WIXLIB

Attachment 18iAccounts ReceivableFINAL INTERNAL AUDIT REPORT2015/16Hywel Dda University Health BoardPrivate and ConfidentialNHS Wales Shared Services PartnershipAudit and Assurance ServicesAssurance RatingReasonable Assurance- Previous review ratingSubstantial Assurance

Accounts ReceivableReport ContentsHywel Dda University Health BoardCONTENTSPage1.Introduction and Background42.Scope and Objectives43.Associated Risks5Opinion and key findings4.Overall Assurance Opinion55.Assurance Summary66.Summary of Audit Findings77.Summary of Recommendations11Appendix AAppendix BAppendiManagement Action PlanAssurance opinion and action plan risk ratingReview reference:Report status:Fieldwork commencement:Fieldwork completion:HDUHB 1514Final19th October 201521st January 2016Draft Report issued:28th January 2016Management response received:Final report issued:Auditor:3rd February 20169th February 2016Mark JonesExecutive sign offKaren MilesDistributionJean Reynolds; Mike Wade;Julie Wheeler-DaviesCommitteeAudit & Risk AssuranceCommitteeNHS Wales Audit & Assurance ServicesPage 2

Accounts ReceivableReport ContentsHywel Dda University Health BoardACKNOWLEDGEMENTNHS Wales Audit & Assurance Services would like to acknowledge the time and co-operation given bymanagement and staff during the course of this review.Please note:This audit report has been prepared for internal use only. Audit & Assurance Services reports are prepared inaccordance with the Service Strategy and Terms of Reference, approved by the Audit & Risk AssuranceCommittee.Audit reports are prepared by the staff of the NHS Wales Shared Services Partnership – Audit and AssuranceServices, and addressed to Independent Members or officers including those designated as Accountable Officer.They are prepared for the sole use of the Hywel Dda University Health Board and no responsibility is taken bythe Audit & Assurance Services Internal Auditors to any director or officer in their individual capacity, or to anythird party.NHS Wales Audit & Assurance ServicesPage 3

Accounts ReceivableFinal Internal Audit ReportHywel Dda University Health Board1.Introduction and BackgroundThe assignment originates from the Internal Audit plan and thesubsequent report will be submitted to the Executive Director andAudit & Risk Assurance Committee.The relevant lead Executive Director for the assignment is theDirector of Finance, Planning & Performance.2.Scope and ObjectivesAs part of the system based audit approach, key staff wereinterviewed and documentary evidence was obtained and subjectedto compliance and substantive testing. Interview and documentaryevidence was used to establish controls and compared to expectedcontrols laid down in the good practice guide of the NHS InternalAudit Manual.We have allocated an assurance rating, dependant on the level ofassurance Internal Audit are able to provide.There are fourpotential levels of assurance available, along with threerecommendation priorities and these are described in Appendix B.The overall objective of the audit is to give assurance that allincome due to the Health Board is properly identified, collected andaccounted for under management control. Timely and adequateinformation should be received by management to confirm this.The areas reviewed were as follows: Follow up the agreed management recommendations made atthe 2014/15 audit review;To ensure that the Accounts Receivable (AR) system operateswithin a secure environment;There is adequate backup of data, and access to data isrestricted;Debtors control accounts are kept up-to-date, reconciled andindependently reviewed at an appropriate level; andThe control of debtor balances is adequate via debtor balancesbeing fully reported on, aged debt analysis, write-offs anddebt collection.NHS Wales Audit & Assurance ServicesPage 4

Accounts ReceivableFinal Internal Audit ReportHywel Dda University Health Board3.Associated RisksSignificant weaknesses within the Accounts Receivable system couldimpede upon the production of accurate financial accounts, lead tounreliable management information and loss of financial control.OPINION AND KEY FINDINGS4.Overall Assurance OpinionWe are required to provide an opinion as to the adequacy andeffectiveness of the system of internal control under review. The opinionis based on the work performed as set out in the scope and objectiveswithin this report. An overall assurance rating is provided describing theeffectiveness of the system of internal control in place to manage theidentified risks associated with the objectives covered in this review.The level of assurance given to the effectiveness of the systems ofinternal control in place for the administration of the Accounts Receivablefunction is Reasonable TIONThe Board can take reasonable assurancethat arrangements to secure governance, riskmanagement and internal control, within thoseareas under review, are suitably designed andapplied effectively. Some matters requiremanagement attention in control design orcompliance with low to moderate impact onresidual risk exposure until resolved.The overall level of assurance that can be assigned to a review isdependent on the severity of the findings as applied against the specificreview objectives and should therefore be considered in that context.NHS Wales Audit & Assurance ServicesPage 5

Accounts ReceivableFinal Internal Audit ReportHywel Dda University Health Board5.Assurance SummaryThe summary of assurance given against the individual areas tested isoutlined in the following table:ASSURANCE SUMMARY *Audit Scope1 Financial Procedures2Access to Data isRestricted 3Adequate Backup ofData 4567891011SatisfactoryContingency Plans inEvent of IT Failure Control AccountReconciliations Debtor Balances areFully Reported Aged Debt AnalysisReview ofOutstanding DebtsWrite-OffsDebt CollectionFollow-Up ofPrevious AuditReport * The above ratings are not necessarily given equal weighting when generating the auditopinion.NHS Wales Audit & Assurance ServicesPage 6

Accounts ReceivableFinal Internal Audit ReportHywel Dda University Health BoardDesign of Systems/Controls (D)The findings from the review have highlighted 0 issues that are classifiedas a weakness in the system control/design for the management of theAR function. These would be identified in the Management Action Plan as(D).Operation of System/Controls (O)The findings from the review have highlighted 3 issues that are classifiedas a weakness in the operation of the designed system/control for themanagement of the AR function. These are identified in the ManagementAction Plan as (O).6.Summary of Audit FindingsThe key findings by the individual areas tested are reported in the sectionbelow with full details in Appendix A:Audit Scope 1 – Financial ProceduresAt the time of the audit, Financial Procedure FP 02/02 – “Credit Control &Debt Recovery” was current, up-to-date and due for review in November2015.No significant findings were noted in this area.Audit Scope 2 – Access to Data is RestrictedClear areas of responsibilities are set out for the Accounts Receivablesystem ensuring that adequate segregation of duties is maintained.Access levels to the Oracle Accounts Receivable system was reviewed byrandomly selecting a sample of 10 users and ensuring that they arecurrently employed by the Health Board.This was found to besatisfactory.NHS Wales Audit & Assurance ServicesPage 7

Accounts ReceivableFinal Internal Audit ReportHywel Dda University Health BoardThe processes in place for Oracle password security were reviewed andfound to be satisfactory.No significant findings were noted in this area.Audit Scope 3 – Adequate Backup of DataAdequate backups are performed on a daily basis. This area is looked atin greater detail in the Financial Ledger audit (report number HDUHB 1512refers).No significant findings were noted in this area.Audit Scope 4 – Satisfactory Contingency Plans in the Event of ITFailureIt was confirmed that satisfactory instructions relating to the ability toraise manual invoices are in place in the event of IT failure within theHealth Board.No significant findings were noted in this area.Audit Scope 5 – Control Account ReconciliationsA review of the main Accounts Receivable reconciliation was undertakento ensure that performance and review was undertaken in a timelymanner, and documents were signed and dated as evidence of this. Atthe time of the audit, reconciliations up to September 2015 (Month 6) hadbeen performed, and up to August 2015 (Month 5) had been performedand reviewed.The latest reconciliation (Month 6) was re-performed by Internal Auditand testing proved to be satisfactory.No significant findings were noted in this area.NHS Wales Audit & Assurance ServicesPage 8

Accounts ReceivableFinal Internal Audit ReportHywel Dda University Health BoardAudit Scope 6 – Debtor Balances are Fully ReportedDebtor balances are reviewed on a monthly basis by the Financedepartment. A review of outstanding invoices as at 19 October 2015 wasundertaken and 22 credit balances were identified. Satisfactoryexplanations were given for each of the credit balances.No significant findings were noted in this area.Audit Scope 7 – Aged Debt AnalysisAged debt analysis is produced and reviewed on a monthly basis by theDebtors Team Leader. This is included in the Welsh Government monthlymonitoring returns.No significant findings were noted in this area.Audit Scope 8 – Review of Outstanding DebtsA sample of 30 debts (5 NHS debts and 25 non-NHS debts) was selectedat random from the list of outstanding invoices as at 19 October 2015.The sample was subjected to testing to ensure that: The correct follow-up action has been taken for the age and statusof the debt; Documented detail supports the correct action for the age andstatus of debt; and Adequate prime documents are held to validate the debtor, serviceprovided and amount charged.The testing revealed 5 instances where there appeared to be inadequateaction to recover the debt, as follows:NHS Wales Audit & Assurance ServicesPage 9

Accounts ReceivableFinal Internal Audit ReportHywel Dda University Health BoardINVOICENO.AMOUNTINVOICEDATEOUTSTANDING4030508 218.4622/08/144034731 598.0004/06/154032251 633.3918/12/144027899 35.6305/03/144033753 2,072.5720/03/15COMMENTSDebtor paying 20intermittently. Lastpayment received in April2015.No dunning letters could besent as a “profile class” hadnot been created byFinance Support Assistant.Meant to be paying ininstalments but only 40paid at time of audit.Needs to go to CCI.CCI instructions on fouroccasions but not actuallyreferred to CCI (debtor isstaff member).Agreed to pay in 24instalments, but only 2monthly instalments of 100 paid so far. Needs togo to CCI.A recommendation relating to the above is contained in Appendix A.Audit Scope 9 – Write-OffsIt was confirmed that comprehensive lists of write-offs are maintained bythe Debtors Team Leader.A sample of 10 write-offs was randomly selected and satisfactorily testedto ensure each debt could be traced to the original invoice and backingdocuments, and adequate reasons for write-off were fully documented ineach case.No significant findings were noted in this area.NHS Wales Audit & Assurance ServicesPage 10