DV - note of two meetings held on 13-1-03
At noon on 13-1-03 Martin Oldfield and I met with Diamond to discuss the concerns to which I had referred in my note to him dated 3-1-03.
I explained to him that I had felt uneasy about his behaviour on 19th December, and in particular by his responses when I called in to his office that afternoon to ask what he was doing. My concern could be summed up in the question: if something was amiss, how would I know? It was this concern that led me to talk to the auditors, and it was their view that the concern was a reasonable one and the way to deal with it was to undertake the exercise that was in fact undertaken on 2-1-03. That exercise had, as I had said to Diamond in my note, raised some questions and prompted some recommendations, hence the meeting scheduled for 2 p.m. But subject to anything that might come out of that discussion, the exercise had reassured me that nothing was amiss, and that implementing the recommendations would give me more confidence that, in future, if anything was amiss I would know.
Diamond said that he was upset by the way the exercise had been undertaken without his knowledge and suggested that I was implicitly accusing him of fraud or incompetence. I repeated that my object was simply to address my concern, and that not to have done so would have been a dereliction of my duty. He asked whether I trusted him. I replied that this was not a question of trust, but of ensuring that appropriate systems were in place to protect the College. This was as much in his interests as anyone else's. Trust, co-operation, working well together, were essential to the efficient management of the College's affairs, but that was predicated on a sound framework of controls, including, if thought worthwhile, independent checks such as we had carried out on 2nd January.
At 2 p.m. Diamond and I met with Stephen Dexter of Grant Thornton. Stephen raised four issues:
Amongst the 8,756 entries during the period 1-8-02 to 2-1-03 there were 239 mis-posts and 4 other corrective measures. This appeared on the face of it to be a very high level. The explanation was that a large number of re-allocations, necessitated by the year-end adjustment process and the introduction of the new SORP framework, had been given the narrative 'mis-post'. The number of 'genuine' mis-posts (i.e. mistakes) was quite small. We agreed that, going forward, only genuine mis-post would be given this narrative so that these could be easily reviewed during the year-end audit.
The transfers of odd amounts across the Barclays accounts were the result of a standing instruction to the bank to transfer cleared balances on the current account to the business reserve account on a daily basis. Stephen observed that this was not how most businesses operated and we agreed that Diamond would discuss with Barclays whether this arrangement was to be preferred over the normal practice of transferring all balances (cleared and un-cleared) over a certain figure to an interest-bearing account.
The reason why we had four Abbey National accounts was that the bank restricted the maximum balance on any one account to £2mn.
We agreed that Diamond would progress the possibility of investing surplus funds in the University Pool rather than in Abbey National.
Passwords. Stephen said it was good practice for an organisation to hold passwords centrally (and in confidence) in case of emergency. Diamond pointed out that since the IT Officer was able to change passwords without knowing the original password this measure was unnecessary, and any disclosure of passwords increased the risk of fraud. Stephen agreed to consider this matter further and write with his views.
We then turned to recommendations for the future and agreed that the Bursar should have read-only access to both the accounting system and the Barclays cash-management system. Diamond will arrange this.
RJB 14-01-03