To consider the Internal Audit work undertaken and the assurance given on the adequacy of internal controls operating in the systems audited.

36.1          The report of the Head of Corporate Services, circulated at Pages No. 55-83, detailed the findings of Internal Audit for the period September-November 2018.  Members were asked to consider the audit work completed and the assurance given on the adequacy of the internal controls operating within the systems audited.

36.2          Members were advised that full details of the work undertaken were attached at Appendix 1 to the report.  An audit of financials e-ordering had been carried out following the introduction of this new purchasing module which had replaced the paper purchase orders that had been used on an ad-hoc basis.  The system had been rolled out to all services and Internal Audit had checked how well it was managed.  Overall, there was a satisfactory level of control and the authorisation level in the system was correctly inputted. One area for improvement had been identified as a number of orders were being raised at the point when the final invoice was received; orders should be raised at the point of the order so it could be reflected in the appropriate budget.  All users had received training on the module but it would be necessary for more targeted training and a further recommendation had also been made around monitoring.  The Head of Corporate Services went on to confirm that departments were required to set-up their own suppliers with supporting evidence which required validation and authorisation from a member of the Finance Team prior to any payments being made in order to mitigate risk of fraud.  A recommendation had been made around Disabled Facilities Grants as there was currently no record of commitment maintained by the service to see what was left in the budget.  Members were advised there was adequate separation of duties within the invoices sampled; however, it had been identified that, as the Finance Team processed invoices for payment, there was potential that the same Officer could raise a purchase order, goods receipt and process the payment without checks or validation from another Officer.  This was considered to be low risk and verbal assurance had been given that two Officers were always involved in the process; notwithstanding this, it was recommended that a monthly report of all purchase orders raised within Financial Services be reviewed and signed-off by the Finance Manager to confirm payments were genuine.  A Member queried what supporting evidence was required in order to set-up a new supplier and was advised that it was necessary to validate that it was an official supplier so it would usually be headed notepaper from the supplier; the information was not taken at face value so additional checks would be carried out, for example, a second source would be used to check the contact telephone number etc.  The Internal Auditor confirmed that, once the supplier information had been entered into the system, this went to the Finance Team to review the bank account details.

36.3           Members were informed that an audit had also been carried out of Adelante, the Council’s new income management system which managed payments taken by card and cash and performed reconciliations on payments received through the bank.  Overall, there was a satisfactory level of control and two technical recommendations around PCI-DSS compliance and retention of card details had been assigned to the Head of Corporate Services and Head of Finance and Asset Management.  There was a good level of control in relation to the day to day operation of the system - refunds were being done for a legitimate reason and were promptly and accurately accounted, payment transactions were correctly allocated and promptly receipted within the bank, and bank receipts were reconciled within the system on a prompt basis – as such, there were no recommendations in relation to this aspect of the audit.  In response to a Member query regarding the risk in relation to non-compliance with the General Data Protection Regulation, the Head of Corporate Services confirmed that this was only being highlighted as a potential risk - there was nothing to suggest any non-compliance currently - and this was being measured against.

36.4           With regard to the business rates audit, Members were advised that there was a good level of control in relation to legislative and policy compliance.  There was a satisfactory level of control in respect of operational risks and a process for identifying new business rateable properties was in place whereby notifications were received from the Planning department.  This was being further enhanced by the full rating list review being carried out by the Counter Fraud Unit.  One recommendation had been made to review the transitional relief certificates to accounts and to apply these to accounts at the same time the alteration to the rating list was processed.  The Council had received 17 schedules from the Valuation Office since it had started issuing transitional relief certificates in April 2017, five of which were yet to be implemented at the time of the audit; this was due to a lack of awareness of the certificates, and how to enter them into the system, which had now been resolved.  It was pleasing to note that the Council was transparent in publicising the support offered to businesses, particularly in terms of the relief businesses could apply for, as demonstrated through a review of the information on the Council’s website.  It was noted that it was common in small authorities for a single Officer to do a particular job and a recommendation had been made around ethics and good governance in relation to spot checking and recording the Area Revenues Officer’s business rate activities within Northgate on a regular basis.  Members were advised that there had been delays in recovery action on some accounts sampled; however, the Revenues and Benefits Manager had addressed this during her 12 months in post and the Area Revenue Officer was now dedicated purely to business rates, as opposed to other revenues tasks, and data reported to the last Overview and Scrutiny Committee suggested this had not been detrimental to the overall collection rate.  In terms of the manually entered exemptions and parameters being entered into the system correctly, a sample of the accounts had confirmed that the system calculations were accurate.  A Member recalled that the Council had written-off considerable sums in the past for uncollected business rates when a company had gone out of business and he questioned whether the owner of the building could be pursued for the debt.  The Audit Manager explained that it did not matter if the company owned the building, rather it was dependent on who held the lease.  Unfortunately, the lease could be for 10 or 20 years and, until it was revoked by the owner, only the person renting the premises could be traced.  The Head of Corporate Services indicated that work had been carried out previously in relation to write-offs and the Internal Audit team was satisfied that process was robust and transparent.  The Head of Finance and Asset Management confirmed that, where debts were written-off, there was a bad debt provision so the costs were shared with central government and Gloucestershire County Council.

36.5          Members were advised that a limited level of control had been identified in relation to the audit of vehicle fleet management for a combination of reasons.  Adequate maintenance records were retained for each vehicle for the prescribed period; however, there was a contractual requirement for Ubico to provide an annual service report which had not been forthcoming.  As such, a recommendation had been made that Ubico and the Council should agree the format of that report and how it should come forward.  In addition, it had been identified that there was no stock control system in place in relation to the depot’s bulk order purchases and consumables – this was not just a Tewkesbury Borough Council issue and needed to be addressed across the board within Ubico.  A recommendation had been made around the process of identifying trends for rechargeable repairs – for example there may be links to a specific driver, route or vehicle - and the Head of Community Services was raising this at the partnership board.  It was noted that, of 95 inspection sheets reviewed during the audit, 35 had made comment on the cleanliness of the vehicles and, in some cases, the vehicle had been “too dirty to fully inspect”.  As such, processes had been put in place to strengthen the cleaning regime and this would be followed-up in due course.  In terms of vehicle usage, it had been noted that two vehicles were being used across different local authorities in line with the ethos of efficiency; however, this was problematic as each authority had its own vehicle fleet.  For example, a food waste vehicle - which had been procured outside of the full procurement process – was found to be unsuitable for use by Tewkesbury Borough Council and had subsequently been lent to Stroud District Council, which was meeting the cost of a replacement vehicle that was being hired for food waste collection, but there was no formal agreement in place to support the arrangement and to reflect the depreciation of the vehicle.  Similarly, a specialised street cleansing vehicle owned by Tewkesbury Borough Council had been used in both Tewkesbury and Cheltenham Boroughs between September 2017 and April 2018 but, in accordance with the terms of the contract, formal reporting of the usage of the vehicle should have taken place with consideration given to cost implications.  Confirmation was provided that there was health and safety reporting with personal, vehicle and property accidents and near misses discussed at the monthly client monitoring meetings and the quarterly Environmental Services Partnership Board meetings; however, more specific information needed to be provided to fully comply with the vehicle hire contract conditions and the frequency of which accident data was notified to the Council should be in line with the contract.  At the time of the audit, there were no Key Performance Indicators (KPIs) in relation to the vehicle hire contract between Ubico and the Council to determine how well the vehicle fleet was being managed; this had previously been flagged up as an issue by the Overview and Scrutiny Committee.  The Head of Corporate Services indicated that a suite of new KPIs was due to be implemented and this would be addressed in the follow-up audit.  Whilst he had not seen the KPIs, it was likely they would include vehicle-related KPIs in relation to the retention of the Driver and Vehicle Standard Agency (DVSA) green rating, which covered maintenance and servicing of vehicles, supported by others which were specific to the Council’s fleet.  It was noted that there was no resource for a dedicated fleet monitoring officer within the Council, and the Head of Community Services had taken this discussion to Management Team, so a recommendation had been made to ensure that ‘fleet’ was included as an Agenda item at Environmental Services Partnership Board meetings.  Finally, Members were advised that the audit had confirmed there was financial reporting at the monthly Board meetings.  Notwithstanding this, an initial sample of 2017/18 expenditure had been traced from the vehicle job sheets and order forms to the finance system and had shown that, in 9 out of 10 cases, expenditure totalling £2,686 had been incorrectly allocated to Cheltenham Borough Council.  The Head of Corporate Services advised that verbal confirmation had been received from Ubico that all invoices for that financial year had been reviewed and procedures had been amended to mitigate future miscoding errors; this was corroborated by additional testing of 2018/19 expenditure.

36.6          During the debate which ensued, a Member questioned whether drivers were made to pay for any accidents they had been involved in and confirmation was provided that they were covered by Ubico’s insurance.  The Member also queried whether the money which had been incorrectly allocated to Cheltenham Borough Council would be recouped and the Head of Finance and Asset Management advised that the invoice had not yet been received but provision would be made for this to be recharged.  Another Member raised concern that overweight vehicles could be a growing problem, given the amount of new residential development in the borough and subsequent increase in loads, so this would need to be closely monitored in future.  The Internal Auditor explained that Ubico would be at risk of losing its operator licence if it failed to comply with DVSA standards and continued to overload vehicles.  In response to a query regarding the annual service report, the Head of Finance and Asset Management advised that this was a requirement set out in the hire agreement and he provided assurance that a report for 2018/19 would be provided by May 2019.  A Member questioned whether stock management was a problem for other partners and was advised the issue related to Tewkesbury Borough Council sharing the Cheltenham Borough Council depot and the processes in place for purchasing equipment.  With regard to the lack of resources for fleet monitoring, a Member questioned whether the onus was on the Council or Ubico.  The Head of Finance and Asset Management confirmed that contract monitoring was the responsibility of the Council and conversations had been taking place as to whether the money which it input into the contract was being used effectively and, if so, whether more was needed to ensure that all elements were being monitored correctly.

36.7          Members were advised that Appendix 2 to the report included a list of recommendations reviewed in the period and their status.  Of the 15 recommendations followed-up during the period, six had been implemented, three partially implemented and six were yet to be implemented.  Of the recommendations not yet implemented, none were categorised as ‘high’ although some had been outstanding for a length of time and it was therefore intended to ask the responsible Officers to attend the next Audit Committee meeting in order to explain their status.  In future, it was proposed that Officers must attend the Committee if the expected implementation date had slipped more than once.  A Member asked for more information regarding the agreement between Tewkesbury Borough Council and Winchcombe Town Trust in relation to the Tourist Information Centre audit and was informed that Winchcombe Town Trust owned the building from which the Tourist Information Centre operated, therefore, it was expected there should be a lease agreement between the two parties to define responsibility; this could not be produced at the time of the audit and had not come forward since, although the comment made by the Economic and Community Development Manager suggested that there was one - if that proved to be incorrect, an agreement would need to be drawn up urgently.  In response to a query, the Head of Finance and Asset Management advised that, whilst the Council was responsible for some of the utilities, he was not aware of any responsibilities for maintenance, although that could not be confirmed without the lease agreement.  It was noted that the implementation date for this recommendation had initially been set for August 2017 before being changed to September 2018 and, most recently, February 2019 which Members felt was unacceptable.  The Head of Finance and Asset Management confirmed there was an expectation this would be completed by the Audit Committee meeting in March 2019 and, if that was not the case, the Economic and Community Development Manager would be required to attend the meeting to give an explanation.  The Committee agreed that responsible Officers should be required to attend the next meeting for any recommendations which were not ‘green’ and the Head of Corporate Services undertook to report this to Management Team. 

36.8          Having considered the information provided, it was

RESOLVED          1.   That the Internal Audit Monitoring Report be NOTED.

2.   That, for any recommendations that had not been implemented where the target implementation date had slipped more than once, the responsible Officer be required to attend the next Audit Committee to give an explanation.