Concessionary Bus Passes
Source: data.gov.uk (2018-10-29)

CYC Internal Audit Reports 2017. These reports are presented to the Audit and Governance Committee for consideration, and are also included with the agenda papers for the [relevant meetings](http://democracy.york.gov.uk/ieListMeetings.aspx?CommitteeId=437). 

Reports are also grouped together by calendar year and published at this York Open Data platform. Reports for other years are available at the [__CYC Internal Audit Reports__](https://data.yorkopendata.org/dataset?q=internal+audit&sort=score+desc%2C+metadata_modified+desc) datasets.

1 
  
 
     
 
 
 
 
 
Concessionary Bus Passes 
City of York Council 
Internal Audit Report 2016/17 
 
 
 
 
 
 
Business Unit: Economy & Place 
Responsible Officer: Director, Economy & Place 
Service Manager: Head of Transport, Parking, Major Transport Projects 
Date Issued: 31/5/2017 
Status: Final 
Reference: 10670/001 
 
Overall Audit Opinion 
Reasonable Assurance 
Actions 
5 
0 
P3 
P2 
P1 
2 

 
2 
  
 
Summary and Overall Conclusions 
 
Introduction 
The English National Concessionary Travel Scheme (ENCTS) was introduced in April 2008, providing free travel on local bus services to persons 
eligible on grounds of age or disability. City of York Council is the Travel Concession Authority (TCA) for the York area and is responsible for 
issuing bus passes, maintaining records relating to pass-holders, and reimbursing Bus Operating Companies (BOCs) for journeys originating 
within the city's boundaries.  
 
The Council is also part of a joint concessionary fares scheme with North Yorkshire County Council (NYCC). NYCC reimburses BOCs for cross-
boundary journeys that originate in York. NYCC charges the Council for these journeys. Payments to BOCs and NYCC total nearly £4.2 million 
per annum, the majority of which is paid to First York.  
 
There are around 40,000 active passes issued by the Council, of which 36,000 are age-related and 4,000 disability-related. Data for January – 
May 2017 suggests the majority of passes are rarely used: 21,000 had been used for an average of less than one return journey per week and 
10,000 had not been used at all. Of the other 9,000, fewer than 100 had been used to make more than 10 return trips per week in that period.     
 
The audit considered the veracity of bus company claims for bus pass usage, as well as the issuance of bus passes and the accuracy of 
calculations for reimbursement. This was the first time that this area had been audited. 
 
Objectives and Scope of the Audit 
The purpose of this audit was to provide assurance to management that procedures and controls within the system ensured that: 
 
• 
Bus passes were issued in line with criteria and up to date records are kept to minimise the risk of abuse or fraud; 
• 
The data returns provided by BOCs and NYCC were reliable and accurate; 
• 
Calculations for reimbursement were accurate and completed in a timely manner. 
 
This audit included a visit to First Group because they are the main recipient of reimbursement from the Council. 
 
Key Findings 
It was found that Customer Services staff understood and had access to the eligibility criteria for passes. The Innovator system, which is used for 
issuing and recording passes, has mandatory fields that must be completed before an application can be processed. These include the pass 
type, date of birth (for age-related passes) and a drop-down list of ‘evidence seen’ for disabled passes. 
 

 
3 
  
 
The first significant issue is that although Innovator contains a ‘hot-listing’ function used for marking passes that are no longer valid, 'hot-listing' is 
not currently in effect. This means that passes barred on the Innovator system (for example, as lost or stolen) can still be used on buses to make 
journeys. Analysis identified three such passes still in use xxxxxxxxxxxxx. It should be noted, however, that officers are currently in the process 
of implementing a version of 'hot-listing', which will go some way to addressing the issue. Furthermore, ‘hot-listing’ has only been implemented by 
some TCAs nationally. This is raised in more detail in Finding 1 below. 
 
Other findings related to issuing passes included that evidence for eligibility is not retained by Customer Services and that there is an available 
category of 'none' for 'evidence seen' that can be used when processing new applications. It was also found that Returns of Deaths have not 
been received from York Register Office for several months, so pass holders have not been marked as deceased. 
 
Overall, analysis of data returns suggests they are generally reliable and that calculations for reimbursement are accurate. Comparison of the 
Electronic Ticket Machines (ETMs) and Host Operator Processing Systems (HOPS) data for First York routes found a discrepancy of 2.33% in 
the total trip figures for April - December 2016. xxxxxxxxxxxxxxxxx  
 
xxxxxxxxxxxxxxx 
 
There is also no written guidance for carrying out 'reasonableness' checks on the data returns provided by First and NYCC. A visit to First York 
was also conducted during the audit. This established the guidance provided to drivers regarding bus passes and what reports are sent to the 
Council. However, the process for extracting data from ETMs and assembling the reports was not discussed in detail. There is an allocation of 
time in the 2017/18 audit plan that will be used for further work in this area. 
 
Calculations for reimbursement were found to be accurate and completed in a timely manner. The purchase order for First York was properly 
authorised and there was an agreement in place for making advance payments, with monthly adjustments. These had been correctly calculated 
and paid. xxxxxxxxxxxxxxxx 
Overall Conclusions 
The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation 
but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was 
that they provided Reasonable Assurance. 
 
 

 
4 
  
 
 
1 Implementation of 'hot-listing' 
Issue/Control Weakness 
Risk 
'Hot-listing' is not currently in effect xxxxxx 
Passes are used fraudulently, leading to financial loss to the 
Council. 
Findings 
It was known at the start of the audit that 'hot-listing' of passes currently was not in operation. Although passes can be 'hot-listed' on Innovator, 
this does not prevent them from being used on buses as it does not communicate with the smartcard readers. 
 
Testing of 30 passes 'hot-listed' on Innovator found 3 to still be in use despite replacements being issued. There are around 2,500 active 'hot-
listed' passes. This suggests, therefore, that around 10% of passes 'hot-listed' in 2016/17 may still be in use. As passes last for up to 5 years, 
the total number may be higher because passes 'hot-listed' as far back as 2012 may still be valid. Usage data for the 3 passes still in use has 
been analysed and no fraud is suspected. 
 
xxxxxxxxxxxxxxxxxxxxxxxx 
 
Officers have indicated that a version of 'hot-listing' will be implemented, which will go some way to reducing the risk. The new system will 
contain a ‘warm-list’ of suspect passes issued by the Council. When used, these passes will be moved to a ‘hot-list’ and will no longer be 
accepted. The system will not hold ‘warm-lists’ of passes from outside the York area due to technological limitations on the buses and because 
most TCAs have not implemented ‘hot-listing’.  
Agreed Action 1.1 
’Hot-listing’ will be implemented soon for the existing system and will be part of the new 
system.  
Priority 
2 
Responsible Officer 
Sustainable Transport 
Manager  
Timescale 
September 2017 
 

 
5 
  
 
 
2 xxxxxxxxxxxxxxxxxx 
Issue/Control Weakness 
Risk 
xxxxxxxxxxxxxxxxx 
xxxxxxxxxxxxxx 
Findings 
xxxxxxxxxxxxxxx 
Agreed Action 2.1 
xxxxxxxxxxxxxxxxx 
Priority 
2 
Responsible Officer 
Public Transport 
Planner 
Timescale 
September 2017 
 
 

 
6 
  
 
 
3 Guidance on 'reasonableness' checks of data returns 
Issue/Control Weakness 
Risk 
'Reasonableness' checks are not documented. 
'Reasonableness' checks are not conducted, leading to 
overpayments by the Council. 
Findings 
Discussion with the Public Transport Planner suggested that identifying discrepancies in trip figures from First York and NYCC relies on his 
experience and knowledge as there is no written guidance on carrying out reasonableness checks. xxxxxxxxxxx it may be advisable to compile 
written procedures on what checks to carry out should it become necessary for a less experienced person to conduct these checks. 
Agreed Action 3.1 
The Public Transport Planner will produce a document containing guidance on how data 
returns from First and NYCC can be checked for reasonableness. 
Priority 
3 
Responsible Officer 
Public Transport 
Planner 
Timescale 
September 2017 
 
 

 
7 
  
 
 
4 Evidence of eligibility 
Issue/Control Weakness 
Risk 
Evidence to support applications is not retained. 
Ineligible applications are approved. 
Findings 
Discussions with officers found that evidence of eligibility is not retained by officers once applications have been processed, despite Innovator 
having a document upload function. It is not possible, therefore, to confirm that applicants are eligible, although it should be noted that 
Customer Service staff were aware of their responsibilities and the evidence required is listed on the application forms. Copying and uploading 
documentation would provide greater assurance that applications are valid and confirm evidence has been seen. 
 
Evidence of eligibility for disabled passes will be retained because evidence of disability has an expiry date and it is more likely there will be a 
need to refer to it. Despite the much greater number of age-related passes, age-related evidence will not be retained as it does not expire and it 
is much less likely there will be a need to refer back to it.  
Agreed Action 4.1 
Copies of evidence of eligibility for disability-related passes will be retained. Upon renewal, 
expired evidence will be removed and new evidence uploaded.  
Priority 
3 
Responsible Officer 
Customer & Resident 
Services Manager 
Timescale 
September 2017 
 
 

 
8 
  
 
 
5 'Evidence seen' field on Innovator 
Issue/Control Weakness 
Risk 
The Innovator system accepts 'none' as a valid category for 'evidence seen' 
when processing applications. 
Ineligible applicants are issued with passes. 
Findings 
Testing found that the Innovator system is designed in such a way that officers must enter certain details for applications to be approved. For 
disabled passes, it checks against a drop-down list of 'evidence seen'. This ensures that all relevant details are captured by the system. 
However, the 'evidence seen' field contains the valid category of 'none', which raises the possibility of applications being approved without valid 
evidence being seen. Although sample testing did not identify any that had 'none' as 'evidence seen', removing this category from the 
replacement system would prevent either accidental or deliberate use. 
Agreed Action 5.1 
The ‘none’ category will be removed from the evidence seen field as part of the new IT 
system. It will be ensured that only valid forms of evidence are included in this field. 
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
September 2017 
 
 

 
9 
  
 
 
6 Guidance for bus drivers 
Issue/Control Weakness 
Risk 
Guidance is in place, but it is not known if the guidance is followed. 
Guidance on checking passes is not followed by drivers, 
allowing possible fraudulent use of passes. 
Findings 
Discussions held with representatives from First York found that there is reasonable guidance in place for drivers regarding their responsibilities 
when checking concessionary bus passes. This discussion does not, however, confirm that the drivers are actually aware of and carrying out 
their responsibilities. Independent verification that drivers are doing so would provide more persuasive evidence than simply relying on the 
discussion held with First York. Incorporating a check into the surveys conducted by the Transport team would provide some evidence that 
guidance is followed. 
Agreed Action 6.1 
Checks that drivers are following the guidance will be incorporated into the bus surveys 
conducted by Council staff. There will also be a general review of the form used for the 
surveys. 
Priority 
3 
Responsible Officer 
Sustainable Transport 
Manager 
Timescale 
September 2017 
 
 

 
10 
  
 
 
7 Return of Deaths 
Issue/Control Weakness 
Risk 
Returns of Deaths are not being received from York Register Office, so pass 
holders are not being marked as deceased. 
Pass holders are not marked as deceased, leading to 
fraudulent renewals or use of passes by other persons. 
Sending out renewal letters to deceased persons may also 
cause distress to families and harm the Council's reputation. 
Findings 
Of 15 individuals on the most recent Return of Deaths list who were positively identified as holding bus passes, 12 of them had not been 
marked as deceased. Discussions with Customer Services established that they had not received a report from the Register Office for several 
months and they had not been chased up, which is why these individuals had not been marked as deceased.   
 
A further 6 individuals could not be positively identified on Innovator because, although their names were on the system, they were registered 
at different addresses. The individuals may have moved house between receiving their bus pass and passing away. However, it is not possible 
to be sure about this without further information, such as a date of birth, which is not included in the report. 
 
Currently, marking individuals as deceased only prevents them from receiving renewal letters. It does not stop the pass from working because 
'hot-listing' is not in effect. Therefore, it is of limited value as a control because another related control does not work. Once 'hot-listing' is 
implemented, however, it will become more important to ensure that records are accurate so that this control is effective. 
Agreed Action 7.1 
Customer Services will liaise with the Register Office to ensure Returns are sent regularly. 
They will also discuss sending the Returns electronically and review the information in the 
report to ensure it is sufficient. Finally, the missing Returns will be acquired and Innovator 
records updated. 
Priority 
3 
Responsible Officer 
Customer & Resident 
Services Manager 
Timescale 
September 2017 
 
 

 
11 
  
 
Annex 1 
Audit Opinions and Priorities for Actions 
Audit Opinions 
Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or 
error. Our opinion is based on the risks we identify at the time of the audit. 
 
Our overall audit opinion is based on 5 grades of opinion, as set out below. 
 
Opinion 
Assessment of internal control 
High Assurance 
Overall, very good management of risk. An effective control environment appears to be in operation. 
Substantial 
Assurance 
Overall, good management of risk with few weaknesses identified.  An effective control environment is in 
operation but there is scope for further improvement in the areas identified. 
Reasonable 
Assurance 
Overall, satisfactory management of risk with a number of weaknesses identified.  An acceptable control 
environment is in operation but there are a number of improvements that could be made. 
Limited Assurance 
Overall, poor management of risk with significant control weaknesses in key areas and major 
improvements required before an effective control environment will be in operation. 
No Assurance 
Overall, there is a fundamental failure in control and risks are not being effectively managed.  A number of 
key areas require substantial improvement to protect the system from error and abuse. 
 
Priorities for Actions 
Priority 1 
A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent 
attention by management. 
Priority 2 
A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to 
be addressed by management. 
Priority 3 
The system objectives are not exposed to significant risk, but the issue merits attention by management. 
 

 
12 
  
 
 
Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that 
any third party will rely on the information at its own risk.  Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in 
relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where 
information is provided to a named third party, the third party will keep the information confidential.