Attachment 2
Internal Audit Report
October 2015
City of Vincent
www.moorestephenswa.com.au
Contents
1.0
Disclaimer
3
2.0
Engagement Overview
4
3.0
Overview and Results of Testing Performed
5
4.0
Summary of Risks Identified
14
5.0
Response Matrix
16
Appendix One: Risk Assessment Table – Level of Risk
23
Appendix Two: Likelihood Levels-Criteria Guide
24
Appendix Three: Consequence Levels–Criteria Guide
25
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS | 2
1.0 DISCLAIMER
The objective of the work we have performed as outlined in Part 2 of this report as presented, was to
provide internal audit services to the City of Vincent, as directed by the officers of the City.
It has been prepared by Moore Stephens for this sole purpose
It is not intended to be used by any other individual or organisation.
Confidential - this document and the information contained in it are confidential and should not be
used or disclosed in any way without our prior consent.
© 2015 Moore Stephens. All rights reserved.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS | 3
2.0 ENGAGEMENT OVERVIEW
INTRODUCTION
At the request of the City, Moore Stephens was engaged to provide internal audit services. This
consisted of a review of the appropriateness and effectiveness of certain financial management
systems and procedures.
OBJECTIVE AND SCOPE
As detailed in the quotation specification, our response to the quotation request and the references
made in the final contract agreed upon by both parties, the objective of the internal audit is outlined
as follows:
OBJECTIVE
To review the appropriateness and effectiveness of the City’s financial management systems and
procedures by undertaking sectional reviews each year as selected and directed by the designated
officers of the City.
SCOPE
For the 2014/15 year, our procedures focused on the following key control areas as specified by the
City of Vincent Audit Committee four year Internal Audit Programme;




Rates
Payroll
Fringe Benefits Tax
Petty Cash and Floats
APPROACH / METHODOLOGY
The process included:



Initial discussions with relevant staff to identify existing policies and procedures in place;
Detailed sample testing and review of relevant documents as applicable; and
Provision of a draft report to the Director Corporate Services.
The results of our procedures, report on work performed, along with management responses and
target resolution dates can be found at Sections 3.0 and 4.0 on the following pages.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS | 4
3.0 OVERVIEW AND RESULTS OF TESTING PERFORMED
KEY CONTROL
AREA EXAMINED
SAMPLE SIZE
TESTING APPROACH
RESULTS
FINDINGS
Ten annual rate
notices and five
interim notices
were judgmentally
selected for
testing.
Performed a walkthrough of
the rates procedures with
the Senior Rates Officer
(SRO) and tested the sample
of rates notices
judgmentally selected to
ascertain the system and
procedures followed from
the raising of rate notices
through to the collection of
rates.
Transactions identified in rates were consistent
with the procedures and methods discussed.
Reviewed the
reconciliation of
the Landgate full
revaluation roll to
the rates system.
Performed a review of the
reconciliation of the
Landgate full revaluation as
at 01 July 2014 to the rates
system.
The reconciliation of the Landgate full revaluation 3.1.2
as at 01 July 2014 to the rates system reconciled
however there was no evidence of review by a
senior officer.
3.1 Rates
CITY OF VINCENT
INTERNAL AUDIT REPORT
3.1.1
During our review of the rates procedures and
discussions with management, we noted the
written procedures were not formalised and
based on an organisation wide standard
template.
Rates procedures should be documented
based on an organisation wide template. The
procedures should be reviewed and updated
as required.
This will allow employees to clearly
understand their roles and responsibilities
within predefined limits and allow
management to guide operations without
constant management intervention, as well as
help ensure staff involved give due
consideration to appropriate risk management
for processing rates.
A hardcopy of the reconciliation should be
should be signed and dated by the preparer
before being reviewed by a senior officer. The
senior officer should sign and date the
reconciliation as evidence of having been
reviewed.
MOORE STEPHENS
|5
3.0 OVERVIEW AND RESULTS OF TESTING PERFORMED (CONTINUED)
KEY CONTROL
AREA EXAMINED
3.1 Rates
(continued)
CITY OF VINCENT
INTERNAL AUDIT REPORT
SAMPLE SIZE
TESTING APPROACH
RESULTS
Reviewed the latest
manual rolling
reconciliation of rate
valuations between
the rates system and
the valuation rolls
received from
Landgate.
Performed a review of the
manual rolling
reconciliation of rate
valuations between the
rates system and the
valuation rolls received
from Landgate as at 17
March, 2015.
The latest manual rolling reconciliation of rate
valuations between the rates system and the
valuation rolls received from Landgate reconciled
as at 17 March, 2015. No discrepancies were
noted however, whilst the SRO reviews a soft
copy of each reconciliation prepared by the
Interim Rates Officer (IRO), there is no hard copy
of the reconciliation and as such, there is no
evidence of review.
FINDINGS
3.1.3
Each reconciliation should be printed out
and the interim schedules from the VGO
attached to it. The reconciliation should be
signed and dated by the preparer before
being reviewed by a senior officer. The
senior officer should sign and date the
reconciliation as evidence of having been
reviewed.
MOORE STEPHENS
|6
3.0 OVERVIEW AND RESULTS OF TESTING PERFORMED (CONTINUED)
KEY CONTROL
AREA EXAMINED
SAMPLE SIZE
TESTING APPROACH
RESULTS
FINDINGS
3.2 Payroll
Judgmentally
selected 22
employees for
testing, of which 2
employees were new
employees and 2
employees were
terminated during
the period 01 July
2014 to 28 February
2015.
A sample of 18 individual
employees was judgmentally
selected and testing performed
to ensure:
 the employee existed;
 the correct rate of pay was
used;
 non-statutory deduction
authorities are on hand;
 time sheets are properly
completed and authorised;
 hours worked are authorised;
and
 allocations are reasonable
and correctly posted.
Based on our testing and review, procedures
appeared to be followed and applied
consistently with the following exceptions: Changes to employees’ details (in particular
banking details) in the system were not
adequately supervised.
3.2.1
To help ensure ALL changes to
employees’ details in the system are
correct and hence all payments are
bona fide, a senior staff member
independent of processing should
review a system generated audit trail
report showing all changes made to
the respective system master files.
The independent review should seek
to confirm the integrity of the details
in the system for the subsequent
creation of the ABA file and should be
evidenced accordingly.
The payroll system was also
reviewed to determine if
adequate controls were in place
to help ensure wages and salaries
are properly processed and
payments are properly
controlled.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS
|7
3.0 OVERVIEW AND RESULTS OF TESTING PERFORMED (CONTINUED)
KEY CONTROL
AREA EXAMINED
3.2 Payroll
(Continued)
SAMPLE SIZE
TESTING APPROACH
RESULTS
3.2.2
 The ABA file is not uploaded immediately
onto the banking system after it has been
created and the integrity of the banking
details in the ABA file are not checked
against an exception report after it has been
uploaded onto the banking system.
The above may result in unauthorised
changes to banking details in the ABA file
between the time it is created and finally
uploaded
CITY OF VINCENT
INTERNAL AUDIT REPORT
FINDINGS
To help ensure all payments made
are bona fide and appropriately
authorised, the ABA file should be
uploaded immediately onto the
banking system after it is created.
A senior staff member independent
of processing should then check the
payment details on the banking
system against the payroll report.
The independent review should seek
to confirm the integrity of the details
in the ABA file prior to payments
being released and should be
evidenced accordingly.
MOORE STEPHENS
|8
3.0 OVERVIEW AND RESULTS OF TESTING PERFORMED (CONTINUED)
KEY CONTROL
AREA EXAMINED
3.2 Payroll
(continued)
SAMPLE SIZE
TESTING APPROACH
RESULTS
 Written payroll procedures were not
formalised and based on an organisation
wide standard template.
FINDINGS
3.2.3
Payroll procedures should be
documented based on an
organisation wide template. The
procedures should be reviewed and
updated as required.
This will allow employees to clearly
understand their roles and
responsibilities within predefined
limits and allow management to
guide operations without constant
management intervention, as well as
help ensure staff involved give due
consideration to appropriate risk
management for processing the
payroll.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS
|9
3.0 OVERVIEW AND RESULTS OF TESTING PERFORMED (CONTINUED)
KEY CONTROL
AREA EXAMINED
3.3 Fringe Benefits
Tax (FBT)
CITY OF VINCENT
INTERNAL AUDIT REPORT
SAMPLE SIZE
A FBT checklist was
used to assess the
effectiveness of
Council’s FBT
processes.
Judgementally
selected several
employee driven
vehicles subject to
FBT as well as
entertainment
expenses subject to
FBT and conducted
tests to ensure the
FBT calculations for
the year ended 31
March 2014 were
properly calculated
in line with the
requirements of the
ATO.
TESTING APPROACH
Conducted a review of the FBT
procedures using a FBT checklist
and tested samples to ensure
compliance with the ATO FBT
legislation.
RESULTS
Based on our review and testing, the following
exceptions were noted: Council has incorrectly used two different
methods for calculating the FBT on
Entertainment expenses (by way of food
and drink).
FINDINGS
3.3.1
To comply with the requirements of
the ATO only "one" of the available
methods of calculating FBT should be
used for all entertainment expenses
(by way of food and drink).
The ‘50/50’ method was used to calculate
the FBT on Council ‘Functions
Entertainment’ expenses whilst the ‘Actual’
method was used for calculating the FBT on
‘EMT Entertainment’ expenses.
MOORE STEPHENS
| 10
3.0 OVERVIEW AND RESULTS OF TESTING PERFORMED (CONTINUED)
KEY CONTROL
AREA EXAMINED
3.3 Fringe Benefits
Tax (FBT)
(continued)
SAMPLE SIZE
TESTING APPROACH
RESULTS
 As Council expects to use one method of
calculating FBT on tax-exempt body
entertainment and at year end the Council
may use another calculation method then
they will be required to process an
adjustment to the Business Activity
Statement (BAS).
This adjustment did not take place for the
2013/14 FBT return.
FINDINGS
3.3.2
Entities can only claim input tax
credits on deductible entertainment
expenditure and entertainment
expenditure that is subject to FBT. If,
throughout the year, entities expect
to use one method of calculating FBT
on tax-exempt body entertainment
and at year end the entities use
another calculation method then
they will be required to process an
adjustment to the Business Activity
Statement (BAS).
"Input Tax Credits" on Entertainment
by way of food and drink should not
be claimed during the year. Instead,
they should be claimed once the FBT
return has been completed and only
on deductible entertainment
expenditure and entertainment
expenditure subject to FBT.
This will help ensure the correct
‘Input Tax Credits’ are claimed in line
with ATO requirements.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS
| 11
3.0 OVERVIEW AND RESULTS OF TESTING PERFORMED (CONTINUED)
KEY CONTROL
AREA EXAMINED
3.3 Fringe Benefits
Tax (FBT)
(continued)
SAMPLE SIZE
TESTING APPROACH
RESULTS
 There were no written FBT procedures in
place.
FINDINGS
3.3.3
FBT procedures should be
documented based on an
organisation wide template. The
procedures should be reviewed and
updated as required.
This will allow employees to clearly
understand their roles and
responsibilities within predefined
limits and allow management to
guide operations without constant
management intervention, as well as
help ensure staff involved give due
consideration to appropriate risk
management for processing FBT data
and preparing the FBT annual return.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS
| 12
3.0 OVERVIEW AND RESULTS OF TESTING PERFORMED (CONTINUED)
KEY CONTROL
AREA EXAMINED
3.4 Petty Cash &
Cash Floats
CITY OF VINCENT
INTERNAL AUDIT REPORT
SAMPLE SIZE
Approximately 70%
of all cash floats
were judgementally
selected and
counted.
TESTING APPROACH
We examined the petty cash
system and procedures and
counted approximately 70% of all
cash floats.
RESULTS
The examination of the petty cash system and
procedures concluded these were being
properly controlled and maintained with the
following exception: The actual cash floats at the Beatty Park
Leisure Centre did not reconcile to the
balances in the general ledger. The net
effect was a $200 cash shortage.
FINDINGS
3.4.1
Petty cash and cash floats should be
reconciled to the general ledger on a
monthly basis. This will help ensure
cash floats are correctly reflected in
the general ledger.
MOORE STEPHENS
| 13
4.0 SUMMARY OF RISKS IDENTIFIED
The following is a summary of risks identified during the course of the internal audit and highlighted in Section
5.0 Response Matrix.
S
C
Systems and Procedures
Compliance Matter
FINDINGS
Rates (3.1.1)
That Rates procedures should be documented based on
an organisation wide template.
Rates (3.1.2)
That a hardcopy of the reconciliation of the Landgate
full revaluation as at 01 July 2014 to the rates system
be signed and dated by the preparer before being
reviewed by a senior staff member independent of
preparation and evidenced as such.
Rates (3.1.3)
That a hardcopy of the manual rolling reconciliations of
rate valuations between the rates system and the
valuation rolls received from Landgate be signed and
dated by the preparer before being reviewed by a
senior staff member independent of preparation and
evidenced as such.
Payroll (3.2.1)
That changes to employees’ details (in particular
banking details) in the payroll system be adequately
supervised.
Payroll (3.2.2)
That the ABA file be uploaded immediately onto the
banking system after it is created and an independent
review should seek to confirm the integrity of the
details in the ABA file prior to payments being released
and should be evidenced accordingly.
Payroll (3.2.3)
That payroll procedures should be documented based
on an organisation wide template.
Fringe Benefits Tax (FBT) (3.3.1)
That only "one" of the available methods of calculating
FBT be used for all entertainment expenses (by way of
food and drink) in order to comply with the
requirements of the ATO
Fringe Benefits Tax (FBT) (3.3.2)
That Council expects to use one method of calculating
FBT on tax-exempt body entertainment and at year end
the Council may use another calculation method, then
Council will be required to process an adjustment to the
Business Activity Statement (BAS).
CITY OF VINCENT
INTERNAL AUDIT REPORT
NATURE
Risk Assessment (Refer Appendices)
Consequence Likelihood
Level of Risk
S
Minor
Unlikely
L
S
Minor
Unlikely
L
S
Minor
Unlikely
L
S
Major
Possible
H
s
Major
Possible
H
S
Minor
Unlikely
L
S
Moderate
Possible
M
S
Moderate
Possible
M
MOORE STEPHENS | 14
4.0 SUMMARY OF RISKS IDENTIFIED (CONTINUED)
S
C
Systems and Procedures
Compliance Matter
FINDINGS
Fringe Benefits Tax (FBT) (3.3.3)
That FBT procedures should be documented based on
an organisation wide template.
Petty Cash and Cash Floats (3.4.1)
That petty cash and cash floats be reconciled to the
general ledger on a monthly basis to help ensure cash
floats are correctly reflected in the general ledger.
CITY OF VINCENT
INTERNAL AUDIT REPORT
NATURE
Risk Assessment (Refer Appendices)
Consequence Likelihood
Level of Risk
S
Minor
Unlikely
L
S
Minor
Unlikely
L
MOORE STEPHENS | 15
5.0 RESPONSE MATRIX
FINDING
POSITION RESPONSIBLE AND TARGET
DATE
COMMENT
MANAGEMENT RESPONSE
Rates procedures should be documented based
on an organisation wide template. The
procedures should be reviewed and updated as
required.
Rates procedures are available in note
format. Agreed that such procedures
require formal documentation which is
reviewed and updated as required.
Senior Rates Officer to undertake
formalisation of documenting all
relevant procedures following the
June-September peak period
Senior Rates Officer
The MFS and the MHR will work with
the rest of the organisation to develop
and implement a standard process for
the development, approval,
appropriate storage/access and
standard template for administration
procedures.
Manager Financial Services &
Manager Human Resources
Completion by 31 December 2015
This was brought to the attention of
the Senior Rates Officer during the
audit and procedural steps have since
been updated to include Senior Rates
Officer Review.
Senior Rates Officer
Rates (3.1.1)
Written procedures were not formalised
and based on an organisation wide
standard template.
This will allow employees to clearly understand
their roles and responsibilities within predefined
limits and allow management to guide
operations without constant management
intervention, as well as help ensure staff involved
give due consideration to appropriate risk
management for processing rates.
- Completion by 31 December 2015
Rates (3.1.2)
The reconciliation of the Landgate full
revaluation as at 01 July 2014 to the rates
system reconciled however there was no
evidence of review by a senior officer.
CITY OF VINCENT
INTERNAL AUDIT REPORT
A hardcopy of the reconciliation should be should
be signed and dated by the preparer before being
reviewed by a senior officer. The senior officer
should sign and date the reconciliation as
evidence of having been reviewed.
- Completed
MOORE STEPHENS
| 16
5.0 RESPONSE MATRIX (CONTINUED)
POSITION RESPONSIBLE AND
TARGET DATE
FINDING
COMMENT
MANAGEMENT RESPONSE
There was no evidence of review of the
manual rolling reconciliations of the rate
valuations between the rates system and
the valuation rolls received from Landgate.
Each reconciliation should be printed out and the
interim schedules from the VGO attached to it.
The reconciliation should be signed and dated by
the preparer before being reviewed by a senior
officer. The senior officer should sign and date
the reconciliation as evidence of having been
reviewed.
This was brought to the attention of the
Senior Rates Officer during the audit and
procedural steps have since been updated
to include Senior Officer Review.
Senior Rates Officer
To help ensure ALL changes to employees’ details
in the system are correct and hence all payments
are bona fide, a senior staff member independent
of processing should review a system generated
audit trail report showing all changes made to the
respective system master files. The independent
review should seek to confirm the integrity of the
details in the system for the subsequent creation
of the ABA file and should be evidenced
accordingly.
The only people maintaining Payroll
information are the Payroll Officer and
Admin Officer Beatty Park. The Admin
Officer Beatty Park only make changes to
the basic details such as addresses. They
may not change bank account or masterfile details. There is an audit trail report
available on authority to monitor all
changes made in the Authority system.
Manager Human Resources
Rates (3.1.3)
- Completed
Payroll (3.2.1)
Changes to employees’ details (in particular
banking details) in the payroll system were
not adequately supervised.
– Implementation by December
2015
This report will be configured and the MHR
will review at least once a month.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS
| 17
5.0 RESPONSE MATRIX (CONTINUED)
FINDING
Payroll (3.2.2)
The ABA file is not uploaded immediately
onto the banking system after it has been
created and the integrity of the banking
details in the ABA file are not checked
against an exception report after it has
been uploaded onto the banking system.
CITY OF VINCENT
INTERNAL AUDIT REPORT
COMMENT
To help ensure all payments made are bona fide
and appropriately authorised, the ABA file should
be uploaded immediately onto the banking
system after it is created.
A senior staff member independent of processing
should then check the payment details on the
banking system against the payroll report.
The independent review should seek to confirm
the integrity of the details in the ABA file prior to
payments being released and should be
evidenced accordingly.
MANAGEMENT RESPONSE
Currently the City cannot link the file
creation to the ComBiz website as
suggested. We are investigating how
the City would be able to lock the file
down, while still allowing it to be
uploaded in the banking website.
POSITION RESPONSIBLE AND TARGET
DATE
Manager Human Resources & Manager
Financial Services
- Completion by 31 December 2015
The value of the bank payment is
currently cross-checked against the
payroll reports by the two bank
signatories (typically the Manager
Financial services and Director
Corporate Services). Until the above
technical issue is resolved, the
authorisers will spot-check a sample of
employee bank details in the ABA file
with the data in the payroll system.
MOORE STEPHENS
| 18
5.0 RESPONSE MATRIX (CONTINUED)
FINDING
Payroll (3.2.3)
Written payroll procedures were not
formalised and based on an organisation
wide standard template.
CITY OF VINCENT
INTERNAL AUDIT REPORT
COMMENT
MANAGEMENT RESPONSE
Payroll procedures should be documented based
on an organisation wide template. The
procedures should be reviewed and updated as
required.
This will allow employees to clearly understand
their roles and responsibilities within predefined
limits and allow management to guide operations
without constant management intervention, as
well as help ensure staff involved give due
consideration to appropriate risk management
for processing the payroll.
The Payroll Officer currently maintains
two sets of procedures – a lengthy
step by step instruction and an
abridged version.
The MFS and the MHR will work with
the rest of the organisation to develop
and implement a standard process for
the development, approval,
appropriate storage/access and
standard template for administration
procedures.
POSITION RESPONSIBLE AND TARGET
DATE
Manager Human Resources & Manager
Financial Services
- Completion by 31 December 2015
MOORE STEPHENS
| 19
5.0 RESPONSE MATRIX (CONTINUED)
FINDING
COMMENT
MANAGEMENT RESPONSE
To comply with the requirements of the ATO only
"one" of the available methods of calculating FBT
should be used for all entertainment expenses (by
way of food and drink).
The City will evaluate and choose
only one of the methods to be used
for the calculation of the
entertainment expenses FBT.
POSITION RESPONSIBLE AND TARGET
DATE
Fringe Benefits Tax (FBT) (3.3.1)
• Council has incorrectly used two different
methods for calculating the FBT on
Entertainment expenses (by way of food
and drink).
The ‘50/50’ method was used to calculate
the FBT on Council ‘Functions
Entertainment’ expenses whilst the ‘Actual’
method was used for calculating the FBT on
‘EMT Entertainment’ expenses.
CITY OF VINCENT
INTERNAL AUDIT REPORT
Manager Financial Services
- Completed May 2015
MOORE STEPHENS
| 20
5.0 RESPONSE MATRIX (CONTINUED)
FINDING
COMMENT
MANAGEMENT RESPONSE
Entities can only claim input tax credits on
deductible entertainment expenditure and
entertainment expenditure that is subject to FBT.
If, throughout the year, entities expect to use one
method of calculating FBT on tax-exempt body
entertainment and at year end the entities use
another calculation method then they will be
required to process an adjustment to the
Business Activity Statement (BAS).
City will determine the one method
to use for entertainment
expenditure and input tax credit
will only be claimed on deductible
entertainment expenditure subject
to FBT.
POSITION RESPONSIBLE AND TARGET
DATE
Fringe Benefits Tax (FBT) (3.3.2)
As Council expects to use one method of
calculating FBT on tax-exempt body
entertainment and at year end the Council
may use another calculation method then
they will be required to process an
adjustment to the Business Activity
Statement (BAS).
This adjustment did not take place for the
2013/14 FBT return.
Accountant
- Completed May 2015
"Input Tax Credits" on Entertainment by way of
food and drink should not be claimed during the
year. Instead, they should be claimed once the
FBT return has been completed and only on
deductible entertainment expenditure and
entertainment expenditure subject to FBT.
This will help ensure the correct ‘Input Tax
Credits’ are claimed in line with ATO
requirements.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS
| 21
5.0 RESPONSE MATRIX (CONTINUED)
FINDING
POSITION RESPONSIBLE AND TARGET
DATE
COMMENT
MANAGEMENT RESPONSE
FBT procedures should be documented based on
an organisation wide template. The procedures
should be reviewed and updated as required.
FBT procedures are available in note
format. Agreed that such procedures
require formal documentation which
is reviewed and updated as required.
Finance Officer to undertake
formalisation of documenting
Accountant
As recommended the petty cash and
cash floats will be reconciled to the
general ledger on a monthly basis.
Finance Officer Accounts Payable
Fringe Benefits Tax (FBT) (3.3.3)
There were no written FBT procedures in
place.
This will allow employees to clearly understand
their roles and responsibilities within predefined
limits and allow management to guide
operations without constant management
intervention, as well as help ensure staff
involved give due consideration to appropriate
risk management for processing FBT data and
preparing the FBT annual return.
- Completion by December 2015
Petty Cash & Cash Floats (3.4.1)
The actual cash floats at the Beatty Park
Leisure Centre did not reconcile to the
balances in the general ledger. The net
effect was a $200 cash shortage.
CITY OF VINCENT
INTERNAL AUDIT REPORT
Petty cash and cash floats should be reconciled
to the general ledger on a monthly basis. This
will help ensure cash floats are correctly
reflected in the general ledger.
– May 2015 and ongoing.
MOORE STEPHENS
| 22
APPENDIX ONE: RISK ASSESSMENT TABLE – LEVEL OF RISK
Likelihood
(Appendix Two)
CONSEQUENCE (APPENDIX THREE)
INSIGNIFICANT
MINOR
MODERATE
MAJOR
CATASTROPHIC
Almost Certain
Medium
High
High
Extreme/ Exceptional
Extreme/ Exceptional
Likely
Medium
Medium
High
High
Extreme/ Exceptional
Possible
Low
Medium
Medium
High
High
Unlikely
Low
Low
Medium
Medium
High
Very low
Low
Low
Medium
Medium
Rare
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS
| 23
APPENDIX TWO: LIKELIHOOD LEVELS-CRITERIA GUIDE
RISK/ OPPORTUNITY LEVEL
DESCRIPTION
5. Almost Certain
Expected to occur in most circumstances or occurs regularly. A clear opportunity
already apparent, which can easily be achieved.
4. Likely
Occurrence is noticeable or is likely to occur. An opportunity that has been explored
and may be achievable.
3. Possible
Occurs occasionally or may occur. Possible opportunity identified.
2. Unlikely
Occurs infrequently or is not likely to occur. Opportunity that is fairly unlikely to
happen.
1. Rare
Only occurs in exceptional circumstances, Opportunity that is very unlikely to
happen.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS
| 24
APPENDIX THREE: CONSEQUENCE LEVELS–CRITERIA GUIDE
STRATEGIC
LEVEL
PERFORMANCE
City unable to achieve its key objectives/
Exceptional improvement on the delivery
of the City’s key strategic objectives.
Consequence
Catastrophic
Ongoing loss of critical infrastructure.
Major impact on the City’s ability to
achieve its key strategic objectives, Major
improvement on the delivery of the City’s
key strategic objectives.
Major
Impact cannot be managed with the
current resources.
Long-term loss of critical infrastructure.
CITY OF VINCENT
INTERNAL AUDIT REPORT
FINANCIAL
ENVIRONMENTAL
Loss of assets, >15% of asset
value.
Catastrophic long term
environmental harm.
Adverse impact on annual
revenues >15% deviation
from budget.
Exceptional improvement
to local environment
and/or national
environment.
Loss of assets, 5% to 15% of
asset value.
Significant long-term
environmental harm,
Major impact to local
environment.
Adverse impact on revenue
and costs 5% to 15%
deviation from budget.
REPUTATION
Significant long term damage to public
confidence in the City leading to
sustained compromise in the
achievement of strategic objectives,
Extensive positive coverage in local
and/or national press.
Adverse local publicity of a major and
persistent nature, affects the
perception/ standing of the City within
the community, Negative coverage in
local press (e.g. extensive or front
page).
External audit qualification on
the report and accounts.
MOORE STEPHENS
| 25
APPENDIX THREE: CONSEQUENCE LEVELS-CRITERIA GUIDE (CONTINUED)
STRATEGIC
LEVEL
PERFORMANCE
Moderate impact on the City’s ability to
meet its key objectives, Moderate impact
on the delivery of the City’s key objectives.
Consequence
Moderate
Minor
Significant adjustment to resource
allocation required to manage impact.
FINANCIAL
Loss of assets, 2% to 5% of
asset value.
Adverse impact on revenue
and costs 2% to 5% deviation
from budget.
Loss of support infrastructure.
External audit management
letter contains significant
issues.
Minor impact on the City’s key objectives,
Minor impact on the delivery of the City’s
key objectives.
Loss of assets < 2 of asset
value.
Additional internal management efforts
required to manage impact.
Adverse impact on revenues
and costs <2% deviation from
budget.
ENVIRONMENTAL
REPUTATION
Significant short-term
environmental harm,
Moderate improvement to
local environment.
Negative publicity or damage to
reputation to a specific audience
which may not have significant longterm or community effects, Negative
coverage in local press.
Minor transient
environmental harm,
Minor impact to local
environment.
Minor negative publicity or damage to
reputation to an insignificant
audience, complaint from a large
group of people, Minimal negative
coverage in local press.
Negligible transient
environmental harm,
Negligible impact to local
environment.
Minor unsubstantiated negative
publicity or damage to reputation to
an insignificant audience, contained
within a business unit/directorate,
complaint from individual/small group,
of arguable merit, Negligible negative
coverage in local press.
Interruption to support infrastructure.
Negligible impact on the City’s key
objectives, Negligible impact on the
delivery of the City’s key objectives.
Insignificant
Impact can be managed through routine
activities.
Negligible interruption to support
infrastructure.
CITY OF VINCENT
INTERNAL AUDIT REPORT
Insignificant loss of assets or,
Insignificant adverse impact
on annual revenue or costs.
MOORE STEPHENS
| 26
APPENDIX THREE: CONSEQUENCE LEVELS-CRITERIA GUIDE (CONTINUED)
OPERATIONAL
Catastrophic
SERVICE DELIVERY/
BUSINESS DISRUPTION
Major loss of service, including
several important areas of
service and/or a protracted
period, Exceptional impact to
service(s).
Consequence
Ongoing loss of business
systems.
Major
Complete loss of an important
service area for a short period,
Major impact to service (s).
Major disruption in business
processes.
Major effect to an important
service area for a short period,
moderate impact to service (s).
Moderate
CITY OF VINCENT
INTERNAL AUDIT REPORT
FINANCIAL
Loss of assets, >15% of asset
value.
OSH
Death.
Extreme incident
effecting organisation's
survival.
All personal details
compromised/ revealed.
Multiple serious
injuries and/or
major OS&H and
WC
incident/issue.
Significant incident
affecting multiple
locations.
Regulatory non-compliance
which place individuals at risk of
harm.
Adverse impact on annual
revenues, Exceptional income
and/or savings > 15%
deviation from budget.
Loss of assets, 5% to 15% of
asset value.
Adverse impact on revenue
and costs, Major income
and/or savings 5% to 15%
deviation from budget.
Adverse effect to services in one
or more areas for a brief period.
Loss of assets, 2% to 5% of
asset value.
Adverse impact on revenue
and costs, Moderate income
and/or savings.
Moderate disruption in business
processes.
2% to 5% deviation from
budget.
PHYSICAL
LEGISLATIVE/REGULATORY/
POLICY
Significant breach of code of
conduct.
Many individual personal details
compromised/ revealed.
Serious injury
and /or illness.
Localised incident.
Significant effect on
operations
Breach of code of conduct.
Some individual personal details
compromised/ revealed.
MOORE STEPHENS
| 27
APPENDIX THREE: CONSEQUENCE LEVELS-CRITERIA GUIDE (CONTINUED)
OPERATIONAL
Consequence
Minor
Insignificant
SERVICE DELIVERY/
BUSINESS DISRUPTION
Brief disruption of important
service area, Noticeable effect to
non-crucial service area, Minor
impact to service(s).
FINANCIAL
Loss of assets < 2 % of asset
value.
Minor disruption in business
processes.
Adverse impact on revenues
and costs, Minor income
and/or savings <2% deviation
from budget.
Brief disruption of non- crucial
service area, Negligible impact to
service (s).
Insignificant loss of assets or
insignificant adverse impact
on annual revenue or costs.
Negligible impact on the
effectiveness of the
organisation’s processes.
OSH
PHYSICAL
First aid or minor
lost time injury
and/or minor
OS&H liability
incident/issue.
Localised incident. No
effect on operations.
Incident with or
without minor
injury.
No notifiable or
reportable incident.
LEGISLATIVE/REGULATORY/
POLICY
Minor breach of code of
conduct.
Isolated individual personal
details compromised/ revealed.
Little or no impact to code of
conduct.
An individual’s personal details
compromised/revealed.
Negligible disruption in business
processes.
CITY OF VINCENT
INTERNAL AUDIT REPORT
MOORE STEPHENS
| 28