Compliance Audit: guide for providers and independent auditors

Compliance Audit Overviewoverview

The annual Compliance Audit programme provides assurance that organisations receiving grant (providers) have met all of Homes England’s requirements and funding conditions, and have properly exercisedfulfilled their responsibilities as set out in the Capital Funding Guide (CFG).

Standard Standardised checks are made by provider-appointed independent auditors on an agreed sample of schemes and,/ orsites sites, that have received Homes England funding under current and earlier affordable housing programmes.

Compliance Audit does not reduce the responsibility of the provider and Homes England to ensure that the costs in any claim for grant are appropriate and have been properly incurred.

Compliance Audit Systemsystem

Homes England manages the annual Compliance Audit programmeprogramme.

The using a web-based IT system. Registered users can access the Compliance Audit Systemis here.submitted Beonline mindfulusing that not all browsers support the ComplianceInvestment AuditManagement system.System If you cannot access the system on the browser you are using, try another browser.(IMS).

The system iscan accessiblebe toaccessed by:

• Homes England staff and
• non-Homes England staff such as providers and their appointed independent auditors. auditors

It provides a communication platform including alerts to users, tracks programme deliverydelivery, and records annual audit findings and outcomes.

IMS access

You must be a registered user to access the system. Access to the system will require a username and password.

Provider access to the Compliance Audit system is managed through the Investment Management System (IMS) security module.

New users willshould needask to be set up by their organisation’s IMS Security Administrator andto willset up their account.

Independent auditor access must be requiredarranged toby logthe inprovider’s withnominated Compliance Audit lead.

System requirements

You must use a usernamecurrent andversion password.of Independentthe auditorEdge, accessChrome willor needFirefox browser to beaccess arrangedthe bysystem.

You themust provider’salso nominatedinstall ComplianceCitrix AuditWorkspace. Lead.Find out how to install Citrix to access the Investment Management System.

Avoid delays on your audit

Providers are required to complete all set-up steps for the Compliance Audit system noat laterleast than 5 weeks before the long-stop date which is set each year by Homes England. The long-stop date will be communicated to providers selected for audit in the notification email.

WeThe havedeadline introducedprovides thissufficient deadlinetime tofor enableHomes usEngland to quickly support any providers struggling to access and update the system, and to make sure that independent auditors canin startaccessing theand auditupdating on the agreed date.system.

If you experience any problems with setting up an account on the Compliance Audit system, contactread us by email.the:

Access

• Compliance Audit system user guidance.

  Access

• IMS guidance and supporttraining.

If you are still experiencing problems, contact Homes England by email.

Audit programme and process

Compliance Audit followsruns an annual cycle.annually.

Scheme sample and notification

Scheme sample selection will take place early in the auditprocess. cycle,Once aftercomplete, which Homes England will notify providers of their selection and the number of schemes and,/ or, sites selected.

Independent auditor appointment and training for providers and independent auditors

Providers must engage an independent auditor in line with published guidance in Chapter 6 of the Capital Funding Guide.

Compliance Audits are expected to be carried out during the notified period and before the long-stop date.

Using Providersthe mustCompliance confirmAudit system, providers must confirm:

• their independent auditor appointment, appointment
• audit start date and
• contact details through the Compliance Audit system.

Providers and their appointed independent auditors can access the schemes selected for audit in the Compliance Audit system 4 weeks before the audit is scheduled to commence.start.

Each year, Homes England organises Compliance Audit training is arranged for providers and independent auditors.auditors each year. This is delivered viausing training packs, videos and guides. These will give theproviders provider and appointed independent auditorauditors an overview of the programme, details of any updates, informationresources, on resources and further information on the audit process.

All We require all providers being audited and their appointed independent auditors tomust self-certify (via(using the Compliance Audit system) that they have observedread and followed the guidance issued.

Independent auditor review and submission

During the audit, the independent auditor considers each selected scheme and,/ or, site against the questions presented in the Compliance Audit Systemsystem, which automatically presents the appropriate set of questions for each scheme and,/ or, site.

The independent auditor reviews scheme and,/ or, site information contained in the provider’s files and Homes England’s Investment Management System (IMS) and is required to complete all the questions presented in the complianceCompliance auditAudit system, setting out all audit findings against published Homes England policy and procedures.

Independent auditors maycan also upload onto the Compliance Audit system documentary evidence in support of their responses to the questions. UnderThe no circumstances should the independent auditor must not share their findings with the provider priorbefore to submission, in any form.form, under any circumstances.

Once all questions have been completed, the independent auditor submitsmust submit their findings through the Compliance Audit systemsystem. -This this should take place within five5 weeks of the commencementstart of the audit and before the long-stop date. The system then notifies the provider and the Homes England lead auditor thatwill both be notified when the findings are available to view.

Fraudulent behaviour

Compliance Audit is not a first line of defence against fraudulent behaviourbehaviour, but occasionally behaviour of this type isof identifiedbehaviour duringis audits.identified. If an independent auditor becomes aware of potentially fraudulent behaviour during the audit year or whilstwhile the audit is being undertaken, they should take steps immediately to notify the Homes England Compliance Audit team who in turn will notify the relevant Homes England contacts.

Provider responds to independent auditor findings

Providers will then have 10 working days to respond to the independent auditorauditor’s findings. It is important that providers use this windowtime as an opportunity to review all findings, even where the independent auditor has submitted a ‘yes’ response. If thereproviders isneed to supply additional information or have points to raise, providersthey can include a response comment viausing the Compliance Audit system. Providers may also upload ontodocumentary evidence to the Compliance Audit system documentary evidence if it supports their response.

If the provider does not respond within the 10 working daydays, window, Homes England will form an opinion based solely uponon the independent auditor findings and will not be able to take further information into consideration at a later stage.later.

Homes England assesses audit findings and prepares the audit report

Once the 10 working day windowperiod for providers to comment on independent auditor findings closes,has ended, the Homes England lead auditor reviews the independent auditor findings and any provider responses wherethat have been submitted. Queries maycan be raised if more information is required or an independent auditor or provider response is not clear. A query does not inform the provider whether non-complianceor hasnot beennon-conformities identifiedhave orbeen not.identified.

The Homes England lead auditor then assigns breaches for any non-compliance identified throughfrom the audit findings using the Homes England breach list.

Breaches have an assigned severity - low, severity:

• low
• medium or high.
• high

Not all breaches apply to all funding programmes. The Compliance Audit system uses the severity of any breaches as the basis for assigning grades to providers.

The Homes England lead auditor will review assigned grades and decidedecide, on behalf of Homes EnglandEngland, whether public funds have been used for the intended purposes and in line with contractual requirements, policies and procedures. The number of breaches and their severity will be taken into consideration along with the information and evidence available at the time of reviewing.review.

The Homes England lead auditor thenwill draftsdraft a judgment summary for inclusion in the audit report,report. recordingThis will record the number of breaches identified, the reasons and their severity. If there is remedial action requiredis required, a recommendation will also be set out.given.

Homes England moderates audits to ensure consistency

Homes England moderates all audit gradings to ensure consistency of breaches and final grades across the programme before Compliance Audit reports are issued.

Compliance Audit report issued to provider

When the report is availableavailable, the Compliance Audit system will generate an email to notify firstlypeople that the provider’sreport Complianceis Auditready lead,to developmentdownload.

The directoremail andwill chiefbe executivesent officerto that the reportprovider’s:

• Compliance isAudit readylead
• development todirector
• chief download.executive Fiveofficer

The days later the Compliance Audit system will notify the provider’s board chair (or equivalent).equivalent) 5 days later.

The report is confidential between Homes England and the provider. The report itself, and any information contained within it, should not be shared with any third party or published in paper or online form, including on social media.

Provider grading

The Compliance Audit report assigns providers a green, amber or red grade based on the number and severity of breaches recorded.

Provider grades defined belowhere may also be accompanied by further contextual comments and recommendations. Grades should be read in the context of comments.

Green grade:grade The— the provider meets requirements.

requirements

No high or medium severity breaches identified, although there may be low breaches identified.

The Homes England audit report will show that the provider has a satisfactory overall performance but may identify areas where minor improvements are required.