Internal Audit Section
Appendix Biv
Bank and Cash Walkthrough Audit Review 2011/12
1.
Introduction
1.1 As part of the 2011/12 Internal Audit Plan, a systems based walkthrough review has
been undertaken of the controls and procedures currently in place over the Cash and
Banking services provided by Allerdale Borough Council.
1.2 A walkthrough review consists of testing a single transaction only unless control
weaknesses are identified requiring further examination. As there are several routes and
methods of payment a single transaction of each type was selected from the payments
made on 24 October 2011.
1.3 The Operational Risk Profile and Business Continuity Plans for the area have not been
reviewed as part of the walkthrough as these have been reviewed corporately and
recommendations are in place regarding these.
1.4 Internal Audit would like to thank all staff involved during the course of the review for
their help and assistance, in particular, the Customer Services Team Leader and the
Cash Receipting and Information System Administrator (CRISA).
2.
Objective and Scope of the Review
2.1 The objective and scope of this audit was defined in the audit brief issued to all relevant
staff on 18 October 2011 a copy of which is available on request.
2.2 Follow up on agreed actions from the last audit review is reported as an extension to the
attached action plan. This is by exception only, where correct implementation could not
be confirmed or changes within the service have affected the relevance of the agreed
action.
2.3 There were no other areas of weakness from the last audit review or identified since
requiring attention.
3.
Audit Opinion and Walkthrough Summary
Internal audit considers that good controls exist in respect of Cash and Banking
services.
3.1 There are no Agreed Actions raised as a result of this review.
3.2 A sample of each payment type was selected, one each of Counter Cheque, Cash,
Counter Card, Internet Payment, Telephone Payment input by Customer Service
Advisors (CSA’s) via the Intranet and Automated Telephone Payments. In each case
the payment records included the corresponding fund and account details and each
transaction is individually referenced including receipt number.
3.3 An observation of the Postal cheque procedure was carried out on 24 October 2011. All
cheques were logged on to remittance sheets which were dual signed and placed into a
sealed courier bag to be transported to the Town Hall Customer Service Centre (CSC).
The sealed bag is taken to the town hall along with a log book this was signed for by the
$awaewqye.docbank and cash audit review, ref no 10312/jpi
Page 1
Internal Audit Section
Appendix Biv
CSA at the Town Hall to state the cheques have been received and that the seal
number was correct. The number of cheques contained within the bag is also
confirmed. Internal Audit (IA) then requested the remittance sheets from the CSC after
the cheques had been input to the system. The receipt numbers had been written on
the sheets and they were signed to confirm that the cheques had been input. A sample
of one postal cheque from the remittances was selected for testing as detailed in 3.2.
3.4 The radius suspense account and supporting spreadsheets were observed and nine
Items have been coded to suspense in 2011/12 and of these eight have been resolved.
The suspense spreadsheet contains a list of all outstanding items, a separate tab
showing the resolved items and the details of the accounts they were moved to. A
balancing sheet is also included showing all the movement on the suspense account.
3.5 The daily cashing up procedure was observed on 28 and 31 October the process
followed the procedure notes. All documentation was completed correctly and any
documents required by the Cash Receipting and Information Systems Administrator
(CRISA) were scanned and emailed the Payments mailbox.
3.6 During the observation paying in slips were completed by the CSA’s. These were placed
in the banking bags with the cash or cheques for collection by the security company. A
copy of the paying in slip is scanned and the amount is also logged in a book to keep a
record of the amounts to be collected. When the security company collect the bags a
receipt is provided and this is stapled into the log book. Copies of the paying in slips are
scanned and emailed to the CRISA. A copy of the bank statement detailing the cash
collected on 28 October 2011 was requested from the CRISA. The cash and cheques
were included on the bank statements and the values matched those on the paying in
slips.
3.7 The record of daily collections spreadsheet is completed at the end of each day or the
beginning of the following day at each CSC. The spreadsheet details the total of each
payment type received for the specific day at each CSC. This is then emailed to the
CRISA on a weekly basis (Monday morning). The CRISA then updates the Credit and
Debit spreadsheet with this information. The credit and debit spreadsheet is also
updated with details of card payments via telephone, Intranet and Internet. These
figures are obtained from Radius Transaction listing report.
3.8 Supervisor checks are carried out on floats and till balances periodically. The most
recent supervisor check was carried out at the Town Hall on 16 November 2011. Prior
to this Keswick and Wigton had checks in Quarter four 2010/11. The CRISA informed
Internal Audit that supervisor checks will be scheduled for Cockermouth and Maryport
CSC’s after discussion with the CSTL (Customer Services Team Leader).
3.9 The automatic interface procedure (slam down) was observed during the observation at
the Town Hall CSC 28 October 2011. Prior to the procedure commencing a payment
was being receipted through the system but not could be concluded until the interface
procedure was complete and would therefore form part of the transactions for the
following day.
3.10 Bank statements are received weekly in finance and these are reconciled by the CRISA
against the paying in slips received from the CSC’s and also against the Credit and
Debit (C&D) spreadsheet. Reconciliations of all payments through radius are carried out
on a monthly basis against the C&D spreadsheet.
$awaewqye.docbank and cash audit review, ref no 10312/jpi
Page 2
Internal Audit Section
Appendix Biv
3.11 During the Walkthrough the procedure notes were looked at for various parts of the
testing carried out. Procedures that had been updated were left in red so that the CSA’s
could see immediately where any changes had occurred. It was noted that the
references to the appendices weren’t correct. This was discussed with the Customer
Services Team leader and she informed me that this would all be brought into line when
the procedure notes are updated at the end of the financial year.
3.12 The 2010/11 review highlighted cheque encashment as a weak area so this area was
tested. Three samples were selected from area offices and all samples had the
appropriate documentation. However some of the documents provided by customers
had not been stamped with the “Original document copied by” stamp. All CSA’s should
ensure that the correct procedures are followed at all times. This matter was discussed
with the Customer Services Team Leader who confirmed that she would highlight this to
the CSA’s.
3.13 Card data is now only kept in the CSC’s for a period on one month, after this time the
receipts are placed in the shredding bins for secure destruction. A log is kept of all items
shredded; however because this includes items which are kept for longer periods it can
be difficult to identify that the card receipts are being destroyed on a monthly basis. This
was discussed with the Customer Services Team Leader and she confirmed that the
document would be updated so that the card receipts are identified separately.
$awaewqye.docbank and cash audit review, ref no 10312/jpi
Page 3
Internal Audit Section
Appendix Biv
Agreed Actions 2010/11 Follow Up
No.
Details
Follow up Conclusion
Grade 2
1.
The Correct cheque encashment procedure should be followed at all
customer service centres.
2.
An appropriate retention period for customer card data produced from the
cash receipting system should be established and implemented. This should
be in line with business needs whilst ensuring that Allerdale Borough Council
remains compliant with the Payment Card Industry Data Security Standard
(PCI DSS) and the data protection act 1998.
3
Individual CSA’s use of the ‘Super CSA login’ should be recorded to ensure
an accurate and full record of who collected the income is maintained with
Financial Regulation 4.17 (part).
Three samples were selected for testing and of these
all the correct documents had been retained and the
correct templates used and signed. However for one
of the items then paperwork had not been stamped
and dated as an original document. However
documents provided at a later date all had been
stamped correctly.
Card receipts are now only retained for one month,
they are then shredded. A log is kept at the Town Hall
of all documents shredded.
A log is now maintained for the use of the super CSA
login. A copy of this was obtained.
Internal Audit shall be monitoring all current and future agreed actions through the Covalent performance management system.
The use of Covalent will allow officers to directly update their progress and give managers the opportunity to monitor these
actions. Implementation dates are agreed before the Final report is issued, amendments to these dates must be agreed with
Internal Audit prior to changes being made within Covalent.
The assigned actions will appear on users’ Covalent homepage. Updates and details of implementation can be completed by
the officers assigned to the actions at any time. The record of the agreed actions updates within Covalent will be used to
provide information required by the Corporate Management Team and Audit Committee.
$awaewqye.docbank and cash audit review, ref no 10312/jpi
Page 4
Internal Audit Section
Appendix Biv
Agreed Actions are graded according to the level of importance and severity of the system weakness. This grading falls into
the following three categories:
• Grade 1 – Agreed Actions which if not actioned, will result in the system weakness compromising the Section 151
Officer’s responsibilities under the Local Government Act 1972 which stipulates “that the Council must make
arrangements for the proper administration of its financial affairs”;
• Grade 2 – Agreed Actions relating to weaknesses which affect key areas of operation of the system and should be
addressed in order to establish a satisfactory level of internal control; and
• Grade 3 – Agreed Actions which, in Internal Audit’s opinion, are desirable but not essential in order to achieve a
satisfactory level of internal control, however upon the acceptance of the recommendation by management, the
implementation will be monitored until completed by the agreed implementation date.
$awaewqye.docbank and cash audit review, ref no 10312/jpi
Page 5