Post Office Ltd Branch Audit Policy / Process
Document Information
Title Audit Process Manual
Category Standard
Subject Audit of Accounts — Section 3 of Process Manual
Version 2.5
Control
Author Operations Manager
Owner National Branch Audit Manager
Purpose Outlining the preparation, on site and post audit
processes associated with the audit of accounts
Audience Branch Audit Team
Keywords Audit of Accounts
Privacy level In Confidence
Document Post Office Sans 14
format
Document type I Electronic (MS Word. Doc), Paper,
Review date August 2005
Expiry date Ongoing subject to review
Approval
Role Name(s) Date
Business input I Branch Audit Lead Team Jan
2004
Assurance Branch Audit Lead Team Jan
2004
Authorised National Branch Audit Manager Feb
2004
Version control
Version No. Reason for issue Date
Version 1.0 Original process Jul 2003
Version 2.0 Revised as a result of annual review. 13" Jan
First new version a draft for comment __I 2004
Version 2.1 Amendments to layout, punctuation 14" Jan
and referencing details. Some minor 2004
changes to content.
Version 2.2 Further amendments following input 9" Feb
from lead team 2004
Version 2.3 Further amendments and additions 19" Feb
following input from National Audit & 2004
Inspections Manager
POL00462751
POL00462751
Version 2.4 Changes to Section 10 — Franchise 23rd
and Multiple branches March
2004
Version 2.5 Changes to reflect changes to job 10"
titles, discrepancy reporting, ALARM June
and CARM, new report template, 2005
SVMs, Paystation, ATMs and DMBs.
POL00462751
POL00462751
POL00462751
POL00462751
INDEX
SECTION 1 PREPARATION ACTIVITIES
pages 3 to6
SECTION 2 ASSET VERIFICATION
pages 7 to 14
SECTION 3 CONSTRUCTING THE P32
pages 15 to 17
SECTION 4 ON SITE VERIFICATION OF REPORTED FIGURES
page 18
SECTION 5 IRREGULARITIES AND DISCREPANCIES
pages 19 to 21
SECTION 6 CLOSING MEETING page
21 to 22
SECTION 7 AUDIT REPORTING
Pages 22 to 24
SECTION 8 OFF-SITE ACTIVITY page
24
SECTION 9 OPEN PLAN AND COMBINATION FORMATS
pages 25 to 27
SECTION 10 FRANCHISE AND MULTIPLE BRANCHES
pages 27 to 28
SECTION 11 ACCESS TO THE HORIZON SYSTEM
Pages 28 to 29
SECTION12 ATMs
pages 29 to 30
SECTION 13 SMOKE AND DYE PACKS
pages 30 to 31
SECTION 14 DIRECTLY MANAGED BRANCHES
pages 31 to 33
SECTION 15 BRANCH COMPLIANCE CERTIFICATE
3
POL00462751
POL00462751
page 33
APPENDIX A _ IDENTITY VERIFICATION LETTER
page 34
APPENDIX B DEALING WITH DISCREPANCIES REVEALED AT
AUDIT page 35
APPENDIX C MULTIPLE / FRANCHISE CONTACTS
page 37 to 41
The following sections detail the audit process to be followed at
agency, multiple, franchise branches and directly managed branches.
The operations manager (scheduling) will allocate a lead branch
auditor as part of the scheduling process. It is the responsibility of this
designated lead branch auditor to fully prepare the audit, lead the audit
on site and subsequently complete the required post audit activity,
including the audit report.
SECTION 1 - PREPARATION ACTIVITIES:
1.1 Open the latest version of the electronic P32. Once opened the P32
must be saved as the branch FAD code, date and name of branch, for
example, 023323.010105 Wakefield.xls — this will prevent accidental
overwriting of the original P32 template and also allows future changes to be
saved, as the original is a “save only” template. Robbery and burglary audits
should be saved in the same format but should be pre-fixed with R or B
respectively e.g. RO23323.010105 Wakefield.xls.
1.2 Check the Post Office Ltd Intranet site for branch profile details. There is
also a link incorporated into the P32 planning sheet that can be utilised to
obtain branch data. This will provide data on the branch address and
opening times. In order to access this detail you must be connected to the
intranet. Example of available data below:
POL00462751
POL00462751
rosolt internet Explorer BEE
[eek - = OD GI Qin Girmats Grom IB
[iis [erp pastorate maiko
oe [ue
Find a branch - Online branch locator
Bipene sakes
LsoIITECRGH IS GRO
Bitoirermss.I QWoiimacin [Banoo Boonei2-m..I (GSES APE i208
Please note; if a branch auditor arrives at a branch scheduled to be
open (info detailed on the intranet), however is closed, then this must
be reported to the operations manager (scheduling) ASAP. Do not alert
the sub-postmaster to the fact that you have come to do an audit, as it
is unlikely that access will be given and the surprise element of the
audit will have become compromised.
POL00462751
POL00462751
1.3 Access the Lotus Notes P32 library to examine the previous audit report
and extract all control gaps. The date of the previous audit can be obtained
from the planning data — branch details - supplied by the management
information team.
1.4 Prep data files are placed on the Branch Audit Library to support the
audits included in the plan. It is the responsibility of the branch auditor to
download and examine the prep data that relates to the audit being planned.
The weekly plan will detail what prep data is to be used for a specific audit. It
will also detail whether the audit is part of the ALARM or CARM programme
or both. Extract all planning data appropriate to the branch being audited
and record the details in the appropriate section of the planning sheet within
the P32. The prep data file contains the following information:
ALARM CARM
1. Errors compliance tests 1. Errors compliance tests
2. Branch details 2. Branch details
3. Cash account discrepancies (103) 3. Cash on hand non-declarations
(301)
4. Error notices (104) 4. Unauthorised losses (304)
5. ONCH variation (101) 5. Error notices (305)
6. Misreported cash (105) 6. PAF compliance (306)
7. Cash rises (106) 7. NBSC (307)
8. Cash increases (quarter) (107) 8. MVL (308)
9. Cash increases (yearly) (108) 9. DMB ACC full compliance (321)
10. ONCH V target 10. DMB ACC non-compliance (323)
11. Reinstatement (121)
12. Repayments (122)
13. Cash Specials (123)
14. Nil discrepancies (124)
15. Cheques (125)
16. FONCH variances (133)
17. FONCH no sales (134)
18. FONCH buy backs (135)
19. Post audit activity
20. MVL concerns
21. Authorised losses
22. Table 2a losses
23. Unauthorised losses
24. Fleet MVLs
25. NRA licence - serial numbers
26. Lottery cheque — serial numbers
27. Urgent audit results
POL00462751
POL00462751
POL00462751
POL00462751
1.5 Obtain the lottery cheque, rod licence serial numbers for on site
verification of stock found at audit. The prep data provides information on
the serial numbers of new stock recently sent to the branch.
1.6 Make / organise travel arrangements. In every case the most cost
effective mode of travel and most time efficient route must be selected to
travel to the branch in accordance with the current business BTE policy.
Pool and hire cars should be utilised and where feasible scheduled by the
operations manager in the first instance, however the CM3 branch auditor
should look to make changes if necessary. Public transport and car sharing
must also be explored.
NB. The current BTE policy states that where public transport, use of a
pool car, lease car or a hire car is identified as the most suitable means
of travel, but you choose to use your own car, the business will only
reimburse the category 2 mileage allowance.
1.7 Audit leader to communicate meeting arrangements if more than one
branch auditor is attending. It is also important that all branch auditors
attending are aware of their role at the audit. Avoid meeting other branch
auditors directly outside a branch as this could compromise the surprise
element of a visit. Also contingency plans should be considered and
discussed at this stage to cover expected actions should problems arise. For
example, where: -
e One or more of the team is late arriving
e One or more of the team does not attend (sickness, bad
weather)
e The lead branch auditor does not attend or is late
1.8 For audits commencing after 8.15am the identity card issued to branch
auditors should be sufficient identification to gain access to a branch. If
required, the auditee should contact the NBSC to further validate
identification.
1.9 For audits commencing prior to 8.15am a verification letter must be
prepared prior to the audit. (See Appendix A). This should be presented to
the auditee together with identity cards on arrival at the branch to be audited.
This should prove sufficient evidence of branch auditors authenticity to gain
admittance, however if the auditee requires further verification the operations
manager should be contacted on the mobile number identified within the
verification letter. For this reason an operations manager must be notified in
advance of the audit and provided with the details of the branch auditors
attending and their identity card numbers.
POL00462751
POL00462751
1.10 The following compliance tests should be untaken:
AV+ Audits Compliance only audits or Full
audits
e Regulatory Requirements & Ie As AV+ Audit.
Standards Plus:
e Information Security e Procedural Security
e Post Office® Card Account Inspection
e Travel Insurance e Core CAT of the period (see
¢ Confirm actions taken against I I Appendix A)
recommendations from last e CAT aligned to the reason for
audit the audit
e Confirm actions taken against
recommendations from last
audit
Furthermore, if a gap is identified whilst on site at the branch, in an area not
due for coverage, then the relevant part of the compliance test should be
completed accordingly.
NB. Please refer to the Compliance Auditing section of the Audit
Process Manual for the full process to be followed when selecting
compliance tests
1.11 Complete the planning sheet within the P32. The sheet must be fully
and accurately completed. If planning is not completed prior to the audit then
‘X’ must be inserted in the appropriate box and a valid explanation recorded.
The explanation must be significant for planning not to have been
performed, simply recording “insufficient time” or similar will be challenged
as part of the QAR process.
1.12 Complete the CAT selection sheet within the P32. The sheet must be
fully completed including: -
e Total number of all risk control gaps at last audit
e Summary of all control gaps at last full audit
e Total number of all risk control gaps from last audit still
outstanding at this audit
e ‘X‘ entered to identify that the test is due to be
completed
e Reasons for examining / not examining each
compliance test. The correct abbreviations to be used
POL00462751
POL00462751
e Initials of branch auditor scheduled to perform the
compliance test
If for any reason changes occur to your plan whilst on-site, then you must
detail any changes in the appropriate column, this also to include whether a
test has been either aborted or extended.
1.13 Please refer to sections 9,10 and 12 of this process manual in the
preparation stage if prep data identifies that the branch to be audited is:
e Open plan or a combination store
e A franchise or multiple
e AnATM branch
POL00462751
POL00462751
SECTION 2 - ASSET VERIFICATION:
The objective of the asset verification is to determine the value of cash,
stock and vouchers on hand by completing the audit of accounts (p32)
document. The figures are compared to the latest declared cash account,
using reports obtained from the Horizon system.
The audit of accounts (p32) must be completed on-site for all asset
verification audits including transfers, closures, robbery and burglaries.
2.1 Gain entry to the branch to be audited. This should be done immediately
upon the Sub-postmaster or staffs arrival on site. His/her access to the
counter area and the assets should be avoided without the presence of a
Branch auditor. It may be that the Sub-postmaster or staff would like to
contact the NBSC before allowing access and this will mean the branch
auditors will have to wait outside until identity has been confirmed by the
NBSC.
In this situation the sub-postmaster or staff should be advised that he/she
should not access cash, stock or the Horizon system until the branch
auditors gain access. In these circumstances anything untoward should also
be documented and a transaction log obtained from the Horizon system to
ensure there has been no activity on the system before the branch auditors
were allowed access to the branch. If the Sub-postmaster refuses to allow
entry to the premises then explain that the branch auditors have the right to
verify Post Office Ltd assets and that the Sub-postmaster is contractually
obliged to allow the Branch auditors access to do this.
If entry is still refused then advise that it may be necessary to involve the
police to ensure access, and contact the operations manager for further
advice and to discuss the situation.
2.2 Before the audit commences the lead branch auditor should make
introductions and discuss the audit process with the sub-postmaster,
ensuring that audit requirements are made clear and that the Sub-
postmaster is also aware of his/her responsibilities. The discussion will
include: -
e The need to identify and produce all cash, stock and vouchers at
the outset of the audit. (It is important that this is stressed to the
auditee and that the location of all cash, stock and vouchers is
identifiable by the branch auditors, especially if outside the secure
area).
POL00462751
POL00462751
The importance of the auditee witnessing the asset verification
Horizon reports, cash accounts, ONCH declarations etc. required
for the audit
The initial audit process — how the cash and stock will be checked.
Estimated opening time of the branch
Facilities for Branch auditors (e.g. working area, toilets)
The secure accommodation of laptop cases, equipment, handbags
Other aspects of the audit - Compliance tests, non-value
reconciliation
The closing meeting
NB. This list is not meant to be definitive, the discussion may be
extended but the above should be included as a minimum.
POL00462751
POL00462751
2.3 If the audit takes place on a Thursday and the previous night’s balance
has not been fully completed, the audit should be based on the trial balance
figure ensuring cash and stock have been declared. It is important that the
branch is balanced and rolled over into the next cash account period and
this must be completed before the branch auditors leave the branch. The
final cash account can then be completed during the course of the audit. The
following are possible (but not it must be stressed exhaustive) scenarios
where it may be found that balance not completed on a Thursday audit: -
Single stock branch
Branch should be kept closed until the stock unit is balanced and rolled over
to current cash account week. The audit can now be commenced but the
auditee should be asked to produce the final cash account as soon as
possible. Ideally the cash account is completed before leaving the branch.
Dual stock branch (counter & lottery)
If lottery stock not balanced then check the counter stock whilst the auditee
balances the lottery stock. Once lottery stock balanced and rolled over allow
the branch to open for business but again the auditee should be requested
to produce the final cash account as soon as possible. Ideally the cash
account is completed before leaving the branch.
Multi stock branch (without lottery)
The branch should be kept closed until all stocks have been balanced and
rolled over. Once this has been completed then branch can be allowed to
open for business when the branch auditors have verified sufficient stocks
and the lead Branch auditor is satisfied. The auditee should be asked to
produce the final cash account as soon as possible and ideally this should
be completed before Branch auditors leave the branch.
Multi stock branch (with lottery)
Branch should be kept closed until all stock units, including lottery, have
been balanced and rolled over. Once sufficient stocks have been checked
and the lead branch auditor is satisfied then the branch can be allowed to
open for business. The auditee should be asked to complete the final cash
account as soon as possible and ideally this should be produced before the
Branch auditors leave the branch.
2.4 Checks of cash, stock and vouchers on hand should be undertaken in
the presence of the auditee. The importance of the auditee witnessing the
asset verification must be stressed to the auditee. Where this is not possible
or the auditee chooses not to be present then checks must be made in the
presence of another branch auditor. It is important that any checks are not
made in isolation. Both the branch auditor and stockholder should
13
POL00462751
POL00462751
acknowledge the accuracy of the figures following the check. Access to all
cash, stock, vouchers and cash accounts should be restricted until they are
checked and released by the audit leader. Where there is only one Branch
auditor on site conducting the audit then it is important that the check of the
cash, stock and vouchers is performed in the presence of the auditee and
this must be stressed at the outset of the audit. Where a discrepancy is
highlighted, the auditee and/or another Branch auditor should verify
the findings and sign the cash and/or stock sheet to confirm that
figures used in the audit are correct.
POL00462751
POL00462751
2.5 Establish where all Post Office® cash, vouchers and stock are held. As
previously mentioned only cash and stock produced at the outset of the audit
must be included and access must be restricted during the asset verification.
There may be circumstances where access cannot be gained to some value
items that are to be included in the audit: -
e Over-locked safes
e Locked drawers or stock units
e Keys or key-holder not available
This must be reported to the operations manager as soon as possible for
further action and advice. The operations manager to subsequently report
the situation to the contract & service manager and investigation team
manager. Any actions arising from discussions should be communicated to
the lead branch auditor as soon as possible. The value of such items should
be discounted from the audit. The discrepancy must be fully explained in the
audit report. In the case of an audit at franchise or multiple branches the
nominee should be informed as soon as possible e.g. at the outset of
the audit.
2.6 Determine if any non-standard transactions are performed at the branch: -
Bureau
ATM
SVM
Lottery
Paystation
Again, not a definitive list but any cash and stock relating to non-standard
transactions must be obtained, verified and included in the audit.
2.7 If necessary display a special notice advising the external customers that
the branch is not going to open at the advertised time. The notice should
give details of the approximate time of reopening and alternative branches
that can be used. The NBSC should be telephoned and advised that the
2.8 Ascertain if the branch operates shared or individual stock units. If
branch operates individual stock units then ensure that access can be
gained to all the cash, stock and vouchers held within the stock units.
2.9 Obtain the previous week’s final cash account. The figures should not be
altered by the Branch auditor in any way or made illegible, as these may
15
POL00462751
POL00462751
need to be produced at a later date, possibly as evidence in a court of law.
Check with the auditee whether any discrepancy in the previous week’s
account has been adjusted e.g. loss made good, surplus withdrawn.
Examine the suspense account to determine if anything is being held and, if
so, whether it is proper to be included in the audit. Request that the auditee
produce the supporting evidence for any amounts held. Losses held in the
suspense account should be held for a period of no longer than 4 weeks and
must have been authorised by the suspense account team (reference
number obtained), via the NBSC.
POL00462751
POL00462751
2.10 The following report printouts must be obtained from the Horizon
system, examined and filed with the working papers in line with the current
retention process:
Office snapshot only — if shared stock unit operated
Balance snapshot for each stock unit and office
snapshot - if individual stock units operated
Suspense account report
Foreign currency holdings
Reversal reports
User summary -- obtain a list of all users and detail
their full names. This can then be checked by
accessing the ‘modify user’ screen and checking that
all entries are current and correct
Un-reconciled/outstanding transfers report
e Transaction log for the day of the audit — branches
audited at the outset of the day — This report must be
produced when the terminal has already been
accessed by the auditee prior to Branch auditor
admittance
e Four week transaction log detailing all transactions
over £5000.00 — this will help when carrying out the
AML Regulatory requirement and Standards CAT
NB. Further reports can be obtained from the Horizon system as
required. The above list is not exhaustive, however this should be seen
as the minimum.
2.11 Obtain the cash declaration for the night prior to the audit. The
declaration from the Horizon system as well as any local record, if
maintained, should be examined, as they will assist with the verification of
the cash on hand. If the branch is unable to produce a cash declaration then
details of the last declaration can be obtained from the event log.
2.12 Count and record all the cash on hand (using standard audit cash input
form) and verify/compare cash figure to that declared. Remember to count
and include lottery takings, cash from Paystation transactions and cash held
in ATMs, SVMs, Bureau, Smoke & Dye packs etc. The cash counted at the
audit may not agree to the branch cash declaration, but this may be due to
an error when declaring the cash, or the cash may have been declared prior
to the close of business on the previous working day.
POL00462751
POL00462751
The cash figure detailed on the office snapshot, for single stock branches, or
the balance snapshot for those operating single stock units, can be used as
a further check. For a Thursday am audit there is also the possibility that the
cash can be compared to the cash figure on the completed cash account.
It may not be possible to immediately check all the cash on hand at the
branch due to the bulk being secured in a main safe, which may not be due
to open until 9.30am or later. A 40-minute internal cell may also be utilised.
In these cases a decision will have to be made whether to allow the branch
to open before this cash has been checked and verified. If in doubt do not
allow the branch to open until all the cash on hand has been counted and
confirmed. Any errors must be investigated and identified to the auditee who
must be given the opportunity to check and agree any discrepancies. Any
significant discrepancies to be investigated by reference to, and evaluation
of, transaction/event logs obtained from the Horizon system.
NB. With the introduction of flexible planning branches are now
allowed to declare cash on hand 20-30 minutes prior to closing and the
time of the cash declaration must therefore be taken into account when
verifying cash found on hand.
Should the auditee present cash after the audit has commenced, and it has
been confirmed that all cash has been produced, it must be excluded from
the audit as the audit result is only based on the verification of the assets
presented as “on hand” at the outset of the audit. The cash must be
accepted from the auditee “without prejudice to investigations or the audit
result” and included in Post Office Ltd funds, but not the audit result.
The situation must be reported to the, contract & service manager,
Investigation team manager and your line manager especially if the
circumstances are suspicious and give cause for concern. Keep a written
record of all discussions and the precise words of any admissions by the
auditee. Mark this as a “True and accurate record of events on........ ”, and
ask the auditee to sign it, if refused endorse the statement “refused to sign’.
2.13 Count and record all the value and non-value stock on hand (standard
audit stock input forms must be used). The “working” stock must be checked
first leaving the bulk/main stock to be checked at a later time. This will allow
the branch to open as soon as possible (once sufficient “working” stock is
available for use by the branch staff) provided, of course, that the cash has
been fully and accurately confirmed.
Once all the stock on hand has been counted and recorded it must be
verified/compared to the Horizon snapshot or the last completed cash
account (Thursday audit). Stock on hand must be checked to ensure that it
18
POL00462751
POL00462751
is current and proper to be held and this should be confirmed with the NBSC
if in doubt. Obsolete stock must be discounted from the audit, the
subsequent shortage included in the audit result and explained in the audit
report. Any errors must be investigated and identified to the auditee who
must be given the opportunity to check and agree any discrepancies.
2.14 Count and record all cheques on hand (standard audit cash input form
to be used) and verify to Horizon snapshot or last completed cash account
(Thursday audit). It should be noted, however, that no cheques should be
reported to Table 5 of the cash account at a Thursday audit. Ensure that
cheques are examined for validity and that any “personal” cheques are not
on hand.
If a personal cheque is found, and there is no evidence of a legitimate
transaction to which it relates then contact the contract & service manager,
investigations team manager and your line manager immediately. This is
likely to result in the suspension of the sub-postmaster, so keep a written
record of all discussions and the precise wording of any admissions by the
auditee. Mark this as a “True and accurate record of events on.” and ask the
auditee to sign it, if refused endorse the statement “refused to sign”.
The personal cheque must be impounded, excluded from the audit result
and a “without prejudice” receipt issued.
POL00462751
POL00462751
2.15 Figures for vouchers already despatched can be obtained from the
Horizon snapshot but all vouchers on hand must be checked and reconciled
to the Horizon snapshot, or cash account if audit performed on a Thursday.
List vouchers on hand for later use when constructing the P32 (standard
audit voucher sheet must be used). When checking and listing vouchers a
daily breakdown of “cheques to processing” and “remittances” must be
recorded for later inclusion in the P32. All the vouchers on hand must be
checked and verified irrespective of the day of the audit. Printouts of
transactions not yet cut-off, therefore still on hand, can be obtained by
accessing the report screen and selecting ‘summaries outstanding’. The
details of the printouts should tie up to vouchers on hand e.g. giro deposits
and withdrawals etc.
It is also important that all vouchers on hand are checked for validity,
early encashment and fraud.
2.16 Count, verify foreign currency holdings and confirm to the sterling
equivalent declared on the Horizon snapshot. Verify all currencies on hand
to the bureau stock snapshot. The sterling held in the bureau stock should
be counted as part of the check of cash on hand. Any errors in foreign
currency holdings should be brought to the attention of the auditee who must
then be given the opportunity to check and agree the discrepancies. The
errors must also be corrected in the Horizon bureau stock at the time of the
audit.
2.17 Count and record lottery scratchcards and reconcile to the Horizon
snapshot and local records, if held. (Sales made in the morning before the
audit may have to be taken into account, as the retail side is usually open in
advance of the post office counter). Scratchcards will normally be held on
the retail counter and it may be necessary to physically count the cards
outside the counter area. In this case care and vigilance must be exercised
at all times. Any cash held on the retail side relating to sales should be
included in the cash on hand verification. If lottery takings are not to hand,
have not been transferred over to the post office counter or are banked into
a personal account then this must be reported to the contract & service
manager, investigations team manager and line manager.
2.18 Obsolete scratchcards must be discounted from the audit result and the
shortage explained in the audit report. The scratchcards on hand can be
verified by reference to the I rix held on the Branch Audit Library or
by telephoning the NBSCL . The auditee to be advised that any
obsolete scratchcards must be dropped from the cash account and the
resultant shortage made good. This should be actioned at the time of the
audit and detailed in the audit report.
20
POL00462751
POL00462751
2.19 Obtain the following reports from the lottery terminal and the auditee,
depending on the type of branch (GVT or OLT):
On line summaries
Instant summaries
Summary Inventory
Pack status reports
Activation receipts
21
POL00462751
POL00462751
Verify the lottery figures from the daily summaries to the Horizon snapshot
and record using the standard audit voucher sheet, for later use when
constructing the P32:
Weekly sales
Activations
Prizes paid
De-activations
2.20 Using the summary inventory and pack status reports confirm and
reconcile the unactivated scratchcards. It should also be confirmed that the
scratchcards on sale have all been activated. The pack status reports
identify the status of the cards held:
CONFIRM - Pack is unactivated
ACTIVE - Pack is activated
2.21 Count and verify the contents of the stamp vending machine (SVM).
Please note; cash in the SVM should be kept to the absolute minimum, any
excess cash should be removed. The branch should maintain a SVM quality
of service record detailing instances when the machine has been out of
service, and for how long, and where there have been discrepancies and the
value of the discrepancy. It is important that the machine remains
operational at all times.
2.22 Obtain the bar code summary report from the Paystation terminal.
Count all monies accepted in respect of transactions carried out on the
terminal to ensure that they balance to the amount detailed on the report. It
is important that the summary total is entered into the Horizon system as
soon as possible after the bar code is available for scanning. If this is not
done the agent will receive repeated reminders to do so. Failure to comply
with this requirement on a regular basis will cause the Paystation to be
suspended. To note; the maximum amount of post office cash that can be
held on the retail side is £250.00. The total of the bar-code summary and
monies in respect of transactions should be included in the P32
2.23 Verify figures held in suspense tables and confirm that they are proper
to be held and will be included in the audit. Examples are:
e Vouchers for despatch in next remittance
e Pension home cheques
e RD cheques (14 days)
e Remittance shortages/surpluses (4 week
maximum)
¢ Cash in pouches awaiting collection
22
POL00462751
POL00462751
NB. Please note that this list is not meant to be definitive. Other
amounts may be held in suspense and included in the audit but the
lead branch auditor will need to make a judgement or seek further
advice.
2.24 Although shortages/surpluses held in suspense may be verified and
found to be proper to be held they are not included for the purposes of the
audit. Any misbalances held in suspense must be discounted from the audit,
included in the audit result and this subsequently explained in the audit
report.
23
POL00462751
POL00462751
Amounts improperly held in the suspense account must also be excluded
from the audit and then reported via the audit report. For amounts in excess
of £500 then these should be reported immediately to the contract & service
manager, investigation team manager and your line manager for further
action. The audit report must detail that the amounts were held “without” the
necessary authority. It may also be necessary to telephone the NBSC
suspense account team to confirm the authenticity of a shortage/surplus
held in the suspense account if no supporting paperwork or authorisation
number is held at the branch.
2.25 Confirm that all error notices identified by the prep data file have been
brought to account. Any outstanding error notices found on site must also be
brought to account at the time of the audit. Also a call must also be made to
the Debt Recovery Team in order to obtain information on any further
outstanding error notices. Attempts must be made to bring any errors
outstanding to account whilst on-site. This may involve carrying out some
investigative work to prove the error is proper to be raised.
Contact — Debt Recovery'—~
2.26 Should the auditee admit any fraudulent activity then he/she should be
immediately advised that the branch will be kept closed, if still closed at the
time, or closed forthwith, if previously allowed to open for business. The
contract & service manager, investigations team manager and your line
manager must be contacted as soon as possible.
As with other scenarios raised in this manual a written record of the precise
words of the admission and any other discussions must be kept. Mark this
as a “True and accurate record of events On .................0066 ” and ask the
auditee to sign it, if refused endorse the statement “refused to sign”.
NB. In order to maintain objectivity and independence do not enter into
any discussion with the auditee regarding the admission, the nature of,
or the problems with the fraudulent activity. The audit role is simply to
report the facts and not to make judgements; any discussions with the
auditee could prejudice later investigations.
2.27 Where the audit is the second of the day and the branch is open for
business then it will not be possible to confirm cash to a branch declaration.
All cash, stock and vouchers must be counted and recorded (using the
standard audit input forms) and confirmed to the Horizon snapshot in this
scenario. It may be necessary to close the branch for a short period in order
to check the cash, stock and vouchers held at the counter. If this is
necessary then a special notice must be displayed advising customers that
the branch is going to be closed. The notice should give details of the
24
POL00462751
POL00462751
approximate time of opening and alternative branches.
The NBSC should be telephoned and advised that the branch is to be
temporarily closed (the NBSC should also be contacted when the branch re-
opens). As previously stated, it is important that the location of all cash,
stock and vouchers is confirmed as the branch may be open for business
and these items held in a variety of places. The need to produce all cash,
stock and vouchers at the outset of the audit is still important and this must
be stressed to the auditee. Determine if any non-standard transactions are
performed at the branch (lottery, SVM, bureau, ATM and Paystation) and
remember to include any cash, stock and transactions in the audit.
25
POL00462751
POL00462751
SECTION 3 - CONSTRUCTING THE P32:
3.1 Obtain the last completed final cash account and input the “Balance due
to Post Office” figure (line 1085: payments table) to the accounts sheet of
the P32. Subsequently complete the following sheets/tables in the P32
taking the data from the last completed cash account/s*:
Cash and stock on hand table (from Table 5)
e Suspense sheet (from Tables 2,2A & 3)
e Postage breakdown (from Table 5(b))
e *Previous 8 weeks cash account results
NB. Once these figures have been input remember to check that the
result of the cash account on hand is confirmed by the P32
spreadsheet. Any input error at this stage will affect the audit result.
3.2 The standard audit working papers (cash sheet, stock sheets and
voucher sheet) must be fully completed in ink and signed by the completing
branch auditor. The completed sheets should be supplied to the lead Branch
auditor as soon as possible. All the data obtained and documented as part
of the asset verification process can now be input to the P32 worksheet to
determine the audit result. The following sheets within the P32 to be utilised:
e Cash & Chqs
Postage
Other Stock
Phil
Daily
Suspense
e Rems
Please note that the cheques to processing centre, or cheques to Belfast
Cash Centre for NI branches, must be entered to the P32 by day rather than
a bulk figure. The data input to these sheets will feed to the accounts sheet
and will identify the audit result.
NB. Most of the figures included within the accounts sheet are linked to
other spreadsheets and are therefore password protected. There is
however some figures that must be input straight into the accounts
sheet and these include:
e Foreign currency — sterling equivalent
e Error notices — brought to account including giro
errors
e Stock up rating — postage, philatelic, postal orders,
discount wholesale
26
27
Business purchases/sales
Counters revenue
Asylum seekers vouchers
London Boroughs schemes
Redistributed national lottery cards
Unpaid cheques to ‘TP’
Giro rent balance entry
POL00462751
POL00462751
POL00462751
POL00462751
3.3 The audit result will now be identified by the audit of accounts (P32)
spreadsheet and this should be confirmed to the expected result taking into
account the following factors:
e Have amounts in suspense been discounted?
e Has any forged notes / obsolete stock been
discounted?
e Has the previous cash account discrepancy been
rectified?
e Have errors been found in cash, stock and vouchers?
NB. This list is not exhaustive but will reflect the circumstances found
at each individual audit.
3.4 Should the audit result identify an unexpected large discrepancy then
further investigations must be made before advising the auditee.
e Ensure that all input sheets have been totalled correctly
e Check that all amounts on input sheets have been input
to the P32
e Check that there are no omissions on the input sheets
i.e. missed scratchcard total.
e Confirm that there have been no other input errors to
the P32 i.e. cash, vouchers, suspense
e Examine the variance in stock levels from the previous
week to identify unusual holdings. (Include the postage
breakdown in this check)
NB. Once again this list is not meant to be exhaustive.
3.5 It is becoming increasingly apparent that, now that the ability to suppress
remittances has effectively been removed, Cheques to Processing Centre
figures are being used to conceal fraudulent activity. When performing an
audit, it is extremely important that:
e Any large amounts of cheques claimed as remitted during the period
since the last declared cash account are examined against the levels
of receipts, figures for previous week and, if necessary, verification
against Horizon reports.
e Any large value cheque discovered at the time of the audit is
questioned and compared to the transaction it was claimed to support
If there is any doubt, then contact the operations manager at the time of the
audit.
28
POL00462751
POL00462751
3.6 Once the audit result has been confirmed then the auditee should be
informed and an explanation obtained. If no explanation is offered then any
discrepancy in excess of £500 must be reported to the contract & service
manager, investigations team manager and your line manager.
3.7 Request that the agent adjusts the discrepancy or seek proposals for its
recovery in the event of a loss.
29
POL00462751
POL00462751
3.8 Within the P32 there are several spreadsheets and documents that need
to be completed before the P32 is finalised and emailed. The information to
be input to each of the sheets/documents is as follows:
30
Planning — details the planning activities completed prior to
the audit
CATs — details the compliance tests to be performed at the
audit and any amendments that need recording due to
changes whilst on site.
Account - receipts, payments, cash & stock and details audit
result
e Suspense - amounts held in suspense account
Rems - value and details of remittances received and
returned
Daily — input sheet for receipt and payment voucher details
Postage label report — input sheet for recording postage
labels issued and rejected
Cash usage sheet — this should be completed at all audits
regardless of the audit result to identify any anomalies in cash
holdings/usage
Cash & chqs — input sheet for cash and cheques on hand
Foreign currency - input sheet for detailing foreign currency
by country and denominational breakdown
Postage & Other stock — input sheets for postage & other
stock on hand
Phil — input sheet specifically for philatelic items, for use
where branch holdings are high
Rec — input sheet for non-value stock reconciliation other
than MVLs
MVL rec — input sheet for vehicle licence reconciliation only
Equip — details of all equipment used by all members of the
team performing the audit
SMCat — used when performing the stock management CAT
test
Docs — the only document in this section is the “Extra
Report”. This is an additional report template to be used in
certain circumstances and will be covered separately in this
manual
PAA - post audit activities table to be completed by the lead
Branch auditor
R&B — documents to be only completed at robbery / burglary
audits. All of the documents must be deleted at other audit
types prior to emailing
POL00462751
POL00462751
e Measures — this sheet must be completed fully after all audits
using the latest guidelines and the comments included in the
sheet
NB. There are 5 sheets (Dbase; Core; Other CG; Conformance full CAT;
Conformance part CAT) included in the P32, which do not require any
input. The sheets contain information that feeds from other sheets
within the P32, and the management information team exclusively uses
them.
3.9 It is important that the measures sheet is fully and accurately completed
following all audits, using the latest guidelines, with all boxes completed. It is
essential that the information recorded is accurate and in the correct format
e.g. words or figures otherwise it will not feed through to the databases
utilised by the management information team.
The information taken from the P32s is very important and
considerable time and effort is wasted when the measures sheet is not
completed correctly.
SECTION 4— ON SITE VERIFICATION OF REPORTED FIGURES:
4.1 It has become increasingly clear that some details previously verified
after the audit by a separate duty could in fact be verified on site at the time
of the audit. This means more timely verification and early detection of any
fraudulent activity. The procedures are as follows:
REMITTANCES
e Whilst on site as soon as possible, usually I once the branch has opened
e Provide pouch numbers, value and dates of all outward remittances
despatched to the cash centre during the week of the audit
e Provide pouch numbers, value and dates of all inward remittances
received from the cash centre during the week of the audit
e The PAA duty must be contacted at all audits, even where no remittances
have been received at, or despatched from the branch. This will confirm
that there have been no remittances and prevent suppression
e Post audit duty will verify details against the SAPADs system and contact
the lead Branch auditor, at the branch, to confirm results of the check
e lf remittances are confirmed annotate the Post audit activity sheet and
record the pouch numbers
e Ifa discrepancy is reported then your line manager must be contacted
immediately with the details
31
POL00462751
POL00462751
NB. Ensure that any remittances on site at the branch, prepared for
despatch, are opened and checked at the audit to confirm and verify
the contents.
LOTTERY CHEQUES AND ROD LICENCES
e Serial numbers of lottery cheques and rod licences to be obtained from
the prep data prior to the audit and recorded on the planning sheet within
the P32
e Details to be confirmed on site at the audit by examination of the cheques
and licences on hand
e lf details are confirmed then the planning sheet and the post audit activity
sheet to be completed to confirm accuracy of check
e lf discrepancy noted then post audit activity and planning sheets to be
marked as unconfirmed and your line manager contacted.
NB. These are currently the only on site verifications performed but it is
the intention to extend the checks to: -
Travellers Cheques
Motor Vehicle Licences
Cheques to Processing
32
POL00462751
POL00462751
SECTION 5 - IRREGULARITIES AND DISCREPANCIES:
5.1 It may be necessary to contact the contract & service manager,
investigations team manager and your line manager to report findings,
errors, discrepancies or admissions. This should be done at the earliest
opportunity. This will allow discussions to take place and a decision be made
whilst the lead branch auditor is still on site at the branch and will ensure that
the matter is dealt with quickly and efficiently. Contact should be made via
mobile phone, as this will ensure confidentiality (use mobex number). The
use of the auditees’ telephone should be avoided.
5.2 The line manager must be contacted in the following circumstances,
where:
There is an unexplained discrepancy in excess of £500
There are any irregular or suspicious circumstances
There is an irregular personal cheque on hand
Credit sales are operated
There is an admission of misuse of Post Office Ltd funds
or fraudulent activity
The auditee refuses to allow access to the premises
e Cash on hand has been inflated or an amount of cash is
produced after the audit has commenced
e Lottery takings are not to hand but banked in personal
account
e There are any unauthorised amounts held in suspense
account
e Error notices are on hand and not brought to account
within expected timescales
e There are discrepancies found in on-site verifications
e The auditee is “rolling” losses
If the lead Branch auditor has any other concerns or is
unsure
e The auditee cannot make good losses and is unable, or
unwilling, to put forward proposals
This list is not meant to be exhaustive as there will always be circumstances
that arise that won't be covered by any list no matter how long. Regardless
of the circumstances, if there is any doubt or concerns then contact the CM3
branch auditor.
Please note; for discrepancies in excess of £5K the operations
manager should be made aware. The operations manager will inform
the national branch audit manager of any amounts in excess of £25K.
33
POL00462751
POL00462751
5.3 When contacting the CM3 branch auditor, or operations manager if
appropriate, it would be helpful to have some information to hand prior to
making the call and this will include:
Date of the incident
Time of the incident
The name of the branch
The address of the branch
Postcode
The FAD code of the branch
Telephone number of the branch
Sub-postmasters name
Branch audit leader
Names of all Branch auditors in attendance / assisting
Name of Branch auditor revealing findings
The risk type
Date of last audit
Result of last audit
Amount of the discrepancy
Amounts that make up the suspense account
How the discrepancy was discovered
Details of any non-value stock losses
Name of the C&SM dealing
Name of person dealing in the absence of the C&SM
Name of the investigator dealing
Details of the decision taken by the C&SM
Location of the assets
Any other comments relative to the event
If this information is to hand prior to making the call to the CM3 branch
auditor (or operations manager if appropriate) then this will greatly assist in
the completion of the Event capture form (ECF).
5.4 Once a call is received to report a discrepancy or irregularity from the
branch auditor on site the CM3 branch auditor will take the following action:
34
Report the discrepancy to the operations manager if in
excess of £5K, or for a lower amount where there is clear
evidence of wrong doing and a suspension has not taken
place
Complete an ECF discrepancy report and e-mail to S&A
Casework, operations managers and management
POL00462751
POL00462751
information manager. In cases where the discrepancy
exceeds £25K the national branch audit manager must
also be copied in
e Report to the national branch audit manager if it is greater
than £25K — relaying all the detail as above
5.5 It may be necessary in certain circumstances to suspend the sub-
postmaster. If there is no one else in the area then communicating the
decision will be the responsibility of the lead branch auditor on site. In this
case advise the auditee the contracts & Service manager has decided that
he/she will be precautionary suspended pending the results of further
investigations. The contract & service manager will contact them in due
course and, until then, the branch will remain closed” (unless an interim sub-
postmaster is appointed).
DO NOT APOLOGISE NOR ENTER INTO DISCUSSION AS TO WHY A
SUSPENSION HAS BEEN AFFECTED - REFER THE AUDITEE TO THE
CONTRACT & SERVICE MANAGER.
5.6 Should the auditee be suspended then there is a possibility that the
branch will remain closed and the assets defunded (please refer to the
Closure section of the Audit Process Manual for details about the defund of
a branch). In this case a special notice to this effect should be displayed and
the NBSC Helpline should be contacted to advise them of the situation. If the
branch is to remain closed then the door and safe keys will need to be
secured once the Branch auditors have left the branch.
In all cases the contracts & Service manager, or a representative of the area
intervention office should be requested to attend the branch before the
branch auditors leave, to take responsibility for the alarms and keys. If this is
not possible, as a last resort the alarms will be changed and set and the
keys taken away by the branch audit team. This will, however, merely be a
temporary measure and the keys and alarm codes should be transferred to
the contract & service manager at the earliest opportunity. This arrangement
should be discussed and organised prior to the lead Branch auditor leaving
the branch.
SECTION 6 - CLOSING MEETING:
6.1 Once the asset verification and compliance tests have been completed,
the audit findings will need to be discussed with the auditee. The following
guidelines should be followed:
35
POL00462751
POL00462751
The closing meeting should already have been discussed and
planned with the auditee as part of the opening meeting at the
outset of the audit
The meeting should be conducted in private whenever possible as
some of the points for discussion may be sensitive
The lead Branch auditor should be familiar with all the findings of
each test completed
When talking through the findings it is important to discuss them in
a balanced way and be able to qualify exactly what is meant. The
reason for any actions should be made clear. The consequences
and impact of not complying should be communicated; however
“because it is in the rules” is not an acceptable explanation. It is
useful to point out where the correct procedure is documented and
the importance of adherence to it
The lead branch auditor should look to influence the auditee
whenever possible — including providing a copy of an action plan so
that the auditee knows what to expect and selling the benefits of
conformance and the impacts of non-conformance
All the auditees’ comments or requests should be documented and
incorporated into management summary section of the branch audit
report
Allow the auditee time for questions
Following the closing meeting a customer satisfaction feedback
form should be left with the auditee at the branch — again try to
influence the auditee to complete the form and outline the benefits
to him/her e.g. possible improvements to auditing etc.
SECTION 7 — AUDIT REPORTING:
7.1 Following an audit the separate ‘stand alone’ audit report must be
completed. To note there are three current audit report templates:
AV only — to be completed for asset verification only audits where a
compliance check has not been undertaken
Compliance only — to be completed for compliance only audits
where an asset verification has not been undertaken
AV+ and Full - to be completed at audits where a full asset
verification and selected compliance testing has taken place
7.2 Once the audit has been completed it is important that a clear, concise
and well-balanced report of findings is written and communicated to all
appropriate recipients. The report template should be completed as follows:
36
Open the latest audit report template and save in the same format
POL00462751
POL00462751
as the relevant P32. Details should include the FAD code, date and
branch name e.g. 023323.010105 Wakefield.xls
Enter the following details to the front sheet of the report:
e To whom report is addressed & job title (drop down selection to be
used for position)
e From whom report is being sent & job title (drop down selection to
be used for position)
e Details of who the report is being copied (drop down section to be
used for position and location)
Date of issue of the report (correct format being 01 January 2005)
Post Office name & FAD code
Date of visit (correct format being ‘day’ 01 January 2005)
Who the actions were agreed with
Name and contact details of the line manager
The control gaps found at the audit should be reported to the action plan at
Appendix A in the audit report. It is also important to detail all the areas
covered as part of the audit and where non-conformance was identified, this
in the management summary section.
37
POL00462751
POL00462751
7.3 The management summary should be completed, in full paragraphs,
detailing the following:
The result of the financial audit
The areas tested
The areas where there is conformance e.g. controls deployed
A sentence to indicate which gaps have not been actioned since
the last visit, and which ones they are e.g. actions highlighted on
bold within the action plan are those that have been reported
previously however no action taken.
Any other info that is critical to the report e.g. failure to comply with
regulatory requirements (Anti-Money Laundering and Financial
Services), poor security of assets (including value of funds at risk
etc).
The management summary section should also be used to balance
the report and identify any good working
There is no requirement to mention previous gaps that have now
been actioned
The report reflects the discussions held with the auditee at the
closing meeting and does not raise any new or unexpected
recommendation
When completed the report must be subject to a check of both the
spelling and punctuation.
7.4 The audit result (full breakdown) and any other details relating to the
asset verification must be outlined in the section named ‘result of financial
audit’. Suspense account details and the situation regarding the audit
discrepancy must also be reported e.g. proposals to make good losses etc.
7.5 Section 4 should be completed detailing the branch name, FAD code
and date the audit was carried out.
7.6 The Action Plan should be completed ensuring that:
38
e The branch name and FAD code are entered
Headings for areas tested input
All relevant control gaps included in the action plan — this should
be done by highlighting the required control gap from within the
excel actions template and copying to the action plan
No alterations are made to the standardised control gaps/actions
Page breaks are inserted to align the actions within the table
POL00462751
POL00462751
7.7 Upon completion save the report and e-mail with the P32 to P32file lotus
notes address.
7.8 Reports completed in respect of audits carried out at the top 15 multiple
and franchise companies should be e-mailed to the nominee (please see
Appendix E) and the multiples e-mail address: multiples} GRO.
NB. THE REPORT IS AN IMPORTANT OUTPUT OF AN AUDIT AND AS
SUCH IT IS VITALLY IMPORTANT THAT IT IS WELL WRITTEN,
BALANCED AND CLEARLY DOCUMENTS THE AUDIT FINDINGS.
REMEMBER A BAD REPORT LEAVES A BAD IMPRESSION!
39
POL00462751
POL00462751
7.8 There is an extra report template within the P32 for use when it is not
appropriate to issue a normal audit report. This would be used in cases
where:
e There is extra information, not detailed in the normal report
that might be useful to other parties e.g. contract & service
manager, Investigation team manager etc.
e The audit is a concern of the contract & service manager or is
an investigation team request
This report once completed should be detached and saved to the C drive
and subsequently emailed to the appropriate recipients - IT SHOULD NOT
BE SENT TO THE AUDITEE.
NB. Whatever the audit type there should always be a completed report
included with the P32, even in cases where the Sub-postmaster is
suspended - either the separate standard audit report or the extra
report within the P32.
Timescales for reports
All audit reports (branch & extra) should be completed, at a minimum, within
five working days of the audit taking place. However every effort should be
made to produce an extra report at the earliest opportunity (before the five
days) to assist the sales and service team. All extra reports must be sent by
e-mail to the respective area intervention office, and copied to the
investigation team leader.
SECTION 8 - OFF-SITE ACTIVITY:
8.1 Following the audit, the lead branch auditor should complete the
following activities:
e Ensure the P32 is fully completed including all documents and
sheets
e Ensure an audit report is fully completed
e Ensure the measures sheet, in particular, is fully and properly
completed
e Complete the Post audit activity sheet
e Save and password protect the P32 and the audit report in the
correct format e.g. 023323.010105 Wakefield.xls
e Save and password protect a copy of the extra report to the C
drive
e E-mail the P32 and the audit report in a zip file entitled
023323.010105 Wakefield to P32 File e-mail address
40
POL00462751
POL00462751
e Email a copy of the audit report to the area intervention office,
FAO the contract & service manager. For franchise and multiple
branches a report should go direct to the nominee via e-mail
e Email a copy of the extra report to the contract & service
manager, investigations team manager and your line manager.
In cases where a discrepancy exceeds £5K then also send a
copy to the Operations manager, and amounts in excess of 25K
copy in the national branch audit manager
address denise.west( GRO ;
e Email a copy of the postage label report to the following address
S8&A Casework( GRO ik
e Management information support will verify the cheques to PC
values
SECTION 9 - OPEN PLAN AND COMBINATION FORMATS:
9.1 Open plan branches are those without a physical screen barrier between
the customer and the person serving.
9.2 A Combination Store is the title given to retail branches that combine
other retail business with Post Office transactions using the same point of
sale. The same person will deal with private and Post Office transactions,
but funds and accounts will be separated.
9.3 The asset verification process outlined in this manual can be applied to
open plan and combination branches, but special care must be taken
because of the different security arrangements.
9.4 Various types of safe will be found in operation, each with the purpose of
protecting cash from counter snatch and theft. The various types are:
Flip Top Till
e A Flip Top Till will be fitted into the top of the counter surface. The Flip
Top till is operated from a push button with an isolating key switch which
requires to be fitted to a suitable adjacent under counter location. The Flip
Top Till of the open plan desk should be limited to hold £500 (less if this
figure represents more than 1‘? hours pay out) cash at any one time.
There should be no more than £500 at risk at any one time at the counter
position. Any other available cash exceeding £500 must be dispensed
into the Cash Funding Unit, (BidiSafe max. £300 per cassette or
Rollercash max. £500 per slot) or into the Drop Safe. Any inpayments that
increase the float to exceed £500 must either be dispensed into the Cash
Funding Unit (BidiSafe max. £300 or Rollercash max. £500) or into the
41
POL00462751
POL00462751
Drop Safe.
Cash Funding Unit [BidiSafe]
e Always ensure that the arrangements for the loading and unloading of
cash are implemented outside of business hours with the office front
door locked.
Main door keys to the BidiSafe must be secured in the Main Safe
except when loading and unloading - as above. The cash-funding unit
must not be used for overnight retention of cash. The amount of cash
that is held in the BidiSafe during the day must never exceed £6k [20
cassettes x£300]. The maximum amount of cash that the cash-funding
unit can dispense for each transaction must be limited to £300.
Cash Funding Unit [Rollercash]
e Loading and unloading of cash must be implemented outside of Post
Office and retail business hours with the front door locked. The Cash
Funding Unit can be used for overnight retention up to a maximum of
£20,000 where the case complies to Post Office approved standards
however where this is not provided cash must be secured within the
safe in the back office and the alarm system set before leaving the
office. The maximum possible amount of cash that could be held
during the day is £19k [18 slots x £1000 and 2 slots x £500. The
maximum amount of notes that the Cash Funding Unit can dispense
for each transaction is £500. The Rollercash programming will reject
deposits or withdrawals higher than £1000. There should be no more
than £500 at risk at any one time per counter position. Keys to the
Cash Funding Unit when not in use must be secured in the main office
safe. Two or more users can operate from one RollerCash i.e. multi
user applications.
42
POL00462751
POL00462751
Drop Safe [DS]
e The Drop Safe comprises of a top [drop] slot capable of accepting up
to small bundles of notes and small bags of coin. The main door is
fitted with a key lock. All cash in excess of the £500 float must be
deposited in the Drop Safe or re-deposited into the Cash Funding Unit
[BidiSafe max. £300 or Rollercash max. £500]. Cash must be removed
from the Drop Safe and stored in the main safe outside of business
hours.
9.5 Many of these sophisticated safes are fitted with “fast access” devices to
allow for rapid replenishment. This facility MUST NOT BE USED if the public
are in the shop or branch. It may be that cash counting will require
considerably more time and consideration will have to be given at the
planning stage to the staff resources required.
9.6 To minimise security risk to staff and funds, the following principle
applies:
“Under no circumstances should bulk cash be counted in positions
which are exposed to the public”.
All cash on hand should be counted in a secure back office area (if
available) or prior to the branch opening for business to avoid the problem.
9.7 Keys to the desk drawers must not be left in the locks at any time.
The desk drawers [fitted with slam shut locks] must be closed whenever it is
necessary to leave the desk, regardless of the length of absence.
9.8 All holdings of stock, licences and other value items must be kept to the
minimum
level, which will meet the requirements of providing an efficient service to the
customer. Obtaining additional holdings during the day is preferable to
holding too much stock at the counter. At the close of business, all cash and
value and secure stock items must be withdrawn from the FTT, BidiSafe and
desk drawers and secured in the Main Safe.
9.9 Where applicable motor vehicle licence discs should be kept to an
operational minimum at the open plan counter and must be kept in the
lockable top drawer of the desk. At the close of business, motor vehicle
licence discs must be withdrawn from the open plan position and secured in
the Main Safe.
9.10 Datestamps must be secured using the retention unit on an under
counter shelf when not being used. If a desk is to be left unattended for any
length of time, the datestamp must be secured within a locked drawer. At the
43
POL00462751
POL00462751
close of business, the datestamp must be withdrawn from the open plan
position and secured in the Main Safe.
9.11Stamp folios must be secured using the retention unit on an under
counter shelf when not being used. If a desk is to be left unattended for any
length of time, the stamp folio must be secured within the locked desk flap.
At the close of business, the stamp folio must be withdrawn from the open
plan position and secured in the Main Safe.
9.12 Transactions must be completed as quickly as possible; cash, secure
stock and documentation etc. must be secured in the Flip Top Till, Cash
Funding Unit [BidiSafe or RollerCash], Drop Safe and drawers straight away.
Cash or documentation including stamp folios must not be left on top of the
freestanding desk. Confidential documentation must not be in a position
where customers can read it. Secure mail must be kept in a secure place out
of reach of general public.
9.13 Where fitted the Giro/Remittance Acceptance Unit must be used for in
payments of more than £500. Remittances must be checked or Horizon
scanned and signed for within the locked back office and not at the open
plan counter positions. For branches with no back office Horizon equipment,
the remittance must be opened after acceptance and deposited into the
main safe immediately. The packaging then being Horizon scanned at the
counter based Horizon equipment. In the event of a Remittance being over
£500 where no Giro/Remittance Position is fitted the office front door must
be closed and locked at the moment of acceptance.
9.14 Where fitted the Giro/Remittance Acceptance Unit must be used for in
payments of more than £500. Giro business deposits up to a maximum of
£500 only can be transacted across the counter and deposited into the Drop
Safe immediately. Local arrangements for the acceptance of Giro deposits
will need to be made in advance between the Sub-postmaster and customer
if the value exceeds £500 where a Giro/Remittance place is not fitted. In the
event of a Giro deposit being over £500 the office front door must be closed
and locked at the moment of acceptance.
SECTION 10 - FRANCHISE AND MULTIPLE BRANCHES:
10.1 The prep data will provide details of branches that are of either a
franchise or multiple type. The lead Branch auditor should obtain this
information at the preparation stage along with:
e The name of the multiple / franchisee
e The multiple/franchise company contact point e.g. nominee
e The name of the Contract & service manager
44
POL00462751
POL00462751
10.2 The asset verification process outlined in this manual can be applied to
multiple and franchise branches with the following exceptions:
10.3 If highlighted in the CARM model the lead branch auditor will need to
determine if the procedural security compliance paper needs to be
undertaken if the branch is a franchise. Some franchise branches are self-
insured and in these cases the security paper should not be completed. The
self-insured franchise branches can be identified from the branch details
excel spreadsheet. Any major security weaknesses must be still noted,
however, and commented upon in the audit report. Where the franchise is
not self-insured the procedural security paper will need to be completed and
any findings/recommendations reported as normal.
10.4 On arrival at the branch, the lead branch auditor should make the visit
known to the store manager and any local entry procedures must be
adhered to. At the beginning of the audit the lead Branch auditor must
telephone the company contact e.g. nominee or post office representative as
soon as possible to advise that an audit is taking place and to invite them to
the closing meeting at the branch. The estimated time of the closing meeting
should be advised and, if the company contact is unable to attend, it must be
confirmed that they are happy for the audit findings to be discussed with the
Officer in charge on site. In this situation, the nominee or post office
representative must be contacted upon completion of the audit to relay the
findings.
45
POL00462751
POL00462751
10.5 Multiple and franchise branches are currently given dispensation from
the Liability for Losses Policy, by the National Multiple Partners Manager, to
hold up to a maximum of 4 weeks discrepancies in the suspense account.
This also applies to Franchise branches. However, as the purpose of the
audit is to report upon the true state of the accounts, the audit result must
exclude any amounts held in suspense, and the subsequent audit report
must simply detail the actual audit result and the breakdown of any amounts
held in suspense, including the dates of the cash account (week numbers)
they relate to. As the issue of dispensation is currently subject to review,
there should be no reference to dispensation within the report (either verbal
or written).
10.6 Any irregularities, discrepancies, admissions etc. should be reported to
the operations manager. In particular, the operations manager must be
contacted in the following circumstances: -
e Branch discrepancies in the suspense account have been held
in excess of 4 weeks
e Error notices have been brought to account and the resultant
shortage / surplus has been transferred to the suspense account
In both of the above cases a copy of the audit report must subsequently be
emailed to the Operations manager.
SECTION 11 —- ACCESS TO THE HORIZON SYSTEM:
11.1 It will be necessary as part of an audit to gain access to the Horizon
system at the branch being audited. There will also be times when different
levels of access will be required and the following should be adopted: -
e Normal Risk Audits
Branch auditors can be added to the system as a user in order to
print the necessary reports or the reports can be requested from,
and produced by, the sub-postmaster. Where the auditee
supplies the reports, a branch auditor should remain in
attendance whilst the reports are produced. If the audit
subsequently develops into a “problem” then a ZAUD99 one-
shot password is to be obtained for further use of the system.
Any extra users can then be added to the system, if required,
from the ZAUD99 user ID.
e Investigation team requests and Operational risk audits
It is important at these audit types that we do not jeopardise
46
47
POL00462751
POL00462751
future court cases or prosecutions by ensuring we have followed
proper access procedures to the Horizon system. A ZAUD99 one-
shot password should therefore be obtained for access to the
system and this to be obtained on site in the secure area. Once
logged on as ZAUD99 user it can then be used to create other
users on the system in order to later assist with the production of
transaction/event logs.
POL00462751
POL00462751
11.2 If the audit is a contract and service concern or investigation request
then the ZAUD99 level of access will be required. The NBSC must be
contacted as soon as possible after the start the audit to commence the
process for obtaining this type of access. As previously stated do not attempt
to log on to or gain access to the Horizon system until this one-shot
password has been obtained. Any delays or problems in obtaining a one-
shot password must be reported to the operations manager following the
audit.
NB. If users have been added to the system during the course of an
audit remember to delete them from the system at the conclusion of
the audit before leaving the branch.
SECTION 12 - ATMs:
12.1 There are 4 different ATM types on site at branches in the network and
this will be identified in the prep data for the branch audited
12.2 The different types of machines in the network are:
e PO maintained — this machine holds between £50k — £80k
and is funded by a remittance received at the branch. The
transactions are reported through the branch cash account
e Fully Serviced — this machine type is totally maintained by
Securicor
e Self-fill: Retail cash — this machine is funded from private
cash and under no circumstances must Post Office funds
be utilised. This is considered misuse of funds and should
be reported to the Audit Manager (Operations)
e Self-fill: PO cash — these machines hold £1k - £3k and are
funded from PO funds
12.3 There are consequently only 2 machine types that would need to be
verified as part of the audit process. Although it is not possible to open any
of the ATMs whilst the branch is open for business, consideration should be
given to checking the contents of the ATMs before the branch is allowed to
open. If the branch (or the retail side) is already open for business when the
audit commences then they should be closed for a short period whilst the
ATM contents are checked.
12.4 Although the contents of the ATMs should be checked and verified
whilst the branch is closed this is not always practical. As a last resort a
report can be obtained from the Self-fill: PO cash machines that details the
holdings in the ATM without opening the machine. Report obtained as
48
follows:
49
POL00462751
POL00462751
Hold down blue key and simultaneously press the 1 key
Select management functions
Enter 6 digit password and press OK
Select close menu
Select trial cassette close (this prints totals without
resetting
Select exit twice, then set to customer transactions
POL00462751
POL00462751
12.5 Every effort should be made to verify the contents of an ATM. This
could include having to close the branch temporarily until the cash cassettes
have been removed and secured within the counter area. The branch will
then be allowed to reopen until a quieter time when again the branch can
close to allow the ATM to be reloaded with the checked cash cassettes. It
must be stressed to the auditee that this process will take no longer than 5
minutes for each procedure, e.g. procedure 1 — remove cassettes &
procedure 2 — insert cassettes.
12.6 If, however, it is not possible to perform a physical check of the ATM
during the audit then sufficient reports should be obtained from the ATM to
provide assurance that funds are on hand within the ATM. This should be
subsequently fully documented in the audit report, and reported to the
Operations manager at the time of the audit.
12.7 The obtaining of ATM reports should not be considered a replacement
for physically checking the actual contents of the machine. It should be used
as a temporary measure to carry on with the audit until such time (during a
quieter period of the day as mentioned above) when the branch can be
closed for a short period to perform the physical verification.
12.8 In extreme circumstances when the ATM is unable to be accessed, 4
weeks cash accounts entries for ATM withdrawals should be checked to
ascertain whether alleged holdings are feasible. All instances whereby the
ATM cannot be accessed must be reported to the Operations manager and
the Contract & service manager.
SECTION 13 - SMOKE AND DYE PACKS:
13.1 There are a large number of branches that are supplied with smoke
and dye packs as a security item. £20 notes surround the packs and these
notes must be included in the branch cash declaration and must be counted
as part of the asset verification.
13.2 The following guidelines apply:
£20 notes surrounding ECA Dyepacks
Two types of ECA Dyepacks found at Post Offices:
1. The ECA 16E/1 Dyepack (maxi-pack):
50
POL00462751
POL00462751
yt ae
a
20H <We20
The ECA 16E/1 Dyepack is housed within a Bank of England dummy bundle
with 2 genuine £20 notes stuck either side — a total of 4 £20 notes (£80).
ECA 16E/1 Dyepacks and surrounding £20 notes are often contained within
a transparent PO Giro note-bag.
SI
POL00462751
POL00462751
1. The ECA Smokenote™ (thin-pack):
‘Smokenote ‘Pocket’ showing position of ‘invisible’ tape
wi
L)
Mo Oo oe
The ECA Smokenote™ is contained within its own package. The
Smokenote™ package is concealed between 2 stuck £20 notes. A further 8
loose £20 notes are placed around the pack, one folded over the top and
held together with an elastic band. (£200 in total) ECA Smokenotes™ and
surrounding £20 notes are often contained within a transparent PO Giro note-
bag.
13.3 Smoke and dye packs are surrounded by real £20 notes and if a
number of packs are on hand at a branch this could amount to a
considerable value. It is therefore important that the smoke and dye packs
are opened and verified at the audit to confirm that:
e the surrounding £20 notes are real
e the surrounding £20 notes are all on hand and are
accurately declared
The branch should have a record (receipt) for the smoke and dye notes.
The record will detail the full value and the serial numbers of all notes
within the pack.
SECTION 14 —- DIRECTLY MANAGED BRANCHES
14.1 The resource levels for an audit of a directly managed branch are
outlined in Section 2 of the Scheduling Process. The comments in this
section assume a routine audit with the minimum level of staff attending and
do not include activities for special follow up visits prompted by the
submission of the annual certificate of compliance (this is contained in
Section 12 of the Audit Process Manual).
14.2 The purpose of routine audits of directly managed branches is to
provide assurance those assets, declared in the cash account, are in
existence. It is not the purpose to reconcile every item of cash or stock or to
52
POL00462751
POL00462751
find corresponding discrepancies for the staff, particularly if the audit is on a
Thursday. Given that it is not possible (or cost effective) to verify every
penny at the branch, without disrupting counter operations, the focus of the
audit is on high value items. With this in mind, the following approach to the
selection of stocks to be audited should be followed: -
e Cash held in ATMs (see note 1)
e Main cash (see note 2)
e Any individual stock declaring more than £25k in cash (see note
3)
e Any individual stock with abnormal levels of stock declared (see
note 3)
e Any stock held solely by the branch manager. For the integrity of
the audit, it is best to ask a back office duty to confirm whether or
not the BM holds a stock rather rely on the BM’s own
declaration. (see note 3)
Note 1: ATMs that are accessible from with a public area are a priority for
checking while the branch is closed. If this is not possible, as a minimum,
obtain the ATM readings and assess the reasonableness of holdings —
compared to previous holdings and average ATM withdrawals. If there are
any concerns, the lead branch auditor will need to make a judgment as to
whether to keep the branch closed (while the ATM is counted) or to return
(at an undisclosed time at the end of the business day). The concerns may
be mitigated if the ATM is held and counted by two individuals or of it is
rotated regularly. Conversely, any concerns may be increased in the ATM
has been held by one individual for a length of time without rotation or
supervisory check.
Note 2: The main cash is usually not accessible until 15 minutes after
opening the branch. This will allow for the audit to concentrate on counter
stocks. However, the main cash safe should be observed so that early
access is not allowed.
Note 3: For the purposes of assurance, the financial audit of an individual
stock should check all cash (sterling and foreign currency), any unusable
notes and cheques on hand. In addition, the branch auditor checking the
stock should assess the reasonableness of high value stock figures declared
and, if concerned, should validate those figures.
14.3 The main role of the lead branch auditor at an audit of a directly
managed branch is:
e to interact with branch staff, especially the branch manager and
particularly at the beginning of the audit
53
POL00462751
POL00462751
e to identify which stocks require checking at audit and assigning work
to branch auditors, in priority order, so as to minimise any disruption to
the general public
e to facilitate the audit by obtaining key information (e.g. cash
declarations, Horizon reports etc) for attending branch auditors.
e observe any transactions between staff (especially main cash) that
may affect the audits of selected stocks and reconciling any transfers
since the last declared balance
e to obtain the last declared annual certificate of compliance and test
compliance to the key controls (see Section 12 of the Audit Process
Manual).
e to verbally conclude the findings of the audit to the branch manager
(or nominated deputy) and ensure that the final written report is in line
with the verbal closing meeting
14.4 The main role of a Branch auditor at an audit of a directly managed
branch is:
e to audit stocks, assigned by the lead branch auditor, in line with notes
1-3 above
e to advise stock holders what items have been checked (and what has
not) and the findings of these checks
e alert the lead branch auditor to any concerns revealed (from audit
findings or observations)
Please note; the limits, as regards values and numbers of stocks, for
checking may change at the discretion of the lead auditor.
54
POL00462751
POL00462751
14.5 Where there are cheques on hand at a DMB audit then there is a
requirement to record:
e the value
e service accepted for
e name of the drawer — check these to the names of members of staff at
the branch
14.6 Any irregularities / discrepancies found at the audit should be reported
to the lead branch auditor, who in turn should take the necessary steps to
report it to the Operations manager and Investigation team manager.
SECTION 15 - BRANCH COMPLIANCE CERTIFICATE (compliance
certificate statement)
The compliance certificate statement is completed by the auditee and
returned to management information within 14 days. Upon receipt, the
details annotated on the certificate are keyed into a database. Where there
are exceptions these are escalated to the operations manager who contacts
the branch direct to discuss the report and point out the impact of non-
conformance. A copy of the exceptions is then sent to the area intervention
office for the attention of the respective contract and service manager.
55
POL00462751
POL00462751
APPENDIX A
Mr A Postmaster
Sub-postmaster/Subpostmistress
1234 East Road
CHESTERFIELD
S49 1PF
31/10/2002
Dear Mr/Mrs Sub-postmaster
BRANCH NAME BRANCH FAD CODE
This letter is to confirm that this Post Office®branch is to be audited today.
The following Branch auditors will be attending this Post Office® branch:
NAME OF BRANCH AUDITOR PASSCARD NUMBER
All Branch auditors will have an official Post Office Ltd pass card with a
photograph on. It is imperative that these are thoroughly checked before
admittance is allowed.
If you are still in any doubt about the authenticity of the branch auditors then
you can telephone John Jenkinson, Operations manager on { ]
or Glyn Burrows, Operations manager, __
56
POL00462751
POL00462751
Martin Ferlinc
National Branch Audit Manager
Post Office Ltd
Finance
57
POL00462751
POL00462751
Appendix B - Dealing with discrepancies revealed at audit
YES
YES
NO
YES
NO
NO
POL00462751
POL00462751
APPENDIX C
NATIONAL MULTIPLE PARTNERS TEAM PARTNERS’ NOMINEE SUBPOSTMASTERS
COMPANY NOMINEE I ADDRESS CONTACT ADDITIONA
NAME LINFO
CO-OPERATIVE I Alan Business Manager Nominee Senior Area
GROUP (CWS) __I McKellar (Regions) alan.mckellar( __ Managers
LIMITED Business The Co-operative i “) are main
Manager Group (CWS) Limited Senior Area contact
(Regions) Robert Owen House Managers: points
87 Bath Street (Please note
GLASGOW Coop now
G2 2EE : I includes
“I Alldays and
Balfours)
ee I David
I nl Harrison
(GRO [Century House
(i ; Jackson Street
re GATESHEAD
Tyne & Wear
a NE8 1HR
STARS NEWSI Paul Siveter [Stars News Shops I...GRO I Mal Hyde — same Mal Hyde
1
POL00462751
POL00462751
Ltd — postal address main contact
51-53 Queen Street i I point
WOLVERHAMPTON GRO : Trade as
WV13BU tennant Stars News
and Spar
GRO.
TATES Geoffrey Tates Ltd ' Stewert Waldron — Stewert
Hallam Long Acre Industrial i same postal address I Waldron
Estate GRO ' I "GRO afb I main contact
Rosehill i point.
WILLENHALL Tel —" Trade as
West Midlands ° Spar
WV13 2JP
COMPANY NOMINEE I ADDRESS TEL NO CONTACT ADDITIONA
NAMEN Si aihae iin ta ntite isa nen FLA Pe acinar LINFO
T&SSTORES I Debra T&S Stores Ltd : Nominee Debi Walls
Wallbanks Apex Road i Ii 'I banks main
Brownhills GRO GRO II contact point
WALSALL J ——_——_—_—— Trade as:
West Midlands One Stop,
WS8 7TS Dillons
Tesco
ee Express
TM RETAIL Alan Brook I T M Retail GRO Nominee Alan Brook
Post Office T M House main
POL00462751
POL00462751
Controller Ashwells Road : contact
BRENTWOOD ‘GRO point
Essex et Trade
CM15 9ST as:Martins
Forbouys
More
McColls
ALFRED JONES I Tom Alfred Jones i : Samantha Worsley — I Samantha
Calderbank I (Warrington) Ltd. IGROI same postal address. I Worsley
Stanley House fer" i main contact
Honiton Way hore 8 RO point
Penketh Tel Trade as
Warrington Spar
WAS 2EY
JAMES HALL Peter James Hall &Co. ---, I Peter
Dodding (Southport) Ltd. : I Dodding
Retail Director I 89 — 91 Blackpool II main contact
Road a point
Ribbleton Peter Trade as
Preston Dodding Spar
PR2 6DY mobile
POL00462751
POL00462751
POL00462751
POL00462751
COMPANY NOMINEE I ADDRESS TEL NO CONTACT
NAME
LINCOLN CO-OP I Stephen Lincolnshire Co- GRO} on mm gm I JOcelyn
Galjaard Operative Limited, I ~*~) ! ! G RO ‘I Simmons
Chief Post Office Division Stephen H II main contact
Financial Stanley Brett House, Galjaard — :I point
Officer Tentercroft Street. Tel =
Lincoln,
LNS 7DB.
SMILESTORES I Mark SmilestoresLtd. [I Nominee Mark
Callaway Shepherds Hall Callaway
Retail Director I 71 Old Market Street and Richard
Bristol to be main
BS2 0OET contacts
Trade as
Smilestores
and Bristol
News Shops
MILLS GROUP _I Nigel Mills Mills Group Nigels Mills
Group Mill House “main contact
Managing 7-11 Earsdon Road I point
Director Whitley Bay :
Richard NE25 9SX
Linsell
Martin
Stokoe I
SOUTHERN Paul Bye Southern Co- GRO I I Gary Trodd-same I Gary Trodd
COOP operatives Society postal address main contact
Limited.
point
5
POL00462751
POL00462751
44 High Street
Fareham
Hampshire
PO16 7YT
POL00462751
POL00462751
COMPANY NOMINEE I ADDRESS CONTACT
NAME
TESCO Tesco Stores Ltd. James Currie — James
Po Box 400 Estates Manager Currie main
Cirrus Building B Revenue Generation I contact point
Shire Park I
Welwyn Garden City
Hertfordshire
AL7 1AB
ASDA Asda Stores Ltd. ARP II Allan Matthews — Allan
South Bank G RO ‘I Concessions Matthews
Great Wilson Street) 9 [oss I Manager tid I main contact
Leeds ipoint
LS1 5AD ____GRO a I
SAFEWAY Wm. Morrison GRO Andrew Smethurst__ I Andrew
Supermarkets Ltd !I Smethurst
Hilmore House,
Thornton Road
Bradford
BD8 9AX
main contact
‘I point
POL00462751
POL00462751
COMPANY NOMINEE I ADDRESS CONTACT
NAME
UNITED CO-OP I Philip Robert I Philip Jones address: Sue Wood — Sue Wood
Jones Company Secretary ‘I main contact
Steven Silver I United Co-operatives point
(for ex Limited
Yorkshire Wood House
Coop part of I Etruria Road Sue Wood postal
estate) Hanley address:
STOKE ON TRENT
ST1 5NW
Steven Silver
address:
United Co-operatives
Limited
Sunwin House
65 Sunbridge Road
BRADFORD
BD1 2AP
United Co-
operatives Ltd
lvymeade Regional
Office
Ivy Road
lvymeade
MACCLESFIELD
SK11 8NA
POL00462751
POL00462751