Office Security
Source: data.gov.uk (2018-10-29)

CYC Internal Audit Reports 2017. These reports are presented to the Audit and Governance Committee for consideration, and are also included with the agenda papers for the [relevant meetings](http://democracy.york.gov.uk/ieListMeetings.aspx?CommitteeId=437). 

Reports are also grouped together by calendar year and published at this York Open Data platform. Reports for other years are available at the [__CYC Internal Audit Reports__](https://data.yorkopendata.org/dataset?q=internal+audit&sort=score+desc%2C+metadata_modified+desc) datasets.

1 
  
 
     
 
 
 
 
 
Office Security 
City of York Council 
Internal Audit Report 2016/17 
 
 
 
 
 
 
Business Unit: Customer and Corporate Services  
Responsible Officer: Assistant Director Legal and Governance 
Service Manager: Head of Property Design and Facilities Management 
Date Issued: 20/2/2017 
Status: Final 
Reference: 10425/001 
 
Overall Audit Opinion 
Substantial Assurance 
Actions 
5 
0 
P3 
P2 
P1 
0 

 
2 
  
 
Summary and Overall Conclusions 
 
Introduction 
West Offices are now the Council’s main offices, having opened in 2013 following a major renovation project.  
 
The building houses the majority of Council staff, as well as several third party organisations. It is also the main point of contact for York 
residents, with a Customer Centre handling enquiries. Ensuring the safety of members of staff and the premises is therefore very important in 
creating an effective working environment. 
 
This is the first time that the area has been audited since the move in 2013. 
Objectives and Scope of the Audit 
The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that: 
 
• 
Policies and procedures were adequate to manage risks, were reviewed regularly to keep them up to date and were readily accessible to 
relevant staff 
 
• 
Access to the building was sufficiently controlled to prevent unauthorised access  
 
• 
Technical security (e.g. CCTV) was managed in accordance with procedures and was maintained correctly 
 
• 
Incidents were logged, managed and escalated in accordance with Council procedures 
 
The audit did not consider security at any other Council premises.  
 
Key Findings 
Overall, the processes in place for ensuring the security of West Offices are operating effectively. Incidents are well managed and resolved 
promptly and there is clear evidence of the Facilities and Security teams planning ahead to deal with potential security issues. Furthermore, 
procedure notes are reviewed regularly to ensure they are up to date and the process for deactivating staff passes is working effectively to 
prevent unauthorised entry by former staff members. 
 
There were, however, five issues arising from the audit, of which three are now being dealt with by the relevant service area(s). 
 
 

 
3 
  
 
 
The main issue identified related to the criteria for accepting requests for new staff passes and inductions to West Offices. Sample testing and 
discussion with the service area suggests that line managers do not always know who to contact regarding inductions and issuing of passes, the 
criteria for accepting a request are not fixed and that documentation is not always completed or retained.  
 
Although it is not thought that anyone has acquired a staff badge improperly, the process for accepting requests for staff badges and inductions 
could be formalised and communicated with relevant Council and partner organisation employees.  
 
Other minor issues found during the audit include the high proportion of missing visitor passes and the number of visitors who do not sign out; 
that the process for collating and retaining visitor logs is unclear; that several contractor passes were missing; and that CCTV maintenance at 
West Offices is not formally included in the maintenance contract. These issues are discussed in more detail in the findings below. 
 
Overall Conclusions 
It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, 
but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was 
that they provided Substantial Assurance. 

 
4 
  
 
 
1 Requests for Staff Passes & Inductions 
Issue/Control Weakness 
Risk 
The process and criteria for accepting requests for inductions and staff passes 
are unclear and documentation is not always retained.  
Unauthorised persons may receive staff passes for or 
inductions to West Offices, possibly leading to theft; harm to 
staff, members of the public or the premises; or financial or 
reputational damage to the Council. 
Findings 
Sample testing and discussion with the service area suggests that line managers do not always know who to contact regarding inductions and 
issuing of passes, the criteria for accepting a request are not fixed and that documentation is not always completed or retained.  
 
For example, discussion with the service area established that, when requests for passes and inductions are received, an email signature or 
other indicator is looked for to establish that the individual is suitable to make the request.  Of twenty new starters selected, authorisation could 
be found for only seven of them. There were also two examples of individuals using external email addresses (i.e. not Council or partner 
organisations) to contact Facilities Management to arrange for an induction and staff passes directly, rather than these requests coming from 
officers already based at the Council. One example was found of an individual emailing the Workforce Development Unit to arrange an 
induction and one of another individual who contacted Facilities but said they were not sure if they were contacting the right team. 
 
Although it is not thought that anyone has acquired a staff badge improperly, the process for accepting requests for staff badges and inductions 
could be formalised and communicated with relevant Council and partner organisation employees.  
 
Agreed Action 1.1 
Information will be made available on the Council’s Intranet regarding the process for 
arranging staff passes and inductions for new starters. A form will be designed that will be 
completed for inductions and will be signed by the line manager. 
Priority 
3 
Responsible Officer 
Facilities Manager 
Timescale 
17/2/2017 
 
 

 
5 
  
 
 
2 Visitor Passes 
Issue/Control Weakness 
Risk 
Many of the visitor passes are missing and a significant number of visitors do 
not sign out. 
Visitors may gain unauthorised access to West Offices 
potentially leading to theft; harm to staff, members of the 
public or the premises; or financial or reputational damage to 
the Council. 
Findings 
A spot-check carried out on 7th November 2016 found 72 out of 200 passes were missing and, during the period tested, 11% of visitors did not 
sign out (and, therefore, presumably did not return their passes). Discussion with the service area confirmed they are aware of the issue and 
have raised it with Customer Centre staff. However, no action has been taken to retrieve the missing passes. 
 
Although the visitor passes cannot be used to unlock doors in West Offices, it is possible that attempts could be made to gain unauthorised 
access by bluffing or tailgating through doors. 
 
Agreed Action 2.1 
A reminder will be issued to reception staff regarding ensuring visitor passes are returned. 
I-comply will be issued to all staff regarding security and visitors on 6/2/2017. There are 
also a number of other possible actions being discussed with the Customer Service Team 
Manager (LA). 
 
Priority 
3 
Responsible Officer 
Facilities Manager 
Timescale 
31/3/2017 
 
 

 
6 
  
 
 
3 Document Retention 
Issue/Control Weakness 
Risk 
The process for collating and retaining visitor logs is unclear. 
Non-compliance with the Council’s document retention 
policies. 
Findings 
The process for collating and retaining visitor logs was also found to be unclear. Currently, visitor logs are being sent from the Customer Centre 
to the Security Office, before finally being sent to Business Support for scanning. Discussion with relevant officers suggests that there is no 
need for them to go to Security; they could simply go straight to Business Support. They are also being sent irregularly and not in date order. 
 
The process would therefore benefit from a review to establish retention periods and how often logs should be sent for scanning. 
 
Agreed Action 3.1 
Daily visitor logs will be clipped together, kept in a drawer in date order, and sent for 
scanning on a weekly basis in an envelope marked with the date. This will commence from 
13/1/2017. Paper copies of the visitor logs will be retained for three months and electronic 
records for two years. 
 
Priority 
3 
Responsible Officer 
Customer 
Service 
Team Manager (LA) 
Timescale 
Implemented 
 
 

 
7 
  
 
 
4 Contractor Passes 
Issue/Control Weakness 
Risk 
Some contractor passes were missing and not all staff members were signing 
the logs to confirm that contractors had signed out and returned their pass. 
Contractors may gain unauthorised access to West Office, 
potentially leading to theft; harm to staff, members of the 
public or the premises; or financial or reputational damage to 
the Council. 
Findings 
Contractor logs were signed by the staff member on duty in only 68% of cases to confirm that the contractor's pass had been returned and a 
count of the passes confirmed that 3 out of 10 were missing.  
 
As a result of the work carried out during the audit, the service area changed the process for issuing contractor passes. All 10 passes were 
cancelled and re-issued by Security. Five passes are now kept in the Goods Entrance, with the other five kept in the Security Office. Facilities 
are now providing a log to Security at the end of each working day to confirm whether or not all the passes have been returned. Security has 
said they will chase up any outstanding passes or, if they are missing, cancel the pass and contact the contractor.  
 
A follow-up will be required to ensure that the new daily log is working effectively.  
 
Agreed Action 4.1 
Contractor passes have been reissued and five are now kept in the Security office. The 
Facilities team are providing Security with a log at the end of each working day to confirm 
whether or not all passes have been returned. 
Priority 
3 
Responsible Officer 
Facilities Manager 
Timescale 
Implemented 
 
 

 
8 
  
 
 
5 CCTV Management and Maintenance 
Issue/Control Weakness 
Risk 
CCTV maintenance at West Offices is not formally part of the Council’s contract 
with the maintenance contractor. 
If technical security (e.g. CCTV) is not managed or 
maintained, this may lead to breaches of security should 
there be a gap in coverage. 
Findings 
Overall, testing shows that CCTV checks are carried out daily; issues are being logged in the Incident Log and reported when necessary. 
However, not all issues are being resolved within contract timescales.  
 
The CCTV Manager explained that CCTV maintenance at West Offices was not formally written into the contract when the Council moved into 
West Offices. However, CCTV was already in use and an arrangement needed to be agreed. Therefore, an agreement was reached with the 
existing contractor to provide CCTV maintenance at West Offices to the same standards as Public Space Surveillance (PSS). As part of the 
procurement process for CCTV maintenance, West Offices will be fully integrated into the contract put out to tender.  
 
It is therefore considered a priority to integrate West Offices CCTV into the new contract and ensure a financial waiver is in place for the 
remainder of the 2016-17 financial year. 
 
Agreed Action 5.1 
A financial waiver is being put in place and CCTV maintenance at West Offices will be 
integrated into the new CCTV contract. 
Priority 
3 
Responsible Officer 
CCTV Manager 
Timescale 
Implemented 
 
 

 
9 
  
 
Annex 1 
Audit Opinions and Priorities for Actions 
Audit Opinions 
Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or 
error. Our opinion is based on the risks we identify at the time of the audit. 
 
Our overall audit opinion is based on 5 grades of opinion, as set out below. 
 
Opinion 
Assessment of internal control 
High Assurance 
Overall, very good management of risk. An effective control environment appears to be in operation. 
Substantial 
Assurance 
Overall, good management of risk with few weaknesses identified.  An effective control environment is in 
operation but there is scope for further improvement in the areas identified. 
Reasonable 
Assurance 
Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control 
environment is in operation but there are a number of improvements that could be made. 
Limited Assurance 
Overall, poor management of risk with significant control weaknesses in key areas and major 
improvements required before an effective control environment will be in operation. 
No Assurance 
Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of 
key areas require substantial improvement to protect the system from error and abuse. 
 
Priorities for Actions 
Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent 
attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to 
be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 
 

 
10 
  
 
 
Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that 
any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in 
relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where 
information is provided to a named third party, the third party will keep the information confidential.