POL00338054
POL00338054
Royal Mail Group plc
IMPACT POL FS
Post Office Limited
Internal Audit & Risk Management
Internal Audit Report: 06/041
Royal Mail - CONFIDENTIAL
Date: March 2007
I
POL00338054
POL00338054
Contents & Distribution
Executive Summary
Overview
Control Assessment and Key Findings
by Scope Area
Appendices
Appendix A — Detailed Findings
Page
Executive Summary & Appendices
Peter M Corbett Finance Director, Post Office Limited (POL)
Rod Ismay Head of Product & Branch Accounting, POL
Keith Woollard Head of Compliance, POL
Martin Knights Reporting & Analysis Manager, POL
Alison Bolsover Client Accountant, POL
Dawn Brooks Product Accountant, POL
‘Andrew Carter Method of Payment Accountant, POL
Marie Cockett Branch Accountant, POL
Eddie Harris Service Manager, People and Organisational
Development Services (P&ODS)
Executive Summary
‘Alan Cook Managing Director, POL
Doug Evans Group General Counsel
Derek K Foster Internal Audit & Risk Management Director
Emst & Young External Auditors
Internal Audit Team
Steve Webb, Benjamin Boyce, David Britain and Gina Thurman,
Internal Auait Report 06/041
Royal Mail Group plc
CONFIDENTIAL Page 20f 11
POL00338054
POL00338054
Executive Summary: Overview
Background I The Post Ofce Limited network of some 14,000 brenches processes client and business transections in excess of £100 bilion annually. The msjoiy of
transactions are conducted on behalf of other partes, for example, receiving payment for domestic ullit bls and paying out National Savings.
‘Customer transactions are captured through the Horizon Electronic Point of Sale equipment in branches, and dally summaries are transmitted overnight to the
‘central accounting system, POL FS (a standard SAP system). The translaion process between the Iwo systems is enabled by the Reference Dala System
(RDS) and this system provides a mechanism to manage the portfolio of clients, branches and products.
‘The POL FS system was implemented in 2005/06 and contains functionality to calculate branch balances (cash, stocks, suspense, debiors and creditors) and
to satte client balances. Additonaly, the data from branches populates a Management information System (MIS).
Objective I Tere hat herevised central accounting procedures implemented inthe POL FS system are adequate fo maintain the integrity of accounting data
1d Scope I MASTER DATA: Amendments to produc, ranch, cent, customer and General Ledger (GL) data are processed in an accurate and timely manner.
and SCOPE] BRANCH TRANSACTIONS: Transactional data is received from branches in an accurate and timely manner and branch balances can be substariiated
‘CENTRAL ACCOUNTING: Significant Branch Discrepancies (BDs) are investigated and processed consistently: settlements with clients are processed in
‘eccordance with client agreements; suspense items are promplly resolved; and summary transections are posted ino the POL financial accounts
‘Audit Rating I AREA CONTROL ENVIRONMENT: Some Improvement Required. Processes to retieve data from branches and post transactions into POL finns
‘counts operate satisfactorily, Further work is required to resolve suspense account aged balances and branch discrepancies.
GROUP IMPACT: Low. At the Group level the impact of issues identified in this report is ow.
‘Overal, the extraction of financial records from branches by Fujitsu and the processing of these by the Product and Branch Accounting department was
‘operating as prescribed. The POL FS system enables transactional data to be inlerrogated and there is an opportunity to enhance the efficiency and
‘effectiveness of this functionally
Issues identiid in the review are:
Branch Discrepancies: Branch Discrepancies and Transaction Corrections (TCs) totalled £2:3m at P9, of which 38% related to the prior financial year. If
‘hese are not resolved, the risk of bad debis increases,
‘Suspense accounts: There were 17 suspense accounts, wth balances ranging from £1k to £2.8m and the net total being £2.2m debit, containing a high level
‘of aged balances. Any delays in clearing these accounts makes reconciliation more ficult and may require adkitional resource to resoive.
Moneygram transactions: There were discrepancies between the Moneygram transactional data (upon which POL make settlements) and the data recorded
Jn POL FS. At P11, £472k of transactions required investigation. Moneygram did not appear to be cooperating fuly with ongoing investigalions. These
discrepancies need tobe resolved to minimise the risk of bad debts and respond tothe possibly of fraud as @ reason.
‘Customer master data: Internally, dala from the SAP HR system is uploaded into RDS. Missing and incorrect customer master data resulted in a high evel of
‘Upload failures (failure rate in January 2007: 23%), This causes additonal costs in rework, and also risks Impacting customer goodail (e.9, when transactions
‘are not recorded on a timely basis, causing unnecessary TCs to be issued),
Tamterat implemen nae by ua
lmpernce “antona” comple pysune? By sept? ByDeedT Byer
Internal Audit Report 06/041 CONFIDENTIAL Royal Mail Group plc
Page 30f 11
POL00338054
POL00338054
Executive Summary: Control Assessment and Key Findings by Scope Area
Objective: The overall objective of the review is to ensure that the revised central accounting procedures implemented with the POL FS
‘system are adequate to maintain the integrity of accounting data.
Ss = Ee II[Bret”)
Waster data - Amendmenis to product branch, dent “robust process exssfor amendments oproaic branch, cient and GL daa
tasfomer and GL mester dala ere processed inn ‘Tere @figh fare rete during tne upload of customer master daa om SAP HR dala to II 4
fccurte ond timely manne. Reference Data System (ROS) (229% for January 2007) due fo missing or aed dala
“Tanseclons harvested fom Hazon syle Fh branches are validled Tor accuracy and
Deinstarenatag = Tranencdne cia fared fora completeness porto canal processing. The nighly conversion of feel vansactons II
through the SAP X middeware nto POLS fe sulla monitored
anon gocounting 2 Banh bolancas Gan be Tony wading sstemenls and morilng underaken by ranch Canto! end Conformance
Branch accounting - ranch bak E ciermurerce el ene wate ae tracted chains oes. Tewemogeent II 5
Stmanagementiniomalion and vansaclona dala coud be enhanced
Branch discrepancies _-_Srifeant Branch on
rly deputed Ds ae Investgaled on a subjective basis. Al PO, blocked Ds and
Discrepancies. (200) iors (knvovlgnted ‘ond procewee! Transaction Corrections (TCs) totalled some £2.3m of which 28% related to 200606, 3
consent
Clint settlements = Setlements with clents ere Discrepancies est Bebveen Maneygram wansectonel dala (won which POL make II
processedin accordance with cent egreemenis. setlements) and the data recorded in POL FS.
Suspense accounts - Suspense items are promptly ‘A ruber of suspense accounsincude high levels of aged balances, fr which root eause II
resolved ‘nals or ppropate resalulon plans are ye o be completed
‘Summary reporting - Summary transactions ere posted ‘The transfer of dela fom POL FS to ESFS appears to be epproprataly contted and II
iio he POL tnencl eccouns, manages
Internal Auait Report 06/041
Royal Mail Group plc
CONFIDENTIAL
Page 40f 11
POL00338054
POL00338054
Appendices
Internal Auait Report 06/041
CONFIDENTIAL
Royal Mail Group plc
Page Sof 11
POL00338054
POL00338054
Detailed Findings
Appendix A
‘The following identifies issues and the related actions within POLFS. These issues were identified in the review and the action plans were agreed by the business. All ofthe actions
shown are deemed important, however, a futher ranking (1-2) has been provided to assistin prioritisation, Priory 1 relates tothe higher risk issue.
Agreed Action Plan Action Owner
Timing
41. Suspense account management
‘Suspense accounts are reconciled and reported via Probity Statements on a
monthly basis. Various suspense accounts include excessive aged items,
requiting addon resource to resolve.
(Owing to restructuring within Product and Branch Accounting (P&BA), root
cause analysis of some suspense accounts has been delayed, Furthermore,
detailed knowedge and understanding of some accounts has been
diminished after internal restructuring or individuals leaving the business,
Before the commencement of ths review the issue of suspense account
management had been identified by the POL team and a series of workshops
arranged to identify root causes. Progress in the majority of cases is
satisfactory
(Our assessment of the individual suspense accounts overleaf reflects the
positon of the accounts at PS and the level of work required to bring the
account toa satisfactory status, on the folowing basis:
+ Account cleared on a timely basi;
+ Corrective action underway; and
+ Further oot couse analysis required
Business impact: Delays in completing reconciliations may mean that any
errors in suspense accounts remain undetected for longer. Also, the delays
‘mean that the business may incur addtional costs to reconcile the accounts,
+ Use the workshops to develop action plans and Rod Ismay
subsequent resolution for the problem suspense accounts,
(Prionty 2)
+ Document current understanding of accounting processes Rod iemay
to provide continuity of control of these accounts.
(Priority 2)
Jun 07
un 07
Internal Auait Report 06/041
Royal Mail Group plc
CONFIDENTIAL
Page 6 of 11
POL00338054
POL00338054
Detailed Findings
Appendix A
‘The following identiies issues and the related actions within POLFS. These issues were identified in the review and the action plans were agreed by the business. Al of the actions
shown are deemed important, however, a futher ranking (1-2) has been provided to assistin prioritisation, Priory 1 relates tothe higher risk issue.
Issue ‘Agreed Action Pian Action Owner Timing
1. Suspense account management (continued)
Set out below s our assessment of these suspense accounts at PS
cade I oesrpton
roouer
31200. Clot py pont
530010 Gaponte ren oldng =
toro CSP FS arenes — MW (9)
G21 ASL Gta port doom Oo 7m
tom Foteonsie cama Aw)
fo Hoteenies cad RW 0
fu Foteonies card RW 2)
cue
SHOT” Retbey SBugtay 7
250000 _Rotbey & Burg we of 138
eam Enmenpcy on (15,
2a Enorpney wie of °
530103 Rerfinee “shots”?
20152 ‘Rerione -Suplwes cw ———(1486)
2st Rerince wrote 2
‘nese! Lect or @
acco cle ova ty bat
core acon nde
Prot cane wey eed
Royal Mail Group plc
Internal Auait Report 06/041
CONFIDENTIAL
Page 7 of 1
POL00338054
POL00338054
Detailed Findings
Appendix A
‘The following identifies issues and the related actions within POLFS. These issues were identified in the review and the action plans were agreed by the business. All ofthe actions
shown are deemed important, however, a futher ranking (1-2) has been provided to assistin prioritisation, Priory 1 relates tothe higher risk issue.
‘Agreed Action Plan
Action Owner
Timing
2. Discrepancies exist between Moneygram transactional data (upon
‘which POL make settlements) and the data recorded in POL FS
Issues have been identified within the process that reconciles the differences
between Client Transacton Summaries (CTS) & POL FS. CTS data is
supplied by Fujitsu and is based on transactions recorded on Horizon in the
branch network. POL FS data is based on @ fle sent by Moneygram and
loaded into POL FS. Transactions claimed by Moneygram do not match with
CTS date.
Moneyoram services are available at some 3,350 branches, allowing
customers to undertake electronic fund transfers to foreign bank accounts
fand generating commission income of some £6.5 millon per annum,
Historically, these transacfons have taken place via a Moneygram terminal or
by the POL clerk making a phone call fo instruct the transfer. All transactions
should be recorded on Horizon
Queries have been sent to Moneyoram yet no response has been received.
POL Investigations Team (POL IT) are considering potential intemal fraud for
some of the transactions. However, itis not clear what action is being taken
with regard to potential raud within the Moneygram organisatin.
POL and Moneygram are currently testing an automated process to eliminate
transactions via phone calls and to replace the Moneygram terminals,
Transactions will be entered directly onto the Horizon terminal and sent to
Moneygram via a webserver.
Business impact: The business may incur bad debts if i does not resolve
these issues. Also, investigations require signficant resource, which may
detract focus from other business priorities.
+ Agree resolution with Moneyoram for curent issues
including establishing bad debt provisions as eppropriat,
‘and estabish 9 process for identifying fraudulent
transactions and communication to POL IT on a timely
basis,
(Priority 2)
+ Inilste @ process to monitor contract performance and
‘compliance in conjunction withthe Merketing department.
(Priority 2)
Dawn Brooks
Dawn Brooks
jun 07
tun 07
Internal Auait Report 06/041
CONFIDENTIAL
Royal Mail Group plc
Page 8 of 11
POL00338054
POL00338054
Detailed Findings
Appendix A
‘The following identifies issues and the related actions within POLFS. These issues were identified in the review and the action plans were agreed by the business. All ofthe actions
shown are deemed important, however, a futher ranking (1-2) has been provided to assistin prioritisation, Priory 1 relates tothe higher risk issue.
‘Agreed Action Plan
Action Owner
Timing
3. At P9, blocked Branch Discrepancies and Transaction Corrections
totalled some €2.3m, 38% of which related to the prior financial year,
Generally, oly disputed BDs are investigated with payment expected for all
other items, Each Product team maintains a list of those items under
investigation or in dispute. There are limited local guidelines on how to
investigate, subsequently the majorly of the process is subjective.
‘The Current Agents Debt team maintain a listing of the frequency of disputed
BDs. This is informally used to highlight potential ongoing issues (none
Noted). All blocked transactions (ie. disputed BDs and TCs) are logged in
POL FS and available to view. At PS there were some 1,440 items
outstanding (some £2:3 milion), with 331 items (some £884k) from the
previous financial year.
System functionality does not provide sufficient analysis of outstanding items,
Business impact:The business incurs further bad debts as a resutt of failure
to resolve issues regarding historic and future transactions.
+ Establish and implement a strategy to resolve and clear Marie Cockett
the outstanding items from 2008/08,
(Priority 2)
un 07
Internal Auait Report 06/041
CONFIDENTIAL
Royal Mail Group plc
Page 9 of 11
POL00338054
Detailed Findings Appendix A
The following idenitfes issues andthe related actons wihin POLFS. These issues were identified inthe review and the action plans were agreed bythe business. Al of he actions
shown are deemed important, however a futher ranking (1-2}has Been provided to assistinpriorsation. Prt 1 eas tothe higher rik issue
Issue ‘Agreed Action Plan Action Owner Timing
4. Customer Master Data upload failures
The fare rae of the SAP HR customer master data upload to ROS was I I «Liaise wit PODS to review contols thet ensure the SAP I I Martin Krighisand I) Jun07
22.9% fr January 2007. The high fale rte is due to missing orincorect I I HR tile containing updates to customer mester dota is II Eddie Haris
data contained in the SAP HR fle. ROS rejects the fle during he valdaton I I accurate and complete
process unless manual intervention takes place (Prony 2)
The errs or omissions appear to be a result of customer master data not
being updeted sccuraelyin SAP HR. Massing data le lagged when TCs are I I * Review process to eslabish reason for customer data nat I I Martinknights and II Jun o7
raised again! hese customers being Wansfered accurately. Resolve issues prior to the II Edcie Haris
implementation ofan automated fx
Business impact: When deta files are incomplete or inaccurate, this resuts I I (Priory)
in fle rejections, which means that unnecessary TCs are issued and
transactions are not recorded prompty. As well 95 incurng unnecessary
costs, this may damage customer goodwil
Royal Mail Group plc
Internal Auait Report 06/041
CONFIDENTIAL
Page 10 of 11
POL00338054
Detailed Findings Appendix A
The folowing identifies issues andthe related actions witin POLFS. These issues were idenfedin the review end the ection plans were agreed bythe business. Allo the actions
shown are deemed important however further ranking (1-2) has been provided oassistin priitsation. Pray 1 relates to the higher nik issue
Issue ‘Agreed Action Plan Action Owner Timing
5, Management information
Branch Control end Conformance curently undertake @ range of I I + Review latest range of M, transacton and rota checks I I Marie Cockett Jun o7
Management information (Ml) and tansactonal reviews including and associated econ arising. Address any obvious gaps
+ Range checks: or duplication
+ Local suspense reviews; and (Priority 2)
+ Rota checks.
‘These reviews are considered appropiate, tke place on a tmely basis and I I * Compare results of action above with latest Audit Risk I} Rod ismay and Jun o7
are supported bythe Audit & Securly and Oulet Suppor teams Model and oer sources of dal forthe risk model. Update I} Keith Wooterd
‘The following issues were identified during the course of our review: tacehmadetsnagpeaptete
+ Concems were raised by members of the POL team regarding the (Prirty 2)
coverage fered by these procedures end thal there may be some
<upticain of efert within POL:
+ Curent sampling procedures end reviews rely heeviy upon staff
knoxledge and experience: and
+ Smaller end less suspicious branches may not be subject to review fr @
considerable length af tm.
Business Impact: The business fafs fo optimise utlsation of both Ml and
staff resources, Disrepancies are net highlighted on @ timely manner and
subsequently requie increased resources 0 resolve.
Royal Mail Group plc
Internal Auait Report 06/041
CONFIDENTIAL
Page 11 of 11