Forty-six people who left Cheshire East Council's employment still had access to computer system
By Belinda Ryan - Local Democracy Reporter
10th Mar 2023 | Local News
Forty six people still had computer access to Cheshire East's financial system after they had left the council's employment, an auditor's report has revealed.
Mazar's, the council's external auditors, identified 46 users that retained general ledger systems access after their leave date.
They highlighted this as a 'level one significant deficiency in internal control' in the external audit report which went to Thursday's meeting of the council's audit and governance committee.
Level one is considered by the auditor to have 'potential for financial loss, damage to reputation or loss of information'.
At the meeting Ron Jones, who is a co-opted independent member of the committee, asked: "Does this include internal transfers as distinct to leavers? The point being, if there's internal financial authority and someone moves to a different section and retains that authority."
Mark Dalton, of Mazar's, said: "We do know that the council and management have been doing a large number of work in relation to those 46 individuals to get their own assurance as to whether those individuals have actually inappropriately accessed the systems after they left, and I'm pleased to be able to report to the committee that that's not the case."
With regard to how they had remained on the system, Mr Dalton said he understood, from the council's initial work, that a number of those individuals were management consultants who had continued to have some kind of support role as the new system was rolled out.
No reference was made during the meeting as to why others had remained on the system.
Mr Jones also picked up on a lower, level two deficiency, where a new worker had been granted access to a system prior to approval of the access request.
A Cheshire East officer told the committee: "They have assured us they have tightened their procedures to ensure that, in all new requests to access the system, line manager approval is obtained."
But Mr Jones sought assurance from the external auditor that there was a control in place to make sure those processes are carried out and he was happy with it.
Mr Dalton replied: "We are assured that management have accepted the improvement opportunity and they're on with that but, as our report states, that remains a control deficiency as things stand and we'll only clear it as part of our 22/23 audit."