Shetland
Islands Council
INTERNAL AUDIT REVIEW
To:
Resources Manager
cc:
Head of Service – Community Care
Head of Service – Children’s Services
Executive Director – Education & Social Care
Head of Finance
Chief Executive
cfi:
Expenditure Manager
From:
Service Manager - Internal Audit
Confidential
Webroster
1. Executive Summary
The auditee is the Resources Manager, Education and Social Care. Initially this was a
scheduled systems review of Webroster, however the remit was expanded due to
concerns expressed by the Expenditure Manager in relation to significant payroll
overpayments.
The Key concerns are:
The monitoring of relief staff working hours and short term contractual arrangements are
not adequately managed and administered. Accordingly there is no assurance that a duty
of care and working time regulations are being observed. This concern was raised in a
previous investigation in 2007 and has not been addressed.
Whilst Webroster appears to deal with the complexities and requirements of the Social
Care rota, there are a significant number of issues of concern compounded by a worrying
lack of checks within the system and the surrounding procedures.
There is insufficient evidence of controls surrounding the authorisation of additional hours
and relief work and the final data to be input to Webroster. This results in overpayments
and budget implications.
The current practices are too complex and have no methods of reconciliation,
therefore there is no assurance that the resulting financial output i.e. the payroll, is
correct.
It is disappointing to note that issues raised in previous audits and investigations
undertaken by this Service are still prevalent and have not been adequately addressed.
(See para 4.4 below).
Page 1 of 5
2. Audit Scope / Background
2.1 This is an audit of Webroster which is a time management and rostering
software solution. The main functionality of the system is for the
scheduling of social care workers delivering personal and domestic care to
clients living in their homes. In 2009 it was agreed that payroll information
for all care at home and residential staff would be processed through
Webroster and uplifted through an interface from Webroster to the CHRIS
system.
2.2 Initially it was envisaged that this would be a systems review covering
access controls, licensing arrangements, audit logs, password
management, authorisation procedures and accuracy of interface uplift.
However, in July 2010 the Expenditure Manager raised concerns
regarding the occurrence of significant overpayments to Social Care staff
which brought into question the system, procedures, authorisation and
controls surrounding the Social Care payroll. In addition, Management
Accountancy has identified significant variances in payroll expenditure
from May to June 2010. Payroll expenditure was up £15k in two units and
£20k in another. Taking these issues into consideration, the Resources
Manager, Education & Social Care requested Audit to expand the review
to include the processes and controls surrounding Webroster.
2.3 Given the complexity and extent of this review it is not considered
appropriate to provide the detailed findings within this report, however, a
working paper was prepared for the Resources Manager that provides
details of the findings with examples.
2.4 It is recognised that there has been a huge learning curve for the Unit
Administration staff within the last few months and it is evident that staff
are becoming more aware of the consequences of incorrect postings on
the systems etc. Audit are aware of the desire on the part of staff to get it
right.
3. Audit Findings
3.1 There is insufficient evidence of controls surrounding the authorisation of
additional hours and the final data to be input to Webroster. Paper rotas
are not signed off and changes to the paper rota are not authorised or
initialled.
3.2 Segregation of duties is insufficient. Unit Administration staff process from
cradle to grave, covering input, changes, verification and submission of
adjustments.
3.3 Contract Adjustment sheets are not authorised by the Unit Managers.
3.4 There are no audit logs and therefore the system is susceptible to fraud
and malicious damage without reliable trace. Because of multiple
contracts, it is common practice for numerous Units to have access to
shared employee data.
Page 2 of 5
3.5 Hours are regularly allocated to the wrong contract, sometimes through
human error but also routinely because the relevant contract is not on the
system. This does have payroll repercussions, adjustments sheet
problems and budgeting implications.
3.6 There are some technical timing issues and communication issues in
relation to updating Webroster information.
3.7 Monitoring relief staff working hours and practices is insufficient. Duty of
care and working time regulations etc are possibly not being adhered to.
3.8 Information is not being submitted to Staffing and Webroster
Administration from the Units within sufficient timescales and therefore
significant and numerous overpayments are being made. The procedures
surrounding granting and backdating relief staff short-term contracts are of
particular concern.
3.9 Unit Administration staff are not always informed of contractual changes
promptly by Unit Management.
3.10 Housekeeping on both CHRIS and Webroster requires to be streamlined
as at present there are over 1,000 relief staff recorded on CHRIS and
many relief contracts recorded on Webroster that could be ended.
3.11 The Licensing arrangements for Webroster could not be clarified. There
are over 150 registered authorised users of Webroster.
4. Concerns and Risks
4.1 Whilst Webroster appears to deal with the complexities and requirements
of the rota, there is significant lack of control within the system and the
surrounding procedures. There are also no reconciling processes and
therefore no assurance that the financial output is correct resulting in
overpayments and budgeting issues.
4.2 Significant overpayments have been identified. These are due to:
 recruitment processes, specifically the transition from relief to
contracted status
 lack of communication
 documentation flow
 contract recording on Webroster and
 human error
4.3 There are no controls over relief hours worked by individuals e.g. it is
technically feasible for an individual to undertake consecutive shifts ad
infinitum at different care units throughout the Council. Currently
Individuals move from one shift to another unit without a break.
Page 3 of 5
4.4 Previous Audit of Social Care 2007
The following is an extract from the Social Care Audit follow up report
issued in March 2008.
3.2 It is disappointing to report that very few issues have been fully
addressed. Internal Audit does acknowledge that the prime concern for
Social Care managers is the welfare of their clients. However, outwith
this prime area of responsibility managers are also paid to ensure that
administrative, human resource and financial matters are adequately
addressed. It would appear some managers do not appreciate the
importance of this. The significance of this requires to be enforced by
senior management with training implemented to address
shortcomings. This has to be more than simply forwarding or
communicating a written procedure and expecting implementation, with
no checks to ensure observance.
This review of Webroster and associated payroll procedures demonstrates
that controls over human resources and financial matters are still not
being adequately managed by Management within Social Care.
5. Recommendations
5.1 Given the scope of the issues surrounding the engagement of relief
workers, the use of short term contracts, Webroster processes, security,
the lack of assurance and the significant overpayments identified, a
comprehensive review / LEAN project should be undertaken to cover the
following areas:












Service requirements
Application of contractual requirements, obligations, pensionable
rights etc
The engagement of real reliefs (Review NHS systems)
Links to and from the existing recruitment processes
Working time directives
Authorisation procedures
Investigate CHRIS Electronic Timesheet capabilities
Documentation flow
Systems requirements / Audit Logs
Webroster capabilities and reporting facilities
Security, Control & Licensing arrangements
Reconciliation processes
Page 4 of 5
5.2 In the absence of a comprehensive review, Audit recommends as a
minimum the following:
 Centralise administration, engagement, control and monitoring of
relief staff
 Introduce authorisation procedures and therefore responsibility
throughout the processes e.g. for additional hours, change of
contracts, the paper rotas and adjustment sheets etc
 Prohibit backdating contracts
 Review information and documentation flow
 Introduce precise guidance in order to achieve consistency with
regard to allocation of hours to specific contracts
 Investigate / develop reporting facilities on Webroster
 Carry out a housekeeping exercise on both Webroster and CHRIS
 Review current licensing arrangements
 Review the Webroster Training Manual and update it to include
standard checklists / spreadsheet requirements e.g. relief annual
leave calculations.
6. Other Observations
6.1 We would like to take this opportunity to thank all staff for the time,
patience and assistance afforded to Internal Audit during the course of the
audit assignment. The positive attitude shown by staff was much
appreciated during the audit.
6.2 This audit will be followed up in approximately twelve (12) months time
when areas of concern identified will be reviewed.
7. Auditee Response
7.1 The Auditee has responded as follows:
I have responded to the issues raised in this report in a separate
document (attached as Appendix 1). This will go some way to rectifying
some of the issues, however, this does not address the fundamental one
of why we do our business in this way. I stand by the comments I made in
my paper on the subject to the Head of Finance, which was to be
discussed by the Executive – essentially, a fundamental review (as
recommended in 5.1 above) of our business processes is required and I
would urge the Executive to give that serious consideration. The status
quo is simply not sustainable.
Date: 24th August 2010
Report No: IAR/SC Systems/Webroster
Page 5 of 5