SUMS/SUPC Purchase to Pay Workshop Uniac – Managing risk in your P2P process Richard Young 22 nd May 2015 Session structure: Audit involvement The risks Auditing culture and mindset Experiences and pitfalls Risk management approaches

Introduction Richard Young, Director – Uniac Uniac - HE Internal Audit Shared Service Provider 10 member institutions ranging from University of Manchester, Huddersfield and Falmouth Risk based approach to internal audit recognising:  Opportunities as well as threats  Control needs to be proportionate to risk  Unnecessary and duplicate controls 2

Getting involved P2P has moved on…..and so should the role of the internal auditors Involvement at the outset - Steering / Project Group – assistance in mapping the existing processes, reviewing new processes as they are developed Understanding the Procurement Strategy:  Where does the P2P process fit within the overall strategy  Is it all joined up – central v devolved initiatives, large contract management, purchasing and procurement cards  Clear objectives for the next five years 3

What are the risks? Same as they always were… We buy goods or services we don’t need (or can’t afford) or which we could have acquired by other means – e.g. sharing We buy too few or too many We over or under state the quality required We don’t take account of ancillary costs – delivery, maintenance, operating costs, disposal The supplier does not deliver on time, within the expected cost or to the quality expected The goods or services don’t deliver the benefits expected Goods or services may be hazardous We pay for things we didn’t order or didn’t receive; and we pay for things more than once or at other than the agreed price 4

Who should manage these risks? Realistically the number of risks and the myriad of circumstances in which they play out must mean that users / clients need to be accountable – supported of course by procurement specialists who (i) provide a framework to manage risk; (ii) monitor how that risk management framework is operating in practice; (iii) provide additional specialist support for more complex or unusual situations; but (iv) cannot be responsible for all procurement transactions 5

A fundamental choice – auditing culture and mind set Emphasis on adherence to rules vs. emphasis on procurers demonstrating good commercial sense Good risk management = emphasis on good commercial sense and crafting rules that support good commercial sense rather than being a prop for poor decision making – evident when there is a sense of managers – whether procurement specialists or “users” going through the motions 6

Good commercial sense – a definition Did I need to procure? –At all –To that specification –In that quantity –Have alternatives (e.g. borrowing, sharing, not procuring at all) been considered properly? Did I get it for a good price? –Including whole life costs –Including procurement costs – transaction time and ancillary supplier costs Did the supplier perform as expected (and did I protect my university from under performance)? Did the goods / services deliver the benefits expected? 7

Managing risk To what extent can rules substitute for good commercial sense? Can rules kill commercial acumen? Can you train people to have good commercial sense? Should managers be given a licence to procure based on their commercial sense – and have it taken away or downgraded if they fall short? 8

Experiences and Pitfalls Delivery of system benefits and procurement lead status:  Initial objectives achieved (eradication of paper orders, requisition to purchase order, three way match) but slower progress with electronic invoices, e-market place, supplier self service)  Ability / opportunity for procurement lead to ensure that strategic procurement benefits are understood and supported by senior management Reduced value of audit testing….the management information is already there:  Spend analysis, invoices without orders, small orders, outstanding invoices, duplicate payments, disproportionate transaction time  Accountability and action 9

Experiences and Pitfalls Multiple layers of authorisation Maintenance of splinter systems e.g. Library and special estates projects Maximising Procurement function role:  Planning – engagement with budget holders identifying procurement needs well in advance  Provision of training  Driving strategic benefits – shared procurement service 10

Experiences and Pitfalls Integral to the VFM agenda:  Institutional VFM reports informed by Procurement Annual Report  Concentration on moving forward as well as reporting backwards  Benefits of a senior academic sponsor 11

Suggested risk management approaches Mandatory training for all who will procure or who will authorise procurement transactions Bottom up budgets that make planned procurement activity readily apparent Regular meetings between procurement specialists and budget holders to identify particular future procurements that require specialist support Review meetings (could be risk based) between procurement specialists and individual procurers / authorisers to look back through recent procurement activity and identify strengths / learning points – with the ability to enforce additional training / withdrawal or limiting of procurement authority Minimal rules beyond what is required to ensure legal compliance – instead strong promotion of a commercial mindset 12

Summary The risks are the same System developments mean that procurement provide the framework and procurers demonstrate good commercial sense Maximise the system benefits Avoid the pitfalls Appropriate risk management framework 13