An internal audit report into Brent Council's planning application process by PriceWaterhouseCooper (PcW) has given only a 'Limited Assurance' rating and identified  high and medium risks of error or fraud. The report LINK which was submitted in November 2016 will be discussed at the Audit Committee on Wednesday January 11th 7pm at Brent Civic Centre.

In the last year there have been major staff changes in the Planning Department. Both planning and regeneration come under the Strategic Director for Regeneration and Environment.  Recently the lead member for Regeneration, Growth, Employment and Skills, which also covers planning policy,  Cllr Roxanne Mashari, resigned from the Cabinet earlier this month to be replaced by Cllr Shama Tatler.

The summary states: (my emphasis highlighted in yellow)

A new management team has been in place since May 2016 and there was evidence of some improvement being made to the system of controls within the planning application assessment process. However, our review did identify significant weaknesses in the planning application review and assessment process due to issues in the design of automated and user access controls with the system used to process planning applications, Acolaid. Issues identified around the system audit trail, user access rights and system enforced controls in place mean that the system is highly susceptible to manipulation and abuse through inappropriate or fraudulent activity and action should be taken immediately by management to strengthen the controls embedded within the system. We have included on page 4 a summary process map identifying the key weaknesses within the overall control system. 

Based on the findings identified by this review we are only able to give Limited Assurance over how the risks covered by this review are being mitigated. Key findings

•       The audit trail supporting the completion of key planning tasks is driven by the user selection from a drop down field that any user can amend rather than being automatically recorded based on the username within the system who has actually processed the task. The audit trail, including evidence of key approvals in the planning application process, may not accurately reflect who has actually performed the task and could be susceptible to manipulation to hide inappropriate activity. 


•       The system does not enforce segregation of duties between key parts of the planning process such as the initial assessment of the application by a Planning Officer and the subsequent approval by a Planning Manager. 


•       Roles and responsibilities are not fully aligned to access rights within the system. There are 9 levels of user access rights in the Acolaid system. Those responsible for granting/amending access rights were not able to define what access rights these user profiles permitted. 


•       Acolaid system user access rights have not been regularly reviewed by management. There are 739 user IDs listed on the Acolaid system. 429 (58%) users had not used the system since 30/3/2016 at the time of audit (01/08/2016) consisting of staff that have left the Council or who no longer require access to Acolaid. There is no effective mechanism in place to identify users who have left the Council or no longer require access to the system and withdraw access rights accordingly. 


•       There is no evidence an anti-bribery risk assessment has been completed for the Planning Department and anti-bribery awareness training has not been provided to planning staff. The Council may not be able to demonstrate that it has taken steps to prevent bribery resulting in non-compliance with the Bribery Act 2010 which could result in reputational damage and prosecution under this legislation. 


•       The Council officers a pre-application advice service in relation to prospective planning applicants. Advice issued should be subject to review in advance of being issued. 7/101 (7%) of pre-applications had been processed and reviewed by the same person. 


Planning Officers are bound by the Royal Town Planning Institute's Code of Conduct, which includes competence, honesty and integrity as key principles. However, this does not include any specific requirements regarding anti- bribery. We reviewed the Council's Anti-Fraud and Bribery Policy and found:

•   The Council has committed to maintain adequate and proportionate procedures to prevent bribery, undertake anti-bribery risk assessments and make all employees aware of their responsibilities to adhere strictly to this policy at all times; 


•   An anti-bribery risk assessment for the planning applications process and anti-bribery awareness training has not been provided to staff; 


•   A planning code of conduct is in place for members, however this does not include provisions relating to officers. We note that the code of conduct is currently being redrafted to include officers; and 
Planning Officers are required to flag any potential conflicts of interest in processing planning applications on an ad-hoc basis, but there is no requirement to make formal written declarations and a register of interests is not maintained.

HIGH RISKApproval of planning applications: System-audit trail and workflow

The Acolaid system does not accurately record the allocation and completion of work and the audit trail is susceptible to manipulation. In addition the system does not enforce segregation of duties for key parts of the process and system access rights do not reflect roles and responsibilities. As a result planning applications may be approved without the prerequisite review and approval in line with roles and responsibilities in place. This could result in planning applications being approved inappropriately due to fraud or error. 


HIGH RISK Acolaid System use access

System access rights do not reflect current roles and responsibilities. Individuals who do not require access to the system or have left the Council have access to the system and are able to make inappropriate changes to records and standing data due to fraud or error. 

MEDIUM RISK Anti-bribery arrangements

The Council is not able to demonstrate that it has taken steps to prevent bribery resulting in non-compliance with the Bribery Act 2010 which could result in reputational damage and prosecution. 
Inappropriate decisions are made regarding proposed planning applications due to bribery and undue influence. 


MEDIUM RISK Pre-application advice

Insufficient segregation of duties and independent review of pre-application advice may result in poor quality advice not being identified and resolved or inappropriate advice being issued based on the scope of services that can be provided at the pre-application stage. 


MEDIUM RISK Management Information Control design

There is insufficient performance information available to management to facilitate effective oversight of operational performance. Operational issues are not identified and resolved in a timely manner.