Paragraph 12 of the report of the Comptroller and Auditor General reads:
The Office of the Paymaster General (PMG) acts as the clearing bank for all Government Departments except for some payments made by the Office of Public Works, the Department of Social Community and Family Affairs and the Office of the Revenue Commissioners. All Payable Orders (POs) issued by Government Departments are drawn on a bank account maintained by the PMG in the Central Bank from which transfers of money are made on a daily basis to banks in respect of POs which they have cashed and into which moneys are lodged from the Exchequer to fund such transfers. In 1999 the PMG processed 4 million POs involving gross payment flows of nearly £34bn.
A computerised system is in operation for processing POs. Details of all POs issued by Government Departments are notified to the PMG each day on Issue Schedules which are entered on the Payable Order Reconciliation System (PORS).
POs when cashed by a bank are returned to the PMG together with summary listings showing the amount the bank is claiming in respect of the encashed orders. Details from the returned POs are also entered on the PORS (PO number and amount). The PORS produces reports showing details and value of the POs which have been accepted for payment (i.e. those POs where values and numbers match those on the Issue Schedules). It also produces details of POs which have been rejected due to PO numbers not matching or cashed amounts not matching issued values and cancelled or out of date POs. These reports are used to compute the amounts due to the banks in respect of valid POs which have been cashed by them and to provide details of the amounts which are not being accepted for payment due to the POs having been rejected as invalid.
At the end of each month the PORS produces statements for each Government Department which detail POs cashed, those which have been cancelled, those which are out of date and those which have not been cashed. These reports are distributed to the Departments to provide them with a record of the status of the POs which they have issued and to enable them to reconcile their records with those of the PMG.
The PMG is committed to abiding by the Inter Bank Clearing Rules and, in particular, to the requirement to process POs and to notify the banks of any errors or invalid POs presented for payment within two days.
Since all POs are crossed and therefore only payable through a bank account and since banks will not normally allow cash for such POs to be withdrawn from the bank account until the two-day clearance period has elapsed, then any errors, irregular amendments or cancellations attaching to POs should be detected before cash has been paid out.
Compliance with the two day clearing period is a key control in preventing cash being obtained for unauthorised POs and is the primary protection for the banks and the PMG against the encashment of unauthorised POs. In this respect the availability in the PMG of a quick, accurate and reliable method of capturing the PO number and amount in an electronic format for each PO returned by the banks is vital.
An optical character-reading (OCR) scanner1 was installed in 1997 to electronically read the PO numbers and amounts and to produce this information in an electronic format to be loaded on the PORS. Prior to the introduction of the scanner this information was manually entered.
An audit by my staff of the PORS, compliance with the two day clearance requirement, and the purchase and performance of the scanner, noted the following:
While funds to the value of the cheques presented to and claimed by banks were being transferred to the banks on the same day in accordance with the inter bank agreement, the PMG was not processing and clearing POs within the two-day time limit for long periods during 1999 and, in fact, was taking up to 15 days to process POs and notify the banks of POs which it was not accepting. The failure to meet the clearance deadline was mainly due to the failure of the scanning equipment to perform to the expected standard.
The decision to acquire a scanner was made in September 1993, when a Request for Proposals (RFP) was issued to potential suppliers for a scanner with OCR software (and associated hardware) to process POs. The RFP was issued to 8 suppliers, 4 of whom replied. All proposals were greatly in excess of the GATT/EU limit for open tendering procedures; initial estimates, based on sample figures supplied by a number of vendors, had indicated that the Department would be within those limits. After discussions with a representative of the Government Contracts Committee, it was decided to place an advertisement in the EU Official Journal. Ten proposals were received by the due date (18 March 1994).
In the RFP a scanner was sought which was capable of reading POs produced using the 10 cpi OCRB font, in line with instructions issued to Departments by the PMG on fonts in 1989. In the course of evaluating the proposals the PMG sought confirmation from Departments that they were complying with the 1989 instruction. It transpired that many Departments were not conforming to the font requirement and the PMG experienced considerable difficulty in establishing what fonts were being used. Many Departments were unclear about the fonts in use, others were reluctant to incur the cost of acquiring new printers to meet this requirement, while the fact that the 10 cpi OCRB is considerably slower to print than other fonts was a major factor for some Departments. The PMG concluded that it would, therefore, be impossible to guarantee that 10cpi OCRB would always be used and, as a result, decided that a scanner capable of handling multiple fonts would better suit its requirements and avoid a situation whereby a scanner incapable of handling a large percentage of their throughput would be installed.
It was therefore decided to cancel this competition in August 1994 and on the advice of the Government Contracts Committee to open a new tender competition.
Following this tendering process, a company was awarded the contract in July 1996. The scanning hardware was delivered on 9 December 1996 and the software, after several months delay was received on 31 July 1997.
Payments to the contractor for the purchase of the scanner and related hardware, software and maintenance amounted to £508,330 (inc VAT) in the period 1996-1999.
The scanner has never performed at or near the levels specified in the contract. An exercise undertaken by the PMG in 1999 found that the performance of the scanner was such that it would take shifts of five operators a total of 12 hours to process 20,000 POs, compared to a standard in the contract of two operators processing 40,000 POs within five hours. The character recognition error rate ranged from 10% to 25% which compared very unfavourably to the target error rate of 2% stated in the contract. The poor performance of the scanner contributed to the difficulty which the PMG has experienced in the years 1997 to 2000 in complying with the two day limit agreed with the banks for clearing POs and to an increase in staff overtime and the need to contract out work to a data entry bureau. In tests carried out on the equipment prior to purchase, a character recognition error rate of 6% was indicated.
The staff complement in the Banking section of the PMG as at June 2000 was 27, compared to 25.5 in 1996, prior to the installation of the scanner. Staffing which was expected to decrease by about 6 due to the automation has instead slightly increased. Furthermore, figures received during the audit indicated that overtime, which was expected to reduce on the acquisition of the system, had in fact significantly increased. In addition, £38,155 and £75,437, respectively, was expended on contracting out data entry work in 1998 and 1999.
The purchase contract for the scanner provides for the archiving of POs and the storing of images of POs electronically. This would reduce the necessity for storage of copies of POs and facilitate retrieval. To date, archiving in the system has not performed to this standard and, for this reason, the final payment due to the contractor has been withheld. As a result the physical storage of POs has not been reduced.
The scanner was out of operation for the period 26 April 2000 to 11 May 2000 due to a computer virus (the so called Chernobyl Virus). This was a serious incident because if the virus had been passed to the PORS it could have seriously damaged it and could have travelled through the main Department of Finance server to all other departmental locations. It would appear that there was a risk that this could have happened due to the fact that certain anti-virus software had not been installed in the scanner or the PORS. Anti-virus software was subsequently installed. As a result of the virus all programmes in the scanner were replaced along with several pieces of hardware.
In or about February 2000 a number of POs presented for payment by banks did not accord with details on record in the PMG. It transpired that the POs had apparently been stolen and the amounts payable amended to much larger values. One PO for £244.68, dated 15 December 1999, had the amount payable changed to £7,244.68. The PO was lodged to a bank account on 17 February 2000 and sent to the PMG for payment on 18 February who transferred the relevant funds to the bank on that day. The PMG on processing the PO on 29 February detected the irregularity and notified the bank immediately. However, by that time £5,239 had been withdrawn from the bank account. The balance of £2,005 has been transferred to the PMG, who sought legal advice from the Office of the Attorney General on how best to pursue the £5,239 paid out by the bank. Ongoing consideration is continuing in light of that Office's advice. Successful action was taken in time in relation to the other POs irregularly amended so that no undue moneys were paid out by the banks. The Gardaí have also been notified.
I sought information from the Accounting Officer in relation to these matters and, in particular, the consequences and financial risks of not processing POs within the two day time limit, when compliance with the requirement was likely to be achieved and if it was likely that the performance of the scanner could be brought up to an acceptable standard. I also enquired as to previous irregularities in relation to the encashment of POs, the security procedures in place in Departments for the safe custody of POs and if any new measures were being considered to reduce the risk of irregular encashment of POs.
The Accounting Officer stated that:
The Clearing Rules were an administrative arrangement for the efficient clearance of cheques and POs and did not specify the consequences of failure to comply with the requirement. The right of the banks to retain payment collected for a customer did not stem from the Clearing Rules per se, but from the Cheques Act 1959, section 4 of which provides that:
Where a banker, in good faith and without negligence,
(a) receives payment for a customer of an instrument to which this section applies or,
(b) having credited a customers account with the amount of such an instrument, receives payment thereof for himself:
and the customer has no title, or a defective title, to the instrument, the banker does not incur any liability to the true owner of the instrument by reason only of having received payment thereof.
The practical implication of not returning unpaid items in time was that, so far as the presenting bank was concerned, the item was paid and it would not accept any attempt by the PMG to recover the money by adjusting a subsequent day's settlement. The procedure then was that the PMG should be reimbursed by the Department that issued the PO and the onus was on that Department to seek redress from the recipient of the money. To the extent that this was not successful, the loss was borne on that Department's Vote. In practice, the banks had been flexible about the timing provided funds had not cleared their customer's account.
No specific legal advice had been obtained by the PMG on the legal consequences of non - compliance with the two-day processing deadline in the event of disputes between the PMG and the banks on the question of liability for losses incurred from the irregular encashment of POs. However, advice from the Office of the Attorney General in relation to the irregularity in February 2000 indicated that the bank was liable for any unrecovered funds and, in seeking the advice, the Attorney General's Office was made aware that the PO had not been processed by the PMG within the two-day time limit.
The failure to meet the two day clearance deadline was due to increased volumes of work, significant variations in the level of work during the year, difficulties with the operation of the scanning equipment, staff turnover, diversion of resources to the introduction of a new computer system for processing POs, poor co-operation from some Government Departments in relation to the standardisation of PO formats, print quality and delivery of payment authorisations and a deterioration of the paperwork submitted by some banks.
The PMG was not complacent about the need to meet the clearance deadline and to this end work practices and problems were being actively reviewed and it was proposed to commission CMOD2 to carry out an in-depth study of the PMG banking operation before the end of October 2000. A range of options had been identified to improve performance which included, improving the performance of the scanner, employment of key punch operators, out-sourcing some or all data entry work, reducing the volume of POs by increasing the use of electronic payments, use of commercial bank accounts to pay farmers, shift work and use of temporary staff. The cost and feasibility of the different options would be explored and there would be full consultation with unions and staff as the changes required to ensure that the clearance deadline is consistently met may be radical. Two staff officers had recently been assigned to the PMG Banking section who had been given particular responsibility for training, the development and use of procedures manuals and examination of improvements in processes. Detailed instructions about the printing and cutting of cheques and the delivery of authorisations to the PMG have been issued to all Departments. Moreover, demonstrations of the scanner and other PMG processes were arranged for those handling POs at operational levels in all Departments. The response had been positive. The PMG's concerns about the standard of work from the presenting banks have been raised formally with the chief executives of the banks and meetings have been held to try to resolve issues, with positive results. An officer has been assigned to monitor the banks and Departments and to maintain standards.
In relation to the performance of the scanner, there were technical problems associated with its operation over which the PMG had very little control, due in large part to the number of organisations and people who handle POs and so affect their condition. Departments affected the read rate by faded print, using too small a font, incorrectly guillotining the POs and printing too close to the edge of the read area. Banks affected the scanner by stamping or writing on, or close to the read area. Finally, the payees caused difficulties by creasing the POs, tearing them and otherwise mishandling them. There were also difficulties caused by variations in PO layout and colouring. A major effort into revising PO layout had been made and the number of variants had been reduced from 22 to 5, but there had been poor co-operation from client Departments in adopting the new layout. For these reasons the recognition software had not lived up to expectations and it was exceedingly difficult for the PMG to exercise quality control because of the number of clients producing POs and the number of bank branches handling them.
Three years after its installation the performance of the scanner had not been anywhere near the expected standard. The archiving function was not operational at all and maintenance of the system was also unsatisfactory. Since the successful introduction of the new PORS computer system in 1999, it had been possible to devote more attention to the problems of the scanner and there had been considerable improvement in recent months but it was still not performing to specification. Concerted pressure had been brought on the supplier, who had carried out work on the system in recent months and, as a result, there had been a considerable improvement in the mechanical operation and character recognition rate. Concerted pressure had also been brought on Departments to improve print quality. The error reading rate had been reduced to 4%, and as a result the processing of POs has been within or very close to the two-day clearing deadline. It was hoped to effect further improvements in processing time through training of operators and closer monitoring of print and PO quality generally.
There were a number of reasons as to why the pre-installation tests of the scanner proved to be so inaccurate compared with full live operation, including non-use for security reasons of live current POs at the development stage, older POs not being suitable for use in tests because of variations in print and layout and problems associated with the handling of POs by payees and banks and with faint printing not being fully anticipated.
The effort required to implement the new PORS system within Year 2000 compliant deadlines fully stretched the resources of the PMG and entailed compromises with the timeliness of the daily processing and with the development of the scanner.
The planned decrease in staff within the PMG banking section did not take place because the productivity levels envisaged for the scanner were not achieved. Additional staff had also to be maintained to ensure that the PORS was Year 2000 and euro compliant. Staffing levels would be evaluated as part of the forthcoming CMOD review.
While the delay in acquiring the scanner and the failure of the equipment to perform to expectations might imply that there had been failures by management in planning and implementing the project, the reality was that many of the problems and difficulties encountered were outside the control of the PMG. In this connection the Accounting Officer referred to the unprecedented levels of staff turnover, increase in volumes of payments, a printing malfunction in the Department of Agriculture Food and Rural Development in 1997 which had caused chaos in the PMG processing system and in the bank clearing system generally, slow response by Departments to adopt the PO layouts devised for the scanner and delays in the completion of payroll replacement projects in Departments. The resulting disruptions had caused havoc with the implementation schedule for the scanning project.
There were serious technical difficulties in relation to the storing of POs electronically and while the supplier has tried a number of different solutions none have been successful. The supplier had assured the PMG that he was continuing to explore ways of resolving the problems and he was confident that a solution could be found. Payments of £38,000 had been withheld from the supplier because of the archiving difficulties experienced.
Anti-virus software was installed as a matter of course by Network Support staff of the IT Unit on all file servers and networked PCs in the Department. In addition, standalone PCs with anti-virus software are situated in all the Department's buildings, including the PMG office, and staff are instructed to use these to check any software received on diskette or CD-Rom. As the PCs attached to the scanner were not connected to the main Department of Finance network, input to the scanner system was possible only via diskette or CD-Rom. All such media should first have been checked on the standalone virus checking PCs. It is believed that the virus in question originated, not on a data diskette from any of the PMG's clients which were all virus checked, but rather on a system diskette used to update the scanner software itself. This represented a gap in the security procedures and anti-virus software had now been installed on all PCs and servers used in the scanner system.
As regards the possibility of a virus transferring from the scanner to the PORS, the PCs on the PORS are part of the Department of Finance network and therefore had virus-checking software installed in line with all other PCs on the Department's network. Any virus attached to files being transferred from the scanner system would therefore have been detected at the input stage.
The fact that virus checking software was not installed on the PORS servers until May 2000 was due to an oversight arising from the division of responsibility for such matters within the IT Unit at the time. It appears that lack of familiarity with the correct procedures arose due to changes in personnel and this had now been addressed. Network Support staff, who are responsible for the maintenance of the anti-virus software, now had responsibility for all computer hardware within the Department, regardless of source and a mechanism had been put in place to ensure that they were aware of all developments on this front.
The PMG had made it clear to the supplier that it was confident that the virus had not originated in its office and shortcomings in the supplier's virus-checking procedures were also pointed out.
There had been no other incidents in the past 5 years of the encashment of forged or altered POs. However, there had been cases of valid POs being stolen and encashed, and POs being encashed despite having been cancelled by the issuing Department. In those cases in which recovery was not made from the bank because of non-compliance with the two day processing period, follow-up action would have been taken by the issuing Department and the PMG would not necessarily be aware of whether or not the loss was subsequently made good. However, the perception was that the total number of such incidents was small and the level of complaints from Departments was low, which would seem to imply that losses were very few.
There were also cases of what were originally valid POs being encashed after they had gone out of date, i.e. more than 6 months after the date of issue. These amounts were all recovered from the banks. There had been an inordinate number of these recently which was indicative of a lower standard of care being taken by the banks and this matter was being taken up with them.
The security features incorporated in the design of POs were currently being reviewed in view of the apparent sophistication of the alterations made to the POs in the February 2000 irregularity. At present POs had incorporated all features recommended by the Irish Banks Standing Committee, with the exception of one, which would interfere with the operation of the scanner. However, to compensate for this, the PMG had additional security features and its stationery was regarded as being generally more secure than cheques.
The PMG had met with its printers to explore what further additional features might be included in its POs and these were being costed but it was probable that new features would only be introduced for the new euro stationery.
Strictly speaking, POs were non-negotiable and non-transferable, but there was a long-established practice of POs being cashed by shopkeepers. Restricting this would be seen as detrimental to customer service and would also impact on payments made by the Department of Social, Community and Family Affairs and was therefore not a course favoured by that Department. However, there was a case for requesting the banks to exercise more care, especially for POs involving larger amounts and a joint approach from various public sector paying agencies should be considered.
There have been guidelines in place for many years about the safe custody of PO stationery, accounting for wastage, etc. These were clearly working well, as there had been no cases of stolen cheque stationery being used fraudulently in recent years.
The indications were that the stolen POs involved in the irregularity, which were issued by the Department of Defence, were not stolen from that Department's premises nor were any staff of the Department involved. Arising from the irregular encashment of the pension POs in question, that Department's Internal Audit Section undertook a review of the controls in operation in the production and issue of POs for the monthly pensions payroll of approximately 11,500 cases. The review concluded that, having regard to considerations of practicality and reasonableness, the controls in place were adequate and satisfactory.