Kent County Council Audit Exposes Significant Financial Control Issues Under Reform UK

KCC’s audit papers don’t prove fraud. They reveal a circular control system in which weak training, payment workarounds and manual checks depend upon one another — while Reform UK’s promised financial watchdog has been folded into the machinery it was created to challenge.

Thirteen.

That was the number before Kent County Council’s Governance and Audit Committee on 23 July. KCC had 474 cost-centre managers, yet only 13 had completed its Budget Manager Basics eLearning course. Another 24 had received face-to-face training since December 2024. Together, the routes had reached 37 people: 7.8% of the total.

Alone, that proves little. Some managers may be experienced or supported by finance staff. KCC did not show who had equivalent training, how competence was tested, or why its basic course reached so few people responsible for watching money.

That is where the story starts in Kent.

Cost-centre managers stand between decisions and cash leaving the building. They monitor budgets, invoices, purchase orders and movements. They should notice when numbers do not look right and assure KCC that spending was authorised. If that safeguard is thinly trained, KCC must rely on the machinery around it. (see an example of what Cost Centre Managers do ⇒ here)

But the machinery was the next thing to wobble.

Cllr Oliver Bradshaw asked about the training. He also asked why five Resource Accountability Statements from KCC’s directorate leadership were outstanding when the audit was undertaken. Answers were not in the room. Members faced yellow and red findings without those responsible explaining how they arose or what would be done.

There may have been a practical explanation for some empty chairs. Shepway Vox understands that senior personnel from Kent and Medway’s 14 councils were meeting at Folkestone’s Leas Cliff Hall that day to discuss Local Government Reorganisation, shortly after ministers chose four new unitary councils.

That explains a diary clash. It does not explain statements already missing when auditors looked, or why informed deputies and written answers were not ready.

Then the committee reached “No Purchase Order, No Pay”.

A purchase order should leave a footprint before money moves: what is bought, who approved it, the cost and paying budget. The invoice can then be matched against that record. Without one, a purchase may be genuine, but the trail is thinner and approval risks becoming an after-the-event tidy-up.

Independent member Camilla Black (pictured) asked how Oracle carried a request through approval into an order. Then came the question that changed it: how could anyone work around that route? How were exceptions identified, what governance applied, and how much money had passed through them?

Oracle Cloud is KCC’s central platform for finance, procurement, supplier payments, HR and payroll. The Shepway Vox’s Team cost trail puts it at about £43m, from an £8.021m budget line, yet officers still could not quantify how many purchase-order workarounds for this project occurred or what they were worth.

The Section 151 Officer Dave Shipton; said he had picked it up only “this very week”. He had been assured Oracle contained the correct workflow, but work was “mid-flight”. The committee was not given their number, value, directorates, or how many were emergencies.

Now look back at thirteen.

Low course completion is less alarming if the computer makes it impossible to break the rules. A workaround is less alarming if everybody using and reviewing it understands the rules. KCC demonstrated neither reassurance. Consistent training was not evidenced; consistent enforcement was not measured.

Each weakness therefore points to the other as its safety net.

KCC can say experience fills the training gap. But they may operate within a system that can be bypassed. It can say Oracle contains controls. But a control that can be worked around is only as strong as the person reviewing the exception. It can say emergencies happen. But it could not count them.

That is not proof that a fraudulent invoice was paid.

It is a sound basis for asking whether KCC could prevent one, spot one, or reconstruct what happened afterwards.

The SEND findings closed the circle. Payments remained reliant on manual work, including spreadsheets. Automated fraud controls were substantially limited and duplicate-payment checks largely manual. KCC accepted significant increased error risk, while automated controls, duplicate detection and exception reporting were not due until March 2027.

Manual does not mean dishonest. A spreadsheet is not a brown envelope. Yet manual control transfers the burden to a person’s training, concentration and willingness to challenge. Software can block an unapproved transaction or flag the same invoice twice. A spreadsheet waits to be asked.

Back we go to thirteen.

If duplicate checks are manual, the checker’s competence matters more. If purchase orders can be bypassed, later review matters more. If training cannot be demonstrated, automated controls matter more. Yet SEND was heavily manual, while the scale and value of purchase-order exceptions remained unknown.

The safeguards do not reinforce one another. They send the reader round in a loop.

When asked what would happen if key staff supporting manual SEND arrangements left, Internal Audit could not answer. The service would have to be asked. That exposed reliance on particular people and their knowledge. A sound control should survive sickness, resignation or retirement.

Oversight ought to break that circle. Instead, oversight became part of it.

Camilla Black found the change not in a constitutional report, but in the gap between what KCC’s published policies said and what councillors were being asked to do. For years, the Anti-Fraud and Corruption Strategy, Anti-Bribery Policy and Anti-Money Laundering Policy had gone to Governance and Audit for approval. Their latest publicly available versions still name that committee as the approver, while the Anti-Bribery Policy expressly says its biennial review “will be taken to the Governance and Audit Committee for approval”. Yet on 23 July members received only a covering report summarising amendments after the policies had already passed through Corporate Management Team. The full revised documents weren’t placed before them for approval. Black asked when the route changed, who authorised it and where members had been told. The paper trail supplied no answer.

The explanation widened the gap. The counter-fraud officer said the new interpretation came from David Whittle, Director of Policy (pictured), who had concluded that Governance and Audit’s terms of reference didn’t permit it to approve the policies. But councillors weren’t shown the advice, its date, the decision adopting it—or the full revised policies whose approval had moved elsewhere. He described himself as “a bit of a piggy in the middle” and promised to return with a fuller rationale. KCC’s published policies pointed one way. The process described in the room pointed another.

That contradiction mattered because the committee hadn’t merely lost the final signature. It had lost the opportunity to inspect the complete documents, test their safeguards and require amendments before approval. Instead, councillors were being asked to consider a summary after senior officers had already settled the policies. At the same meeting, members were hearing about weakly evidenced financial training, unquantified purchase-order workarounds and heavily manual SEND controls. Cllr Harry Rayner called it officers “marking their own homework”. His motion seeking the return of member oversight passed by ten votes to one, with one abstention.

All this is happening under Reform UK, which took control of KCC in May 2025 promising to put Kent residents first and make every penny count. Reform now has 47 of 81 members. Its political answer to waste was DOLGE, created as fresh eyes to interrogate spending and challenge County Hall habits.

A year later, that spotlight has been diffused. The Department for Local Government Efficiency has become the Delivery of Local Government Efficiency, with its second phase owned across Cabinet, councillors, officers and staff. KCC says no extra resource is required because DOLGE will become part of the authority’s overall work.

Officially, that is embedding efficiency.

In practice, the unit has been sidelined into a corporate principle. The challenger has been folded into the organisation it was created to challenge. When scrutiny becomes everybody’s responsibility, accountability can become nobody’s address.

That context matters because these are substantial live weaknesses under an administration elected on waste-cutting and control. Reform did not create every process or failure it inherited. It now owns the duty to fix them and explain why its promised watchdog was not visibly breaking this circle.

This is where plausible suspicion is formed.

It does not mean alleging fraud, bribery or deliberate misconduct. It requires more than rumour, but less than proof. There must be an objective foundation: actions legitimately open to question, concerns identified independently, and missing information capable of confirming or refuting what is suspected.

KCC’s audit work supplies that foundation. Equivalent training was not demonstrated across most cost-centre managers. Payments made without prior purchase orders were not quantified. SEND controls relied heavily on manual work and duplicate checks. Key-person resilience was unexplained. The committee lacked answers, while its approval role over three counter-fraud policies had slipped away without a clear evidenced audit trail.

The suspicion is narrow and testable: financial irregularities could pass through KCC’s arrangements without being prevented, promptly detected or clearly explained.

It sustains itself because every reassurance depends on another safeguard not demonstrated. Experience answers the training gap only if competence is evidenced. Workarounds are harmless only if recorded and reviewed. Manual checks are reliable only if trained staff perform them consistently. Officer-approved policies inspire confidence only if scrutiny remains effective. DOLGE provides challenge only if somebody owns it.

And the information capable of killing the suspicion is the information KCC did not provide.

Publish the training equivalences. Give the number and value of payments made without prior orders, broken down by directorate. Show who authorised exceptions and what checks found. Disclose duplicate SEND payments and safeguards operating until automation arrives. Produce the decision trail for moving the three policies to Corporate Management Team.

If those records show few legitimate, controlled exceptions, publication would correct misconceptions and restore confidence. If they show something worse, residents need to know. Either way, silence preserves suspicion because the unanswered questions are precisely those capable of resolving it.

The meeting ended where it began. Cllr Alister Brady said members were “asking questions into the wind”. Bradshaw said Internal Audit’s job was to audit, not fix. He estimated he had asked around 26 questions and received answers to four. Black said the committee was ineffective and warned she was close to resigning.

The Leas Cliff Hall gathering may explain why senior personnel were elsewhere. It cannot explain why KCC allowed important audit business to proceed without informed substitutes, or why Reform’s promised fresh eyes were absent when financial safeguards most needed looking at.

Thirteen does not prove wrongdoing.

It explains why the plausibe suspicion of fraud at KCC, led by Reform UK, keeps coming back.