westminster city council review of the corporate property division key findings and recommendations...

Westminster City Council Review of the Corporate Property Division Key Findings and Recommendations7 July 2006

Final Draft Report

Westminster City Council Final Draft Report: July 2006

Review of the Corporate Property Division

Scope of our review

We were engaged by Westminster City Council (WCC) to consider potential internal control issues within the Corporate Property Division (CPD). The agreed target objectives were to:

• evaluate and provide a risk rated assessment of the overall level of compliance within CPD and the existing level of management oversight and supervision;

• assess the level of compliance with internal and external regulations;

• make any recommendations for improving departmental management and control systems, and for achieving cultural change;

• identify any wider issues that WCC needs to address for the procurement code and the employee code of conduct (in so far as it relates to procurement), and

to report back to Westminster in a summary format outlining key findings and recommendations.



Method of ApproachWe reviewed an agreed sample of 18 files selected from the four teams within CPD and, where possible, interviewed the respective Nominated Project Officers (NPO), other CPD Officers, Line Management & finance staff. We also undertook a site visit.

Where practicable, for these files we reviewed project and programme management (including procedures for monitoring progress, quality and “Best Value”); project budgeting and financial monitoring; procedures over conflicts of interest, gifts and hospitality; ordering authorisation and controls; invoice payment; and the disposal of property. We also reviewed accountability, reporting structures, and the management culture within CPD; implementation of Internal Audit recommendations; and communication and reporting to Members and other decision makers.

We agreed to report back on issues that we rated*: “Critical” (i.e. with a potential loss > £1m), “High” (i.e. with a potential loss > £100k), and issues which in our view may require further disciplinary investigation.

A number of responses to our draft report were received from WCC Officers. These have been reviewed and our report revised as regards matters of factual accuracy. These responses have been collated and included in the background papers which form an integral part of this report.*Such ratings included, in addition to the direct financial impact, areas that involved fraud or impropriety, raised reputational risks, offered poor value for money, or failed to achieve organisational objectives. These were to be referred to you for urgent action.



Key Findings

Our assessment of the CPD is: “High Risk”. This is based on our finding of an overall lack of compliance with WCC’s Financial Regulations, Standing Orders and Procurement Code. We identified that a high risk of error, mismanagement and/or fraud and corruption existed prior to interim measures being taken in 2006 to mitigate this risk.

We identified an apparent “goal oriented” culture within CPD, which we define as working practices driven by an individual’s preferences rather than through a documented/auditable decision making and compliance process. This culture is considered to have created an imbalance between the accountability for delivery and control of projects.

In our opinion, the effect of these factors continues to undermine WCC’s budgetary control framework. We consider that a residual level of risk still remains within CPD despite the interim mitigation measures taken. Furthermore, we do not believe that these measures are sustainable and remedial steps need to be taken to address this situation to achieve an acceptable level of exposure.



Priority Issues - Findings

We consider that there are four Priority Issues that need to be addressed within CPD:

A. the level of Compliance within CPD with the requirements of the Procurement Code and Financial Regulations is considered inadequate;

B. WCC’s Financial Systems do not reinforce compliance with the control framework, notably as regards the use of purchase orders (PO);

C. ineffective Contract & Activity Monitoring fails to allow WCC to accurately predict capital project cost overruns, which impacts on budgeting and highlights weaknesses over the robustness and adequacy of “Best Value” assessments, and

D. Management do not scrutinise CPD’s work in the manner we would expect, and this lack of Management Oversight & Supervision further weakens the overall control environment.



Priority Issues - Recommendations

We recognise that to require immediate and 100% compliance with WCC’s policies and procedures is impractical. However, a change in behaviour by some Officers is required to effect change in working practices within CPD. This can be achieved through refresher training programmes and a renewed emphasis on rigorous processes and procedures supported by robust monitoring controls. The process of change needs careful communication to staff and sponsorship by senior management.

With respect to the financial systems, we believe that the Westminster Information Management System (WIMS) can be re-configured, as it is capable of enforcing compliance with financial regulations. We outline herein how this system can be better integrated with the procurement process. The effective use of WIMS needs to be addressed and changes can be made in tandem with the refresher training.

We are aware that WCC is recognised as an “excellent” Council. Although our Key Findings are in respect of a limited number of files reviewed within CPD, it raises the question as to whether the deficiencies noted are systemic across WCC. If true, this could have implications regarding the Statement of Internal Control and, potentially, adversely impact WCC’s CPA rating.

Each of the Priority Issues is considered in further detail in the following slides.



Priority Issue A: Compliance with the Procurement Code

Findings

Although all four teams within CPD were assessed as “HIGH RISK”, the level of compliance by two of the teams was greater than for the other two, which we believe reflects primarily on the performance of the individual NPOs. Of the 18 files reviewed, we found numerous examples of non-compliance with key parts of the Procurement Code, including:

- an apparent failure to comply with EU procurement regulations

- general disregard for the use of the approved supplier list

- tenders not administered properly, (e.g. tenders sent directly to the NPO)

- inadequate tender evaluations and specifications on file

- contract extensions and variation orders not notified to the Departmental Contract Board (DCB), (and thus unapproved), and

- missing, lack of duly authorised, or unsigned, contracts, and an incomplete Contract Register.

In addition, we found that consultants are not contractually required to comply with the Procurement Code, and we also noted a lack of specific guidance and procedures when dealing with disposals of property.



Priority Issue A: Compliance with the Procurement Code

Recommendations

As a first step, the Procurement Code should be reviewed to ensure that it is fit for purpose. For example, a specific section relevant to CPD would be beneficial. A NPO Checklist and Procedure Note prepared by the Head of Property in February 2006, should be expanded upon and incorporated within the Procurement Code. Each of the individual points identified in the Findings section above should also be addressed.

Having noted issues over segregation of duties, we recommend that the Approved List Team (ALT) should confirm that the successful contractor appears on the Approved List, or if not, perform appropriate due diligence to add the contractor to the list (for say all contracts estimated to have a value of < £30,000). Furthermore, the effectiveness of the ALT should be enhanced through a review of its current role and responsibilities.

As regards consultants’ contracts, these should be amended to include a requirement to comply with the Procurement Code. All amendments to standard contracts should be approved by Legal Services.

Finally, CPD Line Management should perform more detailed supervision of CPD outputs and be required to review occasionally a sample of underlying project files when approving documents or invoices.



Priority Issue A: Compliance with Financial Regulations

Findings

We found a number of examples of non compliance with key parts of the Financial Regulations. These included:

- segregation of duties issues – the NPO has considerable scope to order and approve goods and services (up to £500k, in and of itself seen as a high limit)

- controls over the Scheme of Delegation (in one case the NPO increased his own limit to £800k without approval)

- the general lack of reliance on purchase orders (POs), and

- Payment Certification Vouchers (PCV) are not always completed or are certified only by the use of illegible initials, which do not identify the approver.

We noted a degree of familiarity between CPD & the outsourced payment processor’s staff (Accord), which on occasions enabled CPD staff to bypass the formal payment process, including payment completion without a PCV, and adding suppliers which were unapproved to the vendor master file; and

Again, as discussed below, the effectiveness of the financial control environment was seen to be undermined by the level of Management Oversight & Supervision exercised over CPD.



Priority Issue A: Compliance with Financial Regulations

Recommendations

Refresher training should be provided to Officers, designed to convey the benefits of compliance and to promote responsibility and accountability. Thereafter, each of the individual points identified in the Findings section above should be addressed.

The use of POs within CPD (and across WCC as a whole) should be mandatory, but WCC should consider using a de minimis purchase value level, below which POs are not required. While there is no benchmark for the use of POs, we have observed a general target figure used at other councils, of at least 80% of transactions by volume.

The current Scheme of Delegation for NPOs seems high and this should be reviewed; an adjustment so that Line Management for CPD become more involved in invoice approval and associated project file review should also be considered.



Priority Issue B: Financial Systems

Findings

WIMS has a number of system control functions which are not currently enabled so that the capability of the system is not fully utilised (e.g. invoices can be paid by use of a special code without matching to a PO);

The lack of, or partial, use of POs means that budgetary controls will be ineffective (e.g. there will be work in progress which is not reflected in the financial systems, thus creditor accruals could be understated, or part-used POs are reported as fully used, and old open POs could be used for fraudulent purposes). Where POs are used the value of invoices paid can exceed the value of the PO (albeit on a one-time basis);

The processing of CPD invoices by Accord is monitored through the use of KPIs - primarily the time taken to process invoices. This was highlighted in an Internal Audit review which reported a focus on performance over quality;

There is no link between the approved list database (Proman) and WIMS. This means that there is no control to prevent payments being made to suppliers not on the Approved List or to suppliers classified as “not approved” on the list; and

In some cases, we found no control over setting up new suppliers on the master file.



Priority Issue B: Financial Systems

Recommendations

WCC should review the use of WIMS and consider using the “three-way match*” function for all payments (except those below any de minimis level or where a two-way match is necessary, e.g. utility bills), and again using WIMS, force compliance with supplier requirements including the use of the Approved List.

WCC should consider, where required, that the Approved List is integrated with WIMS so that the system highlights non-approved entities, and those not on the list, as exceptions.

WIMS should be configured to include details of Officers who approve and countersign invoices to create an audit trail and to facilitate CAATS* testing.

WCC should consider developing WIMS exception reporting, as a detective control, to identify potentially inappropriate transactions, e.g. duplicate payments or highlighting for review multiple invoices from the same contractor (in relation to an individual PO) in a defined period.

*three-way matching requires a PO, invoice and goods received note (GRN) before payment can be made

*CAATS – Computer Assisted Audit Techniques



Priority Issue C: Contract & Activity Monitoring I

Findings: Project Level

CPD does not appear to follow a recognised Project Management methodology. Overall, we found no formal project file structure in use. Levels of document retention on CPD files was found to be poor resulting in a lack of both an audit trail and evidence of continuous improvement, as part of “Best Value” considerations. We often observed no formal monitoring plan on file and evidence of only limited contract monitoring in terms of meetings with contractors. Inadequate monitoring of contractor performance creates a risk that problems are likely to be identified only at a late stage;

We found one file lacking a copy of a contract, which means that the agreed contractual rights and obligations are not readily accessible to the Monitoring Officer;

In another case reviewed, there was no auditable trail of documents relating to the procurement of consultant services or the disposal process itself; and

In a joint venture case, we found no document which specifically details the NPO’s strategy to ensure that the project is effectively controlled to achieve “Best Value”.

.

.



Priority Issue C: Contract & Activity Monitoring II

Findings: Programme Level

Officers within CPD volunteered that they were “goal orientated” rather than financial and/or risk orientated with regards to the delivery of projects. Reference was also made to CPD’s reputation for “getting things done and delivered”, at times if necessary, “cutting corners” at the expense of compliance with procedures. For example, some Officers found the PO system “cumbersome” and did not use it. This approach has probably resulted in an imbalance between accountability for delivery and for control;

Another important issue is the reliance solely on Spend data to monitor the Capital Programme. Financial monitoring is not supported by the use of any activity monitoring data. We found no management oversight at either the project or programme level to monitor, review and compare apparent or actual activity levels against Spend data; and

This has resulted in a significant, and currently unapproved, overspend on one project but there are others of a lesser value. Another project is significantly behind schedule (with costs of circa £4.5k per week to WCC) where the percentage of actual work completed was not known. Other root causes for overspends and project issues include the availability of resources and systems to effectively monitor projects.



Priority Issue C: Contract & Activity Monitoring

Recommendations

We recognise that Officers are focussed on purpose and Service Delivery of projects but there needs to be an appropriate balance with accountability for control. We consider this to be lacking at present. This is complementary to the recommendations as regards compliance with the Procurement Code and Financial Regulations above.

Where necessary Officers should be provided refresher training in contract management so that the Monitoring Officers understand the options available to them under the contract. An effective monitoring system needs to be established at the outset of a contract such that problems can be identified at an early stage. The question as to whether CPD is adequately staffed in light of the size of the Capital Programme both in terms of resources and financial skills should also be addressed as this can otherwise negate the effect of other controls.

In view of the number and value of projects within its portfolio, CPD should consider implementing a recognised Project Management Methodology, and related project file structure, such as that provided by Prince2. Furthermore, the implementation of templates to guide Officers through the project life cycle should also be considered.



Priority Issue D: Management Oversight & Supervision

Findings

We have already referenced issues around the lack of activity monitoring resulting in an unapproved project overspend. Although management is essentially an individual process, we noted:

- CPD Line Management relied upon Officers’ reporting and did not perform a periodic random review of any project file(s)

- the Scheme of Delegation meant that, prior to 2006, Line Management was not called upon to review and approve invoices. Use of this control increases the likelihood that CPD activities and procedures achieve their objectives

- the revenue cost codes may have received greater focus during 2005 than the Capital Programme, and

- Non-implementation (until of late) of Internal Audit recommendations.

We also noted that issues flagged by the DCB and CRB were not always actioned. However, there is no formal escalation process to resolve these matters; and

We understand that responsibility for CPD has been “transferred” around WCC on three occasions during the past three years. This raises a question as to the consistency of the level of management oversight and supervision performed.



Priority Issue D: Management Oversight & Supervision

Recommendations

Officers in the management chain supervising the NPOs should re-assess their approach to oversight and supervision of CPD as a whole, and implement changes to ensure that the balance between accountability for purpose and accountability for control is restored. This will require a shift in the current culture of CPD.

We recommend that Management make appropriate and random checks (including the occasional review of underlying documentation in project files, which they should document), to satisfy themselves that their staff reports are in compliance with the requirements of the Procurement Code (perhaps at the tender evaluation stage) and Financial Regulations. This can be achieved in part by revising downwards the Scheme of Delegation limits so that line management act as the second signatory to approve invoices over a specified limit.

Activity monitoring information should be reviewed by the DCB, the Service Board and where appropriate by the Capital Programme Review Board.



Miscellaneous Findings

Other Findings I

The Internal Audit function is outsourced and the annual programme is based on a rolling 5-year plan. However, following discussions with the Deputy Chief Executive Built Environment, we raise the question as to how much formal input senior management exercises when determining which areas of CPD should be audited each year. He was also unaware of the findings of certain Internal Audit reports, which in turn highlights a lack of process to escalate the failure to implement Internal Audit recommendations;

We were advised by Internal Audit that the use of POs has never been enforced either in CPD or across WCC as a whole;

We also noted issues related to governance regarding the submission of written declarations of Conflicts of Interest and the use of a gifts and entertainment register. We note that there was no gifts register within CPD for nearly two years; and

We also observed a related HS&E issue during our site visit to a school. The Monitoring Officer did not review the work on site against the construction H&S Plan and issues are arising that could have an adverse affect on the reputation of the council, and expose it to possible substantial legal liability for Contractor’s actions.




Other Findings II

Our work was not specifically designed to identify whether any losses had occurred through fraud, and we did not identify any evidence of such losses during our work. However, our findings that there is a HIGH RISK for the potential for such losses to have occurred and/or occur within CPD, lead us to conclude that this possibility exists;

We did perform limited background research at Companies House on seven suppliers based on our professional judgment, e.g. one supplier whose name was concerned with interior design submitted an invoice for “demolition” (a service the company website claims is performed). The work was certified by a temporary CPD employee, who was not a Clerk of Works (CoW), and signed off for payment by the NPO. We also identified circumstances where an architect was performing a CoW function. The level of research into these supplier relationships could be extended; and

We also referred a potential conflict of interest with a supplier to an Investigating Officer for further review and performed a limited review of CPD’s Accounts Payable data, which identified a duplicate payment to a creditor of circa £2k.




Recommendations

The Internal Audit workplan should be reviewed to ensure that key/core financial controls are being audited. In addition, Officers should be consulted to identify areas under their control which should be included on the annual audit workplan. WCC should implement an escalation process to bring the failure to implement Internal Audit recommendations to the attention of the Audit Committee.

WCC should consider requiring Officers to sign a formal declaration that they have no interest in a contract at its tender evaluation stage. More generally, a written annual declaration from Officers confirming they have complied with policies on Conflicts of Interest and Gifts & Entertainment should be introduced.

Risk management procedures to monitor and control HS&E risks on projects should be implemented and a copy of the Contractor’s health and safety plan should be kept on each project file.

WCC should consider performing due diligence on those suppliers not on the Approved List as part of their anti-fraud strategy.

WCC should also consider whether Officers and external agents would benefit from refresher training in the areas highlighted in this report.

Disclaimer

This Final Draft Report (the Report) has been prepared by PricewaterhouseCoopers LLP, the limited liability partnership registered in England under registration no. OC303525 and with its registered address at 1 Embankment Place, London WC2N 6RH, solely for use by Westminster City Council for its own internal purposes, and for the purpose and in the manner contemplated at the time of our instruction. As such the Report and its contents (including the appendices, which are an integral part of the Report) are strictly private and confidential.

The Report must not (save to the extent required by applicable law and/or regulation) be released to any third parties without PricewaterhouseCoopers LLP’s prior written consent, which PricewaterhouseCoopers LLP may withhold at its absolute discretion or may grant subject to conditions including any “hold harmless” letter which PricewaterhouseCoopers LLP may require.

PricewaterhouseCoopers LLP accepts no duty of care to any person (except to Westminster City Council under the terms of the engagement) to whom the Report (or any copies or extracts from it) may be distributed (whether with or without PricewaterhouseCoopers LLP’s prior written consent) or who otherwise receives, uses or relies on the Report or any part it. Accordingly, regardless of the form of action, whether in contract, tort or otherwise, and to the extent permitted by applicable law, PricewaterhouseCoopers accepts no liability of any kind and disclaims all responsibility for the consequences of any person, other than Westminster City Council on the above basis, acting or refraining to act in reliance on the Report or for any decisions made or not made which are based upon such Report.

Forensic ServicesInvestigateAnalyseResolve*

© 2006 PricewaterhouseCoopers LLP. All rights reserved. 'PricewaterhouseCoopers' refers to PricewaterhouseCoopers LLP (a limited liability partnership in the United Kingdom) or, as the context requires, other member firms of PricewaterhouseCoopers International Limited, each of which is a separate and independent legal entity.

westminster city council review of the corporate property division key findings and recommendations...

Documents

cpd officers

andto report

disposal of property

management culture

programme management

departmental management

wcc officers

procurement code