Limited Assurance at Ravenshill Housing
A housing association's procurement files are held partly on a shared drive, partly in email inboxes and partly in a filing cabinet at the depot. An internal audit of 240 live contracts found 37 with no signed copy on file, 12 that had passed their end date but were still being invoiced, 9 where the invoice price differed from the contract price, and no single list of who is responsible for each contract. The auditor has given a limited-assurance rating. One contract, for lift maintenance, has no evidence that the contractor's insurance certificates were ever checked.
1. Rank the audit findings by risk and explain your ranking.
Read the worked answer
- Lift maintenance insurance evidence (highest). This is a safety and liability exposure, not an administrative one. If a lift fails and injures someone, the association must show it checked the contractor's insurance before work started. No evidence means no defence.
- 12 expired contracts still being invoiced. Spend is continuing with no agreed terms, price protection or exit route; the association is exposed to whatever the supplier chooses to charge.
- 9 price discrepancies. Direct financial loss, and it may be ongoing rather than historic - quantify the value before ranking it further, as nine small variances differ greatly from nine large ones.
- 37 missing signed copies. The contract may exist but cannot be evidenced; a dispute or audit challenge becomes hard to answer.
- No named contract owner. This is the root cause of the others, but it is a cause rather than an incident, so it sits last on the incident list while ranking first on the fix list.
Ranking rationale: safety and legal exposure first, live financial exposure second, evidential gaps third.
2. Design the administrative controls and records you would put in place.
Read the worked answer
A single contract register, held in one controlled location, with these fields at minimum:
- Unique contract reference, title, supplier, category
- Named contract owner and deputy
- Start date, end date, extension options, notice period
- Contract value, agreed rates, payment terms
- Insurance and compliance certificate expiry dates
- Signed copy location (link to the document)
- Status (live, expiring, expired, terminated)
Controls:
- Renewal alerts automatically at 90, 60 and 30 days before end date, sent to the owner and procurement.
- A rule that invoices cannot be paid without a live contract reference, with a price check against the register.
- Documents named and stored to a standard convention; no contract held only in an inbox.
- Insurance and compliance evidence logged with expiry dates and re-requested before lapse.
- Access permissions and an audit trail of who changed what.
- Retention and disposal rules so old records are removed on a defined schedule.
3. How would you convince the auditor that things have improved?
Read the worked answer
With an action plan plus re-testable evidence, not a narrative.
- Action plan: each finding mapped to a corrective action, a named owner, a due date and a completion date.
- Immediate remediation: obtain and file insurance certificates for the lift contract now; issue renewal or termination notices on the 12 expired contracts; raise credit notes or correct pricing on the 9 discrepancies and quantify the recovery.
- Root cause fix: populate the contract register and assign owners - state how many of the 240 contracts are on it by the target date (aim 100%).
- Evidence of operation: show three months of renewal alerts issued, and a sample of invoices checked against contract prices with the results.
- Agree the re-test method with the auditor in advance - how many files they will sample and against what criteria - so improvement is measured on the auditor's terms, not yours.