Cairngorms Nation­al Park Authority

Intern­al Audit Report ²⁰²³⁄₂₄

Expendit­ure and Creditors

August 2023

---

Page 1: (Image)

---

Page 2:

Cairngorms Nation­al Park Author­ity Intern­al Audit Report ²⁰²³⁄₂₄ Expendit­ure and Creditors

• Exec­ut­ive Sum­mary 1
• Man­age­ment Action Plan 4
• Appendix A – Defin­i­tions 11

Audit Spon­sor	Key Con­tacts	Audit team
Dav­id Camer­on, Deputy Chief Executive	Louise Allen, Head of Fin­ance and Cor­por­ate Operations	Eliza­beth Young, Chief Intern­al Auditor
	Mark Tuck­er, Man­age­ment Accountant	Stephanie Hume, Seni­or Audit Manager
	Amy Mack­en­zie, Man­age­ment Accountant	Camer­on Laurie, Intern­al Auditor
	Calum Guy, Gradu­ate Train­ee Accountant

---

Page 3:

Exec­ut­ive Summary

Con­clu­sion

Cairngorms Nation­al Park Author­ity (CNPA) has adequate con­trols in place over expendit­ure, with good prac­tice being noted in the con­trols sur­round­ing the val­id­a­tion of sup­pli­ers, the recon­cili­ations under­taken between the pur­chase ledger and com­mit­ted expendit­ure and the ongo­ing review of pur­chases to ensure prompt payment.

We have iden­ti­fied a small num­ber of recom­mend­a­tions includ­ing the abil­ity to evid­ence that segreg­a­tion of duties has been employed through­out the pro­cess of com­mit­ting expendit­ure, doc­u­ment con­trol of intern­al pro­ced­ures and the remov­al of inact­ive sup­pli­ers from the system.

Back­ground and scope

In order to account com­pletely and accur­ately for its use of resources and to ensure pay­ments are made in accord­ance with nation­al stand­ards, CNPA needs to ensure that the pro­cesses and con­trols around expendit­ure and cred­it­ors are robust.

In accord­ance with the 2023/2024 Intern­al Audit Plan, we have reviewed the con­trols over the pro­cessing and mon­it­or­ing of expendit­ure and cred­it­or payments.

---

Page 4:

Con­trol assessment

1. There are clear policies, pro­ced­ures and del­eg­ated author­ity levels in place and avail­able to staff cov­er­ing expendit­ure and cred­it­or payments.
2. Pay­ments are made to val­id and agreed cred­it­ors for goods and ser­vices con­firmed as received, with­in the agreed timeframes.
3. Pay­ments made are con­sist­ent with expendit­ure com­mit­ment, adequately author­ised and sub­ject to review pri­or to release, with appro­pri­ate segreg­a­tion of duties in place.
4. Non-pay expendit­ure is accur­ately reflec­ted in the fin­an­cial ledger.
5. The pur­chase ledger is reviewed reg­u­larly to min­im­ise any dis­puted or over­due accounts.

(Image of a pie chart show­ing con­trol assess­ment results)

Improve­ment actions by type and priority

(Image of a bar chart show­ing improve­ment actions by type and priority)

Three improve­ment actions have been iden­ti­fied from this review, all of which relate to the design of the con­trols in place. See Appendix A for defin­i­tions of col­our coding.

---

Page 5:

Key find­ings

Good prac­tice

• There is a clear Del­eg­ated Level of Author­ity in place, which provides com­pre­hens­ive guid­ance for com­mit­ting expendit­ure and author­isa­tion of pay­ment for goods and services.
• A new sup­pli­er form has been intro­duced as a means of doc­u­ment­ing the veri­fic­a­tion pro­cess of new sup­pli­ers, with man­age­ment con­firm­ing this form is also used for exist­ing sup­pli­ers who have changed details.
• We con­firmed via sample test­ing of 24 pur­chases that pur­chases are made only to val­id and agreed cred­it­ors, after the receipt of goods, and all with­in 15 days of receipt.
• Our test­ing con­firmed that reg­u­lar recon­cili­ations are under­taken between CNPA’s bank accounts, the data held with­in Sage, and the pur­chase and sales ledgers in order to ensure accur­ate reflec­tion of expenditure.
• The status of invoices and pur­chases are mon­itored reg­u­larly to min­im­ise over­due payments.

Areas for improvement

We have iden­ti­fied a small num­ber of areas for improve­ment which, if addressed, would strengthen CNPA’s con­trol frame­work. These include:

• Intro­du­cing doc­u­ment con­trol on intern­al pro­ced­ure doc­u­ment­a­tion, in order to evid­ence that guid­ance is rel­ev­ant and up to date.
• Con­sid­er­ing the remov­al or re-veri­fic­a­tion of inact­ive sup­pli­er accounts on Sage.
• To form­ally doc­u­ment and stand­ard­ise the pur­chas­ing pro­cess, in order to increase trans­par­ency and evid­ence the segreg­a­tion of duties in place for purchases.

These are fur­ther dis­cussed in the Man­age­ment Action Plan below.

Impact on risk register

This review is linked to all fin­an­cial risks from the Cor­por­ate Risk Register (as at Feb­ru­ary 2023).

The find­ings from this review do not raise sig­ni­fic­ant con­cerns around the effect­ive­ness of con­trols in place to man­age these risks. Imple­ment­a­tion of the find­ings iden­ti­fied in the Man­age­ment Action Plan will strengthen the exist­ing con­trol envir­on­ment in this area to bet­ter facil­it­ate good prac­tice and ensure guidelines are adhered to.

Acknow­ledge­ments

We would like to thank all staff con­sul­ted dur­ing this review for their assist­ance and co-operation.

---

Page 6:

Man­age­ment Action Plan

Con­trol Object­ive 1: There are clear policies, pro­ced­ures, and del­eg­ated author­ity levels in place and avail­able to staff cov­er­ing expendit­ure and cred­it­or pay­ments. (Green)

1.1 Doc­u­ment control

We sought to con­firm that suf­fi­cient policies and pro­ced­ures, includ­ing the levels of del­eg­ated author­ity, are in place.

We were unable to con­firm that policies and pro­ced­ures related to the expendit­ure pro­cess have been sub­ject to review and approv­al, with all pro­ced­ure doc­u­ments (with the excep­tion of the Del­eg­ated Level of Author­ity dated in May 2023) undated. As such staff may find it hard to identi­fy wheth­er guid­ance is the most up to date and rel­ev­ant to the pro­cesses to be undertaken.

Risk: There is a risk that, due to doc­u­ment con­trol not being in place for sev­er­al of the step-by-step pro­ced­ures rel­ev­ant to the pro­cess of com­mit­ting expendit­ure, staff may fol­low out of date pro­ced­ures poten­tially lead­ing to error or con­fu­sion, par­tic­u­larly for poten­tial new mem­bers of the depart­ment or any­one else unfa­mil­i­ar with pro­cesses in apply­ing the guid­ance set out in procedures.

Recom­mend­a­tion: CNPA should imple­ment ver­sion con­trol inform­a­tion on intern­al policies and pro­ced­ures rel­ev­ant to the expendit­ure and cred­it­ors process.

Man­age­ment Action: (Grade 1 (Design)) Pro­ced­ures were updated in advance of the Inter­im Extern­al Audit car­ried out by Maz­ars in April/​May 2023. The format of the doc­u­ment­a­tion has been amended to include a review date. A pro­cess for reg­u­lar review of doc­u­ment­a­tion will be estab­lished as part of the year-end/rollover routine.

Action own­er: Man­age­ment Accountant

Due date: 31 March 2024

---

Page 7:

Con­trol Object­ive 2: Pay­ments are made to val­id and agreed cred­it­ors for goods and ser­vices con­firmed as received, with­in the agreed time­frames. (Green)

2.1 Inact­ive sup­pli­ers on the Sage system

New Sup­pli­ers: We selec­ted a sample of 24 sup­pli­ers to con­firm that sup­pli­er veri­fic­a­tion checks were under­taken at the point the sup­pli­er was cre­ated. Of the 24 sup­pli­ers we were only able to obtain evid­ence of the veri­fic­a­tion under­taken on three of these. We were advised by man­age­ment that this was due CNPA only com­men­cing util­isa­tion of a New Sup­pli­er Form in Janu­ary 2023. For sup­pli­ers that pred­ate this, veri­fic­a­tion was not doc­u­mented as the con­trols in place were to phone the sup­pli­er to con­firm the bank details as cor­rect as seen on the invoice. As such we are sat­is­fied a form­al, doc­u­mented means of veri­fy­ing sup­pli­ers is now in place and con­firmed that for the new sup­pli­ers tested from Janu­ary 2023 onwards the New Sup­pli­er Form was completed.

Dormant Sup­pli­er Accounts: As a res­ult of our test­ing we noted a num­ber of sup­pli­ers on the sys­tem which are dormant, with five of the 24 sup­pli­ers selec­ted for test­ing not used for over three years. From dis­cus­sions with man­age­ment it is unclear wheth­er it would be pos­sible for the organ­isa­tion to remove inact­ive sup­pli­ers or mark them as inact­ive to ensure that a new veri­fic­a­tion pro­cess was under­taken should the sup­pli­er be used again in the future.

Risk: There is a risk that inact­ive or dormant sup­pli­er accounts are kept on the Sage sys­tem longer than neces­sary increas­ing the risk of fraud with the poten­tial for dormant account details being used to fraud­u­lently facil­it­ate pay­ment from CNPA, res­ult­ing in fin­an­cial loss.

Recom­mend­a­tion: We recom­mend that CNPA identi­fy accounts that have had no pur­chas­ing activ­ity for a pre­de­ter­mined peri­od of time (e.g. great­er than 12 months) and invest­ig­ate the pos­sib­il­ity of mak­ing them inact­ive or remov­ing their details. If this is not pos­sible, CNPA should con­sider under­tak­ing the updated veri­fic­a­tion pro­cesses for any accounts that have not been used for a set peri­od of time should the sup­pli­er be util­ised again.

---

Page 8:

Man­age­ment Action: (Grade 1 (Design)) We have reviewed sup­pli­er bank details held on our Bank of Scot­land Cor­por­ate Bank­ing Online facil­ity and removed all those that are no longer needed — both sup­pli­ers and employ­ees. It is not pos­sible to remove sup­pli­er accounts from SAGE on which trans­ac­tions have been recor­ded. SAGE does not give us the facil­ity to de-activ­ate used accounts, although we can hide them from view. We can also remove bank details. Re-veri­fic­a­tion would seem to be the most prag­mat­ic approach; we will amend our pro­ced­ures to include the instruc­tions that:

1. Sup­pli­er accounts on SAGE will be reviewed annu­ally (as part of the year-end pro­cess) to identi­fy any that haven’t been used in the pre­vi­ous 12 months. Bank details will be removed from these accounts.
2. Bank account details for sup­pli­er accounts unused for 12 months or more will be con­firmed using the new sup­pli­er form.
3. Any unused pur­chase ledger accounts on SAGE will be deleted.

Action own­er: Fin­ance Manager

Due date: 31 March 2024

---

Page 9:

Con­trol Object­ive 3: Pay­ments made are con­sist­ent with expendit­ure com­mit­ment, adequately author­ised and sub­ject to review pri­or to release, with appro­pri­ate segreg­a­tion of duties in place. (Yel­low)

3.1 Segreg­a­tion of duties

The Del­eg­ated Levels of Author­ity doc­u­ment states that: ​“The inter­ac­tion of DFA (del­eg­ated fin­an­cial author­ity) and DPA (del­eg­ated pro­cure­ment author­ity) is designed such that no one indi­vidu­al can author­ise expendit­ure all the way from pro­cure­ment to pay­ment. This approach pro­tects the organ­isa­tion from fraud­u­lent or inap­pro­pri­ate use of resources, and import­antly, it also pro­tects indi­vidu­al staff mem­bers from accus­a­tions of fraud or inap­pro­pri­ate use.”

As such, CNPA have a respons­ib­il­ity of ensur­ing appro­pri­ate segreg­a­tion of duties is under­taken from the cre­ation of a requis­i­tion, through to payment.

For a sample of 21 pur­chases, we tested wheth­er segreg­a­tion of duties had been under­taken between those rais­ing and author­ising the requis­i­tion, receiv­ing the goods/​services and author­ising pay­ment. Of the 21 pur­chases we were able to read­ily identi­fy that segreg­a­tion of duties has occurred between those request­ing the requis­i­tion, approv­ing the requis­i­tion, receiv­ing the goods and request­ing pay­ment for 12 (57%) trans­ac­tions. The most com­mon format of evid­en­cing segreg­a­tion of duties for each pur­chase is main­tain­ing the fol­low­ing documentation:

• Invoice with stamped evid­ence of receipt.
• Requis­i­tion form raised and approved by two dif­fer­ent mem­bers of staff.
• Email chain from the receiv­er ask­ing for approv­al of pay­ment; and
• Email by budget hold­er with rel­ev­ant author­ity con­firm­ing approv­al for pay­ment has been granted.

For the remain­ing nine transactions:

• For six (29%) pur­chases, we could not ini­tially ascer­tain who under­took the respons­ib­il­it­ies of a) rais­ing, b) author­ising the requis­i­tion, c) receiv­ing the goods/​services and d) author­ising pay­ment. From the doc­u­ment­a­tion provided, it was not clear who was respons­ible for these four activ­it­ies and as such we could not con­firm that appro­pri­ate segreg­a­tion of duties was main­tained. Fol­low­ing com­ple­tion of field­work addi­tion­al evid­ence was provided by man­age­ment to sup­ple­ment the ini­tial doc­u­ment­a­tion received and provide clar­ity the segreg­a­tion of duties in the pur­chas­ing pro­cess for five of the sample items, with one remain­ing unclear.
• Two (10%) requis­i­tions were not placed, as these pur­chases were made as part of a shared ser­vice agree­ment with the sup­pli­er and invoices are treated as a con­tinu­ous supply.
• One (4%) requis­i­tion was not placed as the pay­ment was on the basis of a claim form spe­cif­ic to a his­tor­ic­al pro­ject. In this case the amount noted was the amount remain­ing in the claimant’s budget in the pro­ject pot, and pay­ment was made against the items claimed in the form.

We noted that there is no agree­ment as to the stand­ard doc­u­ment­a­tion that should be retained to evid­ence segreg­a­tion of duties, nor is this reflec­ted in policies and pro­ced­ures. This is the root cause of the issues noted in our testing.

Risk: There is a risk that, due to the lack of form­al­ised, doc­u­mented and stand­ard­ised meth­od of fil­ing and retain­ing doc­u­ment­a­tion per­tain­ing to pur­chases, that the segreg­a­tion of duties in pur­chas­ing can­not be evid­enced. This could lead to issues in segreg­a­tion of duties going uniden­ti­fied, and res­ult in fraud­u­lent or inap­pro­pri­ate use of expenditure.

Recom­mend­a­tion: CNPA should pro­mote the import­ance of the stand­ard­isa­tion of doc­u­ment­a­tion kept for each pur­chase, and require that for each com­mit­ment of expendit­ure the fol­low­ing should be doc­u­mented and maintained:

• Requis­i­tion form — with a dif­fer­ent sig­na­ture for cre­ation and approval.
• Invoice — with stamped evid­ence of receipt of goods/​services
• Evid­ence of approv­al — this could be in the meth­od of an email chain from a mem­ber with appro­pri­ate author­ity (as per the del­eg­ated levels of authority)

---

Page 10:

Man­age­ment Action: (Grade 2 (Design)) We will rein­force with col­leagues the import­ance of main­tain­ing segreg­a­tion of duties and of evid­en­cing this with­in the trail of doc­u­ment­a­tion – we are plan­ning to deliv­er a set of work­shops for the wider staff group to dis­cuss pro­ced­ures and will cov­er these mat­ters at these events. Fin­ance staff pro­cessing invoices will ensure that a stand­ard set of doc­u­ments is kept in sup­port of each trans­ac­tion. Where there is any devi­ation from stand­ard pro­ced­ure, this will be doc­u­mented on the invoice. A review of expendit­ure on con­tinu­ing ser­vices will be per­formed before the com­mence­ment of each fin­an­cial year, and requis­i­tions will be re-author­ised to con­firm the appro­pri­ate­ness of con­tinu­ing with the exist­ing busi­ness arrangement.

Action own­er: Fin­ance Manager

Due date: 31 March 2024

---

Page 11:

Con­trol Object­ive 4: Non-pay expendit­ure is accur­ately reflec­ted in the fin­an­cial ledger. (Green)

No weak­nesses identified

Daily recon­cili­ations are car­ried out to ensure records held on Sage and with­in the pur­chase ledger match with com­mit­ted expendit­ure detailed with­in the CNPA bank accounts, recon­cil­ing account deb­its in the pre­vi­ous day, into the Sage sys­tem and pur­chase ledger.

In addi­tion to the daily checks under­taken, monthly, doc­u­mented recon­cili­ations are car­ried out for CNPA bank accounts. Recon­cili­ations are car­ried out between the bank account state­ment, the pur­chase ledger and against the sales ledger. Recon­cili­ations are signed off and for any items that do not recon­cile, invest­ig­a­tion nar­rat­ive and explan­a­tion is sought.

We selec­ted a sample of three months with­in the last year and observed that recon­cili­ations had been under­taken for CNPA’s bank accounts against the pur­chase and sales ledgers. For any items that did not recon­cile, we con­firmed that an invest­ig­a­tion had been under­taken and an explan­a­tion was provided.

---

Page 12:

Con­trol Object­ive 5: The pur­chase ledger is reviewed reg­u­larly to min­im­ise any dis­puted or over­due accounts. (Green)

No weak­nesses identified

An invoice register is kept as a means of mon­it­or­ing the status of pur­chase invoices. The invoice register provides a real-time meth­od of mon­it­or­ing the status of pur­chase invoices, in order to identi­fy and mit­ig­ate dis­puted or over­due accounts before risk is real­ised. For each invoice, the register outlines:

• Date received
• Sup­pli­er
• Invoice date
• Invoice num­ber
• Value
• The email of the staff mem­ber who provided approval
• Date the email request­ing approv­al was sent
• When approv­al was returned

Man­age­ment noted that over­due accounts or pay­ments rarely hap­pen, and when they do it is mostly due to approv­al for pay­ment not being returned. In order to ensure this is min­im­ised the invoice register is reg­u­larly reviewed, and approv­al is chased by mem­bers of the man­age­ment account­ing team. We have been able to observe the invoice register util­ised in day-to-day work for the account­ing staff, and we were able to observe that when accounts/​payments are approach­ing being over­due, these are promptly chased up.

---

Page 13:

Appendix A – Definitions

Con­trol assessments

Code	Descrip­tion
R	Fun­da­ment­al absence or fail­ure of key controls.
A	Con­trol object­ive not achieved — con­trols are inad­equate or ineffective.
Y	Con­trol object­ive achieved — no major weak­nesses but scope for improvement.
G	Con­trol object­ive achieved — con­trols are adequate, effect­ive and efficient.

Man­age­ment action grades

Grade	Descrip­tion
4	Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
3	High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
2	Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
1	Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

---

Page 14:

© Azets 2023. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.