Highways Agency - Safe roads, Reliable journeys, Informed travellers

Statement on Internal Control

The Statement on Internal Control describes the overall control environment and the management of risk within the Highways Agency.

1. Scope of responsibility

1.1 As Accounting Officer, I have responsibility for maintaining a sound system of internal control that supports the achievement of the Agency's policies, aims and objectives, whilst safeguarding the public funds and departmental assets for which I am personally responsible, in accordance with the responsibilities assigned to me in Government Accounting. This includes responsibility for transactions in respect of the Dartford-Thurrock Crossing Road User Charging Scheme.

1.2 I hold regular meetings with Ministers when operational risks are discussed. Ministers receive direct reports about risks to key initiatives, the outcome of key Gateway Reviews and other key risk areas as necessary. They receive reports on risks to delivery of Public Service Agreement Targets through the Department for Transport reporting system.

1.3 My staff work closely with their counterparts in the Department for Transport to ensure that risk management, planning and performance measurement systems are compatible, clear accountability for risk management is agreed, joint action is taken where appropriate to manage, transfer or tolerate risks, and the Department is kept informed of risks as appropriate.

2. The purpose of the system of internal control

The system of internal control is designed to manage risk to a reasonable level rather than to eliminate all risk of failure to achieve policies, aims and objectives; it can therefore only provide reasonable and not absolute assurance of effectiveness. The system of internal control is based on an ongoing process designed to identify and prioritise the risks to the achievement of departmental policies, aims and objectives, to evaluate the likelihood of those risks being realised and the impact should they be realised, and to manage them efficiently, effectively and economically. The system of internal control has been in place in the Highways Agency for the year ended 31 March 2005 and up to the date of approval of the annual report and accounts, and accords with Treasury guidance.

3. Capacity to handle risk

3.1 The Highways Agency Board, Directors, and other senior managers lead risk management in their commands, supported by a team of risk management co-ordinators led by a risk management adviser. This team develops and maintains procedures for risk management, and identifies and spreads good practice internally.

3.2 Risk management guidance is available to all staff. The guidance explains the Agency's underlying approach to risk management, documents the roles and responsibilities of the Highways Agency Board (HAB), managers and staff, outlines key aspects of the risk management process and identifies the main reporting procedures.

3.3 The senior management teams in each directorate have received training in risk management tailored to their particular responsibilities and concerns.

4. The risk and control framework

4.1 The Highways Agency Board sets the Agency's risk appetite in line with that of the DfT Board.

The risk appetite is set to ensure that all risks with a high impact on:

• the Agency's performance or
• stewardship of public funds or
• the Agency's stewardship of the environment or
• on the Agency's or the wider Government's reputation

receive focussed management attention, that decisions to tolerate or treat risks are made on cost-justified grounds, and that where appropriate action is escalated through the line management chain to DfT and Ministers.

We give priority to risks to achieving the DfT's targets of reducing congestion and improving safety, and to those to stewardship of public resources and assets.

4.2 Risk management is an integral part of the Agency's management and project planning procedures.

The Board identify strategic risks to the Agency's business. Managers identify and evaluate risks to successful delivery of the Agency's operational and control objectives when they prepare and monitor directorate and divisional management plans.

Project leaders ensure that risks are identified when preparing project plans.

4.3 The key strategic risks managed by the Board are:

• The Agency fails to justify and secure sufficient funds to meet our objectives and customer / stakeholder expectations;
• The Agency fails to recruit, retain, motivate and develop staff with the skills and qualities needed to deliver our objectives and outcomes;
• The Agency's financial management systems and controls fail to deliver and demonstrate value for money, propriety, accountability and management information;
• Operational Failure (including structure / network, standards, major projects and mitigation of environmental impact);
• The Agency fails to manage or meet customer / stakeholder service expectations;
• The Agency does not provide complete, accurate and timely management and other information to our people, stakeholders and customers; and
• The Agency fails to meet the health and safety needs of its employees, and fails to achieve all legal obligations in respect of those working for it and others affected by it.

4.4 Staff and managers are required to identify new or increased risks and opportunities as part of the routine risk reporting process, for discussion and reporting to senior management and the Board. Risk is a standard agenda item in team meetings in many areas of the Agency. Key risks and their handling are included in Directorates' performance reporting arrangements.

4.5 Risks are reviewed, the effectiveness of risk treatments and their impact on residual risk is monitored, and changes identified and evaluated throughout the year, as part of routine management activity. Risk owners include reports on their handling of operational risk as part of their wider stewardship reports. The Board allocate the management of strategic risks to nominated directors who report back as appropriate through the year.

4.6 I am keenly aware that risks to public stakeholders arise from many aspects of the development and operation of the strategic highways network. While developing new works, we involve the public in risk management through the normal consultation process. In operations, my senior staff and I regularly meet with stakeholder groups and cover their views on risks to their interests in these meetings. We use the DfT safety strategy as a proxy for public involvement in managing road safety risks.

4.7 Risk management informs a number of internal control processes designed to fulfil the following control objectives:

• To ensure that the Agency has established (agreed) clear strategic direction, objectives and key targets in support of government policies;
• To ensure regularity and propriety in the Agency's stewardship of public funds and other assets with due regard to accountability, probity and integrity;
• To ensure that the Agency delivers its services to time/ cost / quality;
• To ensure that the quality of Agency projects and advice are effective, accurate and timely;
• To ensure that HA people and procedures comply with relevant legal, government, departmental and technical standards and requirements

5. Review of effectiveness

5.1 As Accounting Officer, I have responsibility for reviewing the effectiveness of the system of internal control. My review of the effectiveness of the system of internal control is informed by the work of the internal auditors and the executive managers within the Agency who have responsibility for the development and maintenance of the internal control framework, and comments made by the external auditors in their management letter and other reports.

I have been advised on the implications of the result of my review of the effectiveness of the system of internal control by the Board and the Audit Committee. A plan to address weaknesses and ensure continuous improvement of the system is in place.

5.2 The Highways Agency Board (which comprises the senior members of the Agency and three independent non-executive directors) meets frequently to consider the plans, performance and strategic direction of the Agency, the most important risks to successful delivery of those plans and the Agency's stewardship of public assets.

5.3 The Audit Committee is made up of two of the non-executive directors, one of whom chairs it, and three Highways Agency Board members. I, together with my Head of Internal Audit, Finance Director and representatives from the DfT and National Audit Office attend but have no vote. The independent chairman of the Audit Committee advises as appropriate on key risk and control issues.

5.4 My Head of Internal Audit provides regular reports on key risk and control issues, to standards defined in the Government Internal Audit Manual, and an annual independent opinion on the adequacy and effectiveness of the Agency's system of internal control together with recommendations for improvement. The Head of Internal Audit's opinion for the year 2004-05 is that:

• Risk Management is working effectively with some minor weaknesses
• Risk Handling / Internal Control is operating effectively except for some areas where significant weaknesses have been identified.
• Corporate Governance is working effectively with some minor weaknesses.

5.5 Managers make regular reports on the steps they are taking to manage risks in their areas of responsibility including progress reports on key projects.

5.6 In the Statement on Internal Control for 2003-04 I reported on some actions designed to improve control in areas where the control environment gave Medium to Low assurance. As a follow-up I can report:

• Monthly Management Accounts, Quarterly interim financial statements, monthly business reviews and a monthly financial risk monitoring tool were developed and have improved financial accountability, budgetary control and resource allocation in the business. These measures have also allowed us to significantly improve the speed of production and the audit of our draft statutory accounts for 2004-05.
• The structure of the finance function was reviewed, with the aim of embedding financial control into the business. Implementation started late in the financial year and is continuing in 2005-06.
• A System of Stewardship reporting, by senior managers principally on financial controls was introduced and worked well. This has given improved assurance and some learning points for improvements in processes, controls and communication.
• Improvements in the definition of our processes and internal controls and the guidance on how they are to be operated are being introduced. We started to publish these electronically during the year, with complete coverage scheduled by 2006.

5.7 I have commissioned action to:

• Raise the profile of internal control with managers;
• Improve the design and monitoring of controls;
• Complete the electronic publication of guidance on processes and controls; and
• Improve the scope and machinery of Stewardship Reporting by senior staff, and the associated guidance available to them on their internal control and stewardship responsibilities;

and thus give me improved assurance on the system of internal control.

Archie Robertson
Accounting Officer
19 January 2006

Back to Top