POL00088252
POL00088252
POST OFFICE INTERNAL
Chapter 07 - Performing a Cash Centre Audit
Title Audit Process Manual Volume 4
Subject Chapter 07 - Performing a Cash Centre Audit
Version v5
Control
Purpose Outlining the preparation, on site and post audit processes
associated with the audit of accounts at Post Office® Cash
Centres
Audience Network Services Team
Next Review October 2016 for Stakeholder and Name Changes.
date Then Annual review July 2017
Stakeholders
Stakeholders Responsibility
Name
Mark Ellis Head of Supply Chain POL
Sandra Murray I Operational Compliance Manager, Supply Chain
Drew McBride __I Head of Network Services
Jazz Chand National Cash Operations Manager
Russell National Operations Manager
Hancock
Responsibilities in Change
Role Job Title Date
Author/Owner Field Team Leaders - Bob Collins. 26/08/16
bob.collins¢ RO H
Assurance Field Support Change Advisor - Sandra McBride 26/08/16
Authorised Network Support Project & Standards Manager - I 08/09/16
Sue Richardson
Communication I Field Support Change Advisor - Sandra McBride 08/09/16
Performing a Cash Ce
Owner ~ Bob Collins!
1
POST OFFICE INTERNAL
POL00088252
POL00088252
POST OFFICE INTERNAL
Version control
Version No. I Reason for issue Section No I Date of
issue
Version 1.0 Complete Audit Process Chapter Review 12/08/11
PROJECT
Version 2.0 Annual Review. 1.0, 1.1, 13/07/12
Changed Stakeholder names, 1.0, 1.1, I 2.7, 2.8,
2.7 and 7.4. 2.8 is a new section. This I 7.4
reflects the nominee, and quite a lot
around the Finance Manager section
and Lead Auditor responsibility in
proving the figures on the Trading
Statement and actually being sent the
TS in first place to print on site.
Version 2.1 Change to Stakeholders for 2013/14. 7.2 &7.4 12/03/13
Version 3.0 Annual Review 02/09/13
Change to Stakeholder 7.4
Finance Manager Location 2.8
New Cash Centre P32
Changes to Essentials Information Manchester
Sheet deleted
Version 4.0 I Annual Review 05/01/15
Additional wording around agreed 1.0
program 1.3
Change to Finance arrangements.
Romec replaced with Grapevine 1.4
Grapevine details inserted
Updates to CC3, CC4 and CC13
Version 4.1 Annual review As above & I 28/08/15
Change to Stakeholders and their Titles I 7.4
Small change to wording 21
Font changed to Verdana - business
standard
Version 5 Annual review All sections I 26/08/16
Change of reference to Network
Operations
INDEX
Section Title Page No.
Section 1 Preparation Activities 3
Section 2 Performing a Cash Centre Audit 3
Section 3 Completion of the Audit of Accounts (P32) 6
Section 4 Reporting of Irregularities and Discrepancies 6
Section 5 Performing Compliance Checks 7
Section 6 Close of Audit Meeting 8
Section 7 Audit Reporting 9
Performing a Cash C
Owner ~ Bob Collins
ugust 2016 2
POST OFFICE INTERNAL
POL00088252
POL00088252
POST OFFICE INTERNAL
SECTION 1 - PREPARATION OF ACTIVITIES
As part of the audit plan and scheduling process to conduct cash centre audits, the
Regional Managers will allocate a Network Operations Manager to organise the audit
program for each financial year to incorporate all Cash Centre and Swindon Stores
activity.
At the request of Stakeholders it is agreed that the program will consist of five
audits per year with Swindon being audited once every other year. A selected cash
centre will be audited consecutive with the previous year. Thus the element of
surprise with provided within each plan.
It is the responsibility of this designated Network Operations Manager to fully
Prepare the audit, lead the audit on site, report financial irregularities and
subsequently complete the required post audit activity, including the audit report.
Consideration should be given to any operational needs at individual cash centres,
when planning the day of audit.
1.1. At least 3 weeks prior to the audit identify the numbers of personnel required
for the audit based on past activity information and location of any remote coin
storage. Ensure appropriate personnel are available considering any leave or other
activities already scheduled. Identify if any personnel require accommodation on
the evening prior to the audit for an early start, and book accommodation as
necessary.
1.2 Check the Cash Centre profile details including the Cash Centre address and
opening times. These can be found on the CC13 Cash Centre Essentials form. Two
weeks before the audit, send a brief to all personnel involved (known throughout
this brief as the Network Operations Team), which will include the date of audit,
location, coverage, centre information, management details, domestics and
directions. Also send a CC1 Cash Centre Resource Plan for Stage 1 and 2 outlining
the stage 1 and 2 activities and the CC2 Terms of Reference for individual areas.
Arrange a conference call with the network Operations Team to ensure all are aware
of what is expected of them at the audit. There is a Pre Visit Conference Call
Awareness document CC14
1.3 One week before the audit prepare the CC3 Notification of Telephone
Authorisation Call letter for Grapevine and the CC4 Notification of Asset Verification
Audit, introductory letter to the Cash Centre Manager (see section 2.2). Prepare
files for sectional leaders and ensure appropriate cash count forms are available
(CC5-CC12). Obtain previous audit reports and review actions to ensure these areas
are covered.
1.4 On the day before the audit send an e-mail to Grapevine at
admin” “attaching the CC3 Notification of Telephone Authorisation
f receipt is not received within 15 minutes, contact
Grapevine on _f
NB: Also confirm the auditing team are still available and that any accommodation
is still booked. Ensure all those involved in the stage 1 entry have made the
necessary travelling arrangements and they know the location of the Cash Centre.
SECTION 2 - PERFORMING A CASH CENTRE AUDIT
Performing a Cash Ci
Owner ~ Bob Collins;
5 August 2016 3
POST OFFICE INTERNAL
POL00088252
POL00088252
POST OFFICE INTERNAL
The objective of the Cash Centre audit is to determine the value of cash on hand by
completing the P32 document, and comparing this to the POLSAP system balance as
at 12am the previous evening. This figure is then reconciled back to the last
authorised Trading Statement on the previous Sunday evening by accounting for all
movements since then until the time of the audit. It is also necessary to verify Bank
Accounts, Suspense Accounts and other accounting information, as well as
conformance to Security instructions.
2.1 Gain entry to the Cash Centre to be audited. The personnel involved in Stage 1
entry should include the Network Operations Manager, the person completing the
P32 and at least 2 other members to ensure there is no movement of Cash or
changes to accounting information. The team should meet away from the site and
then progress to the cash Centre in time to observe the opening team from the
Cash Centre performing its Security checks prior to entry (some units are open 24
hours a day).
When the Security checks have been completed and observed (comments to be
recorded as part of the audit on the Control Test Report) the network operations
Manager and one other person should ask for entry via the communication system.
Cash Centre personnel should exit the cash centre to verify the identities of the
Network Operations Team. This is carried out by confirming the list of attendees
with appropriate ID cards and obtaining confirmation of attendance via Grapevine.
These procedures are outlined in the Cash Centre Procedures Manual. The Cash
Centre personnel should be advised that they should not access cash, or the
POLSAP system until the Field Support Team have gained access and given
authority to do so. If the Cash Centre personnel refuse to allow entry to the
premises, explain that the network Operations Team have the right to verify Post
Office Ltd assets and that they will need them to notify the Centre Manager that the
Network Operations Team are in attendance and would like to gain access to the
site. Remind the cash centre personnel that movement of cash and accessing the
POLSAP system is not permitted until the Cash Centre Manager has been made
aware of the presence of the audit team and given a decision on admittance.
If entry is still refused then the Head of Supply Chain PO Ltd, Head of Network
Operations and Head of Security are to be informed and the audit re-arranged. NB
It may be advisable to have the relevant names and numbers to hand before
conducting the audit
2.2 Before the audit commences, the Network Operations Manager should make
their introductions to the Shift Manager and discuss the audit process, ensuring that
the audit requirements are made clear and that the Manager is also aware of
his/her responsibilities. The discussion will include:
e« The need to identify and produce all cash at the outset of the audit. (It is
important that the location of all cash is identifiable by the network
Operations Team, especially if outside the vaults).
« The manager in control of the cash centre must provide an individual to
ensure all staff are notified on first entry, that they must not access the cash
until authority is given by the Lead Auditor.
« Gaining information on starting times of Cash Processors to calculate how
soon their cash holdings can be counted and when we expect they will be able
to start work on business as usual processing
« The importance of Cash Centre staff witnessing the check of cash
« The need to have access to a network link to enable appropriate POLSAP
reports to be printed off.
« Facilities for Network Operations Team (e.g. working area, toilets)
Performing a Cash Ce
Owner ~ Bob Collins f
August 2016 4
POST OFFICE INTERNAL
POL00088252
POL00088252
POST OFFICE INTERNAL
« The secure accommodation for laptop cases, equipment, handbags
« Request a copy of the most recent Centre H&S inspection report
When the Centre Manager (or Manager in Charge) arrives then introductions need
to be made again and the Manager presented with the introductory letter CC4 and a
copy of the CC3. A close of audit meeting should be arranged at which action points
can be agreed and the Manager be given the opportunity to comment on any
findings.
Please note: - This list is not meant to be definitive, the discussion may be
extended but the above should be included as a minimum.
2.3 Access to all cash should be restricted until it is checked and released by the
Network Operations Manager.
2.4 Maintain a log of each area counted and the Network Operations Advisor who
performed the count. Each Field Advisor should count and record all the cash and
coin on hand using forms CC7, CC8 or CC9, (there are notes to accompany see
CC8a, CC8b, CC9a, CC9b CC10) in the presence of the stockholder and the forms
returned to the person completing the P32. These details should be entered on to
the P32 to determine the total cash on hand. Verify each bin balance / compare the
cash figure to that on the P32. Calculate any variances. Any errors must be
investigated and identified to the Shift Manager or their representative, who must
be given the opportunity to check and agree any discrepancies.
Please note: - Where a discrepancy is highlighted, the Shift Manager and/or the
bin owner should verify the findings and sign the cash sheet to confirm that the
figures to be used as part of the audit are correct. A discrepancies form (CC6)
should be used for all discrepancies over £20.
2.5 Count and verify foreign currency holdings (using CC11) and confirm the
sterling equivalent declared on POLSAP. Verify all currencies on hand to the bureau
stock bin balance. The sterling held in the bureau stock should be counted as part of
the check of cash on hand. Any errors in foreign currency holdings should be
brought to the attention of the shift manager, who must then be given the
opportunity to check and agree the discrepancies. The errors must also be
corrected in the bureau bin balance on POLSAP at the time of the audit. Totals from
currencies verified should be documented for later inclusion in the P32. Upon
correcting the errors, the revised sterling equivalent figure should be used in the
P32.
2.6 Each member of the Network Operations Team should complete a CC12 Cash
Centre Working Paper advising the network Operations Manager on the work area
they have checked, the results of the cash verification. Any other observations that
they deem relevant can also be done on this paper.
2.7 Determine whether there are any outstanding transaction corrections (TCs) and
if so, ask the Finance Manager (based off site with the exception of Manchester,
Belfast and Hemel B de C) of his / her intentions to process the TCs.
2.8 It is the responsibility of the Lead Auditor to request Trading Statements and
check the validity of all entries on the Trading Statements from the Finance Manager
based at Bark Street, Bolton (Belfast for Glasgow) with the exception of Hemel B de
C Cash Centre who retain their own Finance Department.
Performing a Cash Ci
Owner ~ Bob Collins!
ugust 2016 5
POST OFFICE INTERNAL
POL00088252
POL00088252
POST OFFICE INTERNAL
SECTION 3 - GUIDELINES FOR COMPLETION OF THE AUDIT OF ACCOUNTS
(P32)
The P32 is an Excel spreadsheet, with interlinked sheets, it accumulates all data
counted by area and denomination, to arrive at a comprehensive document,
recording all value items in the Cash Centre that have been counted.
3.1 The standard audit working papers must be fully completed in ink and signed by
the completing network Operations Team members. The completed sheets should
be returned to the person completing the P32 as soon as possible. All the data
obtained and documented, as part of the audit process, can now be input to the P32
worksheet to determine the current cash holding position.
Please note: - The entries on all working papers must be legible with any
alterations initialled by the correcting person.
SECTION 4 — REPORTING IRREGULARITIES AND DISCREPANCIES
4.1 It may be necessary to contact the Investigation Team and the Security
Manager for Supply Chain to report findings, errors, discrepancies or admissions.
This should be done at the earliest opportunity to allow discussions to take place
and decisions to be made whilst the network Operations Manager is still on site,
ensuring that the matter is dealt with quickly and efficiently. NB. It may be
advisable to have the relevant names and numbers to hand before conducting the
audit.
4.2 The Cash Centre Manager must be contacted in the following circumstances,
where:
There is an unexplained discrepancy in excess of £500
There are any irregular or suspicious circumstances
There is a personal cheque on hand
Credit sales are operated
There is an admission of misuse of Post Office Ltd funds or fraudulent
activity
The Operations Manager refuses to allow access to the cash
« Cash on hand has been inflated or an amount of cash is produced after
the audit has commenced
« Transaction corrections have not been actioned to the expected timescales
« There are discrepancies found in on-site verifications (remittances,
suspense accounts etc.)
e Ifthe Field Team Leader has any other concerns or is unsure
This list is not meant to be exhaustive as there will always be circumstances that
arise that won't be covered by any list no matter how long. Regardless of the
circumstances, if there is any doubt or concerns, contact the Cash Centre Manager.
4.3 The following information may be required for onward cascade.
The:
date of the incident
time of the incident
name of the Cash Centre
Site code of the Cash Centre
address of the Cash Centre inc. Postcode
telephone number of the Cash Centre
Performing a Cash Cer
Owner - Bob Collins f
August 2016 6
POST OFFICE INTERNAL
POL00088252
POL00088252
POST OFFICE INTERNAL
Cash Centre Manager's name
Network Operations Manager’s name
Name of Network Operations Advisor revealing findings
amount of the discrepancy (current branch trading position)
amounts that make up the suspense account
way in which the discrepancy was discovered
location of the assets
name of the Investigation Team Manager dealing or their deputy
4.4 Once a call is received to report a discrepancy or irregularity from the Field
Support Team member on site the Network Operations Manager will take the
following action:
« Where the amount is greater than £25K, the network Operations Manager will
relay the relevant details to the Head of Network Operations
SECTION 5- PERFORMING COMPLIANCE CHECKS
Internal control relates to the whole system of controls and co-ordinated measures
designed to safeguard the assets and to maintain accurate and reliable records.
The importance of internal control to the Network Operations Manager arises from
the need to be certain that information produced is soundly based and possibilities
of deliberate or accidental errors are reduced. Internal audit’s primary function is
therefore to appraise the effectiveness of internal control by confirming compliance
with documented business process and procedures.
5.1 The concept of compliance auditing is based on the assumption that the laid
down mandatory business procedures or regulatory controls are in operation.
Compliance audit tests are designed to test that controls are operating as intended,
by checking evidence of adherence to the approved systems.
5.2 The Network Operation Manager's role in compliance auditing is to undertake
sufficient testing to be able to confirm, with reasonable assurance that controls, that
should be present in a system are being deployed. Whilst the Network Operations
Manager has the responsibility for ensuring the tests take place to the documented
standards, the task can be completed by another, who should fully inform the Field
Team Leader of the test results prior to the closing meeting.
5.3 The Cash Centre Test Report should be completed during the audits of Cash
Centres; all the following tests should be completed at all centres:
1 - Opening procedures for cash centre staff
2 - Access to site for Field Support Team
3 - General security observations
4 - System access / reports / probity
5 - Notes sorting facility verification
6 — Notes vault verification
7 - Coin Cashier
8 - Processing area 100
9 - Bank of England Bond
10 - Audit of accounts
For satellite Coin Centres only the following tests need to undertaken:
Performing a Cash
August 2016 7
Owner ~ Bob Collin:
POST OFFICE INTERNAL
POL00088252
POL00088252
POST OFFICE INTERNAL
1 - Opening procedures for cash centre Staff
2 - Access to site for Field Support team
3 - General Security observations
7 - Coin Cashier
5.4 The record and results of each test should be documented on the standard
working paper - Cash Centre Control Test Report. Details and results of each test
performed should be recorded against the appropriate question under the Findings
heading. The person completing the test should sign in the completed column.
5.5 The person completing the test should print their name and the date on the
Cash Centre Control Test Report. If the test is completed by another other than the
Field Team Leader then the Field Team Leader should also record their name and
the date on the Cash Centre Control Test Report
5.6 Extended tests - In normal circumstances, tests based on the suggested
minimum sampling levels will provide sufficient evidence upon which to base
conclusions. The level of sampling may be extended in certain circumstances and at
the Network Operations Team Member's discretion, depending on the significance of
findings and materiality of control gaps identified. Sufficient evidence should always
be obtained to enable appropriate action to be taken to close the control gaps. If
weaknesses are revealed in a small sample (e.g. one or two week’s records)
examine a further period to establish the extent of any concern.
5.7 Aborted tests - If tests are aborted the reason for not performing the test
should be recorded.
5.8 Conclusions - A summary and evaluation of findings for each area tested and
reviewed should be recorded: -
¢ Detail control gaps and strengths found;
¢ Evaluate the significance of non-compliance with key controls; outline
corrective action required
SECTION 6 - CLOSE OF AUDIT MEETING
6.1 Once the audit tests have been completed, the audit findings will need to be
discussed with the Cash Centre Manager. The following guidelines should be
followed:
« The closing meeting should already have been discussed and planned with
the Cash Centre Manager as part of the introductions when meeting the
Cash Centre Manager at the outset of the audit
« The meeting should be conducted in private whenever possible as some of
the points for discussion may be sensitive
« The Network Operations Manager should be familiar with all the findings of
each test completed
e When talking through the findings it is important to discuss them in a
balanced way and be able to qualify exactly what is meant. The reason
for any actions should be made clear. The consequences and impact of
non-compliance should be communicated and the benefits of compliance
hi-lighted. It is useful to point out where the correct procedure is
documented and the importance of adherence to it.
« The Network Operations Manager should look to influence the Cash Centre
Manager whenever possible by selling the benefits of conformance and the
acts of non-conformance -
u
imp:
Performing a Casl gust 2016
Owner ~ Bob Collins
POST OFFICE INTERNAL
POL00088252
POL00088252
POST OFFICE INTERNAL
including providing a copy of an action plan so that they know what to
expect.
e All the Cash Centre Manager’s comments or requests should be
documented and incorporated into the management summary section of
the audit report
e Allow the Cash Centre Manager time for questions.
e Following the closing meeting a customer satisfaction feedback form
should be left with the Cash Centre Manager - again try to influence them
to complete the form and outline the benefits to him/her e.g. possible
improvements to auditing etc.
SECTION 7 —- AUDIT REPORTING
7.1 Following an audit two reports will be completed.
7.2 The first report should be a detailed account of events and findings and must
be completed and shared with the Cash Centre Manager, the Operational
Compliance Manager (Supply Chain), and the Head of Network Services (Drew
McBride) within one week. The control gaps found at the audit should be reported in
the action plan in the audit report. It is also important to detail, within the
management summary section, all the areas covered as part of the audit, and
where non-conformance was identified.
7.3 Within one week of receipt the Cash Centre Manager should confirm and agree
the report by e mail to the Lead Auditor.
7.4 The Lead Auditor will then complete a 2 page hi-level report and despatch to
the following:
e« Cash Centre Manager ceeseseeee wee
e Head of Supply Chain PO Ltd Mark Ellis
« Head of Network Services Team Drew McBride
e¢ Operational Compliance Manager - Supply Chain Sandra Murray
« National Cash Operations Manager Jazz Chand
e National Operations Manager Paul McDonald
This report must include:
e The overall risk rating
« The financial result
e Any significant security or compliance failures
7.5 In both reports an indication should be made in the report of the level of
assurance that can be given.
7.6 Upon completion the reports should be e mailed to Sandra McBride, Field
Change Advisor for secure retention.
Please note the report is an important output of an audit and as such it is
vitally important that it is well written, balanced and clearly documents
the audit findings
Performing a Cash Cent
‘ ugust 2016 9
Owner ~ Bob Collins!
POST OFFICE INTERNAL