WARNING - By their nature, text files cannot include scanned images and tables. The process of converting documents to text only, can cause formatting changes and misinterpretation of the contents can sometimes result. Wherever possible you should refer to the pdf version of this document. CAIRNGORMS NATIONAL PARK AUTHORITY Audit Committee Paper 2 Annex 1 15/12/06 Cairngorms National Park Authority Review of Cash Flow Management Internal Audit 2005/2006 August 2006 Strictly Private and Confidential THIS IS A DRAFT REPORT AND REPRESENTS A WORK IN PROGRESS AND MAY CONTAIN PRELIMINARY RESULTS OR CONCLUSIONS INCOMPLETE INFORMATION OR INFORMATION WHICH IS SUBJECT TO CHANGE This report and the work connected therewith are subject to the Terms and Conditions of the engagement letter between The Cairngorms National Park Authority and Deloitte & Touche LLP. The report is produced solely for the use of The Cairngorms National Park Authority. Its contents should not be quoted or referred to in whole or in part without our prior written consent except as required by law. Deloitte & Touche LLP will accept no responsibility to any third party, as the report has not been prepared, and is not intended for any other purpose. Contents Section 1 Executive summary Page 1 Section 2 Detailed findings and recommendations Page 5 Section 3 Statement of responsibility Page 7 Appendices Appendix A Scope and objectives Page 8 Appendix B Personnel interviewed Page 9 Section 1 - Executive summary 1.1 Introduction This review of cash flow management is part of our coverage of core financial areas as required in the audit plan approved by the Audit Committee. Appendix A shows the detailed scope and objectives of our review. 1.2 Background Organisational funding is obtained from the Scottish Executive and is based on a 3 year cycle. 2006/07 is the second year of the current cycle. £4.3m was received in 2005/06. £4.4m is to be received in 2006/07 and £4.5m in 2007/08. Resource allocation is determined by the Scottish Executive. Requirements for the coming year are determined by the Management Team in December and a detailed month by month cash flow is prepared by the Finance Manager. This is agreed by the Management Team and the Finance Committee. Planned expenditure is also incorporated into the Operational Plan. The Finance Manager submits a monthly cash draw down application to the Scottish Executive. This is performed on the 6th of each month. The Scottish Executive has prepared a Management Statement and Financial Memorandum detailing expectations for treatment of finances, including management of bank accounts within the organisation. The memorandum states that bank accounts must be informally reviewed every 2-3 years, with a formal review and possible re-tender every 3-5 years. An informal review of the banking arrangements was performed in 2005/06 with a formal review expected in 2007/08. Local financial regulations are also in place, which follow the Management Statement and Financial Memorandum. These are held on the shared network and all staff have access to them. The Finance Committee and Management Team receive monthly income and expenditure reports from the Finance Manger and a quarterly report is submitted to the Finance Committee. CNPA has two current bank accounts, one for projects and one for core funding. All funding received is credited to the core account and project funding is transferred as and when necessary. There are two petty cash imprests, one at the Grantown location of £150 and one in Ballater at £100. The Grantown cash imprest is maintained by front office staff and is used for incidental items. Receipts are required and are retained in a receipt book. A spreadsheet of expenditure is maintained and is passed to the Finance Assistant. She logs expenditure on the ledger and this is reviewed by the Finance Manager. The imprest is replenished on a monthly basis and is cashed by the Finance Assistant. A staff member in Ballater maintains the imprest at that location and sends the spreadsheet to the Finance Assistant in Grantown, who again logs payments to the ledger. 1.2 Background (continued) All cash, cheques and credit cards are securely stored. There are six cheque signatories within the organisation, two of which have authorisation above £10k. All cheques require two signatories and if over £10k at least one signature must be that of the senior signatories. All cheques are issued by Finance Assistants and are reviewed by the signatory with back up attached. 1.3 Approach The following approach was used in order to complete this review: • Discussions were held with the Finance Manager and processing staff to document the systems in place regarding cash flow forecasting, management reporting, security of cash and segregation of duties with regard to cash and banking; • An evaluation of mitigating controls against risks was performed in order to identify key controls and areas for testing; • Testing was performed on a sample basis on all key controls identified. 1.4 Conclusion The following table details our overall assessment of the control environment against each audit objective: Objectives / Overall Assessment / Report Ref. Adequate cash management policies have been developed and applied **** - Bank accounts have been established in accordance with Scottish Executive and CNPA financial instructions and are subject to periodic review **** - There is effective segregation of duties in dealing with cash, banking and treasury management ** 2.1; 2.2 Sufficient security measures are in place to protect staff and monies in areas of physical cash management **** - Key: **** Arrangements accord with good practice and are operating satisfactorily (recommendations are in respect of minor matters). *** Adequate arrangements are in place, but certain matters noted as requiring improvement. ** Arrangements in place offer scope for improvement. * Inadequate level of control and unacceptable level of risk. 1.4 Conclusion (continued) In overall terms, the control environment is efficient, however a number of minor control gaps were identified. These were as follows: • Income is not logged when received in the organisation resulting in a lack of segregation of duties in recording and banking income. (Recommendation 2.1); • Petty cash expenditure is recorded in the ledger without being reconciled to receipts and the remaining imprest resulting in an increased risk of inaccurate financial reporting. (Recommendation 2.2); Our detailed findings and recommendations are within Section 2 of this report. In total, we identified two recommendations as follows: Description Priority Number Major issues that we consider need to be brought to the attention of Management and the Audit Committee 1 0 Important issues which should be addressed by management in their areas of responsibility 2 0 Minor issues where management may wish to consider our recommendations 3 2 Key - 2 1.5 Acknowledgements We would like to take the opportunity to thank all of the CNPA staff involved in assisting us in this audit. The findings and recommendations in this report were discussed with the Head of Corporate Services at the conclusion of our fieldwork. Section 2 - Detailed findings and recommendations (continued) 2.1 Recording of Income Finding Most income recorded within the organisation arrives in the form of cheques or remittance advices. However there is no recording procedure in place. The cheques are passed directly to the Finance Assistants without being logged and are recorded in the ledger by the Finance Assistants. They also are responsible for banking income. As a result there is a lack of segregation of duties, with no evidence of income received. Recommendation All income received within the organisation should be recorded in the form of a cheque log. This should record information such as: • Amount Received • Received From • Cheque Number • Date Received • Received By The Finance Assistant should sign the log when she receives income. Rationale The lack of segregation of duties at present could allow for misappropriation of funds. Management Response Recommendation accepted. Responsibility / Deadline Finance Manager and Business Services Manager / March 2007 Priority Two Cairngorms National Park Authority – Internal Audit 2005/06 Review of Cash Flow Management Section 2 - Detailed findings and recommendations (continued) 2.2 Petty Cash Imprest Finding There is a petty cash imprest of £150, held in the front office at the organisation in a locked cupboard. This is maintained by one of the receptionists who releases funds for incidental items. All receipts are required and are held in a receipt book with the petty cash imprest. Expenditure is also recorded in a spreadsheet which is passed to the Finance Assistant to record in the ledger. However the Finance Assistant logs this without reconciling the spreadsheet to receipts and cash in the imprest. Recommedation The petty cash spreadsheet should be passed to the Finance Assistant, with the receipt book and the imprest in order to be appropriately reconciled prior to recording in the ledger. Rationale Petty Cash expenditure may be incorrectly recorded in the ledger resulting in inaccurate financial reporting. Management Response Recommendation accepted Responsibility / Deadline Finance Manager / March 2007 Priority Three Section 3 - Statement of responsibility Section 3 - Statement of responsibility Statement of Responsibility We take responsibility for this report which is prepared on the basis of the limitations set out below. The matters raised in this report are only those which came to our attention during the course of our internal audit work and are not necessarily a comprehensive statement of all the weaknesses that exist or all improvements that might be made. Recommendations for improvements should be assessed by you for their full impact before they are implemented. The performance of internal audit work is not and should not be taken as a substitute for management’s responsibilities for the application of sound management practices. We emphasise that the responsibility for a sound system of internal controls and the prevention and detection of fraud and other irregularities rests with management and work performed by internal audit should not be relied upon to identify all strengths and weaknesses in internal controls, nor relied upon to identify all circumstances of fraud or irregularity. Auditors, in conducting their work, are required to have regards to the possibility of fraud or irregularities. Even sound systems of internal control can only provide reasonable and not absolute assurance and may not be proof against collusive fraud. Internal audit procedures are designed to focus on areas as identified by management as being of greatest risk and significance and as such we rely on management to provide us full access to their accounting records and transactions for the purposes of our audit work and to ensure the authenticity of these documents. Effective and timely implementation of our recommendations by management is important for the maintenance of a reliable internal control system. Deloitte & Touche LLP Inverness August 2006 In this document Deloitte refers to one or more of Deloitte Touche Tohmatsu, a Swiss Verein, its member firms and their respective subsidiaries and affiliates. As a Swiss Verein (association), neither Deloitte Touche Tohmatsu nor any of its member firms has any liability for each other’s acts or omissions. Each of the member firms is a separate and independent legal entity operating under the names “Deloitte”, “Deloitte & Touche”, “Deloitte Touche Tohmatsu”, or other related names. Services are provided by the member firms or their subsidiaries or affiliates and not by the Deloitte Touche Tohmatsu Verein. In the UK, Deloitte & Touche LLP is the member firm of Deloitte Touche Tohmatsu and services are provided by Deloitte & Touche LLP and its subsidiaries. Deloitte & Touche LLP is authorised and regulated by the Financial Services Authority. ©2005 Deloitte & Touche LLP. All rights reserved. Deloitte & Touche LLP is a limited liability partnership registered in England and Wales with registered number OC303675. A list of members’ names is available for inspection at Stonecutter Court, 1 Stonecutter Street, London EC4A 4TR, United Kingdom, the firm’s principal place of business and registered office. Appendix A -Scope and objectives Appendix A -Scope and objectives Scope As a cash limited organisation, the Authority must have a robust cash flow forecasting process, linking into the budgeting and financial ledger processes. Our review will assess the controls in place to ensure that cash flow forecasts and cash draw-downs are based on valid and appropriate assumptions. Objectives The specific control objectives for this review will be to assess the controls in place to ensure that: • Adequate cash management policies have been developed and applied; • Bank accounts have been established in accordance with Scottish Executive and CNPA financial instructions and are subject to periodic review; • There is effective segregation of duties in dealing with cash, banking and treasury management; and • Sufficient security measures are in place to protect staff and monies in areas of physical cash management. Appendix B -Personnel interviewed Appendix B -Personnel interviewed • Denby Pettitt – Finance Manager • David Cameron – Head of Corporate Services • Mandy Mathieson – Finance Assistant