Buller council releases heavily redacted audit

A forensic audit of the Buller District Council's (BDC's) controversial Project Management Office (PMO) has found "inadequate management", "lack of critical controls", and council claims for costs it was not entitled to.

Auditor KPMG found council staff had acted outside council policy - without repercussions - and councillors failed to properly assess risk.

The report suggests Buller ratepayers may have to pay costs government agencies are refusing to shoulder.

Council set up the PMO in January 2021 to handle external funding from the government. Consultants filled staffing gaps.

The PMO has been in The Westport News' headlines since June last year when a former council staff member alleged the council had failed to properly manage PMO consultants and costs.

Late last year, then council chief executive Steve Gibling commissioned KPMG to conduct a forensic audit into "serious allegations of mismanagement of funds". Gibling promised the report, which was budgeted to cost ratepayers about $100,000, would be made public.

His successor, Simon Pickford, has kept the report under wraps since March. He released it on Monday. About a third of the 28 pages were redacted.

Pickford cited the Local Government Official Information and Meetings Act's personal privacy and risk of prejudicing commercial positions provisions, for withholding information, including all names.

"Some of these people have identified as whistleblowers, others are employees or ex-employees who either are or have been working through employment and other disputes which require confidentiality," he said. "The report also discusses contractors, sub-contractors and employees of contractors."

Root cause of problems identified

KPMG found the root cause of the PMO issues appeared to be "inadequate management across multiple levels and a lack of critical controls".

"We found evidence that supports the allegation that BDC has submitted claims for costs associated to the management of the PMO, which in our view, fall outside the parameters set by the external funders.

"The value of the costs disputed by NEMA (National Emergency Management Agency) is yet to be finalised but is expected to be (cost redacted)."

In March the council told The News NEMA was still disputing about $90,000 worth of bills from Christchurch-based Team Projects Advisory.

KPMG said incurring costs ineligible for reimbursement appeared to show lack of oversight and management within council's infrastructure services department.

"Consequently, BDC has incurred costs that will likely need to be funded internally."

NZTA funding many have to be repaid

KPMG said contractors working for the PMO had been told (by whom is redacted) they could include travel and disbursements in costs claimed from the New Zealand Transport Agency (NZTA). This appeared to be a "work around NZTA's stated funding parameters".

KPMG said the NZTA was still assessing the value of ineligible claims. Council might have to repay NZTA funding.

The report said lack of senior leadership over the PMO had allowed inappropriate claims and failed to reflect council's level or risk.

"Our review has established that council staff acted outside of council policy, but we have not found any evidence of behaviour that in our view is serious enough to warrant a complaint to police or the Serious Fraud Office."

KPMG found a lack of understanding of the costs covered by external funders.

In January 2022, then council chief executive (Sharon Mason) had approved the PMO's continuation as long as external funding covered any costs. The annual PMO costs were $800,000 to $900,000, including staff.

Council had added 3 percent to active projects for overhead costs and another 9-10 percent for project management.

Some external funders declined to fund these costs, seeing them as potential duplication of efforts or a business-as-usual cost, KPMG said.

"Consequently, any costs which are not covered by external funders will need to be met by council. It is unclear whether there is a budget for these costs, in particular PMO office overheads."

KPMG disagreed with the conclusion last year of a previous PMO reviewer, Morrison Low (ML). KPMG said the review scope was inappropriate to address the allegations. Communications between NEMA and council did not support ML's conclusion that council had appropriate processes for works procurement.

The council received three Protected Disclosures - the first in July last year, another last November and the third in January this year.

KPMG found council took only limited action over the allegations of misconduct and did not have a Protected Disclosure Policy until recently. This reflected a lack of governance by council's Audit and Risk Committee, the report said.

Scrutiny of Westport trunk main project

One of the complaints was about the $3 million 'budget overrun' on the Westport trunk main project.

The Department of Internal Affairs (DIA) had funded the first stage of the project. Council staff had made the "optimistic assumption" DIA would fund the second stage and did not include it in council's 2023/24 draft annual plan, KPMG said.

The staff then submitted a late budget request for the funding, which councillors declined.

"The claim of a $3 million budget overrun appears to be based on the late staff submission for additional budget…" KPMG said. "However, this does not align with our understanding of the reasons behind the budget request."

The report said (name redacted) had bought $14,040 office furniture in December 2022, then issued an invoice to council for the cost. The council had divided the invoice into several expense categories, apparently because the furniture and fittings general ledger account was overspent, instead of coding the total invoice as capital spending in that account.

The report said (name redacted) recognised the miscoding and tried to fix it by contacting those responsible. The person received no response and corrected the coding with approval from (name redacted).

"As we understand it, no formal investigation was conducted."

KPMG said council needed detailed invoice approval processes and oversight from its own staff to ensure its interests came before those of consultants.

"As the PMO is predominantly comprised of consultants, a high level of oversight should have been applied."

(Name/s redacted) had failed to adequately manage critical areas such as budgets, consultants, procurement and conflicts of interest.

KPMG found two instances where information acquired as a BDC consultant, such as rates of other consultants, was inappropriately shared.

KPMG also said council's high staff turnover and ballooning capital spending budget had had an impact on the PMO operations.

Since 2022 council had had four chief executives: (Sharon Mason, Rachel Townrow, Sean Judd and Steve Gibling). Townrow and Judd were in acting roles.

Council had also had two chief financial officers (Rod Fox and contractor Douglas Marshall).

KPMG said the role of general manager infrastructure services had undergone two changes in personnel since 2021 (manager Mike Duff went on secondment for a year, during which Mike Williams filled the role).

The report names none of the council managers, all of whom have left council over the past 18 months.

KPMG said council's budget for capital expenditure was about $6m in 2020/21. However, actual costs between 2020 and 2023 were between $12m and $14m annually. Council's Audit and Risk Committee and/or councillors appeared not to have adequately assessed the increased spend and risk. This led to a lack of oversight, controls and internal audit procedures for the PMO.

"There is no clear evidence that (name/s redacted) or the councillors fulfilled their respective responsibilities in appropriately managing the risk associated with a high number of consultants in the PMO."

KPMG said the PMO had evolved from a "supportive" to a "directive" model too quickly and became actively involved in every project and every aspect of every project.

ML's report last year had highlighted plans to update the PMO's statement of intent but this hadn't happened.

KPMG recommended:

• The PMO transition to a supportive model and not function as a directive model unless managed by a PMO employee
• Council's audit and risk committee become more proactive about overseeing council's risk and put in place plans to mitigate risk
• Council ensure all its managers are aware of the Protected Disclosures Policy and understand the requirements of the Protected Disclosures Act
• Council co-operates with NEMA and make provision to cover any shortfall over funding claims
• council considers its process for dealing with staff who breach policy. KPMG could find no evidence that, over the last 2-3 years, council had taken the breaches seriously or that there were any repercussions.

At the end of June this year council quietly disbanded the PMO. By then it had cost almost $9m, including over $1m from ratepayers.

- Westport News