Meeting of the Finance Audit & Risk Sub-committee

 

 

Date:                 Wednesday 7 March 2018

Time:                9.00am

Venue:

Council Chamber

Hawke's Bay Regional Council

159 Dalton Street

NAPIER

 

Agenda

 

Item       Subject                                                                                                                  Page

 

1.         Welcome/Notices/Apologies 

2.         Conflict of Interest Declarations  

3.         Confirmation of Minutes of the Finance Audit & Risk Sub-committee meeting held on 4 December 2017

4.         Follow-ups from Previous Finance Audit & Risk Sub-committee Meetings                 3

Decision Items

5.         Six-Monthly Risk Assessment and Management Update                                          15

6.         Procurement Internal Audit Scope and Water Management Internal Audit Progress Update                                                                                                                         29

Information or Performance Monitoring

7.         HBRC Works Group Update                                                                                       41

8.         Resource Management Information System Implementation Update                       43

9.         Local Government Act Section 17a Reviews                                                             47

10.       March 2018 Update on the Sub-committee Work Programmes                                49

 

 


HAWKE’S BAY REGIONAL COUNCIL

Finance Audit & Risk Sub-committee

Wednesday 07 March 2018

SUBJECT: Follow-ups from Previous Finance Audit & Risk Sub-committee Meetings

 

Reason for Report

1.      In order to track items raised at previous meetings that require follow-up, a list of outstanding items is prepared for each meeting. All follow-up items indicate who is responsible for each, when it is expected to be completed and a brief status comment. Once the items have been completed and reported to the Committee they will be removed from the list.

Decision Making Process

2.      Council is required to make every decision in accordance with the Local Government Act 2002 (the Act). Staff have assessed the in relation to this item and have concluded that as this report is for information only and no decision is required, the decision making procedures set out in the Act do not apply.

 

Recommendation

That the Finance, Audit and Risk Sub-committee receives and notes the report Follow-ups from Previous Finance Audit and Risk Sub-committee Meetings.

 

 

Authored by:

Leeanne Hooper

Governance Manager

 

Approved by:

Jessica Ellerm

Group Manager Corporate Services

 

 

Attachment/s

1

Follow-ups from 4 Dec 2017 FA&R meeting

 

 

  


Follow-ups from 4 Dec 2017 FA&R meeting

Attachment 1

 

 


HAWKE’S BAY REGIONAL COUNCIL

Finance Audit & Risk Sub-committee

Wednesday 07 March 2018

Subject: Six-Monthly Risk Assessment and Management Update

 

Reason for Report

1.      To provide the Sub-committee with a six monthly review of the risks that Council is exposed to and the mitigation actions in place to manage Council’s risk profile.

Background

2.      The Sub-committee last considered the risk management report at its meeting held 4 December 2017. The updated risk register is attached.

3.      Following on from a series of risk management workshops held in January/February and executive interrogation of findings, high consequence risks and upwards trending risks, attached is the latest risk management update for Councillors review.

4.      At the previous meeting, Councillors requested an update on anything that has “moved” in the risk register, along with a request for a report on consideration of project risks (attached).

Key Changes

5.      While not exhaustive, commentary around most significant changes has been provided below of any major changes or action points to the risk register for Councillors attention. Items listed below are in addition to risk management strategies already reported on previously.

6.      All key strategic level risks now have a dedicated “risk owner” is to remain accountable for action points and follow ups.

7.      Consideration of education of non ICT staff of ICT risks due to potential high causation factor as well as consideration of independent audit of our ICT security and backups.

8.      Recognition of Joint Drinking Water Groups is proving effective. Some additional work required in clarity of responsibility of monitoring small scale/self-supply bores - to be addressed during upcoming group meetings.

9.      Recognition of stress and fatigue as a Health and Safety issue that may affect staff’s wellbeing and performance. To be covered by executive during their next “away day”.

10.    Staff have requested shorter/higher frequency Civil Defence training to ensure the knowledge of their roles is current in how to respond to an emergency. This is to be reviewed as part of a Civil Defence training review.

11.    Due to the current LTP process underway, it has been recognised that the failure to meet public expectations risk should be elevated to high. These are being mitigated through open and effective communication strategies.

12.    Due to the proposal of several new highly skilled/experience staff, the ability to retain and attract appropriately skilled staff risk has also been elevated to “high”. While Council provides good training and is proud of its culture, it also recognised the ability to attract staff to both Hawke’s Bay and a Council environment may be a challenge.

13.    It has been recognised that Council’s current contract engagement and monitoring could provide for extra efficiencies. A procurement audit is scheduled with results to be available in June whereby Council will review and enact any recommendations from the findings it deems viable.


Project Risks

14.    During the recently conducted risk management workshops, specific project risks were added as an additional element to discussions. Five topical/high risk projects were identified and discussed along with what potential risks we may face with the execution of these projects.

15.    Projects reported on are Plan Change 6, TANK, Iris Implementation, Costal Strategy and Hot Spots (FIF’s).  In addition to this, discussions were held as to what Council is doing to mitigate any risks that may arise as a result of these projects.

16.    It is important to note that this is in addition to the risk mitigation strategies Council already conducts as an organisation. Project risk mitigation methods have been listed as specific to each project and is an additional layer to what is already recorded in the risk register.

17.    Budgeting and planning regarding an organisational project management system including common methodologies and a consistent approach to project management has been initiated. It has been decided that this sits under the Corporate Services function and there is sufficient budget in the LTP to allow for this.

18.    It is intended that project risks are to be embedded in future risk management discussions and strategies in the future.

Decision Making Process

19.    Council is required to make every decision in accordance with the requirements of the Local Government Act 2002 (the Act).  Staff have assessed the requirements in relation to this item and have concluded:

19.1.   The decision does not significantly alter the service provision or affect a strategic asset.

19.2.   The use of the special consultative procedure is not prescribed by legislation.

19.3.   The decision does not fall within the definition of Council’s policy on significance.

19.4.   The persons potentially affected by this decision are staff or persons in the community that rely on Council services.

19.5.   Options for Council in regard to this paper are to defer or not consider risks that this Council is exposed to.  This paper adopts the option of Council reviewing the risk profile.

19.6.   The decision is not inconsistent with an existing policy or plan.

19.7.    Given the nature and significance of the issue to be considered and decided, and also the persons likely to be affected by, or have an interest in the decisions made, Council can exercise its discretion and make a decision without consulting directly with the community or others having an interest in the decision.

Recommendations

1.      That the Finance, Audit and Risk Sub-committee:

1.1       Receives and considers the “HBRC Risk Assessment and Management” staff report.

2.      The Finance, Audit and Risk Sub-committee recommends that the Corporate and Strategic Committee:

2.1.      Agrees the decisions to be made are not significant under the criteria contained in Councils’ adopted Significance and Engagement Policy, and that Council can exercise its discretion and make decisions on this issue without conferring directly with the community.

2.2.      Confirms the Finance Audit and Risk Sub-committee’s confidence that the risk assessment processes are appropriate processes to identify and assess organisational risks.

Authored by:

Melissa des Landes

Management Accountant

 

Approved by:

Jessica Ellerm

Group Manager Corporate Services

 

 

Attachment/s

1

HBRC Risk Register March 2018

 

 

2

March18 Key HBRC Projects Risk Management

 

 

  



HBRC Risk Register March 2018

Attachment 1

 


HBRC Risk Register March 2018

Attachment 1

 


HBRC Risk Register March 2018

Attachment 1

 



March18 Key HBRC Projects Risk Management

Attachment 2

 






HAWKE’S BAY REGIONAL COUNCIL

Finance Audit & Risk Sub-committee

Wednesday 07 March 2018

Subject: Procurement Internal Audit Scope and Water Management Internal Audit Progress Update

 

Reason for Report

1.      To confirm the scope for the upcoming Procurement Internal Audit, and to provide the Sub-committee with an update on the status of the Water Management internal audit currently under way.

Background

2.      At its meeting on 19 September 2017, the sub-committee agreed to internal audit work programme for the 2017-18 financial year to include Data Analytics, Water Management, and Procurement.

3.      At its meeting 4 December 2017 the sub-committee received internal audit report on first audit in agreed work programme, “Data Analytics”. Water Management scope has been agreed to and work is currently underway, Procurement scope to be reviewed at this meeting and work will commence following.

Data Analytics

4.      The report on data analytics highlighted that Council has strong transactional processes for both payroll and accounts payable, however identified some possible improvements in its procedures.

5.      Council has now applied the changes to controls by training staff on using a consistent approach when creating new supplier accounts thus reducing the possibility of entering a duplicate vendor. In addition to this process, staff are now performing a Companies Office search when setting up a new supplier to ensure supplier existence. Duplicate vendors have also been minimised by blocking any current duplicate suppliers. Staff have implemented an additional step of searching by IRD number before entering new suppliers to reduce the risk of multiple vendors being created in the future.

6.      Another gap identified was a handful of invoices paid twice (albeit of minimal value) which was caused by a large volume of invoices being issued to staff. Council has worked with suppliers to ensure credits/refunds of these payments have been issued. Council has also negotiated with our catering suppliers to provide us with one weekly invoice, as opposed to several each week. This hasn’t reduced payment frequency to these suppliers, however has reduced both time and paperwork for both parties, along with reduced risk of duplication of transactions.

Water Management

7.      At its meeting on 4 December, the sub-committee agreed to “water management” internal audit scoping document. This assignment was originally intended to proceed immediately, however after this document was provided to Corporate & Strategic Committee 11 December, there were concerns raised around the breadth of the assignment.

8.      It was agreed to refine the scope to cover local authority consent holders, and water sources that specifically affect the health and safety of the community. This scope was refined and presented to Council 31 January 2018, whereby the scope was agreed to by resolution. The internal audit fieldwork commenced immediately following.

9.      The Water Management internal audit was originally scheduled to be presented to this sub-committee meeting, however due to alterations in the scope causing a delay of 8 weeks, this report will now be pushed out to the following sub-committee meeting scheduled for 6 June 2018.

Procurement

10.    At its meeting held 19 September, the subcommittee agreed to its work programme for the 2017-18 financial year, the final audit for this period being procurement. A scoping document is attached for the sub-committees review, it is noted that the scope has been extended to include a review of payment of “living wage” to contractors.

11.    Following resolution of the Procurement Scoping document, fieldwork is scheduled to commence immediately with findings to be presented at 6 June 2018 sub-committee meeting.

2018-19 Internal Audit Programme

12.    At its meeting scheduled for 6 June, the sub-committee will receive a proposed work programme for the 2018-19 financial year, which will again consist of three separate audits spaced out over the financial year.

13.    It is intended that relevant Group Manager is to review any future scoping documents prior to their presentation to the Finance, Audit and Risk Sub-committee to allow for specialist input. This will ensure that scoping documents are fit for Council’s purpose and operating environment, and will ensure efficiency in the process in future.

14.    It is also planned for Council to speak with other HB LASS Council’s regarding their own internal work programme and maximise on information sharing opportunities where possible. 

 

Decision Making Process

15.    Council is required to make every decision in accordance with the requirements of the Local Government Act 2002 (the Act). Staff have assessed the requirements in relation to this item and have concluded:

15.1.   The decision does not significantly alter the service provision or affect a strategic asset.

15.2.   The use of the special consultative procedure is not prescribed by legislation.

15.3.   The decision does not fall within the definition of Council’s policy on significance.

15.4.   The decision is not inconsistent with an existing policy or plan.

15.5.    Given the nature and significance of the issue to be considered and decided, and also the persons likely to be affected by, or have an interest in the decisions made, Council can exercise its discretion and make a decision without consulting directly with the community or others having an interest in the decision.

 

Recommendations

1.      That the Finance, Audit and Risk Sub-committee receives and notes the “Procurement Internal Audit Scope and Water Management Internal Audit Progress Update” staff report.

2.      The Finance, Audit and Risk recommends that the Corporate and Strategic Committee:

2.1.      Agrees that the decisions to be made are not significant under the criteria contained in Council’s adopted Significance and Engagement Policy, and that the Committee can exercise its discretion and make decisions on this issue without conferring directly with the community and persons likely to be affected by or to have an interest in the decision.

2.2.      Approves the scope for the Procurement internal audit, including agreed amendments, and the initiation of the Audit.

 

 

 

Authored by:

Melissa des Landes

Management Accountant

 

Approved by:

Jessica Ellerm

Group Manager Corporate Services

 

 

Attachment/s

1

Procurement and Purchasing Audit scope

 

 

  


Procurement and Purchasing Audit scope

Attachment 1

 






   


HAWKE’S BAY REGIONAL COUNCIL

Finance Audit & Risk Sub-committee

Wednesday 07 March 2018

Subject: HBRC Works Group Update

 

Reason for Report

1.       To provide the sub-committee with an update on the overall financial performance and other areas of interest of Council’s Works Group. It is intended that a regular, six monthly or annual update will be provided to the Sub-committee on financials and work programme highlights for the Group.

2.      Hamish Fraser (Works Group Manager) and Kathy Hughes (Office Administrator) will attend the meeting to provide a presentation.

Background

3.      The Works Group sits in the organisational structure under the Asset Management Group of Activities, and is structured as follows.


Decision Making Process

4.      Staff have assessed the requirements of the Local Government Act 2002 in relation to this item and have concluded that, as this report is for information only, the decision making provisions do not apply.

 

Recommendation

That the Finance, Audit and Risk Sub-committee receives and notes the “HBRC Works Group Update” staff report and presentation.

 

Authored by:

Melissa des Landes

Management Accountant

 

Approved by:

Jessica Ellerm

Group Manager Corporate Services

 

 

Attachment/s

There are no attachments for this report.


HAWKE’S BAY REGIONAL COUNCIL

Finance Audit & Risk Sub-committee

Wednesday 07 March 2018

Subject: Resource Management Information System Implementation Update

 

Reason for Report

1.      To provide an update on progress with the implementation of the new Resource Management Information System software.

Milestones and Progress

2.      Good progress has been made with key milestones resulting in the successful delivery of:

2.1.      Infrastructure and Platforms; and

2.2.      Solution Planning and Configuration for the core Consents Business functions.

3.      As a result of a 3-month check-point review, it was identified that there was significantly more complexity around some key project tasks than initially anticipated resulting in forecast timelines and delivery targets being unrealistic and forecast resource requirements being insufficient.

4.      Also, as a result of the 3-month check-point review, it was identified that a number of project tasks, namely data mapping and data migration, had not been performed adequately due in part to resource constraints, the readiness of data and an unsatisfactory engagement between the ICT Team and the Business.

5.      It was identified that there had been a lack of continuity in resource and engagement of senior stakeholders since the procurement phase of the project resulting in a misalignment between the ICT Team and the Business and misunderstandings about exactly what the solution would, and wouldn’t, achieve.

6.      These finding resulted in a number of corrective actions which have largely been executed, including:

6.1.      Refinement of the Project Management Structure

6.2.      Implementation of a system to plan, monitor and manage the project lifecycle

6.3.      Introduction of an agile methodology for project phases and tasks

6.4.      Strong focus on engagement between the ICT Team and the Business

6.5.      Increased buy-in, and participation in decision-making, by the Senior Stakeholders in the Business

6.6.      Engagement of a fixed-term resource exclusively dedicated to data quality and cleansing.

7.      With corrective actions in place, the wider project team (ICT Team and the Business) are now able to accurately forecast resource requirements, timeframes and have agreed definition of the functionality of the solution including the Critical Success Factors that will measure and confirm project success.

8.      The result of reforecasting the resource requirements and delivery targets has tentatively rescheduled the delivery of the solution to November 2018, this is 6 months later than we initially expected to deliver Consents and Compliance functionality and 2 months later than initially intended to deliver Incidents and Enforcements functionality. It is worth noting that this is to achieve baseline functionality or what is referred to as a Minimum Viable Product (MVP).

9.      This delay has no adverse impact on how the Consents and Compliance Teams perform their duties or deliver core services. The rescheduling and delay, has been approved by senior Stakeholders across the business and has been collectively devised to ensure that timeframes and workloads are realistic, that business risks are minimal, and that the delivery of core services are not affected.

10.    A primary reason for this significant delay in Consents and Compliance functionality is that, as engagement between the ICT Team and the Business increased, it was identified that a significant oversight had been made in regard to the required functionality of the Compliance function. Specifically, this oversight was that of the Water Information Services (WIS) function. Although this is typically a Compliance function, within HBRC it is not performed by the Compliance Team but rather the Client Services Team and was therefore not well represented nor scoped during solution planning workshops.

11.    The oversight of WIS functionality has contributed to approximately 6-8 weeks of the 6 month delay. It has directly, and indirectly, incurred an additional $55k external cost due to requiring a 6-month part-time fixed-term resource to assist the Client Services Team and also an additional 6 month fixed-term resource to implement the Incidents and Enforcements module due to ICT staff being repurposed to focus on WIS activities.

12.    Also, it was identified that although the functionality of the solution that would be delivered would be ‘fit for purpose’ and satisfy core requirements as an MVP, it may not be fully maximising the investment HBRC are making. Therefore, a list of potential feature and functionality additions is being generated by the Business that will be evaluated for feasibility. If feasible, these can either be included within the scope of the current project (resource and costs permitting) or earmarked for incremental release post project. Examples of these so far include a Surface Water Allocation Calculator as used by Waikato Regional Council or integration with external services such as the Companies Register or NZ Post postal addresses to improve efficiencies and increase data quality.

13.    The project team will spend the next two months evaluating the potential feature and functionality additions with a view to present a revised Scope, Cost and Timeframes for the project at the next Finance, Audit and Risk Sub-committee meeting on 6 June 2018. Depending on the extent of feasible feature and functionality additions, there could be an additional, parallel and/or subsequent project to deliver these so there isn’t undue delay in the core solution delivery.

14.    It is worth noting that regardless of the delays, the project is now considered in very good health, with a very high level of engagement and alignment between the ICT Team and the Business and an extremely robust and professional methodology and approach in place.

Finances and Resources

15.    At this stage, with all of the above taken into consideration, to achieve a MVP will take approximately 2 months longer overall than initially forecast and could incur up to $180,000 in external costs (combination of additional Time and Materials from Datacom and resourcing via fixed-term contracts). A summary of where these costs are likely to be incurred is set out in the table below, and will be taken into consideration in the March reforecast for the full year to 30 June 18.

Reason

Description

Cost

Data Quality and Cleansing Resource

Data in existing systems was not suitable for data migration and required dedicated ICT resource to cleanse the data on behalf of the business unit.

$65,000

WIS Resourcing

A key function of Compliance is WIS, due to this being delivered by a team outside Compliance, it was overlooked and not scoped during Compliance Solution Planning Workshops and requires additional resource in the Client Services Team to ensure the solution is fit for purpose.

$15,000

Incidents and Enforcements Resourcing

The ICT Team has inadequate resourcing levels to perform the solution planning, configuration and testing due to ICT resource being repurposed to focus on WIS.

$40,000

Additional Vendor Costs

Due to the change in functional requirements (WIS) and extended duration of the project, significant addition costs will be incurred as a result.

$60,000

 

16.    Significant and unplanned time has been spent on the project by internal staff although this has no material impact on the balance sheet.

17.    The increased cost will have minimal impact on the 2017-18 financial year given the delay will require the carry-forward of existing funding and the expenses will be capitalized and depreciated over a 10-year period.

18.    Further resourcing and funding may be required as a result of the evaluation of the potential feature and functionality additions and these will be tabled for consideration at the next Finance, Audit and Risk Subcommittee Meeting on 6 June 2018.

Decision Making Process

19.    Staff have assessed the requirements of the Local Government Act 2002 in relation to this item and have concluded that, as this report is for information only, the decision making provisions do not apply.

 

Recommendation

That the Finance, Audit & Risk Sub-committee receives and notes the “Resource Management Information System Implementation Update” report.

 

Authored by:

Kahl Olsen

Information and Communications Technology Manager

 

Approved by:

Jessica Ellerm

Group Manager Corporate Services

 

 

Attachment/s

There are no attachments for this report.  


HAWKE’S BAY REGIONAL COUNCIL

Finance Audit & Risk Sub-committee

Wednesday 07 March 2018

Subject: Local Government Act Section 17a Reviews

 

Reason for Report

1.      To provide an update on progress with s17a Activities Reviews. It has been agreed that s17a would be a standing item in the Finance, Audit & Risk sub-committee agenda.

Background

2.      At its meeting held 11 December 2017 the Corporate and Strategic Committee received a paper which provided information behind s17a Activity Review requirements as required under the Local Government Act (2002).

3.      The paper advised that Council has been actively reviewing various aspects of the organisation’s efficiency through various functional reviews that have taken place in the current financial year. The paper also proposed that staff report back to this current Finance, Audit & Risk sub-committee meeting with a formal proposal for further work programme for discussion.

4.      Due to capacity constraints as a result of LTP requirements, staff have been unable to complete this process in time for this meeting. It is proposed that staff report back to 6 June Finance, Audit & Risk sub-committee meeting with a formal proposal for a work programme.

Decision Making Process

5.      Staff have assessed the requirements of the Local Government Act 2002 in relation to this item and have concluded that, as this report is for information only, the decision making provisions do not apply.

 

Recommendation

1.    That the Finance Audit & Risk sub-committee receives the “Local Government Act Section 17a Reviews” report.

 

Authored by:

Melissa des Landes

Management Accountant

 

Approved by:

Jessica Ellerm

Group Manager Corporate Services

 

 

Attachment/s

There are no attachments for this report.


HAWKE’S BAY REGIONAL COUNCIL

Finance Audit & Risk Sub-committee

Wednesday 07 March 2018

Subject: March 2018 Update on the Sub-committee Work Programmes

Reason for Report

1.      In order to ensure the sub-committee’s ability to effectively and efficiently fulfill its role and responsibilities, an overall update on its work programme is provided following.

 

Task

Item

Scheduled / Status

Internal Audits

Water Supply/ Wastewater/ Stormwater Management

Report to 6 June 2018 FA&R meeting

Procurement and Purchasing

Report to 6 June 2018 FA&R meeting

2018-19 Schedule of Internal Audits

To FA&R 6 June 2018 FA&R meeting

Risk Assessment & Management

Reporting on risks (6-monthly) affecting Council plus noting changes / improvements / areas that require attention from last report (3-monthly)

2018 FA&R 7 March & 19 September meetings

Insurance

Council’s proposed 2018-19 Insurance programme

Aligned with insurance renewal dates each year. Report to 6 June 2018 FA&R meeting

Annual Report

Discussion on Audit Management Letter

Auditor scheduled to attend December 2017 FA&R meeting

Discussion on the major issues (if any) in the audit report on the Annual Report.

Aligned with Audit NZ & legislative requirements Sept-Nov each year

Reviews

Review of the Council’s capital structure, taking into account the value of dividends in supporting Council operations.

Ongoing work forming part of LTP process including consultation. Statement of Expectation paper to be presented to 14 March C&S meeting.

Investment Returns Monitoring

Update on progress in obtaining required level of dividend from PONL

PONL to present to 14 March C&S meeting

 

Decision Making Process

2.      As this report is for information only and no decision is to be made, the decision making provisions of the Local Government Act 2002 do not apply.

Recommendation

1.      That the Finance, Audit and Risk Sub-committee receives and notes the “March 2018 Update on Sub-committee Work Programmes” staff report.

Authored by:                                                     Approved by:

Melissa des Landes

Management Accountant

 

Jessica Ellerm

Group Manager Corporate Services

 

 Attachment/s

There are no attachments for this report.