Highways Agency

Statement on Internal Control

1. Scope of responsibility

1.1 As Accounting Officer, I have responsibility for maintaining a sound system of internal control that supports the achievement of the Highways Agency's policies, aims and objectives, whilst safeguarding the public funds and departmental assets for which I am personally responsible, in accordance with the responsibilities assigned to me in Government Accounting. This includes responsibility for transactions in respect of the Dartford-Thurrock Crossing.

1.2 Ministers receive direct reports on risks to key initiatives, the outcome of key Gateway Reviews and other key risk areas as necessary. They receive reports on risks to delivery of Public Service Agreement Targets through the Department for Transport reporting system.

1.3 My staff work closely with their counterparts in the Department for Transport to ensure that risk management, planning and performance measurement systems are compatible, clear accountability for risk management is agreed, joint action is taken where appropriate to manage, transfer or tolerate risks, and the Department is kept informed of risks as appropriate.

2. The purpose of the system of internal control

The system of internal control is designed to manage risk to a reasonable level rather than to eliminate all risk of failure to achieve policies, aims and objectives; it can therefore only provide reasonable and not absolute assurance of effectiveness. The system of internal control is based on an ongoing process designed to identify and prioritise the risks to the achievement of departmental policies, aims and objectives, to evaluate the likelihood of those risks being realised and the impact should they be realised, and to manage them effi ciently, effectively and economically. The system of internal control has been in place in the Highways Agency for the year ended 31 March 2004 and up to the date of approval of the annual report and accounts, and accords with Treasury guidance.

3. Capacity to handle risk

3.1 The Highways Agency Board, Directors, and other senior managers lead risk management in their commands, supported by a team of risk management co-ordinators led by a risk management adviser. This team develops and maintains procedures for risk management, and identifies and spreads good practice internally. Additionally the risk management adviser participates in benchmarking and information exchange with a wide range of public and private sector bodies.

3.2 Risk management guidance is available to all staff. The guidance explains the Agency's underlying approach to risk management, documents the roles and responsibilities of the Highways Agency Board (HAB), managers and staff, outlines key aspects of the risk management process and identifi es the main reporting procedures.

3.3 Training in governance, internal control and risk management has been delivered to senior managers, and some operational staff have attended risk management awareness seminars.

4. The risk and control framework

4.1 The Highways Agency Board sets the Agency's risk appetite in line with that of the DfT Board. The risk appetite is set to ensure that all risks with high residual impact on the Agency's performance or stewardship of public funds or on the Agency's or the wider Government's reputation receive focussed management attention, that decisions to tolerate or treat risks are made on cost-justified grounds, and that where appropriate action is escalated through the line management chain to DfT and Ministers.

Priority is given to risks to achievement of the DfT's targets of reducing congestion and improving safety, and those to stewardship of public resources and assets.

4.2 Risk management is an integral part of the Agency's management and project planning procedures. Risks to successful delivery of the Agency's operational and control objectives are identified and evaluated by managers when formulating directorate and divisional management plans, by project sponsors when formulating project plans, and at strategic level by the Board.

4.3 As part of the routine risk reporting process, staff and managers are required to identify new or increased risks and opportunities, for discussion and reporting to senior management and the Board. Risk is a standard agenda item in team meetings in many areas of the Agency. Key risks and their handling are included in Directorates' performance reporting arrangements.

4.4 Risks are reviewed, the effectiveness of risk treatments and their impact on residual risk are monitored, and changes identifi ed and evaluated throughout the year, as part of routine management activity. Risk owners make quarterly stewardship reports on their handling of operational risk as part of the cycle of performance management and reporting. The Board allocates the management of strategic risks to nominated directors who report back as appropriate through the year.

4.5 Risks to public stakeholders arise from many aspects of the development and operation of the strategic highways network.

In developing new works, the public are involved in risk management through the statutory consultation process.

In operations, I and my senior staff regularly meet with stakeholder groups and consider their views on risks to their interests in these meetings.

4.6 Risk management informs a number of internal control processes designed to fulfil the following control objectives:

• to ensure that the Agency has established (agreed) clear strategic direction, objectives and key targets in support of Government policies;
• to ensure regularity and propriety in the Agency's stewardship of public funds and other assets with due regard to accountability, probity and integrity;
• to ensure that the Agency delivers its services safely to time/ cost / quality;
• to ensure that the quality of Agency projects and advice are effective, accurate and timely; and
• to ensure that HA people and procedures comply with relevant legal, government, departmental and technical standards and requirements.

5. Review of effectiveness

5.1 As Accounting Officer, I have responsibility for reviewing the effectiveness of the system of internal control. My review of the effectiveness of the system of internal control is informed by the work of the internal auditors and the executive managers within the Agency who have responsibility for the development and maintenance of the internal control framework, and comments made by the external auditors in their management letter and other reports.

I have been advised on the implications of the result of my review of the effectiveness of the system of internal control by the Board and the Audit Committee. A plan to address weaknesses and ensure continuous improvement of the system is in place.

5.2 The Highways Agency Board (which comprises the senior members of the Agency and two independent non-executive directors) meets frequently to consider the plans, performance and strategic direction of the Agency, the most important risks to successful delivery of those plans and the Agency's stewardship of public assets.

5.3 The Audit Committee is made up of the two non-executive directors, one of whom chairs it, and three Highways Agency Board members. I, together with my Head of Internal Audit, and representatives from the DfT and National Audit Office attend as observers. The independent chairman of the Audit Committee advises as appropriate on key risk and control issues.

5.4 My Head of Internal Audit provides regular reports on key risk and control issues, to standards defined in the Government Internal Audit Manual, and provides an annual independent opinion on the adequacy and effectiveness of the Agency's system of internal control together with recommendations for improvement. The Head of Internal Audit's opinion for the year 2003-04 is that on the basis of the evidence obtained during the year he can provide an overall assurance level as follows:

• Risk Management - MEDIUM to HIGH;
• Risk Handling / Internal Control - MEDIUM to LOW; and
• Governance - MEDIUM.

This means that our governance and risk management arrangements, whilst open to some improvement, are broadly satisfactory, but signifi cant work (some of which is outlined below) is necessary to bring risk handling and internal control up to a satisfactory standard.

5.5 Managers make regular reports on the steps they are taking to manage risks in their areas of responsibility including progress reports on key projects.

5.6 The following actions are in hand to accelerate improvements in areas where the control environment gives Medium to Low assurance:

• Monthly Management Accounts have been developed;
• A monthly financial risk monitoring tool has been developed;
• The structure of the fi nance function is under review, with the aim of embedding financial control into the business;
• A system of top down monthly business reviews is being developed;
• A System of Stewardship reporting by senior managers is being introduced; and
• Improvements in the definition of our processes and internal controls and the guidance on how they are to be operated are being introduced.

Archie Robertson
Accounting Officer
7th February 2005