 below. 
 
Analysis of NYCC's data processing methods found that they require manual inputs from staff as data is copied from operator returns to a 
'master' spreadsheet showing all routes and to their finance system. Currently, reconciliation with Host Operator Processing System (HOPS) is 

 
3 
  
 
not possible due to incomplete HOPS data. Veritau is currently carrying out a similar audit at NYCC and it is likely that an action will be agreed 
that they reconcile the operator returns, 'master' spreadsheet and finance system, and also implement reconciliations with HOPS. 
Implementation of these actions will provide more assurance regarding the accuracy of NYCC’s data processing. Updates on the operation of 
routes that CYC pays for are requested from CYC by NYCC staff on an ad-hoc basis. In order to ensure accurate payments are made by CYC, 
this should be carried out on a regular basis as explained in Finding 2 below. 
 
Overall, there are no significant concerns regarding the data processing methods used by First or NYCC. Furthermore, the actions proposed as a 
result of the audit at NYCC should improve processes there. However, it was apparent that neither First nor NYCC conduct detailed checks on 
the accuracy and reliability of data returns to CYC specifically. This reinforces the importance of CYC having robust checks of the data returns it 
receives from First and NYCC. An action was agreed in respect of these checks in the 2016-17 audit and a further action has been raised at 
Finding 1 below. 
 
Pass usage data for 2016-17 was analysed for trends, possible misuse and data quality. Of around 160,000 passes used in York, around 70% 
were used 10 times or less. By comparison, only 74 were used to make more than 1000 trips during the year. As CYC has around 40,000 active 
passes, it is assumed that the other 120,000 passes were issued by other TCAs. The low average usage likely reflects York's popularity as a 
tourist destination. In other words, visitors are using their passes to make a small number of trips while visiting the city.  
 
The most significant finding of the analysis was that disabled pass holders, who make up 10% of all pass holders, were disproportionately 
represented in the top 20 most heavily-used passes (11/20), suggesting they make more frequent use of their passes than people eligible due to 
age.  Two disabled pass holders in the top 20 were using passes that were hot-listed (marked as no longer valid) in 2013 and 2014 respectively, 
suggesting there may be more in use. Currently, hot-listing is not in effect, so the holders were able to continue using the passes, but there are 
plans to implement it in the near future. If this is done without any warning to pass holders, it may temporarily prevent disabled or vulnerable 
people from travelling freely on York buses.  
 
Finally, other findings include limitations on the reporting capability of the card management systems, the wording of the bus pass application 
forms, and data quality issues relating to duplicate records and postcode entry. 
 
Overall Conclusions 
The arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is 
scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they 
provided Substantial Assurance. 
 

 
4 
  
 
 
1 Reconciliation of First York's returns with HOPS figures 
Issue/Control Weakness 
Risk 
Processes are mostly automated with little checking done to confirm accuracy 
of data. 
Data is incorrect, leading to overpayments by CYC. 
Findings 
First York's systems are largely automated with little manual intervention. Data is automatically downloaded from ETMs and transferred in 
batches between the Depot Computer System, Central Computer System (CCS) and EP Morris system. A return is then produced from the EP 
Morris system by the Finance team and forwarded to CYC.  
 
First check that the ETMs have sent the batch data and can check for corrupted data files in the CCS. However, there are no checks in place to 
confirm that the data is complete and accurate between the three systems. The HOPS system receives data directly from the ETMs, avoiding 
First’s computer systems.  
 
Agreed Action 1.1 
a) First's returns will be reconciled to HOPS figures on an annual basis to check for 
accuracy and completeness. Any major discrepancies will be investigated. 
b) The Public Transport team will seek a letter of assurance from First Group’s Internal 
Auditors as to the robustness of their data processing methods. 
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
April 2018 
 
 

 
5 
  
 
 
2 Updates on CYC route changes 
Issue/Control Weakness 
Risk 
Routes are incorrectly included or not included at all in the monthly data return. 
Incorrect data may lead to incorrect payments by CYC. 
Findings 
NYCC request updates from CYC on route changes, but this is on an ad-hoc basis. NYCC officers explained they are not always aware of route 
or timetable changes for CYC bus routes as their team focuses on NYCC routes. 
 
The audit found that updates on discontinued routes had been provided by CYC. It was confirmed that no journey figures were provided for 
these routes in NYCC’s data returns, but the routes were still included in the returns. This, along with the ad hoc nature of the updates, limits 
the confidence that processes ensure returns are always accurate. 
 
Agreed Action 2.1 
a) CYC will provide an annual update on route changes to NYCC at the beginning of the 
financial year. NYCC will implement changes as a priority and confirm this with CYC. 
b) CYC will provide updates to NYCC throughout the year as routes change or in response 
to data quality checks on the monthly returns. 
 
These responsibilities will be included in the service agreement between the two councils. 
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
April 2018 
 
 

 
6 
  
 
 
3 Implementation of Hot-listing 
Issue/Control Weakness 
Risk 
Implementation of hot-listing may cause problems for customers and an 
increased workload for CYC. 
 
CYC may receive negative publicity in the press or 
complaints. There may also be a sudden increase in 
workload for Customer Services staff as pass holders try to 
get replacement passes. 
Findings 
Analysis found that 20% of the top 20 passes were hot-listed, but had been used after they had been hot-listed. One was hot-listed in 2013 and 
the other in 2014, both of which were disabled passes. These two pass holders had not used their replacement passes. It is assumed that they 
found their lost passes and continued to use them instead. This suggests that there are more hot-listed passes being used, although exact 
numbers are not known (see Finding 4 below).  
 
Currently, hot-listing is not in effect (which is why the pass holders were able to continue using their passes) as BOCs previously did not have 
the technology to implement it. This reflects the national position, few TCAs have implemented hot-listing, but CYC is now in a position to do so. 
However, implementing hot-listing without warning may temporarily deprive some pass holders, including people who are disabled or 
vulnerable, of their ability to travel freely on York buses until they get a replacement. 
 
Agreed Action 3.1 
A project plan will be developed for the implementation of hot-listing. This will include 
posting information regarding hot-listing on CYC’s website and in local newspapers and 
identifying and contacting pass holders who might be affected by the implementation, as 
well as actions 4.1-7.1 below.  
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
April 2018 
 
 

 
7 
  
 
 
4 Reporting functionality in the new card management system 
Issue/Control Weakness 
Risk 
The new card management system's reports do not include certain key fields. 
Fraudulent pass usage cannot be detected. 
Findings 
Limitations in the reporting functionality of Innovator (the old system) meant it was not possible to analyse the number of hot-listed passes still 
in use as a list of hot-listed passes could not be extracted.  
 
The new card management system provided by ACT can produce lists of active and hot-listed cards broken down by card type (e.g. age, 
disability), but it cannot provide single complete lists of active or hot-listed passes. The reports also do not include certain key fields, such as 
hot-listing date and reason, the 16-digit ISRN or the issuing and expiry dates of the cards. Including these fields would make analysing pass 
usage and identifying possible fraudulent use more effective. 
 
Agreed Action 4.1 
The Public Transport team will review reporting functionality to determine if the fields 
identified above can be included. 
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
April 2018 
 
 

 
8 
  
 
 
5 Data Quality in Innovator / ACT 
Issue/Control Weakness 
Risk 
Data entered into the card management system is incorrect or incomplete. 
Incorrect customer data may lead to passes being sent to the 
wrong address. 
Findings 
Analysis was conducted on a list of approximately 40,000 active passes to look for issues in data quality or unusual entries.  
 
Several hundred postcodes had been prefixed as ‘Y0’ or ‘Y)’ instead of ‘YO’ or had been left blank. Officers stated that the new card 
management system has an inbuilt postcode checker that will flag up incorrect postcodes. These should, therefore, have been corrected when 
pass holder data was uploaded to the new system.  
 
A number of applicants had West Offices entered as their address. Customer Services indicated that occasionally this is allowed if the applicant 
has no fixed address. They have agreed to review these cases to ensure they are still suitable. 
 
Agreed Action 5.1 
a) Customer Services will review the customers with incorrect postcodes to ensure they 
are now correct. 
b) Customer services will review customers who have West Offices listed as their address 
to ensure these are appropriate. 
 
 
 
Priority 
3 
Responsible Officer 
Customer & Resident 
Services Manager 
Timescale 
April 2018 
 
 
 

 
9 
  
 
 
6 Duplicate Customer Records 
Issue/Control Weakness 
Risk 
A small number of pass holders have been duplicated in the old card 
management system and issued with a second pass. 
The passes may be used fraudulently by pass holders. 
Findings 
There were 14 pairs of duplicate customer records in the previous card management system (Innovator). Each record had a different pass 
associated with it. There is, therefore, the potential for fraudulent use of these second passes; for example, pass holders could give them to 
family or friends to use instead. 
 
The Public Transport team said that the new system should prevent further duplicate records being created and there is a duplicate checker 
built into the system.   
 
Agreed Action 6.1 
The Public Transport team will investigate the duplicate records and take appropriate 
action to prevent further use of the second passes by the pass holders. This may include 
investigating usage, contacting pass holders, and hot-listing the passes. 
 
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
April 2018 

 
10 
  
 
 
7 Bus Pass Application Forms 
Issue/Control Weakness 
Risk 
Bus pass application forms do not contain a clear statement about data 
protection or a declaration about proper use. 
CYC is unable to prove intent during fraud investigations and 
applications do not comply with the Data Protection Act. 
Findings 
Discussion with Veritau's Counter-Fraud team found that the bus pass application forms do not include a space for a signed declaration to the 
effect that applicants have provided true information, that they understand the terms of use, and that they will not use their pass for fraudulent 
gain. Best practice is for application forms to include such a statement. It also makes proving intent in cases of possible fraudulent use simpler 
for CYC. 
 
It was also noted that the application forms do not make clear that applicants' personal data will be used in accordance with the Data Protection 
Act 1998 or that it will be shared with ACT. 
 
Agreed Action 7.1 
a) The Public Transport team will develop a declaration with advice from Veritau's 
Counter-Fraud team. 
b) The Public Transport team will develop a statement about data protection with advice 
from CYC's Information Governance team. 
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
April 2018 

 
11 
  
 
Annex 1 
Audit Opinions and Priorities for Actions 
Audit Opinions 
Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or 
error. Our opinion is based on the risks we identify at the time of the audit. 
 
Our overall audit opinion is based on 5 grades of opinion, as set out below. 
 
Opinion 
Assessment of internal control 
High Assurance 
Overall, very good management of risk. An effective control environment appears to be in operation. 
Substantial 
Assurance 
Overall, good management of risk with few weaknesses identified.  An effective control environment is in 
operation but there is scope for further improvement in the areas identified. 
Reasonable 
Assurance 
Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control 
environment is in operation but there are a number of improvements that could be made. 
Limited Assurance 
Overall, poor management of risk with significant control weaknesses in key areas and major 
improvements required before an effective control environment will be in operation. 
No Assurance 
Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of 
key areas require substantial improvement to protect the system from error and abuse. 
 
Priorities for Actions 
Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent 
attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to 
be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 
 

 
12 
  
 
Annex 2 
 
     
 
 
 
Concessionary Bus Passes 
City of York Council 
Internal Audit Report 2016/17 
 
 
 
 
 
 
Business Unit: Economy & Place 
Responsible Officer: Director, Economy & Place 
Service Manager: Head of Transport, Parking, Major Transport Projects 
Date Issued: 31/5/2017 
Status: Final 
Reference: 10670/001 
P3 
P2 
P1 
Actions 
5 
2 
0 
Overall Audit Opinion 
Reasonable Assurance 

 
13 
  
 
Summary and Overall Conclusions 
 
Introduction 
The English National Concessionary Travel Scheme (ENCTS) was introduced in April 2008, providing free travel on local bus services to persons 
eligible on grounds of age or disability. City of York Council is the Travel Concession Authority (TCA) for the York area and is responsible for 
issuing bus passes, maintaining records relating to pass-holders, and reimbursing Bus Operating Companies (BOCs) for journeys originating 
within the city's boundaries.  
 
The Council is also part of a joint concessionary fares scheme with North Yorkshire County Council (NYCC). NYCC reimburses BOCs for cross-
boundary journeys that originate in York. NYCC charges the Council for these journeys. Payments to BOCs and NYCC total nearly £4.2 million 
per annum, the majority of which is paid to First York.  
 
There are around 40,000 active passes issued by the Council, of which 36,000 are age-related and 4,000 disability-related. Data for January – 
May 2017 suggests the majority of passes are rarely used: 21,000 had been used for an average of less than one return journey per week and 
10,000 had not been used at all. Of the other 9,000, fewer than 100 had been used to make more than 10 return trips per week in that period.     
 
The audit considered the veracity of bus company claims for bus pass usage, as well as the issuance of bus passes and the accuracy of 
calculations for reimbursement. This was the first time that this area had been audited. 
 
Objectives and Scope of the Audit 
The purpose of this audit was to provide assurance to management that procedures and controls within the system ensured that: 
 
• 
Bus passes were issued in line with criteria and up to date records are kept to minimise the risk of abuse or fraud; 
• 
The data returns provided by BOCs and NYCC were reliable and accurate; 
• 
Calculations for reimbursement were accurate and completed in a timely manner. 
 
This audit included a visit to First Group because they are the main recipient of reimbursement from the Council. 
 
Key Findings 
It was found that Customer Services staff understood and had access to the eligibility criteria for passes. The Innovator system, which is used for 
issuing and recording passes, has mandatory fields that must be completed before an application can be processed. These include the pass 
type, date of birth (for age-related passes) and a drop-down list of ‘evidence seen’ for disabled passes. 
 

 
14 
  
 
The first significant issue is that although Innovator contains a ‘hot-listing’ function used for marking passes that are no longer valid, 'hot-listing' is 
not currently in effect. This means that passes barred on the Innovator system (for example, as lost or stolen) can still be used on buses to make 
journeys. Analysis identified three such passes still in use and a case of fraudulent use was reported to Veritau's Counter-Fraud team during the 
audit. It should be noted, however, that officers are currently in the process of implementing a version of 'hot-listing', which will go some way to 
addressing the issue. Furthermore, ‘hot-listing’ has only been implemented by some TCAs nationally. This is raised in more detail in Finding 1 
below. 
 
Other findings related to issuing passes included that evidence for eligibility is not retained by Customer Services and that there is an available 
category of 'none' for 'evidence seen' that can be used when processing new applications. It was also found that Returns of Deaths have not 
been received from York Register Office for several months, so pass holders have not been marked as deceased. 
 
Overall, analysis of data returns suggests they are generally reliable and that calculations for reimbursement are accurate. Comparison of the 
Electronic Ticket Machines (ETMs) and Host Operator Processing Systems (HOPS) data for First York routes found a discrepancy of 2.33% in 
the total trip figures for April - December 2016. Only one significant discrepancy was found in the NYCC figures (discussed below) and evidence 
was provided of other minor discrepancies being queried and resolved during the year.  
 
The second major issue was a discrepancy in the trip figures provided by NYCC for May 2016 for two bus routes. These are more than double 
the average and represent a potential additional cost to the Council of over £20,000. Discussion with the Public Transport Planner found no 
obvious reason for such a discrepancy and it was agreed that further investigation is required. This is raised in more detail in Finding 2. 
 
There is also no written guidance for carrying out 'reasonableness' checks on the data returns provided by First and NYCC. A visit to First York 
was also conducted during the audit. This established the guidance provided to drivers regarding bus passes and what reports are sent to the 
Council. However, the process for extracting data from ETMs and assembling the reports was not discussed in detail. There is an allocation of 
time in the 2017/18 audit plan that will be used for further work in this area. 
 
Calculations for reimbursement were found to be accurate and completed in a timely manner. The purchase order for First York was properly 
authorised and there was an agreement in place for making advance payments, with monthly adjustments. These had been correctly calculated 
and paid. It was noted, however, that NYCC are not prompt in providing data returns and invoices, which meant that the purchase order for 
2016/17 had not yet been raised at the time of the audit and an agreement on the amount owed had not been reached. 
Overall Conclusions 
The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation 
but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was 
that they provided Reasonable Assurance. 
 
 

 
15 
  
 
 
1 Implementation of 'hot-listing' 
Issue/Control Weakness 
Risk 
'Hot-listing' is not currently in effect, which has led to fraudulent use of passes. 
Passes are used fraudulently, leading to financial loss to the 
Council. 
Findings 
It was known at the start of the audit that 'hot-listing' of passes currently was not in operation. Although passes can be 'hot-listed' on Innovator, 
this does not prevent them from being used on buses as it does not communicate with the smartcard readers. 
 
Testing of 30 passes 'hot-listed' on Innovator found 3 to still be in use despite replacements being issued. There are around 2,500 active 'hot-
listed' passes. This suggests, therefore, that around 10% of passes 'hot-listed' in 2016/17 may still be in use. As passes last for up to 5 years, 
the total number may be higher because passes 'hot-listed' as far back as 2012 may still be valid. Usage data for the 3 passes still in use has 
been analysed and no fraud is suspected. 
 
Nevertheless, during the audit, a bus pass fraud case was referred to Veritau's Counter-Fraud team. A bus driver had confiscated two passes 
from a husband and wife when he noticed that the wife was using her husband's pass. Both passes were in the husband's name. The husband 
had been issued with a pass in September 2015, but reported it as not received. This was 'hot-listed' and he was sent a second pass in 
November 2015. Upon investigation, it was found that both passes had been used since then, with the couple making 55 duplicate trips 
between 15/3/2016 and 13/1/2017. The case is currently ongoing. 
 
Officers have indicated that a version of 'hot-listing' will be implemented, which will go some way to reducing the risk. The new system will 
contain a ‘warm-list’ of suspect passes issued by the Council. When used, these passes will be moved to a ‘hot-list’ and will no longer be 
accepted. The system will not hold ‘warm-lists’ of passes from outside the York area due to technological limitations on the buses and because 
most TCAs have not implemented ‘hot-listing’.  
Agreed Action 1.1 
’Hot-listing’ will be implemented soon for the existing system and will be part of the new 
system.  
Priority 
2 
Responsible Officer 
Sustainable Transport 
Manager  
Timescale 
September 2017 
 

 
16 
  
 
 
2 NYCC Data Return 
Issue/Control Weakness 
Risk 
The trip figures for May 2016 for routes 840 and 843 require further 
investigation to determine their accuracy. 
Trip figures provided by NYCC are inaccurate and are not 
thoroughly checked, leading to overpayments by the Council. 
Findings 
Analysis of the data returns from NYCC identified two significant variations in trip numbers in May 2016. The figures for routes 840 and 843 
were more than double their average for 2016/17 in May 2016. The routes had average monthly figures of around 8,500 and 11,600 
respectively, but the figures for May were nearly 17,000 and 27,000 respectively. As the Rate Per Concession (RPC) for each route is £1, this 
represents a potential saving for the Council of over £20,000.  
 
Discussion with the Public Transport Planner found no legitimate reason for such a variation and it was agreed that further investigation is 
required to ascertain if these figures are correct. Furthermore, the discussion also highlighted that less attention is given to checks on the 
NYCC data than First York data because NYCC is paid to carry out the administration on behalf of the Council. It may be advisable, therefore, 
to give the same level of attention to both sets of figures.  
 
It should be noted that no payment has yet been made to NYCC because the final amount has not been agreed and this error may have been 
identified before payment was made. The Public Transport Planner is currently in discussion with NYCC about final trip figures and RPCs for 
different routes. 
Agreed Action 2.1 
The May 2016 data discrepancy will be queried with NYCC and payment will not be made 
until officers are confident that the May 2016 figures are accurate. ‘Reasonableness’ 
checks will be conducted to the same standard on returns from both NYCC and First York. 
Efforts will also be made to get data in a timely manner from NYCC. 
Priority 
2 
Responsible Officer 
Public Transport 
Planner 
Timescale 
September 2017 
 
 

 
17 
  
 
 
3 Guidance on 'reasonableness' checks of data returns 
Issue/Control Weakness 
Risk 
'Reasonableness' checks are not documented. 
'Reasonableness' checks are not conducted, leading to 
overpayments by the Council. 
Findings 
Discussion with the Public Transport Planner suggested that identifying discrepancies in trip figures from First York and NYCC relies on his 
experience and knowledge as there is no written guidance on carrying out reasonableness checks. Although no major discrepancies in First's 
data have been identified in the last year and only one significant discrepancy in NYCC's data has been identified during the audit, it may be 
advisable to compile written procedures on what checks to carry out should it become necessary for a less experienced person to conduct 
these checks. 
Agreed Action 3.1 
The Public Transport Planner will produce a document containing guidance on how data 
returns from First and NYCC can be checked for reasonableness. 
Priority 
3 
Responsible Officer 
Public Transport 
Planner 
Timescale 
September 2017 
 
 

 
18 
  
 
 
4 Evidence of eligibility 
Issue/Control Weakness 
Risk 
Evidence to support applications is not retained. 
Ineligible applications are approved. 
Findings 
Discussions with officers found that evidence of eligibility is not retained by officers once applications have been processed, despite Innovator 
having a document upload function. It is not possible, therefore, to confirm that applicants are eligible, although it should be noted that 
Customer Service staff were aware of their responsibilities and the evidence required is listed on the application forms. Copying and uploading 
documentation would provide greater assurance that applications are valid and confirm evidence has been seen. 
 
Evidence of eligibility for disabled passes will be retained because evidence of disability has an expiry date and it is more likely there will be a 
need to refer to it. Despite the much greater number of age-related passes, age-related evidence will not be retained as it does not expire and it 
is much less likely there will be a need to refer back to it.  
Agreed Action 4.1 
Copies of evidence of eligibility for disability-related passes will be retained. Upon renewal, 
expired evidence will be removed and new evidence uploaded.  
Priority 
3 
Responsible Officer 
Customer & Resident 
Services Manager 
Timescale 
September 2017 
 
 

 
19 
  
 
 
5 'Evidence seen' field on Innovator 
Issue/Control Weakness 
Risk 
The Innovator system accepts 'none' as a valid category for 'evidence seen' 
when processing applications. 
Ineligible applicants are issued with passes. 
Findings 
Testing found that the Innovator system is designed in such a way that officers must enter certain details for applications to be approved. For 
disabled passes, it checks against a drop-down list of 'evidence seen'. This ensures that all relevant details are captured by the system. 
However, the 'evidence seen' field contains the valid category of 'none', which raises the possibility of applications being approved without valid 
evidence being seen. Although sample testing did not identify any that had 'none' as 'evidence seen', removing this category from the 
replacement system would prevent either accidental or deliberate use. 
Agreed Action 5.1 
The ‘none’ category will be removed from the evidence seen field as part of the new IT 
system. It will be ensured that only valid forms of evidence are included in this field. 
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
September 2017 
 
 

 
20 
  
 
 
6 Guidance for bus drivers 
Issue/Control Weakness 
Risk 
Guidance is in place, but it is not known if the guidance is followed. 
Guidance on checking passes is not followed by drivers, 
allowing possible fraudulent use of passes. 
Findings 
Discussions held with representatives from First York found that there is reasonable guidance in place for drivers regarding their responsibilities 
when checking concessionary bus passes. This discussion does not, however, confirm that the drivers are actually aware of and carrying out 
their responsibilities. Independent verification that drivers are doing so would provide more persuasive evidence than simply relying on the 
discussion held with First York. Incorporating a check into the surveys conducted by the Transport team would provide some evidence that 
guidance is followed. 
Agreed Action 6.1 
Checks that drivers are following the guidance will be incorporated into the bus surveys 
conducted by Council staff. There will also be a general review of the form used for the 
surveys. 
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
September 2017 
 
 

 
21 
  
 
 
7 Return of Deaths 
Issue/Control Weakness 
Risk 
Returns of Deaths are not being received from York Register Office, so pass 
holders are not being marked as deceased. 
Pass holders are not marked as deceased, leading to 
fraudulent renewals or use of passes by other persons. 
Sending out renewal letters to deceased persons may also 
cause distress to families and harm the Council's reputation. 
Findings 
Of 15 individuals on the most recent Return of Deaths list who were positively identified as holding bus passes, 12 of them had not been 
marked as deceased. Discussions with Customer Services established that they had not received a report from the Register Office for several 
months and they had not been chased up, which is why these individuals had not been marked as deceased.   
 
A further 6 individuals could not be positively identified on Innovator because, although their names were on the system, they were registered 
at different addresses. The individuals may have moved house between receiving their bus pass and passing away. However, it is not possible 
to be sure about this without further information, such as a date of birth, which is not included in the report. 
 
Currently, marking individuals as deceased only prevents them from receiving renewal letters. It does not stop the pass from working because 
'hot-listing' is not in effect. Therefore, it is of limited value as a control because another related control does not work. Once 'hot-listing' is 
implemented, however, it will become more important to ensure that records are accurate so that this control is effective. 
Agreed Action 7.1 
Customer Services will liaise with the Register Office to ensure Returns are sent regularly. 
They will also discuss sending the Returns electronically and review the information in the 
report to ensure it is sufficient. Finally, the missing Returns will be acquired and Innovator 
records updated. 
Priority 
3 
Responsible Officer 
Customer & Resident 
Services Manager 
Timescale 
September 2017 
 

 
22 
  
 
 
Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that 
any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in 
relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where 
information is provided to a named third party, the third party will keep the information confidential.