To receive the report of the Director of Finance, Resources & Customer Services summarising the work that the Internal Audit and Risk Management Service (ARMS) has completed for the period 1 April 2016 to 19 September 2016.
RECEIVED the report of the Director of Finance, Resources & Customer Services summarising the work that the Internal Audit and Risk Management Service (ARMS) had completed for the period 1 April 2016 to 19 September 2016.
1. During the review period, the internal audit team had commenced 47% of the current plan of which 4% had been completed.
2. Some changes had been to the 2016/17 Audit Plan, primarily to help the Council achieve savings by reducing the cost of internal services. This has meant that that the service has reduced and re-thought how they are going to deliver some of the current audit plan. Details are shown in table 2 (page 3 of the first agenda) of the report. In summary, this has resulted in a reduction of the total days the team audits the plan by 200 days which will save approximately £60k - £70k through a reduction in the PwC contract. There would be no impact on the in house team from that.
3. Arising from the Audit meeting in July 2016, there had been some updates on the audits that were completed during 2015/16 but were given ‘no assurances’. At the July 2016 meeting the committee requested updates on those 3 audits. These were:
· Payments to families with no recourse to public funds
· Private sector leasing
· IT disaster recovery
Pages 4,5 & 6 of the report provide paragraphs from the responsible managers for those audits and who are in attendance today. Christine Webster (Head – Internal Audit & Risk Management) invited the Committee to ask any further questions to the responsible managers in response to their reports and the Chair asked manager’s if there was anything further they wished to add to their reports. The manager’s were Julian Edwards from Children’s Services, Madeleine Forster from Enfield Council Housing and Steve Durbin from Corporate IT.
a. Julian Edwards – He agreed that the audit process had been helpful. The system in place wasn’t sufficiently tight and wasn’t working effectively. Other Local Authorities were bringing in different systems and the new system that the department were developing was very much in line with that of Lewisham Council. Details of the Lewisham model had now been sent out to all London Borough’s. The new system positions a Counter Fraud officer alongside social workers and Housing staff at the initial screening stage as regards payments to families with no recourse to public funds (NRPF). The new system comes into operation next week after a pilot scheme, with a review built in for January 2017. Over the 14 families that the department saw during the pilot period of the system, 10 were accepted as legitimate and legally needed to be supported by the Council. However, there were 4 families that were refused as a result of counter fraud involvement. This is a significantly improved system and will allow the department to turn the curve in total expenditure patterns.
The following issues raised by Members in response to the report and clarified by Julian Edwards:
· Families were put in the NRPF category because they have not got a legal entitlement to stay in the UK and they have not had any final decision made about deportation. This could be a lengthy process that is made by the Home Office. In extreme cases it can take up to 5 years before a decision is made. In that period of time the Council has to provide housing, subsistence and any other services that may be required to support these families.
· In addition to the new families, the department will also look at the 80 households the Council is supporting at present.
· Children’s Services had asked Internal audit to come in because of concerns regarding payments to familes’ with no recourse to public funds.
Children’s Services would be providing a further report after the review of the new system in January 2017.
ACTION: Julian Edwards (Interim Assistant Director – Children’s Services).
b. Madeleine Forster – Work on reducing the number of outstanding gas safety certificates, would not depend on implementing a current re-structure in the department and good progress was now being made. At the beginning of September 2016, there were 128 outstanding gas certificates and within a month this figure had reduced to 104. The team is steadily reducing the number of outstanding certificates. Processes had now been agreed with the relevant Hub, whom are still administering a large part of this, by bearing down on tenants to allow the department access and the owners of properties to comply with Council requirements to provide gas safety certificates. Confidence within the department that they have turned the curve on this risk but will still take a while to address the larger outstanding gas certificates because there may be a need to take a legal route on a number of those. Processes had now been agreed by legal and tenancy teams and are now aligned to the new processes.
The following issues raised by Members in response to the report and clarified by Madeleine Forster:
· The Chair enquired how long the legal cases would take. Madeleine Forster clarified that there were 40 properties at present where the teams have no access and are following this up with contractors and tenants. We now start chasing tenants before the gas certificates expire using the housing management process which the new process has been modelled on. Therefore, by the time the gas certificate is due and teams have not been able to gain access to properties, the teams have managed to take legal action to enter. This action would take some time to deal with the backlog, where applications have to be made to court. In addition there are 26 further cases where the department is waiting for gas certificates from landlords who were now being chased and action will be taken if those are not received.
· Councillor Neville stated that a gas certificate should be obtained before allowing tenants into properties. Madeleine Forster said that this is what the department would be doing going forward. She could not assure the committee that this was the case. This was what should have been happening and may well be the case. Madeleine would find out this information and report back to the committee.
ACTION: Madeleine Forster (Housing Programme Manager).
· The internal audit team had taken a sample of these cases to audit and found that all the sample properties had been gas certified once but they had not been re-certified or renewed and were out of date. These were not new lets.
c. Steve Durbin – The internal audit identified seven high risk findings and at the time the managed facility was being provided by the previous outsourcer. IT disaster recovery is now in-house and teams have agreed new disaster recovery arrangements with Corporate Management Board (CMB). A business continuity disaster recovery board has been set up which meets regularly to oversee IT disaster recovery. There is now a single dedicated officer in IT, responsible for this. This project has now been initiated with a company called ‘Sungard’ who have been doing disaster recovery for 30 years and are working with other London Local Authorities to create a new workable disaster recovery (DR) system. These days DR is needed a lot less due to more resilient systems being built with these being spread across several geographical areas. If there is failure in one geographical area then it switches automatically to another area. Therefore DR is now mostly concerned with older systems or systems that cannot be replicated. A completed version of the new system is now in place with testing due to start next week. The test is due for completion by November 2016 and Steve will feedback to committee after this date. Christine Webster also confirmed that Internal Audit will be doing a follow up audit of IT disaster recovery.
The following issues raised by Members in response to the report and clarified by Steve Durbin:
· Testing of the new system is done by pretending there is an IT disaster but without an actual IT disaster. This cannot be done on-site because of the running live system. Teams have to travel to Heathrow to build systems and ferry users down there to test and make sure everyone is confident about it before signing it off in that way. The department are hoping to cut costs further by installing a communications link that doesn’t put the Council’s main systems at risk.
· The Council’s set objectives on IT disaster recovery are beyond what was possible, as detailed at 3.10 (page 6) of the report.
· The Chair requested a full report on the outcome of the new processes regarding IT disaster recovery, which Steve Durbin agreed to.
ACTION – Steve Durbin (Interim Head of IT)
4. In terms of Managers’ progress with implementation of recommendations, chart 1 (page 7) of the report, summarises progress with implementing management actions. Overall 36% of high priority actions had been implemented. The remainder are either progressed and a few recommendations that were not implemented. In particular, 2 high risk recommendations for FRCS had not been implemented as detailed at Table 3 (page 7) of the report.
Since the production of this report, Christine had received information that GVA had now agreed the sub-contracts with Spencer Craig & Knight Frank. The sub contracts mirrored the terms of proposal with GVA in that the contract runs to February 2017 and there are options to extend if necessary. In addition, several headings for reporting have been agreed. Standard report format should be agreed within the next few weeks and a revised target date of 1 October 2016 has been given. Internal audit will follow up this risk again next week.
5. In terms of Counter Fraud achievements, there is a summary detailed at Table 4 (page 80) of the report.
The team have recovered 19 Council houses so far this year, 1 temporary accommodation recovery and savings from frauds prevented are totalling £572k. To note, that the team have now added in the savings from the prevented fraud and no recourse to public funds (NRPF) cases which amounts to £49,200 for 3 cases. The team have also prevented the sale of 2 right to buy properties amounting to £171,500.
Table 5 (page 9) of the report gives the results of audit servicing measures, which are better than the target dates.
6. The following issues raised in response to the report:
a. Councillor Neville mentioned the 36% of high risk recommendations that have been implemented and asked over what period these recommendations had been implemented. Christine Webster clarified that these were all management actions which have passed target dates. They should all have been implemented by the target dates. These recommendations are either outstanding at the beginning of April 2016 or have fallen due in the period from 1 April 2016 to 1 September 2016.
The Committee agreed that they would be in favour for Directors to come before the committee to explain why recommendations had not been implemented by specified target dates.
The Chair agreed that a timetable should be agreed and factored into the work programme.
ACTION: Committee Administrator (Work Programme)
b. Councillor Neville asked whether the savings that are to be made, as a result of the reduction in audit days of 200, offset or would this lead to further errors due to increasing pressures and staff reduction. Christine Webster clarified that the reduction in audit days was a risk but what the department had tried to do was target the reduction to areas where they could provide assurances in different ways. For example, they would be relying on work that BDO will be doing for some assurances around the Meridian Water Project, because BDO were doing that anyway. The team have tried to combine some audits so as to try to deliver them in a more efficient way. The biggest area of reduction was around the financial services audit work which had been delivered through a continuous audit monitoring approach. This meant 3 phases of audits on 10 different systems. They were now reducing this approach to 2 phases instead of 3 phases and targeting the systems that did not provide high assurance. The team were trying to be risk based but if, after reviewing these changes, things got worse then a decision would have to be made to increase audit days.
c. Councillor Dogan spoke about Table 3 and the appointed sub-contractors, Spencer Craig & Knight Frank and if there were any implemented checks in place to prevent or detect fraud, so, for example, when applicants apply for leases on Council properties, checks can be made that things are being done correctly.
Post meeting note from Christine Webster:
Prospective tenants undergo various checks before any assignment / new letting is agreed. These include identity checks (passport / valid driving licence / ID cards) being provided, proof of residency (for Non-UK nationals – visa documentation / work permits), and proof of residential address (council tax or utility invoices dated within the last 3 months).
Additional to this are companies house document searches (for corporate tenants), bank / accountants references, CCJ searches and credit referencing. There have been a few cases where these searches have turned up anomalies such as continued limited company failures which tend to indicate not only a lack of creditworthiness but also deliberate credit liability evasion. In these rare cases, further enquiries are made directly to establish whether a prospective tenant can be considered.
AGREED to note the progress made in delivering the Audit and Risk Management Service’s 2016/17 work plan and the outcomes achieved to date.