Audit Committee Meeting 24 June 2009

AUDIT FINDINGS REPORT PURCHASE REQUISITION SYSTEM (PRS) PROJECT

Executive summary and recommendations

Introduction This paper provides the PKF audit findings on the recent audit of the PRS system project. Decision The Committee is asked to review and approve the audit findings report. Background information Following the PRS project go live date in early February 2009, a PRS update paper was presented to the February Committee meeting. PKF was invited to perform a post implementation review audit on the project, which occurred in March. The results of the audit are attached. In the report, PKF concluded that management has now addressed the key issues arising from the initial implementation of the PRS. Lessons learned meetings relating to the PRS project were held on 18 March and 27 May. The output of those meetings will feed into a project trend analysis to be prepared by the Projects Office in 2009/2010 relating to lessons learned from various projects recently completed. The PRS audit report referred to some further PRS system enhancements occurring 2009. These were actioned in late May/early June and encompassed the following; - Currency amounts rounded to two decimal places, - enable optional file attachments to purchase orders, - enable separate archive of closed purchase orders by user, - enable instant updates for purchase orders created & goods received, and - introduce a system control & warning message if a user attempts to goods receive a quantity greater than the PO quantity. Resource implications Nil

Date 2008-112012

Ver. a

Dept/Cmte ADT

Doc Type PPR

Title Audit Findings paper

Status Draft DD: None

Int. Aud. Public RD: None

Financial implications PKF Audit cost Appendices Appendix One PKF Post implementation review paper Date of paper 12 June 2009

PURCHASE REQUISITION SYSTEM PROJECT PKF- POST IMPLEMENTATION REVIEW AUDIT COMMITTEE PAPER 1. Background
At the last meeting of the Audit Committee in February 2009, management provided members with an update report on the progress made in implementing the Purchase Requisition System (PRS) project to introduce on-line purchase ordering at the Health Professions Council (HPC). The new system first went live in July 2008 but was subsequently taken off-line in the following September after various operational difficulties. Since that time steps have been taken to specify the problems that needed to be resolved and to ensure that these have been corrected. At the February Audit Committee management reported that the system problems had been addressed and that the system went live again on 2
nd

February 2009.

We understand that management has now also conducted a lessons learned review and intends to report the findings to the Committee via a wider project lessons learned paper to be presented later in the year. Nevertheless, the Committee and the Chief Executive and Registrar requested that we should undertake a brief post-implementation review to confirm that the key operational difficulties that were identified by management have been addressed and to provide a report to the next meeting of the Audit Committee. Our review of these matters was completed in March 2009. The findings of our work are set out in the following paragraphs.

2. Findings
We noted that in January 2009, detailed workshops were held with all the key system users to identify the problems involved in operating PRS. A full list of the issues was collated through these meetings. These were then worked through by management and a prioritised list of required enhancements to the software was prepared. The software providers (Sicon) were then commissioned to put these into place. The key issues identified through the workshops were as follows: The list of the HPCs approved suppliers could not be easily searched on the system; Approval routes for purchase orders raised on the system were causing practical difficulties; and Performance issues regarding the transfer of data from PRS to the SAGE purchase ledger.

Final March 2009

The system enhancements were implemented in January 2009 alongside extensive user acceptance testing by HPC staff to confirm that the issues identified had indeed been addressed. Our review indicated that the user acceptance testing was clearly documented on an Excel spreadsheet with each aspect of the system tested checked off by the relevant user. Our walk through testing indicated that when raising a purchase request users are invited to select from an approved list of suppliers (the complete supplier database held in the Sage purchase ledger). Before the system enhancements we understand that over 2,000 selections were available including suppliers, partners, employees and Council members. A decision was taken to filter the list in PRS so only suppliers would show for selection. The list of available selections for users has therefore been considerably reduced, making selection more manageable. The set up of supplier groups has also been amended to enable the list to be sorted alphabetically and therefore searched more easily. We understand that the processes for approving the expenses of partners, employees and Council members remain are to remain off-line, although there is scope for including one or more of these groups in the list in the future. In view of the selection difficulties experienced by system users during the initial implementation we concur with this approach. We noted that the approval routes for purchase requests have been amended and now provide an increased number (up to three) of possible authorised approvers than previously. This pooled approach should prevent one individual becoming overloaded with items requiring their authorisation. We cross checked a sample of the authorised approvers to the HPCs scheme of delegation. Our testing indicated that the approvers and their privileges set up on the system were consistent with the scheme of delegation. Through our walk through testing we noted the system has inbuilt controls to prevent unauthorised ordering because any individual with password access to the PRS may request a purchase order. To do so they first need to select an approved supplier and a cost code. This generates a purchase request that is automatically transmitted to the approver(s) assigned to the cost code. A purchase order can only be created once the approver has electronically confirmed the request. Different tiers of authorisation have also been built into the system for each department. For example if a purchase request is made for 7,500 the individuals authorised to approve expenditure between 1,001 and 8,000 for that cost code within that department will be notified. Changes to standing data such as adding a new supplier/ code/ approver can only be made by an individual with system administrator access.

Final March 2009

From our discussions with management we understand that the performance issues regarding the transfer of data from PRS to the SAGE purchase ledger have largely been addressed as a result of the system enhancements described above, although we were advised that data transfer does not always take place in real time. We understand that some further system enhancements are planned to be made over the coming months to improve communications between PRS and SAGE. However, at the time that we undertook our walk through testing, we did not identify any processing delays.

3. Conclusion
Based on our review, we concluded that management has now addressed the key issues arising from the initial implementation of the PRS. The key system users performed detailed acceptance testing and confirmed that they were satisfied with the functionality. Our walk through testing also indicated that the system has the embedded controls necessary to prevent unauthorised purchase orders being raised. We understand that some further enhancements are planned to be made over the coming months notably in relation to communications between PRS and SAGE and reports generated from SAGE. We will be performing more detailed compliance testing of purchase processing generally as part of our financial systems review work during 2009/10. As part of this work we will consider the impact of the implementation of any further enhancements to the system upon the financial control environment at the HPC. This report has been prepared as part of the internal audit of the Health Professions Council under the terms of the contract for internal audit services. It has been prepared for the Health Professions Council and we neither accept nor assume any responsibility or duty of care to any third party in relation to it. The conclusions and recommendations are based on the results of audit work carried out and are reported in good faith. However, our methodology is dependent upon explanations by managers and sample testing and management should satisfy itself of the validity of any recommendations before acting upon them.

PKF (UK) LLP March 2009

Final March 2009