Below is the speech I made in the May 2013 States’ meeting setting out the findings of the Public Accounts Committee’s review into the financial controls of the States of Guernsey in relation to Fraud.
When it was announced in July 2012 that the States of Guernsey had been defrauded of £2.6 million of taxpayers’ money, there was understandable shock and anger throughout the community. That such a fraud did occur only highlights the fact that we must have the necessary frameworks in place, to defend against this type of threat.
Whilst the public clearly have an interest in the details of the specific incident of fraud, (which is currently the subject of a police investigation), it was as important to find out whether there was an underlying problem that led to the States of Guernsey being exposed to this unacceptable risk of fraudulent activity. Ernst and Young were commissioned by the Public Accounts Committee to undertake that piece of work.
Ernst & Young review covered the following areas;
The appropriateness of the anti-fraud governance framework pre-May 2012
The reasonableness of Internal Audit Reports which were issued in May 2012, before the fraud, and August 2012, after the incident took place
The appropriateness of the anti-fraud governance framework subsequent to those recommendations and actions
Their own recommendations
The key findings of their report are;
First, that prior to May 2012, the anti-fraud governance framework was inappropriate.
As Ernst & Young state, ‘while there were elements of an anti-fraud governance framework, they were unco-ordinated, inconsistent and not embedded culturally.’
Second, that the Internal Audit Reports issued in May and August 2012 were not unreasonable.
Third, that at 17 December 2012, the date they completed their fieldwork, the anti-fraud governance framework remained inappropriate. This was due to a number of factors, including;
Some planned actions were dependent on the identification of a corporate fraud lead. Indeed a permanent Corporate Fraud lead is still to be appointed.
Some planned actions were dependent on the new SAP system going live on 1 January 2013; and
Other competing priorities, such as the Financial Transformation Programme
Fourth, that the work then in progress should improve the anti-fraud governance framework; and
Finally, additional actions were required to meet their baseline expectations.
A number of reports, spanning more than a decade, into the States’ financial controls and risk management regime (of which an effective anti-fraud governance framework is a vital part) have highlighted numerous inadequacies . This, despite the fact that Guernsey has one of the most regulated and highly respected financial services industries in the world.
One of those reports was published by the previous Public Accounts Committee in May 2012, just before the specific incident took place. The findings of the Committee’s report were confirmed by the States Internal Audit Unit report the same month, which stated, and I quote;
‘The States of Guernsey is in the bottom 5-10% of UK organisations in terms of counter-fraud maturity.’
There has been a persistent failure to develop a States-wide approach to risk and it has not been appropriately prioritised.
However, the incident of fraud in July 2012 has been a catalyst for change. It should be acknowledged that a significant amount of work has been undertaken in the months following the incident and credit should be given to the States’ Head of Assurance who is leading the implementation of the improvements.
Political ownership has also been evidenced in the creation of a temporary Risk Steering Group comprising the Chief Minister and Ministers of Treasury & Resources and Public Services.
There are also significant workstreams in progress, including;
the appointment of a supplier to develop and implement a Risk Framework and Policy;
the drafting of a Corporate Risk Register by the Head of Assurance in conjunction with the Executive Leadership Team;
the drafting of a Fraud Rule, Directive and Response Plan, which has been circulated for consultation; and
the development of a comprehensive authorisation policy which is currently being reviewed for feasibility and appropriateness
However, a permanent corporate fraud lead, a key recommendation of both Ernst & Young and the Internal Audit Unit, has yet to be appointed and, whilst a lot of positive moves have been made, they do not fulfil all of the recommendations in the Ernst & Young report.
The Public Accounts Committee fully concurs with the conclusion of Ernst & Young that; ‘the climate is right to ensure that there is a robust and fully embedded anti-fraud governance framework across the States. Anti-fraud must be owned by staff at all levels, but the change must be driven by the right tone from the top.
Throughout this review, it has become evident to the Committee that the ownership and accountability of risk management within the States of Guernsey is not entirely transparent.
In future there needs to be clarity of where responsibility and accountability rests for successfully implementing both the States’ Fraud Risk Management Improvement Plan and the recommendations made by Ernst & Young – at both a political and operational level.
Political ownership has been evidenced in the creation of a temporary Risk Steering Group but this momentum needs to continue.
The Treasury & Resources Department and the Policy Council (working via the Executive Leadership team and Risk Steering Group) must ensure that future planned actions are completed in a timely manner and that those charged with taking forward the workstreams have the necessary authority, resources and support to do so.
Currently, the responsibility lies with the Treasury and Resources Department and the Committee would like to be satisfied that this is a logical place for this to sit, or whether it should become the responsibility of Policy Council.
The Head of Assurance has taken the lead in managing the Corporate Risk Management improvement activity, including acting as the temporary Corporate Fraud Lead, whilst also in the role of Head of Internal Audit, responsible for reviewing the adequacy of the risk management regime. The Committee needs to be assured that any potential conflicts between the roles of Head of Internal Audit and Head of Assurance are managed appropriately.
In conclusion, the report from Ernst & Young confirms that, prior to May 2012, the States of Guernsey had an inadequate risk management framework in place. However, improvements have been made and progress is ongoing, but it is clear that, at this time, further work is required.
The Committee believes the States of Guernsey has taken some important steps in improving the States’ anti-fraud governance framework, but it is crucial that the States does not falter, as it has done historically, and delivers a consistent, formal, comprehensive and truly corporate approach to risk management.
There is a vital role for the Committee to play in monitoring the progress being made in the development of an appropriate risk management framework. In addition, it is well aware that the recent implementation of SAP and the Shared Transaction Service Centre (STSC) has had a major effect on the financial control environment within the States of Guernsey. The Committee is concerned that such a significant change has occurred prior to the development of an appropriate risk management framework and accordingly it has approved the commencement of Stage 2 of its Review of Financial Controls, focussing on those controls now in place.
Finally, as Members will be aware, the Committee has previously been advised that it would be inappropriate to undertake a review of the specific incident of fraud due to concerns that this might compromise the ongoing criminal investigation. I wish to advise that discussions are currently in place with the law officers and police authorities involved with the investigation with a view to commencing Stage 3 of its review into the specific incident of fraud as soon as possible
I made the following statement as Chair of the Public Accounts Committee at the November 2012 States meeting.
Sir, I am making this statement to update Members about progress in terms of the investigation into the July Fraud and its Review. Having spoken to the Minister of Treasury and Resources Department and Minister of Home Department, we have agreed that, in the absence of any material changes, we shall alternate the updates we provide to this Assembly between us. These will be provided every 2 months and the next update will be provided by the Home Minister.
With regards to the police investigation, members will be aware of the recent arrests carried out by Lincolnshire Police as part of Operation Infinity. We have been advised that there is no further information to report at this time.
In relation to the review of the specific incident of fraud, as I said in my last statement, this will not be able to start until we are advised that it will not prejudice the ongoing criminal investigation. As I am sure members will understand, given the current stage of the investigation, this continues to be the case. I will advise Members as soon as circumstances change.
In my last statement in relation to the broader review into the effectiveness of financial controls in place to minimise the risk of fraud I notified this Assembly that external reviewers were to be appointed and that I would advise who these would be, the timeframe for the review and the cost by the end of October 2012. This target was met and Members were advised that the local practice of Ernst & Young were appointed at a cost not exceeding £25k. Members were also advised that we were expecting completion of their work in December and that the Committee would receive its findings in January.
I am pleased to be able to advise this Assembly that Ernst & Young commenced work on 1 November 2012. I am also happy to be able to report that their work is ahead of schedule and we now expect to receive their report by the end of the year.
It will then be for the Committee to review and consider these findings before setting a date for a public hearing.
Finally, I should like to advise that whilst all the news coming out of the Public Accounts Committee thus far has been in relation to the Fraud Review, we have been undertaking a number of workstreams and activities which will be made public over the coming months and, whilst I have advised that we intend to hold a public hearing in relation to the fraud, it is envisaged that this will not be the first or the last undertaken by this Committee.
At the November 2012 States meeting I provided answers to a set of Rule 5 questions asked by Deputy Peter Gillson.
- 1. Could the Chairman of the Public Accounts Committee please explain why the Committee felt it preferable to inform Members of this Assembly that Ernst & Young had been appointed to undertake the investigation into the £2.6m fraud by copying a press release to Members rather than by making a Statement to the Assembly, especially considering that the Assembly was in session at the time the press release was circulated to Members.
A press release was circulated to announce the appointment of Ernst & Young to undertake the external review because the Committee considered that it was not necessary to request the permission of the Presiding Officer under Rule 8 of the Rules of Procedures to make such a statement.
The Committee used the Rule 8 procedure in the September States Meeting, at which I provided a detailed statement explaining the scope of the review and the Committee’s intention to appoint external reviewers. The media release issued to the Members of the States on 31st October 2012 sought only to confirm the name of the appointed reviewers, the maximum budget and timeframe for the first stage of the review. Given the limited amount of new information to be communicated, the Committee did not consider a formal statement to the States was necessary, in addition to the circulated release.
As you know, the media release was circulated to all Deputies on Wednesday 31st October. It was subsequently provided to the media embargoed until Friday 2nd November. The release was also uploaded onto States of Guernsey website on Friday 2nd November and may be accessed through the Public Accounts Committee website.
- 2. The independence of the review is vital to public confidence, therefore could the Chairman please provide the following information:
a) The nature of any contract Ernst & Young currently have with the States of Guernsey, in particular those with Treasury & Resources, and provide the total value* of these, if any.
b) The nature of any contracts Ernst & Young have had with the States of Guernsey for each of the past 5 years, again, providing the total value of these, if any*.
c) Are Ernst & Young in the tender or pre tender stage and contracts with the States of Guernsey? if so what are they?
d) Are any Partners or members of the Senior Management Team of Ernst & Young members of any States Departmental or Committee Board, or members of any of the Boards of any States owned trading company?
(* to protect commercial confidentiality, providing the total value of contracts to the nearest £50k for each of questions 1, 2 and 3 will suffice, i.e. below £50k, or between £50k and £100k, etc. etc.)
In response to part (a) of the question, I can confirm that Ernst & Young presently have only two contracts with the States of Guernsey, including the contract with the Public Accounts Committee under which they are carrying out this review. The other contract is for ICT consultancy work and has no bearing on the Committee’s review.
Further, ahead of PAC’s engagement Ernst & Young reviewed its available records to determine whether potential conflicts might arise out of its performance of the Services and no such conflicts were identified. However, I should note that given the very nature, diversity, magnitude, and size of the Ernst & Young organisation and its past and present professional relationships it does not allow the organisation to be certain that each and every possible relationship or potential conflict has come to its attention, but the letter of engagement requires Ernst & Young to promptly notify the Committee if additional relevant relationships or potential conflicts come to its attention.
In response to part (b), I can inform you that Ernst & Young have reviewed their global billing system and identified three invoices in the last five years. Two invoices related to the ICT consultancy work mentioned above and one relates to a one-off assignment performed under a separate engagement letter for an independent States body seeking advice on a tax matter. These invoices amount to less than £50,000 and the work was performed between April 2008 and November 2009.
In response to part (c), I can inform you that the only formal pre-tender Ernst & Young has identified is the submission of a Pre-Qualification Questionnaire entitled “Professional services to develop and implement a corporate approach to risk management across the States of Guernsey”. The outcome of the submission of this pre-Qualification Questionnaire is not currently known. Ernst & Young has informed the Committee it is not aware of other formal tender. The current contracts have already been detailed.
In response to part (d), the Committee has made enquiries of Ernst & Young who have confirmed that no partners or executive directors are members of any States Departmental or Committee Board, or members of any of the Boards of any States owned trading company. However, for completeness, please note that one partner/executive director of Ernst & Young has confirmed he is a Commissioner and Treasurer of the Guernsey Arts Commission.
Finally, I can confirm the Public Accounts Committee is not aware of any possible conflicts of interest and it is assured of the independence of Ernst & Young in conducting this review.
This Statement was made by me, as Chair of the Public Accounts Committe, at the Meeting of the States on 25 September 2012.
Deputy Bailiff, Members of the States
I am making this statement further to last week’s publication of the terms of reference for the Public Accounts Committee’s fraud review. On behalf of the Committee, I wish to expand on the information provided in the accompanying Media Release and advise what action it has taken since the Minister of the Treasury and Resources Department made his statement in July.
The Committee agreed at its meeting in July to commission and oversee the independent, external review into the specific incident of fraud, in liaison with the Chief Minister. Although we wanted to commence the review immediately, it was prudent that we take advice from the Guernsey Police and Law Officers on the potential impact the review could have on the ongoing criminal investigation.
It mustn’t be forgotten that we are not dealing with a basic bread and butter review here. The fact is a criminal act has been committed against the States of Guernsey, which affects the people of Guernsey, and a police investigation is underway.
It is not the wish of the Committee, or in the interests of the people of Guernsey, to jeopardise the Police investigation. We wish to get to the heart of this incident as quickly as possible but will pursue this matter responsibly and with regard to the professional advice of those seeking to establish criminal responsibility and the recovery of funds. The clear legal advice is that the section of the review considering the circumstances of the specific incident of fraud should not be conducted until the criminal investigation has been completed.
However, the Committee will carry out a broader review into the appropriateness of financial controls relating to fraud prevention across the States of Guernsey as soon as possible. Part of the Committee’s mandate is to ensure that proper scrutiny is given to the States’ assets, expenditure and revenues to ensure that States’ bodies operate to the highest standards in the management of their financial affairs. The purpose of this review is to consider the effectiveness of financial controls in place to minimise the risk of fraud and to provide an independent assurance that processes and procedures across the States are to an acceptable standard. The Treasury and Resources Department is responsible for the regulation and control of States’ financial affairs. Whilst we have received assurances from the Minister of the Treasury and Resources Department that controls have been changed, we must have independent validation that they are now fit for purpose. It is imperative that the public are assured, and those outside this Island are in no doubt, that the States of Guernsey are not ‘open to fraud’.
In publishing the terms of reference, we also announced that we would be commissioning external reviewers to undertake both stages of the review. I have made very clear my views on the use of external consultants and my desire that the PAC undertakes an increasing number of reviews in-house. At this early stage of the current Committee’s existence we simply do not have the resources or expertise available to undertake this review. This is why the Committee has an existing budget available for ‘contracted out work’ which this review is expected to fall within.
The staff of the PAC and the Scrutiny Committee were amalgamated at the start of this political term. There is a total of 4 members of staff available to support the work of both Committees. We lack staff resources. This is a highly specialised area and large elements of this review will require relevant expertise that we currently do not have available without outsourcing. During this political term I will endeavour to ensure that the Committee is appropriately resourced. However, at the present time, it would be unrealistic of the Committee to expect the team to single-handily undertake a review of this nature.
In addition, we agree with the Chief Minister that the PAC, working together with the external experts, will give the public assurance that this is a thorough and independent review.
I would like to clarify the use of the term ‘external’. By this we mean external to the States of Guernsey, not the Island itself. Given the quality and experience of our financial services industry, the expertise we require is clearly available on-Island. We are seeking to commission a local business to investigate and produce a report in line with the terms of reference and aim to announce the reviewer and the timescale for the review by the next States meeting.
As many Members will be aware, there have been reports previously published on States internal controls. Indeed, the former PAC issued such a report on risk management in the last year. The Committee will not be replicating work previously undertaken but will assess how effectively previous recommendations and findings have been implemented. It is essential that attention is focussed on the effects of the changes made following the fraud incident, as well as the effects of recent changes in the management structure in the Treasury and Resources Department and the implementation of the Shared Transaction Service Centre.
Finally, I would also like to make a brief comment regarding disclosure of information that will be received as part of this review. I can confirm that we will publish all relevant information arising from our review, unless we are advised that we cannot do so for legal reasons or because it would not be in the public interest to do so.
The public will have answers and I trust will understand that, in these unique circumstances, these should be the right answers and the not the quick answers.
Below is the Media Release issued on 19 September, accompanying the Terms of Reference for the Fraud Inquiry, which are attached.
The Public Accounts Committee has published its terms of reference for its review prompted by the fraud committed against the States of Guernsey reported in July 2012.
This will be a broad review of the effectiveness of financial controls in place across the States of Guernsey to minimise the risk of fraud against the organisation and safeguard States’ assets.
The Treasury and Resources Minister has previously given his assurances that immediate steps have been taken to tighten procedures internally in the light of the fraud incident, and the review will seek to validate those steps.
Deputy Soulsby, Committee Chairman, said:
“The Public Accounts Committee will assess whether appropriate financial control policies and procedures are in place and are being applied consistently, that risks are properly managed and weaknesses addressed promptly.
The focus of the review will be very much on preventing future vulnerability and providing independent assurance that processes and procedures across the States of Guernsey are to an acceptable standard. The review will include consideration of information about the circumstances surrounding this specific case of fraud, in particular considering how the fraud was able to occur and what the response has been to protect the States against future fraud.”
The Committee will now be commissioning expert consultants to investigate and produce a report in line with the terms of reference it has set.
The appointment of those consultants is expected to be completed and announced by the end of October 2012. The Committee is of the view that it is necessary to appoint external consultants to provide the necessary expertise. The cost of the review will be met from the Public Accounts Committee’s budget.
The Committee intends to conduct a hearing based on the information provided by the consultants, and will then publish its findings.
Deputy Soulsby said:
“The Committee has a general policy to publish information gathered relevant to its reviews and aims to hold its hearings in public, unless it would not be in the public interest to do so. Obviously this review will include consideration of extremely sensitive information so the Committee will need to navigate very carefully when it comes to deciding what can be published and what evidence may be heard in a public forum. The review must not prejudice the ongoing police investigation, and we will work closely with the police and Law Officers in order to ensure that.”
The Chief Minister, Deputy Peter Harwood, said:
“I have been provided with assurance that steps have been initiated to tighten up on procedures since the fraud was discovered. I am pleased that the Public Accounts Committee has agreed this review to provide independent validation of the processes and procedures in place.”
Below is the media release published on 2 August 2012 by the Public Accounts Committee confirming that it would be investigating the circumstances surrounding the fraud against the States of Guernsey.
In light of the recent £2.6 million fraud committed against the States of Guernsey, the Public Accounts Committee will seek to ensure financial management and governance lessons will be learnt, shared and changes implemented across the States of Guernsey.
Chairman of the Public Accounts Committee, Deputy Heidi Soulsby, stated:
“The Committee was shocked and disappointed to learn of the fraud recently suffered by the States of Guernsey. The Committee will carry out a review into the appropriateness of financial controls across the States of Guernsey in the light of the recent fraud.
The review will clearly identify defects in process and procedures and seek assurances on behalf of the public that the States is acting appropriately to safeguard public funds. Where the review identifies areas which require improvement, the Committee will make recommendations accordingly and monitor their implementation”.
The Committee is drawing up the proposed terms of reference of the review in discussion with the Chief Minister, with a view to jointly commissioning external expertise to gather essential evidence once it is clear this will not have a negative impact on the ongoing police investigation.
The Chief Minister commented:
“The Policy Council will be making sure that appropriate steps are being taken to protect the States of Guernsey from the risk of future incidents of this nature. It is also keen to ensure robust and thorough independent scrutiny is given to the circumstances of this case, but recognises that such an investigation needs to be held at arm’s length from the executive functions of the States.
I have been directed by the Policy Council to take these matters forward on its behalf and have met with the Public Accounts Committee to discuss the terms of reference for a comprehensive review drawing on external expertise where appropriate. It has been agreed that the choice of who to commission to carry out such investigations should be a matter for determination by the Public Accounts Committee”
This investigation falls within the Public Accounts Committee’s mandated role to ensure that proper scrutiny is given to States’ expenditure in order that States’ bodies operate to the highest standards in the management of their financial affairs.
Deputy Soulsby stated:
“Work on the review will commence as soon as possible, starting with an examination of the policies and processes and taking into account legal and police advice so as not to prejudice the ongoing police fraud investigation.
It will also be important not to take away the focus of the Treasury and Resources Board and staff from getting on with taking steps to make sure that processes and procedures are as robust as possible so that public money is appropriately safeguarded. These actions will in time form part of what comes under scrutiny in the Committee’s review.”
The Public Accounts Committee is at arm’s length from the departmental executive and is tasked by the States of Guernsey to carry out investigations of this nature. It also has a policy of full disclosure, subject to guidelines where disclosure would not be in the public interest.
Deputy Soulsby said:
“The public will have answers, but I am sure will appreciate that sensitivity and patience is required to ensure that the integrity of the police investigation is not jeopardised and that practical measures to put things right are not in any way delayed.”