Agenda of Audit and Risk Committee

PALMERSTON NORTH CITY COUNCIL

Audit and Risk Committee MEETING

19 February 2018

Order of Business

NOTE: The Audit and Risk Committee meeting coincides with the ordinary meeting of the Finance and Performance Committee meeting. The format for the meeting will be as follows:

- Audit and Risk Committee will open and adjourn immediately to following Finance and Performance Committee

- Finance and Performance Committee will open, conduct its business and then close.

1. Apologies

2. Notification of Additional Items

Pursuant to Sections 46A(7) and 46A(7A) of the Local Government Official Information and Meetings Act 1987, to receive the Chairperson’s explanation that specified item(s), which do not appear on the Agenda of this meeting and/or the meeting to be held with the public excluded, will be discussed.

Any additions in accordance with Section 46A(7) must be approved by resolution with an explanation as to why they cannot be delayed until a future meeting.

Any additions in accordance with Section 46A(7A) may be received or referred to a subsequent meeting for further discussion. No resolution, decision or recommendation can be made in respect of a minor item.

3. Public Comment

To receive comments from members of the public on matters specified on this Agenda or, if time permits, on other Committee matters.

(NOTE: If the Committee wishes to consider or discuss any issue raised that is not specified on the Agenda, other than to receive the comment made or refer it to the Chief Executive, then a resolution will need to be made in accordance with clause 2 above.)

4. Confirmation of Minutes Page 7

“That the minutes of the Audit and Risk Committee meeting of 20 November 2017 Part I Public be confirmed as a true and correct record.”

5. Health and Safety Report Oct - Dec 2017 Page 13

Memorandum, dated 1 February 2018 from the Human Resources Manager, Wayne Wilson.

6. Business Continuity Planning PNCC update Page 25

Memorandum, dated 9 January 2018 from the Head of Emergency Management, Stewart Davies.

7. Internal Audit Plan 2018/19 (Year 2 of the 3 Year Plan) Page 29

Memorandum, dated 10 January 2018 from the Senior Internal Auditor, Vivian Watene.

8. Risk Management Progress - YTD December 2017 Page 45

Memorandum, dated 18 January 2018 from the Senior Internal Auditor, Vivian Watene.

9. Internal Audit 2017/18 Plan Progress - YTD December 2017 Page 87

Memorandum, dated 18 January 2018 from the Senior Internal Auditor, Vivian Watene.

10. Committee Work Schedule Page 161

11. Exclusion of Public

To be moved:

“That the public be excluded from the following parts of the proceedings of this meeting listed in the table below.

The general subject of each matter to be considered while the public is excluded, the reason for passing this resolution in relation to each matter, and the specific grounds under Section 48(1) of the Local Government Official Information and Meetings Act 1987 for the passing of this resolution are as follows:

General subject of each matter to be considered	Reason for passing this resolution in relation to each matter	Ground(s) under Section 48(1) for passing this resolution

This resolution is made in reliance on Section 48(1)(a) of the Local Government Official Information and Meetings Act 1987 and the particular interest or interests protected by Section 6 or Section 7 of that Act which would be prejudiced by the holding of the whole or the relevant part of the proceedings of the meeting in public as stated in the above table.

Also that the persons listed below be permitted to remain after the public has been excluded for the reasons stated.

Chief Executive (Heather Shotter), Chief Financial Officer (Grant Elliott), General Manager, City Enterprises (Ray McIndoe), General Manager, City Future (Sheryl Bryant), General Manager, City Networks (Ray Swadel), General Manager, Customer Services (Peter Eathorne), General Manager, Libraries and Community Services (Debbie Duncan), Human Resources Manager (Wayne Wilson) and Communications and Marketing Manager (or their representative (name)) because of their knowledge and ability to provide the meeting with advice on matters both from an organisation-wide context (being members of the Council’s Management Team) and also from their specific role within the Council.

Legal Counsel (John Annabell), because of his knowledge and ability to provide the meeting with legal and procedural advice.

Governance and Support Team Leader (Kyle Whitfield) and Committee Administrators (Penny Odell, Carly Chang and Rachel Corser), because of their knowledge and ability to provide the meeting with procedural advice and record the proceedings of the meeting.

[Add Council Officers], because of their knowledge and ability to assist the meeting in speaking to their report and answering questions, noting that such officer will be present at the meeting only for the item that relate to their respective report.

[Add Third Parties], because of their knowledge and ability to assist the meeting in speaking to their report/s [or other matters as specified] and answering questions, noting that such person/s will be present at the meeting only for the items that relate to their respective report/s [or matters as specified].

PALMERSTON NORTH CITY COUNCIL

Palmerston North City Council

Minutes of the Audit and Risk Committee Meeting Part I Public, held in the Council Chamber, First Floor, Civic Administration Building, 32 The Square, Palmerston North on 20 November 2017, commencing at 9.00am.

Members

Present:

Councillors Vaughan Dennison (in the Chair), Brent Barrett, Susan Baty, Adrian Broad, Gabrielle Bundy-Cooke, Lew Findlay QSM, Leonie Hapeta, Jim Jefferies, Lorna Johnson, Karen Naylor, Bruno Petrenas and Tangi Utikere.

Apologies:

The Mayor (Grant Smith) and Councillors Rachel Bowen and Aleisha Rutherford.

Councillor Duncan McCann entered the meeting at 10.32am when the meeting resumed. He was not present for clause 27.

27-17

Apologies

Moved Vaughan Dennison, seconded Bruno Petrenas.

The COMMITTEE RESOLVED

1. That the Committee receive the apologies.

Clause 27-17 above was carried 12 votes to 0, the voting being as follows:

For:

Councillors Brent Barrett, Susan Baty, Adrian Broad, Gabrielle Bundy-Cooke, Vaughan Dennison, Lew Findlay QSM, Leonie Hapeta, Jim Jefferies, Lorna Johnson, Karen Naylor, Bruno Petrenas and Tangi Utikere.

The meeting adjourned at 9.01am.

The meeting resumed at 10.32am.

Councillor Duncan McCann was present when the meeting resumed.

28-17

Confirmation of Minutes

Moved Bruno Petrenas, seconded Lorna Johnson.

The COMMITTEE RESOLVED

1. That the minutes of the Audit and Risk Committee meeting of 21 August 2017 Part I Public be confirmed as a true and correct record.

Clause 28-17 above was carried 12 votes to 0, with 1 abstention, the voting being as follows:

For:

Councillors Brent Barrett, Susan Baty, Adrian Broad, Gabrielle Bundy-Cooke, Vaughan Dennison, Lew Findlay QSM, Leonie Hapeta, Jim Jefferies, Lorna Johnson, Duncan McCann and Karen Naylor and Bruno Petrenas.

Abstained:

Councillor Tangi Utikere.

29-17

Alter A Resolution Previously Passed

Memorandum, dated 27 October 2017 from the Senior Internal Auditor, Vivian Watene.

Moved Vaughan Dennison, seconded Brent Barrett.

The COMMITTEE RESOLVED

1. That the Committee approve the correction to the Resolution clause 23-17 of the August 2017 Audit and Risk Committee meeting to read ‘That Risk 15 residual risk remain as critical (i.e. Likelihood: Almost Certain; Impact: Moderate), and

2. That “excluding those programmes which are subject to third party funding” to be deleted from the risk description.’

Clause 29-17 above was carried 12 votes to 0, with 1 abstention, the voting being as follows:

For:

Abstained:

Councillor Tangi Utikere.

30-17	LED Street Lighting Compliance Review Report, dated 2 November 2017 from the Road Planning Team Leader, David Lane. In discussion it was suggested that a business case for the upgrading of the street light networks needed to be developed sooner rather than waiting on the Long Term Plan.
	Moved Vaughan Dennison, seconded Bruno Petrenas. The COMMITTEE RECOMMENDS 1. That Council confirm continued delivery of programme 1086 allowing upgrading of LED luminaires in both compliant and non-compliant parts of the network; thereby rescinding Resolution 6.3(b) adopted on 25 May 2017. 2. That Council notes that a proposed programme 1367 will be included for consideration in the Draft 2018-28 Ten Year Plan to allow for upgrading of street lights to meet the relevant standard.
	Clauses 30.1 and 30.2 above were carried 13 votes to 0, the voting being as follows: For: Councillors Brent Barrett, Susan Baty, Adrian Broad, Gabrielle Bundy-Cooke, Vaughan Dennison, Lew Findlay QSM, Leonie Hapeta, Jim Jefferies, Lorna Johnson, Duncan McCann, Karen Naylor, Bruno Petrenas and Tangi Utikere.
	Moved Lorna Johnson, seconded Leonie Hapeta. 3. That the Chief Executive develop a business case for the upgrading of street light networks with the aim of delivering the programme within the next financial year 2018/19.
	Clause 30.3 above was carried 7 votes to 6, the voting being as follows: For: Councillors Brent Barrett, Gabrielle Bundy-Cooke, Lew Findlay QSM, Leonie Hapeta, Lorna Johnson, Duncan McCann and Tangi Utikere. Against: Councillors Susan Baty, Adrian Broad, Vaughan Dennison, Jim Jefferies and Karen Naylor and Bruno Petrenas.

31-17

Health and Safety July - September 2017

Memorandum, dated 6 November 2017 from the Human Resources Manager, Wayne Wilson.

Moved Vaughan Dennison, seconded Bruno Petrenas.

The COMMITTEE RESOLVED

1. That the Audit and Risk Committee note the information contained within this report.

Clause 31-17 above was carried 11 votes to 1, with 1 abstention, the voting being as follows:

For:

Councillors Brent Barrett, Susan Baty, Adrian Broad, Gabrielle Bundy-Cooke, Vaughan Dennison, Lew Findlay QSM, Jim Jefferies, Lorna Johnson, Karen Naylor, Bruno Petrenas and Tangi Utikere.

Against:

Councillor Leonie Hapeta.

Abstained:

Councillor Duncan McCann.

32-17

Management Agreed Audit Corrective Actions Progress Status - September 2017

Memorandum, dated 24 October 2017 from the Senior Internal Auditor, Vivian Watene.

Moved Vaughan Dennison, seconded Susan Baty.

The COMMITTEE RESOLVED

1. That the Committee receive the Memorandum titled “Management Agreed Audit Corrective Actions Progress Status – September 2017” and dated 24 October 2017, from the Senior Internal Auditor, Vivian Watene, for information.

Clause 32-17 above was carried 13 votes to 0, the voting being as follows:

For:

Councillors Brent Barrett, Susan Baty, Adrian Broad, Gabrielle Bundy-Cooke, Vaughan Dennison, Lew Findlay QSM, Leonie Hapeta, Jim Jefferies, Lorna Johnson, Duncan McCann, Karen Naylor, Bruno Petrenas and Tangi Utikere.

33-17

Two New Internal Audits - Earthquake Strengthening, and Accounts Receivable and Aged Debtors

Memorandum, dated 24 October 2017 from the Senior Internal Auditor, Vivian Watene.

Moved Vaughan Dennison, seconded Bruno Petrenas.

The COMMITTEE RESOLVED

1. That the Committee receive these two audit reports: Earthquake Strengthening, and Accounts Receivable and Aged Debtors audits, for information.

2. That the Committee note the audit issues identified and the related Management responses to the audit recommendations.

Clause 33-17 above was carried 13 votes to 0, the voting being as follows:

For:

34-17

Delegations Manual - Amendment to Powers of Chief Executive

Memorandum, dated 3 November 2017 from the Legal Counsel, John Annabell.

Moved Vaughan Dennison, seconded Bruno Petrenas.

The COMMITTEE RECOMMENDS

1. That the Council’s Delegations Manual be amended by adding the following sub-clause (c) to clause 201 relating to delegations to the Chief Executive:

“(c) Does not involve the revocation or alteration of any decision previously made by the Council unless expressly permitted; and”.

Clause 34-17 above was carried 13 votes to 0, the voting being as follows:

For:

35-17	Auditor Engagement and FY 2017 Final Management Report Memorandum, dated 1 November 2017 from the Financial Accountant, Keith Allan. In discussion it was suggested that a robust performance framework needed to be established and included in the Long Term Plan.
	Moved Vaughan Dennison, seconded Susan Baty. The COMMITTEE RESOLVED 1. That the Committee receive the 2017 Final Audit Management Report.
	Moved Brent Barrett, seconded Leonie Hapeta. 2. That the Chief Executive be directed to work with Council in establishing a robust performance framework, for inclusion in the Long Term Plan.
	Clause 35-17 above was carried 13 votes to 0, the voting being as follows: For: Councillors Brent Barrett, Susan Baty, Adrian Broad, Gabrielle Bundy-Cooke, Vaughan Dennison, Lew Findlay QSM, Leonie Hapeta, Jim Jefferies, Lorna Johnson, Duncan McCann, Karen Naylor, Bruno Petrenas and Tangi Utikere.

36-17

Committee Work Schedule

Moved Vaughan Dennison, seconded Leonie Hapeta.

The COMMITTEE RESOLVED

1. That the Audit and Risk Committee receive its Work Schedule dated November 2017.

Clause 36-17 above was carried 13 votes to 0, the voting being as follows:

For:

The meeting finished at 12.03pm

Confirmed 19 February 2018

Chairperson

PALMERSTON NORTH CITY COUNCIL

Memorandum

TO: Audit and Risk Committee

MEETING DATE: 19 February 2018

TITLE: Health and Safety Report Oct - Dec 2017

DATE: 1 February 2018

AUTHOR/S: Wayne Wilson, Human Resources Manager, Headquarters

RECOMMENDATION(S) TO Council

1. That the Audit and Risk Committee note the information contained within this report.

1. ISSUE

This report covers the period 1 October to 31 December 2017. The information included in this report is discussed at the appropriate H&S Committee, the Main H&S Committee and Management Team.

2. BACKGROUND

Hazards, Incidents and Near Misses Reported

Quarter	Mar 16	Jun 16	Sep 16	Dec 16	Mar 17	Jun 17	Sep 17	Dec 17
Hazards	12	15	21	15	10	7	4	3
Incidents	12	40	45	31	56	20	58	12
Near Misses	5	21	67	24	24	28	27	8
Lost Time (days)	32.6	67.3	154.6	215.0	215.6	140	129.15	133.06
L.T. Injuries	5	10	11	14	13	9	17	9

Two injuries accounted for 66% of the lost time. Only 1 injury was not in City Enterprises.

Included below is the City Enterprise report from People Safe. This report covers the month of December with commentary for the quarter as well. National benchmarks included show that City Enterprises incident and lost-time rates are well below these national benchmarks. The issue of injury by activity type being recorded against “other” or “unassigned” has been rectified, with all injuries being reassessed to an appropriate category.

Investigations

No investigations required this quarter.

Previous Investigations

Number of Recommendations 24

Number of Recommendations Completed 22

The 2 outstanding recommendations relate to a formal external review of our H&S processes and procedures which is currently being confirmed with the consultant.

Training

included is a report on H&S specific training undertaken during the calendar year. This captures most of the training provided but not all, as H&S can be a component of other courses and it does not capture the on-the-job instruction type learning. The highlighted courses are those that new employees undertake. Not included is the H&S induction that all new staff receive.

Wayne Wilson

HUMAN RESOURCES MANAGER

Attachment One

City Enterprises –Health and Safety Report, December 2017

Executive Summary

This report provides a high-level overview of the health and safety performance of City Enterprises for month end December 2017. The trends over the eight months to date are presented, together with a brief Quarterly Report at 2017-Q4.

· We are still performing very well against national benchmarks for Total Recordable Injuries and Lost Time Injuries per 200,000 hours worked.

· No Notifiable Incidents in the past 7 months.

· One new Lost Time Injury this month (duration 2 days).

· Quarterly, comparing 2017-Q4 to Q3, all benchmark trends are improving.

· People Safe system development and information input is making good progress.

Actions for further improvement include:

· Progressing input of staff training and skill set information to People Safe

· More timely input of data into People Safe from other recording systems

· Completing Standard Operating Procedures and other documentation

People Safe - Progress

Advances have been made with information entry for periodic staff training and equipment testing; work is ongoing. IT Business Solutions has assigned resources to implementing Microsoft Power BI for People Safe. When complete this will enable enhanced analysis and visualization to produce custom reporting and dashboards in People Safe.

Venues and Treatment Plants teams have been added to CE’s People Safe system and information is being filled out now. The teams are already fully integrated in terms of reporting. Staff training and skill set information has been held up by the summer break but is progressing.

National Benchmarks and Commentary

The following are key benchmarks from Zero Harm NZ’s Business Leaders’ Health and Safety Forum. More at http://www.zeroharm.org.nz/our-work/benchmarking/

City Enterprises is still performing very well compared to the national benchmark for all employers. Frequency of Total Recordable Injuries this month is the lowest in the 8-month reporting period to date and Lost Time Injuries is equal second lowest.

TRIFR = total medical treatment injuries, restricted work injuries, lost time injuries and fatal injuries.
Benchmark 2016 =
3.29 / 200,000 hours worked

LTI = where an injury prevents a return to work for 1 day/ shift or more.
Benchmark 2016 =
1.54 / 200,000 hours worked

Lost time amounted to 314 days, which includes pro rata adjustment from 231 days to reflect the 5.5 days’ staff leave over Christmas/ New Year. Of the original 231 days, 192 or 83% were due to just 3 staff members’ injuries dating back to mid-2017. We still have a small number of longstanding injuries accounting for a disproportionate number of days lost. However, overall City Enterprises is still consistently well below the national benchmark for LTI for all employers.

Notifiable Events

There were no Notifiable Events in the reporting period.

	This Month	6 Months to Date
Fatalities	0	0
Notifiable Incidents under H&S at Work Act 2015	0	0

Range of Incidents, Injuries and Near-hits

The graph below illustrates the range of incidents, injuries and near-hits encountered. It includes “general pain and discomfort”, which are reported through People Safe. This remains a significant issue; manual handling and lifting refresher courses are being maintained. The monthly totals continue to show a gradual reduction over time. The People Safe system’s introduction has raised staff awareness of Health and Safety issues.

Injuries by Activity Type

The graph below illustrates the range of injures by activity.

The reports have been updated to eliminate the use of categories, “other” and “unassigned”, which have been discontinued given the wide range of reporting options available.

The highest risk groups of activities in terms of injuries remains: working around vehicles; operating mobile plant and manual handling at (13+13+11+24) = 61%.

Staff training is focused accordingly. Vehicles and plant are well maintained through the on-site Garage service.
Quarterly Report

When full historic data are available, quarterly reports will provide the following:

1. The latest Quarter’s results

2. Comparison with previous Quarter

3. Comparison with the same Quarter from the previous year

4. 12 months to date

At the moment we have sufficient data for 1 and 2 above:

Quarterly Metric	Benchmark	2017 Q3	2017 Q4	Change, Q3 to Q4, %
Quarterly Metric	Benchmark	2017 Q3	2017 Q4	Change, Q3 to Q4, %
All Incidents (injury and non-injury); per 200,000 hours	-	3.79	1.89	-50
Total Recordable Injuries (TRIFR); per 200,000 hours	3.29	1.89	1.14	-40
Lost Time Injuries (LTI); per 200,000 hours	1.54	0.76	0.51	-33
Fatalities; number	-	0	0	0
Notifiable Incidents under H&S at Work Act 2015; number	-	0	0	0

All metrics are below national benchmarks and are trending downwards (improving).

PeopleSafe Metrics

We remain mindful that lagging indicators such as those in the previous section represent failure. They must be supplemented by other measures that provide positive assurance that good practices aimed at preventing injuries and incidents are implemented (leading indicators). PeopleSafe provides a number of metrics against which we can measure our preparedness. Our targets are summarized below and expanded upon in the following paragraphs.

	Up to Date
PeopleSafe Metric	Target, %	Complete, %	Comments
Stories	90	100	-
Gear	95	97	-
Safety Plans	95	-	Well progressed; initial documenting in process.
People	98	-	100% of staff in the system, but completing data entry of each staff member still in process.
Training	90	91	Some initial data entry still in process

Stories. 137 Stories have been told in the year to date, with 4 in the last month. None are awaiting review. This is 100% up to date.

Gear. We have 991 items logged in People Safe, sorted into 45 types ranging from heavy trucks to portable electrical appliances. To date 1120 scheduled checks have been done this year with 32 outstanding on laboratory equipment scheduled for disposal and 1 outstanding. That equates to (1087/ 1120) = 97% up to date. We have rationalised lifting equipment testing schedules to ensure they are synchronised annually and therefore more efficient and reliable to keep track of.

Safety Plans. This is a work in progress, because we need to document all of our plans in the People Safe system. Currently we have:

· Safety Plans: 17 completed, with 4 reviewed in the past month. 1 scheduled Safety Plan review is due in the next month.

· Risks: 142 total Risks documented, with 18 new Risks remaining to be reviewed.

· Arising from the above, we have 28 Plans and Actions needed; these are in process.

This is about the same rate of progress as last month. Once we have established our plans in the People Safe system we will aim to have 95% of all actions up to date at each month-end.

People. All 220 staff members in the teams that use People Safe are in the system. Completing all People information in the system is well progressed. When this is complete we will aim to have all People information 98% up to date at all times.

Training. The training for the Job Skillsets is in process of being completed. Once we have established our training records in the People Safe system we will aim to have 90% of all training actions up to date at each month-end. 1681 training tasks have been done in the year to date, with 1 in the last month. 147 training tasks are expired or not up to date. That’s (1498/ 1681) = 91% up to date. This is down from 94% this time last month, and may be accounted for by the Christmas/ New Year break.

Paul Compton

Logistics and Support Manager

09 January 2017

Appendix Two

Event	Mar 17	Jun 17	Sep 17	Dec 17
Accident and Event Investigation			12
BRANZ Bracing Seminar	2
Brushwood Chipper Training				11
Business First Line Management L4				1
Chainsaws Use and Safety	6
Collections Induction			5
Confined Space Entry				5
Dealing with Difficult People			17
Dealing with Mental Health			24
Defibrillator Training				20
Driver Assessment Training	12	17	18	2
Driver’s License – Class 1R (Restricted)				1
Driver’s License – Class 2L (Learners)		1
Driver’s License – Class 5L (Learners)		1
Driver’s License – Class 4L (Learners)		1		1
Driver’s License – Class 1 (Car License)	2	3	4	2
Driver’s License – Class 2 (Medium Rigid Vehicle)		2	3	3
Driver’s License – Class 3 (Medium Combination)				1
Driver’s License – Class 4 (Heavy Rigid)		1	3	2
Driver’s License – Class 5 (Heavy Combination)				1
Driver’s License – Class 6 (Motorcycle)			1
Elevated Working Platform (Scissor Lift and Boom)		7
Emergency Management CIMS4	1
Endorsement (D) Dangerous Goods		1
Endorsement (F) Forklift	2	1	1	4
Endorsement (R) Roller		6	3	3
Endorsement (T) Tracks		6	3	2
Endorsement (W) Wheeled Special Type		6	3	3
Fall Arrest System Refresher, Rope & Abseiling Refresher		5
First Aid Certificate	4	3	2	1
Forklift OSH Certificate	2	9	3
Harassment Prevention and Awareness				34
H&S at Work Act 2015 (The Journey)		8
How To: Tell Your Story		1
Internal Training – Basic Asbestos Induction	1	1
Internal Training – Easy Start Orientation		2	12	23
Internal Training - Collections Induction Video			8
Internal Training – Forklift SOP				6
Internal Training – Notifiable Events	2	1
Kerbside Collection Traffic Leader		4
Managing Performance Masterclass	3
Move at Work (Manual Handling)			32
NC in Sports Turf L5		1
NZ Certificate in Infrastructure Level 2				2
Playground Safety Inspections Level 2				2
Safe Work Zones	1
Site Induction Training: Collections	1
STMS Level 1 – Site Traffic Management	1	5	12
TC1 – Basic Traffic Controller Level 1		15	5	4
Tractor and LUV Training Level 2				6
Truck Loader Crane/Hi Ab			10	3
WCTL (Waste Collection Traffic Leader)		2

Total Number of Events	14	26	21	27
Total Number of Staff Attending	40	110	181	143

· Highlighted Courses are for new staff, in addition all new staff complete a H&S induction.

3. Compliance and administration

Does the Committee have delegated authority to decide? If Yes quote relevant clause(s) from Delegations Manual <Enter clause>	Yes
Are the decisions significant?	No
If they are significant do they affect land or a body of water?	No
Can this decision only be made through a 10 Year Plan?	No
Does this decision require consultation through the Special Consultative procedure?	No
Is there funding in the current Annual Plan for these actions?	No
Are the recommendations inconsistent with any of Council’s policies or plans?	No

Attachments

Nil

Wayne Wilson

Human Resources Manager

PALMERSTON NORTH CITY COUNCIL

Memorandum

TO: Audit and Risk Committee

MEETING DATE: 19 February 2018

TITLE: Internal Audit Plan 2018/19 (Year 2 of the 3 Year Plan)

DATE: 10 January 2018

AUTHOR/S: Vivian Watene, Senior Internal Auditor, City Corporate

RECOMMENDATION(S) TO Audit and Risk Committee

1. That the Committee note the recommended changes to the Internal Audit 2018/19 and 2019/20 Plans in paragraphs 8 and 9 respectively.

2. That the Committee endorse the Internal Audit 2018/19 Plan narrated in paragraphs 8 and 10.

ISSUE

1. To ensure Council’s activities are audited in a relevant and adequate manner, and that its internal audit activity complies with the Internal Audit Charter and the Management Team policies and procedure, the Committee is invited to receive this memorandum and consider its recommendations.

BACKGROUND

2. In February 2017, the Audit and Risk Committee approved the Internal audit 3 Year Plan 2017/18 to 2019/20.

3. The 3 Year Plan was the outcome of the stakeholders ranking exercise on a list of more than 70 possible audit projects from the audit universe. The stakeholders for this exercise were the Audit and Risk Committee members, the Management Team members and the Internal Audit staff.

4. A total of 92% of the stakeholders surveyed responded. This was a good respond rate.

5. The projects for year 1 (i.e. current year) are being delivered and on track to be fully completed by June 2018.

6. The projects for year 2 of the 3 Year Plan are listed below, with more details in Appendix A. The number in the brackets indicates the priority ranking of the stakeholders in February 2017 where the stakeholders have ranked for these particular projects to be carried out next in the Internal Audit Plan.

7. Recently the Management Team recommended some changes to the Years 2 and 3 of the Internal Audit 3 Year Plan. These changes and the reason for change are narrated below alongside the project proposed for change.

8. Internal Audit 2018/19 Plan – Year 2

1) Leased Carparks Revenue (10)

~~2) Arena Manawatu Revenue Collection Process Revenue (10)~~ -- Now in Year 3 i.e. 2019/20, because item 7) and item 8) below are relatively more urgent.

~~3) Capital Expenditure Plan (10)~~ -- Now in Year 3 i.e. 2019/20 because the Council’s Procurement, Contract Management, Project Management and Contract Tendering were recently subject to Internal Audit and/or External Audit reviews, this review will accrue more value to be carried out in Year 3.

4) Fixed Assets (10)

5) Animal Control Revenue Collection Process Review (10)

6) Grant/Subsidy Revenue (9)

7) IT Security (9) – Transferred from Year 3, together with IT Disaster Recovery, the reason being that the potential process improvements emanate from these two audit reviews will inform the PNCC Digital Transformation Project which is aimed to enhance the customer interface.

8) IT Disaster Recovery (8) – Transferred from Year 3. Refer to item 7) above for the reason to change.

9. Internal Audit 2019/20 Plan – Year 3:

1) Councillor Payments (9)

2) ~~IT Security (9)~~ -- Now in Year 2 i.e. 2018/19, refer to item 7) on the above paragraph for the reason to change.

3) Commercial Property Rental Revenue (8)

4) Convention Centre Revenue (8)

5) Customer Service Centre Cash Collections (8)

6) ~~IT Disaster Recovery (8)~~ -- Now in Year 2 i.e. 2018/19, refer to item 7) on the above paragraph for the reason to change).

7) External Quality Assessment on Internal Audit Activity (Mandatory to meet the International internal Auditing Standards)

8) Arena Manawatu Revenue Collection Process Revenue (10) – Transferred from Year 2. Refer to paragraph 8 for the reason.

9) Capital Expenditure Plan (10) – Transferred from Year 2. Refer to paragraph 8 for the reason.

10. The Management Team also reconsidered the following previously approved yearly routine audit projects with no changes made. These routine audit projects are as follows:

1) Weekly payroll master file changes review

2) Follow Up on the agreed corrective actions on the past internal audit reviews

3) Accounts Payable and Receivables Data Analysis

4) Credit Cards and Sensitive Expenditure Payments

5) Staff Disbursements & Payments

6) Cash Spot Checks

7) Journals (Authorisations and supporting documents)

8) Miscellaneous sample checks

11. For completeness, the Audit Universe that the stakeholders used for the ranking exercise is in Appendix B for information. Appendix B includes the relevant year the projects were reviewed.

NEXT STEPS

12. As usual, this Committee will receive progress reports on the Internal Audit 2018/19 Plan 6 monthly.

Compliance and administration

Does the Committee have delegated authority to decide? If Yes quote relevant clause(s) from Delegations Manual <Enter clause>	Yes
Are the decisions significant?	No
If they are significant do they affect land or a body of water?	No
Can this decision only be made through a 10 Year Plan?	No
Does this decision require consultation through the Special Consultative procedure?	No
Is there funding in the current Annual Plan for these actions?	Yes
Are the recommendations inconsistent with any of Council’s policies or plans?	No

Attachments

1.	Internal Audit 2018/19 Plan - Appendix A Detail 2018/19 Plan ⇩
2.	Internal Audit 2018/19 Plan - Appendix B Audit Universe and Year of Audit ⇩

Vivian Watene

Senior Internal Auditor

PALMERSTON NORTH CITY COUNCIL

Memorandum

TO: Audit and Risk Committee

MEETING DATE: 19 February 2018

TITLE: Risk Management Progress - YTD December 2017

DATE: 18 January 2018

AUTHOR/S: Vivian Watene, Senior Internal Auditor, City Corporate

RECOMMENDATION(S) TO Audit and Risk Committee

That the Committee note:

1. Management’s risk management progress made to the Strategic and Operational Risk Profiles.

2. The Year-to-Date Residual Risk status for the key Strategic and Operational risks.

ISSUE

1. To inform the Committee on Management’s risk management Year-to-Date December 2017 progress as outlined on Appendixes A and B for the key Strategic Risks and Appendix C for the key Operational Risks.

2. To also inform the Committee Management’s Residual Risk reassessment on these risks.

BACKGROUND

3. The Operational Risk Profile and Strategic Risk Profile are monitored quarterly and 6 monthly respectively by the Management Team and by the Audit and Risk Committee on a 6 monthly basis.

4. The Council reviews the Strategic Risk Profile 3 yearly in alignment with the Council’s 10 Year Plan planning cycle. The Operational Risk Profile is reviewed annually at the end of each financial year.

5. This Memorandum gives this Committee Management’s risk management progress on both the Strategic and Operational risks.

Strategic Risks (Appendixes A and B)

6. Appendix A is the Strategic Risk Profile. As usual, it outlines the risk description, gross risk and residual risk, and risk treatments, what would success look like, among other details.

7. Appendix B, supplied by the City Future and City Corporate Units, describes the risk management progress at 30 months in Strategic Risks originally identified in August 2015. The progress is described under the headings of Current Situation, Council Actions and the Likely Future Outcomes.

8. Residual Risk for Risks 79 and 81 has shifted to a lower risk level. Residual Risk for Risks 76, 77 and 80 has not moved significantly from when they were last reported 6 months ago in August 2017. (Refer to the Table 1 below for the Risk Description and the reasons for the risk movement in these risks)

9. From Appendix B, the Table 1 below extracted the main reasons for the progress in the risk levels.

Table 1

Risk #	Risk Description	Comment
76a	Poor City image and reputation (from the outsiders’ perspective)	Not changed significantly from what was reported 6 months ago, though the domestic and international visitors spending in the year ended October 2017 has increased by 2.6% from October 2016.
76b	Poor City image and reputation (from the residents’ perspective)	No indication that the risk has shifted from what was reported in the past.
77	Lack of Vibrancy in the CBD	No indication that the risk has shifted from what was reported in the past.
79	Decline in City economy and jobs	Residual risk has shifted to a lower level because Job numbers such as in construction, jobs transfer and relocating to the City projected to continue to grow. The Gross Domestic Product (GDP) growth rate and retail growth rate in Palmerston North are greater than the national growth rates.
80	Low Level of community trust and engagement with Council	Not changed significantly from what was reported 6 months ago though the Council has continued to improve and increase its online interface with the community.
81	Council’s Financial Position is not sustainable	Residual risk has shifted to a lower level as $36m additional to the budgeted loan repayments have been repaid since 2013.

10. The Strategic Risk Matrix below shows:

· the Gross Risk (at August 2015) 77

· Residual Risk reassessed at 30 months (at 31th December 2017)

· the forecasted Residual Risk (at 30 June 2018)

11. The organisation will continue to aim toward the forecasted June 2018 residual risk status for these 5 key Strategic Risks.

Operational Risks (Appendixes C)

12. Updated by the managers assigned to manage these risks, Appendix C is the year to date risk treatment progress on the 4 key Operational risks. It also includes the Gross Risk, the Residual Risk i.e. after the risks are successfully treated and what the success would look like.

13. At the reporting period, the residual risk for all 4 key operational risks has not moved to their forecasted Residual Risk year end position. The Table below gives the main reasons.

Table 2

Risk #	Risk Description	Comment
15	Council does not deliver the capital (new and renewal) programmes within approved scope of works, planned timeframes and budget	Although several vacant positions were filled and external consultants were engaged to assist with progressing with the capital works, the effect of these is yet to be realised.
48	Council's infrastructural assets are not managed in accordance with the adopted Asset Management Plans (AMPs) and/or granted Resource Consents	Due to various reasons approximately $17m renewal budget has been underspent since 2013. At the reporting period, the renewal capital expenditure for 2017/18 is behind the planned timeline.
58	PNCC is not meeting its responsibilities for an emergency or a civil defence emergency event because it is unable to deliver the basic services	The organisation’s Business Continuity Plans (BCPs) are being finalised. The final product is yet to be endorsed by the Management Team before the communication and the training of the Plans are provided to the relevant staff.
59	Council's activity preparation in key areas does not align to the Long Term Plan (Long Term Plan) programmes approval and budget processes and vice versa	The Information Management Strategic Plan (IMSP) is being finalised. The Management Team has decided the IMSP will now form a subset of the new proposed project ‘PNCC Digital Transformation Project’ which aims to enhance customer interface.

14. The Operational Risk Matrix below shows:

· the Gross Risk (at August 2017)

· Residual Risk reassessed at 6 months (at 31th December 2017)

· the forecasted Residual Risk (at 30 June 2018)

NEXT STEPS

15. To inform this Committee Management’ risk management 6-month progress in August 2018.

Compliance and administration

Does the Committee have delegated authority to decide? If Yes quote relevant clause(s) from Delegations Manual <Enter clause>	Yes
Are the decisions significant?	No
If they are significant do they affect land or a body of water?
Can this decision only be made through a 10 Year Plan?	No
Does this decision require consultation through the Special Consultative procedure?	No
Is there funding in the current Annual Plan for these actions?	Yes
Are the recommendations inconsistent with any of Council’s policies or plans?	Yes

Attachments

1.	Appendix A Strategic Risk Profile ⇩
2.	Appendix B Strategic Risk Profile Report Dec 2017 ⇩
3.	Appendix C Operational Risk Profile ⇩

Vivian Watene

Senior Internal Auditor

PALMERSTON NORTH CITY COUNCIL

Memorandum

TO: Audit and Risk Committee

MEETING DATE: 19 February 2018

TITLE: Internal Audit 2017/18 Plan Progress - YTD December 2017

DATE: 18 January 2018

AUTHOR/S: Vivian Watene, Senior Internal Auditor, City Corporate

RECOMMENDATION(S) TO Audit and Risk Committee

1. That the Committee note the progress of the Internal Audit 2018/19 Plan.

ISSUE

1. In accordance with the Internal Audit Charter, this Memorandum informs the Committee about the outcomes and findings of the Internal Audit activities.

BACKGROUND

2. The Internal Audit Charter stipulates that this Committee be informed 6 monthly on the Internal Audit progress and findings.

Progress Status

3. Appendix A is a schedule of the 2017/18 projects and their progress status.

4. Overall Management has agreed to implement 85% (last reported 77%) of the Internal Audit suggested improvements. This is a satisfactory outcome.

5. Internal Audit has completed 4 out of 7 reviews from the 2017/18 Internal Audit Plan as follows:

1) Earthquake Strengthening (reported to this Committee in November 2017)

2) Accounts Receivable and Aged Debtors (reported to this Committee in November 2017)

3) Landfill Revenue Collection (Appendix B to this Memorandum)

4) Contract Tendering (Appendix C to this Memorandum)

6. The Landfill Revenue Collection audit objective was to review the processes to calculate, collect and record revenues with a particular focus on the controls surrounding the cash handling.

7. The audit found that some of the cash handling processes do not comply with Management’s Cash Handling Policy (MT81) and that there was no assurance that the revenue collected from the recycled glass sale is complete. Management has agreed to implement more than 80% of the audit suggested process improvements.

8. The Contract Tendering audit report appended to this Memorandum was to provide assurance over the level of compliance of Council’s Tendering processes to the Management Team policies, good practice guidelines and that it meets the New Zealand Transport Authority requirements.

9. The audit found that the Council’s Contract Tendering process is generally open, fair and accountable. However the audit has identified some 19 issues for Management’s attention. Management has agreed to implement more than 80% of the audit suggested process improvements.

10. The following paragraphs give a summarised update on the Internal Audit Routine Reviews from the 2017/18 Internal Audit Plan.

11. Accounts Payable and Receivable data were analysed for anomalies. We have satisfactorily resolved the issues surrounding the invoices paid. Goods and Services Tax treatments on rental revenue were tested, and the validity of the staff listed on the accounts payable authorisation table examined. Issues identified were brought to Management for attention.

12. The brainstorm sessions entitled ‘Can We Beat the Systems?’ started in August 2016 with City Corporate and Customer Services Units, is continuing this financial year involving City Enterprises. The brainstorm sessions have several benefits:

· creating fraud awareness

· generating ideas on how to fix up the gaps/weakness identified and,

· enhancing the existing processes from the grass root levels.

13. The gaps and weaknesses identified during the above mentioned brainstorming sessions that are urgent and critical have been rectified. Other improvements to the existing internal controls have either been implemented or will be put into practice. The brainstorm sessions are documented for follow-up, where appropriate.

14. We envisage the ‘Can We Beat the Systems?” brainstorm sessions will continue to cover the rest of the Council Units.

15. Management continues to carry out cash spot-checks on the Council’s cash handling sites. This is a good business practice. With the closure of Bunnythorpe Transfer Station on 12 August 2017, the previously identified issues related to this cash handling site, where the Operator was using private cash as cash float, the Transfer Station had no electricity supply, cash register and EFTPOS machine etc., now disappeared.

16. Internal audit conducted its own spot check at four of the Council’s cash handling sites. It found that these sites were not fully complying with the Council’s Management Team Cash Handling Policy (MT81). Internal Audit noted other process gaps and recommended some initiatives to Management for process improvements. Many recommendations have been implemented. Internal Audit will continue to conduct spot checks and follow up previous recommendations.

17. Internal Audit noted from the sample of credit card payments that a majority of the credit card holders accounted for their credit card expenses in a relatively timely manner. No exceptions were noted in the audit samples.

18. As part of the audit routine, Internal Audit sampled staff expense reimbursements. The audit noted issues which had been previously forwarded to Management for attention. The issues identified were as follows:

· business purpose for some expenses not clearly stated,

· expenses authorised but not by someone who has a delegated authority,

· some expenses authorised but not by the General Manager as stipulated by the Management Team’s Expense Policy (MT18),

· Goods and Services Tax (GST) document not enclosed, and

· GST document enclosed but GST input tax not claimed.

19. Internal Audit sampled some journal transactions for September 2017 from our accounting system. More than 90% (or 23 journals out of 25 sampled) met the agreed criteria. This was a good outcome.

20. The weekly/fortnightly Payroll master file changes continued to be audited throughout the period. Occasional payroll clerical errors were made but were all subsequently rectified. Audit also identified some potential non-compliance in the recruitment method to the Council’s recruitment strategy. This has been brought to Management’s attention.

21. Internal Audit Reviews Follow Up on the previously Management agreed to implement corrective actions/process improvements:

· Appendix D is a schedule of suggested improvements by Internal Audit from previous audit reviews. It includes those recommendations that Management has missed the agreed implementation timeline by 6 months or longer. Several items have been removed from the schedule as they have been implemented. However, some new items have been added.

· Appendix E is a schedule of issues raised by Audit New Zealand and detailed in their final management report to the Council received in November 2017. The Schedule contains the Management agreed actions and the implementation progress status updated by Management on the agreed actions, among other details. The Schedule includes only those items requiring action.

NEXT STEPS

22. Complete the rest of the 2017/18 Internal Audit Plan.

Compliance and administration

Does the Committee have delegated authority to decide? If Yes quote relevant clause(s) from Delegations Manual <Enter clause>	Yes
Are the decisions significant?	No
If they are significant do they affect land or a body of water?	No
Can this decision only be made through a 10 Year Plan?	No
Does this decision require consultation through the Special Consultative procedure?	No
Is there funding in the current Annual Plan for these actions?	Yes
Are the recommendations inconsistent with any of Council’s policies or plans?	No

Attachments

1.	Appendix A Internal Audit 2017/18 Plan Progress Status ⇩
2.	Appendix B Internal Audit - Landfill Revenue Collection Process ⇩
3.	Appendix C Internal Audit - Contract Tendering Process ⇩
4.	Appendix D Manageemnt Corrective Actions - Timeline Missed ⇩
5.	Appendix E External Audit - Recommendations Implementation Progress ⇩

Vivian Watene

Senior Internal Auditor

Vaughan Dennison (Chairperson)
Bruno Petrenas (Deputy Chairperson)
Grant Smith (The Mayor)
Susan Baty	Lew Findlay QSM
Adrian Broad	Jim Jefferies
Gabrielle Bundy-Cooke	Lorna Johnson