internal audit activity report - West Midlands Police and Crime ...

David Giles CPFA, Head of Internal Audit
31 st May 2012
INTERNAL AUDIT ACTIVITY REPORT
Head of Internal Audit - David Giles
Ext: 7800 2380
e-mail: giles_57340
Copies to:
Audit Committee
Mike Williams – Treasurer to the Police Authority

Internal Audit Activity Report 31 st May 2012
Contents
Introduction ............................................................................................................. 2
Progress Summary ................................................................................................. 2
Overall Opinion on Control Environment 2012/13 ................................................ 3
Recommendations in 2011/12 ................................................................................ 4
Other Areas of Activity............................................................................................ 5
Appendix 1 – Internal Audit Plan – Status / Assurance Summary ........................6
Appendix 2 – Summary of agreed action plans for reviews completed to date
with Major or Significant Recommendations ............................................ 10
Appendix 3 – Audit opinion and recommendation definitions .......................... 16
1

Internal Audit Activity Report 31 st May 2012
Introduction
1. This report provides an overview of the work undertaken by Internal Audit during the
period 1 st April 2012 to the 31 st May 2012 and the progress against the Internal Audit
Plan for 2012/13.
Progress Summary
2. Attached at Appendix 1 is a summary of Internal Audit progress against planned
activity to 31 st May. The appendix summarises the status of each audit review and the
level of assurance provided where applicable. 9 reviews have been completed during
the period.
3. Since the 1 st April 2012, Table 1 details the Internal Audit reviews that have been
reported and agreed with management:
Audit Review Assurance provided Appendix
Intelligence Department
Controlled, but
needs improvement
N/A
PPU Follow Up Controlled N/A
Walsall LPU
CJPT
Sandwell LPU
General Ledger
Payroll
Fleet Services Department
Controlled, but
needs improvement
Controlled, but
needs improvement
Controlled, but
needs improvement
Controlled, but
needs improvement
Controlled, but
needs improvement
Controlled, but
needs improvement
2 (i)
2 (ii)
2 (iii)
N/A
2 (iv)
2 (v)
Certificate Income Follow Up Well-Controlled N/A
Table 1
4. Appendix 2 contains the agreed action plan of any review with a significant or major
recommendation, but does not include the detailed findings. Full reports can be made
available to Audit Committee members upon request but are not included as a matter
2

Internal Audit Activity Report 31 st May 2012
of course. The exception to this where a review gives an “inadequately controlled”
assurance opinion when the full report will be made available to the committee to
enable members to fully understand the reasons why this opinion has been given and
the implications for the Authority. A summary of the audit opinions and
recommendation descriptions at Appendix 3.
Overall Opinion on Control Environment 2012/13
5. An audit opinion is provided as part of each Internal Audit report. It is derived from the
work undertaken during the audit review and is intended to provide assurance about
the internal controls in place in that system or particular Force / Authority activity. The
Internal Audit work to date has covered a number of areas across the Force / Authority.
The assurance provided by this work is as follows in Table 2:
Assurance provided Q4 Q3 Q2 Q1
Year to
Date
Well Controlled 1 1
Controlled 1 1
Controlled, but needs
improvement
7 7
Inadequately Controlled 0 0
Number of reviews reported 9 9
Table 2
6. A number of recommendations have been agreed as part of each review completed to
date. However, no major areas of concern have been highlighted as a result of the
Internal Audit reviews completed to the end of May 2012. In each case appropriate
action and a timescale has been agreed with senior managers across the Force /
Authority to implement the recommendations made. Progress in implementing agreed
recommendations will be monitored and reported accordingly. As a result of the
reviews completed recommendations for improvement have been agreed with
management where necessary and is summarised in Table 3 below under the following
categories.
3

Internal Audit Activity Report 31 st May 2012
Recommendations agreed Q4 Q3 Q2 Q1
Year to
Date
Major 0 0 0 0 0
Significant 7 7
Moderate 28 28
Low
11 11
Number of
recommendations agreed
46 46
Number of reviews reported 9 9
Table 3
Recommendations in 2011/12
7. An analysis of recommendations made by Internal Audit is given in Table 4
(Recommendations made and accepted in 2011/12) and Table 5 (Recommendations
implemented, in relation to 2011/12 where appropriate – i.e. followed up) below.
Recommendations Major Significant Moderate Low Total
Made 0 14 117 94 225
Accepted 0 14 114 93 221
Percentage Accepted N/A 100% 97% 99% 98%
Table 4
Recommendations Major Significant Moderate Low Total
Accepted 0 14 (3) 114 (12) 93 (14) 221 (29)
Implemented 0 (2) (10) (8) (20)
Percentage Implemented 0 67% 83% 57% 69%
Table 5
8. The unimplemented significant recommendation in Table 5 above relates to issues
regarding detained property within Walsall LPU. It was found that the number of items
missing from its property stores has increased along with the number of items being
booked out and not promptly returned. To address the issues identified by Internal
Audit, LPU management have agreed to place an additional member of staff into the
property store.
4

Internal Audit Activity Report 31 st May 2012
9. There is an audit allocation during the current year to review detained property across
the Force as issues were identified with the majority of LPU property stores during the
most recent round of LPU reviews.
Other Areas of Activity
10. In addition to planned Internal Audit work that requires assurance levels to be
assessed, other planned work relates to those areas of work / activity that support and
underpin the overall concept of Internal Control rather than individual control systems.
11. Where requests are made that fall in this category but have not been originally
budgeted for, these will be met from the small contingency allocation held within the
plan (4%).
12. During the period covered by this Activity Report, the following work in this category
has been undertaken.
Riots Damages Act
PCC Transition Project
5

Internal Audit Activity Report 31 st May 2012
Appendix 1 – Internal Audit Plan – Status / Assurance Summary
2012/13 Internal Audit Plan
DEPARTMENTAL REVIEW
Property Services
Fleet
Corporate Services
Information Department
Finance
Crime Support
Criminal Justice Department & Custody
Organisational Support
Intelligence
Operations
CTU
Public Protection Unit
Local Policing
LPU REVIEW
Birmingham North
Birmingham South
Birmingham East
Birmingham West and Central
Dudley
Walsall
Wolverhampton
Sandwell
Solihull
Coventry
LPU REVIEW (Completion 2012)
Birmingham North
Birmingham East
Dudley
Wolverhampton
Walsall
Sandwell
Solihull
Coventry
Status at 31 st
May 2013
Final
On-Going
Draft
Final
Draft
Draft
Draft
Draft
Final
Final
Draft
Draft
Assurance
provided
Controlled, but
needs improvement
Controlled, but
needs improvement
Controlled, but
needs improvement
Controlled, but
needs improvement
6

Internal Audit Activity Report 31 st May 2012
2012/13 Internal Audit Plan
SYSTEMS/APPLICATIONS/CAATS
Status at 31 st
May 2013
Assurance
provided
National Fraud Initiative Support role N/A
FUNCTIONAL AREAS
Detained Property
Certificate Income Final Well-Controlled
General Stores Audit
On-Going
Building Security (Physical, Technical & Guards)
Building Maintenance
Fleet Management
Fuel Management
On-Going
Garage Stores
On-Going
Mobile Storage Devices
On-Going
Inv/Asset Registers
On-Going
Fixed Penalties
Spec Servs Income
Bank Reconciliation
Creditors
Draft
Payroll - Police, Staff And Pensions
Final
Controlled, but
needs improvement
Cash Office
On-Going
Write Offs & Losses (Physical)
Core Financial Systems
General Ledger
On-Going
Final
Establishment Control
On-Going
Sickness Management
Management Of Staff Time
On-Going
Occupational Health
Hospitality
Gateway Project
On-Going
Wide Banding
Workforce Planning
On-Going
Interpreters
On-Going
Crime
ID Parades
Data Protection
Community Init Funds
Stand Orders/Fin Regs
On-Going
Members Allowances
On-Going
Risk Management Support Role N/A
Corporate Governance (To Include Transition) Support Role N/A
Strategic Partnerships Support Role N/A
Collaboration / Regional Services Support Role N/A
Controlled, but
needs improvement
7

Internal Audit Activity Report 31 st May 2012
2012/13 Internal Audit Plan
Status at 31 st
May 2013
Assurance
provided
Audit Committee Reports / Workplans Support Role N/A
Audit Planning Support Role N/A
Strategic Business Plan Support Role N/A
Organisational Change Support Role N/A
Police Authority Inspections (HMIC) Support Role N/A
Source Handlers
Covert Operations
Final
Controlled, but
needs improvement
Intelligence Related Reviews
Firearms Unit
Dog Training
Operation Supp Unit
Business Continuity
On-Going
Major Incident Response
CTU Covert Accounts
Public Protection Unit Related Reviews
Management Of Police Information
Insurance
Draft
BACSTEL
Treasury Management
Overtime
External Funding
Seized Monies (POCA)
Specific Grant Funding
On-Going
PIC Monies / Custody
Internal Investigations / Professional Standards
Air Support Unit
Health and Safety
Draft
Fleet Management - Blameworthy
On-Going
Financial Planning
On-Going
Events Management
On-Going
CONTRACTS & PROCUREMENT
Final Accounts processes 2013
Final Accounts review 2013 Support role N/A
Contracts & Procurement
CONTINGENCY
PCC Transition Project
LPU Overpayments
HONORARY AUDITS & ADVICE
Support Role
On-Going
Tally Ho! Sports Club Accounts Support role N/A
Superintendents Association Accounts Support role N/A
Rainbow Club Accounts Support role N/A
8

Internal Audit Activity Report 31 st May 2012
2012/13 Internal Audit Plan
Status at 31 st
May 2013
Association of Police Lawyers Support role N/A
MANAGEMENT / DEVELOPMENT / TRAINING
General Administration Support role N/A
Courses - External Support role N/A
Post Entry Training Support role N/A
Police Internal Auditors Group Support role N/A
Performance Development and Review Support role N/A
Audit Website Support role N/A
West Midlands Chief Auditors Group Support role N/A
CIPFA - CPD Support role N/A
Galileo Project Support role N/A
Audit Away Day Support role N/A
OTHER NON PRODUCTIVE
Annual Leave Support role N/A
Bank Holidays Support role N/A
Sickness Management Support role N/A
Flexi time Support role N/A
FOLLOW UPS
Assurance
provided
PPU Final Controlled
9

Internal Audit Services
Internal Audit Activity Report 31 st May 2012
Appendix 2 – Summary of agreed action plans for reviews completed to date with Major or Significant Recommendations
(i)
Walsall LPU – Final Recommendation Action Plan
Key
Risk
Major
Significant
Moderate
Low
Rec.
No.
1
Recommendation Agreed Responsibility Action to be Taken to Implement Recommendation Date By
Management should ensure that all required
Management Control Checks are undertaken within the
recommended timescales.
Yes
Business manager
/ SSTM
Cash received through the post is now checked every month.
PBB2 should rectify the need for additional resources in the
Walsall Property store. Additionally, the SBM has allocated an
additional .5 post to assist the Property Officer address missing
items of property and progress disposals with a view to reducing
the number of items in the store.
Issues
addressed and
property
reduced by 30 th
June 2012
10

Internal Audit Services
Internal Audit Activity Report 31 st May 2012
(ii)
CJPT – Final Recommendation Action Plan
Key
Risk
Major
Significant
Moderate
Low
Rec.
No.
Recommendation Agreed Responsibility Action to be Taken to Implement Recommendation Date By
3
Management control checks should be undertaken on a
monthly basis.
Yes
Finance Team
Response from Strategic Business Manager
Management control checks will be completed on a monthly
basis.
June 12
11

Internal Audit Services
Internal Audit Activity Report 31 st May 2012
(iii)
Sandwell LPU – Final Recommendation Action Plan
Key
Risk
Major
Significant
Moderate
Low
Rec.
No.
Recommendation Agreed Responsibility Action to be Taken to Implement Recommendation Date By
3
Management control checks should be undertaken on a
monthly basis.
Yes
Finance Team
Response from Strategic Business Manager
Management control checks will be completed on a monthly
basis.
June 12
12

Internal Audit Services
Internal Audit Activity Report 31 st May 2012
(iv)
Payroll – Final Recommendation Action Plan
Key
Risk
Major
Significant
Moderate
Low
Rec.
No.
Recommendation Agreed Responsibility Action to be Taken to Implement Recommendation Date By
1
Copies of authorised documentation relating to new
starters should be held on the employee personal file to
provide evidence of the authority to create the employee
record within the payroll system. Where bulk notifications
are used, these should be filed in a manner which allows
source documentation to be easily retrieved as required.
Any new appointment of Authority Members should only
be actioned on receipt of an appropriately authorised
variation form. (This matter has also been raised and
agreed with the Police Authority Team to ensure that the
correct procedures are followed in the future).
Agreed
Payroll Section
Managers
Where individual starter variations are received, they are and
should always be held in the individual’s personal file. In the case
of Bulk/electronic notifications staff have been advised that e-
mailed notifications should be filed on the shared drive rather
than individual hard disks.
Payroll team have been instructed that all future new
appointments/changes to the Police Authority team should only
be accepted via a payroll variation signed by the Chief Executive.
Implemented
Implemented
13

Internal Audit Services
Internal Audit Activity Report 31 st May 2012
Rec.
No.
Recommendation Agreed Responsibility Action to be Taken to Implement Recommendation Date By
2
Officers who are designated signatories should be
requested to include their collar number alongside their
signature when authorising documentation.
Payroll officers should check to ensure that all payroll
forms received are authorised only by designated
signatures. Any forms which are incorrectly authorised
should be referred back to the originating department for
the correct authorisation.
Agreed
Payroll Section
Managers
Staff should be checking the signatures against the authorised
signatory list and have been reminded of the importance of this.
However, the authorised signatory list only shows the current
status and does not show historical changes. The database
changes frequently when staff move around the Force and
individuals that are not showing against a department or LPU
now, may have been at the time they signed the form. One of the
examples provided by audit has demonstrated this where a HR
officer was working in one department at the time of authorising
the variation but who has since moved to SSC.
Implemented
4
Payroll officers should be reminded of the need to check
all leaver data processed through the payroll and to
ensure that transactions are checked, independently
verified and evidenced on the variation form and daily
audit report.
Agreed
Payroll Section
Managers
Checks are being done but staff have been reminded to
demonstrate this by initialling the documents
Implemented
14

Internal Audit Services
Internal Audit Activity Report 31 st May 2012
(v)
Fleet Services Department – Final Recommendation Action Plan
Key
Risk
Major
Significant
Moderate
Low
Rec.
No.
Recommendation Agreed Responsibility Action to be Taken to Implement Recommendation Date By
1
The Department should ensure that management control
checks are undertaken within the recommended
timescales and evidenced accordingly in the
management control check file and source
documentation.
Agreed
SSTM / LPO
Check list has been implemented to ensure a monthly review is
being performed. The source of income received has been
updated in to a folder to assist with future audits. A consolidation
of CIT books and a revised spreadsheet has already been
introduced to assist with reconciliation of income received to CIT
book.
Immediately
15

Internal Audit Activity Report 31 st May 2012
Appendix 3 – Audit opinion and recommendation definitions
Overall Opinion
Status Assurance Rating Assurance Criteria
Well
Controlled
Controlled
Controlled, but
needs
improvement
Inadequately
controlled
The system is performing
particularly well to achieve
business objectives.
The system is adequate to
achieve business objectives.
Some improvement is
required to ensure that
business objectives are met.
Significant improvement is
needed before business
objectives can be met.
There is a sound framework of control
operating effectively to achieve business
objectives.
The framework of control is adequate and
controls are generally operating effectively.
The control framework is adequate but a
number of controls are not operating
effectively.
Adequate controls are not in place to meet
all system objectives and controls are not
being consistently applied.
Key and description of recommendation gradings
Grade Status Definition
Major
Significant
Moderate
Low
A control issue has been identified which exposes the
Force / Authority to an unacceptably high level of material
risk.
A control issue has been identified which is likely to
prevent an individual system or unit from achieving its
purpose, or may give rise to a considerable vulnerability to
impropriety, loss or exposure.
A weakness in control has been identified which may
reduce the ability of a system or unit to achieve its
objectives, or which may give rise to a potential for
impropriety, loss or exposure.
A minor improvement to the control is needed. The risk to
the individual system or unit is low, but remedial action is
required by Management.
16