08 - 2025-08-27 IJB PFA - Internal Audit Charter Paper
North Lanarkshire Council · 27 August 2025
Back to IJB Performance, Finance and Audit Committee — 27 August 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Page 1 of 18 Item No: 8 SUBJECT: Draft Internal Audit Charter TO: Integration Joint Board Performance, Finance & Audit Committee. Lead Officer for Report: Claire Rae, Chief Officer Author(s) of Report Francis Scott, Chief Officer (Audit and Risk), North Lanarkshire Council Jocelyn Lyall, Chief Internal Auditor, NHS Lanarkshire Contact details for Author(s) of Report Scott Fr@northlan.gov.uk Jocelyn.lyall2@nhs.scot DATE: 27 August 2025 1. PURPOSE OF REPORT The purpose of this report is to provide the Performance, Finance & Audit Committee with assurance that the Internal Audit Charter complies with the Global Internal Audit Standards (GIAS) requirements and to seek approval of the Internal Audit Charter. This Charter is complementary to the relevant provisions included in the Code of Corporate Governance. This paper is coming to the IJB for: For Approval: ☒ For Endorsement: ☐ To Note: ☐ 2. ROUTE TO THE BOARD This paper has been:
Page 2
Page 2 of 18 Prepared By: Chief Officer (Audit and Risk), North Lanarkshire Council and Chief Internal Auditor, NHS Lanarkshire) ☒ Reviewed By: Chief Finance Officer ☒ Endorsed By: ☐ 3. EXECUTIVE SUMMARY 4. RECOMMENDATIONS 4.1 It is recommended that the IJB PFA note the contents of the report. • (1) Note that this report provides assurance that the Internal Audit Charter complies with GIAS • (2) Approve the Internal Audit Charter. 5. VARIATIONS TO DIRECTIONS? This section outlines if the report requires a direction to be issued to the Local Authority, the Health Board, to both, or that no direction is required 6. BACKGROUND The Internal Audit Charter will be presented to the Performance, Finance & Audit Committee annually for approval. This August 2025 version has been drafted to ensure the Charter fully complies with the Institute of Internal Auditors (IIA) Global Internal Audit Standards (GIAS) and the Application Note: GIAS in the UK Public Sector, applicable from 1 April 2025. The Audit Charter is based on the Institute of Internal Auditors (IIA) template to ensure it fully complies with the requirements of GIAS. GIAS require each organisation to agree an Internal Audit Charter, which is a formal document that includes the internal audit function’s mandate, organisational position, reporting relationships, scope of work, types of services, and other specifications. The Internal Audit Mandate forms part of the Internal Audit Charter and sets out the internal audit function’s authority, role, and responsibilities, which may be granted by the Performance, Finance & Audit Committee and/or laws and regulations. Yes ☐ No ☐ N/A ☒
Page 3
Page 3 of 18 The Internal Audit Charter is complementary to the relevant provisions included in the Code of Corporate Governance. 7. SUMMARY OF KEY ISSUES The Public Bodies (Joint Working) (Scotland) Act 2014 requires the IJB to comply with the accounts and audit regulations and legislation under section 106 of the Local Government (Scotland) Act 1973. A professional and objective Internal Audit Service arrangement has been established in accordance with recognised Internal Audit standards and practices as laid out in the Public Sector Internal Audit Standards, in order to comply with article 7 of the Local Authority Accounts (Scotland) Regulations 2014. The Integrated Resources Advisory Group also issued guidance which set out the IJB’s responsibility to establish adequate and proportionate Internal Audit arrangements for risk management, governance and control of delegated resources. The guidance further advised that IJBs should make appropriate and proportionate arrangements for the consideration of the audit provision. To comply with GIAS the Charter includes the following key elements: • Reference to Internal Audit’s commitment to complying with Global Internal Audit Standards • Inclusion of the Internal Audit Mandate • Clarification of the Performance, Finance and Audit Committee oversight role • Clarification of the Chief Internal Auditors’ role • Inclusion of the requirement for a Quality Assurance and Improvement Program • Requirement for formal approval by the Chair of the Performance, Finance and Audit Committee and Chief Officer, in addition to approval by the Chief Finance Officer. 8. CONCLUSIONS GIAS Standard 8.3 Quality requires that the Chief Internal Auditor develops, implements and maintains a quality assurance and improvement program that covers all aspects of the internal audit function. The program includes external and internal assessments. When expressing conformance with standards, auditors must be clear that they are conforming to the GIAS subject to the Application Note and must refer to this as conformance with Global Internal Audit Standards in the UK Public Sector. The Internal Audit Charter reflects the Chief Internal Auditor’s responsibility to develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function, to be reported to Performance, Finance and Audit Committee. 9. IMPLICATIONS 9.1 NATIONAL OUTCOMES
Page 4
Page 4 of 18 Link(s) to National Health and Wellbeing Outcomes People are able to look after and improve their own health and wellbeing and live in good health for longer ☐ People, including those with disabilities or long-term conditions, or who are frail, are able to live, as far as reasonable practicable, independently and at home or in a homely setting in their community ☐ People who use Health and Social Care Services have positive experiences of those services, and have dignity respected ☐ Health and Social Care Services are centred on helping to maintain or improve the quality of life of people who use those services ☐ Health and Social Care Services contribute to reducing health inequalities ☐ People who use Health and Social Care Services are safe from harm ☐ People who work in Health and Social Care Services feel engaged with the work they do and are supported to continuously improve the information, support, care and treatment they provide ☐ Resources are used effectively and efficiently in the provision of Health and Social Care Services ☒ 9.2 ASSOCIATED MEASURE(S) 9.3 FINANCIAL This paper has been reviewed by Finance: Yes No N/A 9.4 RISK ASSESSMENT/RISK MANAGEMENT Relevant Risk Register Details Current Risk Level Risk Owner IJB10/21 – Ineffective Governance Arrangements Low Chief Officer 9.5 ENGAGEMENT & PARTICIPATION Please tick the engagement and participation objectives that link(s) with this piece of work and provide further details on the engagement and participation that was undertaken.
Page 5
Page 5 of 18 Objectives Further details ☐ Involve stakeholders in the development work aimed at achieving the national outcomes N/A ☐ Provide stakeholders with information on how to get involved N/A ☐ Ensure a diverse range of engagement and participation and opportunities are in place to suit different needs N/A ☐ Measure how well we involve community stakeholders in the planning, design and delivery of our services N/A ☐ Provide regular feedback on how stakeholder engagement and participation is shaping and influencing service development and delivery N/A ☐ Provide support to enable stakeholder representatives to participate meaningfully and confidently at meetings N/A ☐ Develop participation guidelines to ensure a common understanding and set of expectations for both stakeholders and partnership staff N/A ☐ Support engagement planning and participation in localities, taking account of other engagement activity and local plans across the Community Planning Partnership N/A 9.6 INEQUALITIES & FAIRER SCOTLAND DUTY EQIA Completed & Fairer Scotland Impact Assessment Form Completed and attached to report: Yes No N/A EQIA added to website: Yes No N/A
Page 6
Page 6 of 18 10. BACKGROUND PAPERS N/A 11. APPENDICES Appendix 1 – Draft Internal Audit Charter CHIEF ACCOUNTABLE OFFICER (or Depute) Members seeking further information about any aspect of this report, please contact the following; Francis Scott, Chief Officer (Audit and Risk), North Lanarkshire Council) – Scott Fr@northlan.gov.uk Jocelyn Lyall, Chief Internal Auditor (NHS Lanarkshire) – Jocelyn.lyall2@nhs.scot
Page 7
Appendix 1 Page 7 of 18 Internal Audit Charter Version: August 2025 Update: August 2026
Page 8
Appendix 1 Page 8 of 18 1. Purpose 1.1 The purpose of the internal audit function is to strengthen North Lanarkshire IJB’s ability to create, protect, and sustain value by providing the Performance, Finance and Audit Committee and management with independent, risk-based, and objective assurance, advice, insight, and foresight. The internal audit function enhances North Lanarkshire IJB’s: • Successful achievement of its objectives. • Governance, risk management, and control processes. • Decision-making and oversight. • Reputation and credibility with its stakeholders. • Ability to serve the public interest. North Lanarkshire IJB’s internal audit function is most effective when: • Internal auditing is performed by competent professionals in conformance with The Institute of Internal Auditor’s (IIA’s) Global Internal Audit Standards, which are set in the public interest. • The internal audit function is independently positioned with direct accountability to the Performance, Finance and Audit Committee. • Internal auditors are free from undue influence and committed to making objective assessments. 1.2 Commitment to Adhering to the Global Internal Audit Standards in the UK Public Sector North Lanarkshire IJB’s internal audit function will adhere to the mandatory elements of The Institute of Internal Auditors' International Professional Practices Framework, which are the Global Internal Audit Standards and Topical Requirements. The Chief Internal Auditors (CIAs) will report to each meeting of the Performance, Finance and Audit Committee and senior management regarding the internal audit function’s conformance with the Standards, which will be assessed through a quality assurance and improvement programme. The Application Note: GIAS in the UK Public Sector provides UK public sector-specific context, interpretations of GIAS requirements in the specific circumstances expected to apply across the UK public sector and some additional requirements which the Relevant Internal Audit Standard Setters consider essential for the practice of internal audit in the UK public sector.
Page 9
Appendix 1 Page 9 of 18 2. Mandate 2.1 The Public Bodies (Joint Working) (Scotland) Act 2014 requires the IJB to comply with the accounts and audit regulations and legislation under section 106 of the Local Government (Scotland) Act 1973. A professional and objective Internal Audit Service arrangement has been established in accordance with recognised Internal Audit standards and practices as laid out in the Public Sector Internal Audit Standards, in order to comply with article 7 of the Local Authority Accounts (Scotland) Regulations 2014. The Integrated Resources Advisory Group also issued guidance which set out the IJB’s responsibility to establish adequate and proportionate Internal Audit arrangements for risk management, governance and control of delegated resources. The guidance further advised that IJBs should make appropriate and proportionate arrangements for the consideration of the audit provision. The Performance, Finance and Audit Committee grants the internal audit service the mandate to provide the Performance, Finance and Audit Committee and senior management with objective assurance, advice, insight and foresight. 2.2 Authority Internal Audit derives its authority from the Integrated Joint Board, the Chief Officer, the Performance, Finance and Audit Committee and the relevant provisions included in the organisation’s Code of Corporate Governance. The internal audit function’s authority is created by its direct reporting relationship to the Performance, Finance and Audit Committee. Such authority allows for unrestricted access to the Performance, Finance and Audit Committee. The Chief Internal Auditors report on a functional basis to the Chief Officer and to the Performance, Finance and Audit Committee on behalf of the Board. The Performance, Finance and Audit Committee authorises the internal audit function to: • Have full and unrestricted access to all functions, data, records, information, physical property, and personnel pertinent to carrying out internal audit responsibilities. Internal auditors are accountable for confidentiality and safeguarding records and information. • Allocate resources, set frequencies, select subjects, determine scopes of work, apply techniques, and issue communications to accomplish the function’s objectives. • Obtain assistance from the necessary personnel of North Lanarkshire Health and Social Care Partnrtship (HSCP) and other specialised services from within or outside North Lanarkshire HSCP to complete internal audit services.
Page 10
Appendix 1 Page 10 of 18 2.3 Independence, Organisational Position, and Reporting Relationships The CIAs will be positioned at a level in the organisation that enables internal audit services and responsibilities to be performed without interference from management, thereby establishing the independence of the internal audit function. (See “Mandate” section.) The CIAs will report functionally to the Performance, Finance and Audit Committee and administratively (for example, day-to-day operations) to the Chief Finance Officer. This positioning provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Performance, Finance and Audit Committee, when necessary, without interference and supports the internal auditors’ ability to maintain objectivity. In addition, the shared service model of Internal Audit provision allows further organisational independence. The CIAs will confirm to the Performance, Finance and Audit Committee, at least annually, the organisational independence of the internal audit function. If the governance structure does not support organisational independence, the CIAs will document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. The CIAs will disclose to the Performance, Finance and Audit Committee any interference internal auditors encounter related to the scope, performance, or communication of internal audit work and results. The disclosure will include communicating the implications of such interference on the internal audit function’s effectiveness and ability to fulfill its mandate. 2.4 Changes to the Mandate and Charter Circumstances may justify a follow-up discussion between the CIAs, Performance, Finance and Audit Committee, and senior management on the internal audit mandate or other aspects of the internal audit charter. Such circumstances may include but are not limited to: • A significant change in the Global Internal Audit Standards. • A significant reorganisation within the HSCP. • Significant changes in the CIAs, Performance, Finance and Audit Committee and/or senior management. • Significant changes to the organisation’s strategies, objectives, risk profile, or the environment in which the organisation operates. • New laws or regulations that may affect the nature and/or scope of internal audit services. 3. Performance, Finance and Audit Committee Oversight 3.1 To establish, maintain, and ensure that North Lanarkshire IJB’s internal audit function has sufficient authority to fulfill its duties, the Director of Finance will:
Page 11
Appendix 1 Page 11 of 18 • Discuss with the CIAs and senior management the appropriate authority, role, responsibilities, scope, and services (assurance and/or advisory) of the internal audit function. • Ensure the CIAs have unrestricted access to and communicates and interacts directly with the Performance, Finance and Audit Committee, including in private meetings without senior management present. • Discuss with the CIAs and senior management other topics that should be included in the internal audit charter. • Participate in discussions with the CIAs and senior management about the “essential conditions,” described in the Global Internal Audit Standards, which establish the foundation that enables an effective internal audit function. • Approve the internal audit function’s charter, which includes the internal audit mandate and the scope and types of internal audit services. • Review the internal audit charter annually with the CIAs to consider changes affecting the organisation, such as the employment of new CIAs or changes in the type, severity, and interdependencies of risks to the organisation; and approve the internal audit charter annually. • Endorse the risk-based internal audit plan, prior to Performance, Finance and Audit Committee approval. • Provide input to the internal audit function’s human resources administration and budgets. • Ensure sufficient budget and resources to allow the internal audit function to fulfil its mandate and accomplish its audit plan. • Receive communications from the CIAs about the internal audit function including its performance relative to its plan. • Ensure a quality assurance and improvement program has been established and review the results annually. Make appropriate inquiries of senior management and the CIAs to determine whether scope or resource limitations are inappropriate. 4. CIA Roles and Responsibilities 4.1 The CIAs will hold membership of the CCAB Institute, or equivalent or CMIIA with experience equivalent to at least five years post-qualification experience and at least three years of audit. 4.2 Ethics and Professionalism
Page 12
Appendix 1 Page 12 of 18 The CIAs will ensure that internal auditors: • Conform with the Global Internal Audit Standards, including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, and confidentiality. • Conform with the Seven Principles of Public Life (the Nolan Principles) • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the organisation and be able to recognise conduct that is contrary to those expectations. • Encourage and promote an ethics-based culture in the organisation. • Report organisational behavior that is inconsistent with the organisation’s ethical expectations, as described in applicable policies and procedures. 4.3 Objectivity The CIAs will ensure that the internal audit function remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication. If the CIAs determine that objectivity may be impaired in fact or appearance, the details of the impairment will be disclosed to appropriate parties. Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality, and do not subordinate their judgment on audit matters to others, either in fact or appearance. Internal auditors will have no direct operational responsibility or authority over any of the activities they review. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including: • Assessing specific operations for which they had responsibility within the previous year. • Performing operational duties for North Lanarkshire IJB or its affiliates. • Initiating or approving transactions external to the internal audit function. • Directing the activities of any North Lanarkshire IJB employee that is not employed by the internal audit function, except to the extent that such employees have been appropriately assigned to internal audit teams or to assist internal auditors.
Page 13
Appendix 1 Page 13 of 18 Internal auditors will: • Disclose impairments of independence or objectivity, in fact or appearance, to appropriate parties and at least annually, such as the CIAs, Performance, Finance and Audit Committee, management, or others. • Exhibit professional objectivity in gathering, evaluating, and communicating information. • Make balanced assessments of all available and relevant facts and circumstances. • Take necessary precautions to avoid conflicts of interest, bias, and undue influence. 4.4 Managing the Internal Audit Function The CIAs have the responsibility to: • At least annually, develop a risk-based internal audit plan that considers the input of the Performance, Finance and Audit Committee and senior management. Discuss the plan with the Performance, Finance and Audit Committee and senior management and submit the plan to the Performance, Finance and Audit Committee for review and approval. • Communicate the impact of resource limitations on the internal audit plan to the Performance, Finance and Audit Committee and senior management. • Review and adjust the internal audit plan, as necessary, in response to changes in North Lanarkshire IJB’s business, risks, operations, programs, systems, and controls. • Communicate with the Performance, Finance and Audit Committee and senior management if there are significant interim changes to the internal audit plan. • Ensure internal audit engagements are performed, documented, and communicated in accordance with the Global Internal Audit Standards and laws and/or regulations. • Follow up on engagement findings and confirm the implementation of recommendations or action plans and communicate the results of internal audit services to meetings of the Performance, Finance and Audit Committee and senior management and for each engagement as appropriate. • Ensure the internal audit function collectively possesses or obtains the knowledge, skills, and other competencies and qualifications
Page 14
Appendix 1 Page 14 of 18 needed to meet the requirements of the Global Internal Audit Standards and fulfill the internal audit mandate. • Identify and consider trends and emerging issues that could impact North Lanarkshire IJB and communicate to the Performance, Finance and Audit Committee and senior management as appropriate. • Consider emerging trends and successful practices in internal auditing. • Establish and ensure adherence to methodologies designed to guide the internal audit function. • Ensure adherence to North Lanarkshire IJB’s relevant policies and procedures unless such policies and procedures conflict with the internal audit charter or the Global Internal Audit Standards. Any such conflicts will be resolved or documented and communicated to the Performance, Finance and Audit Committee and senior management. • Obtain an understanding of the organisation and its activities, encourage two-way communications between internal audit and operational staff, discuss the audit approach and seek feedback on work undertaken. • Coordinate activities and consider relying upon the work of other internal and external providers of assurance and advisory services. If the CIAs cannot achieve an appropriate level of coordination, the issue must be communicated to senior management and if necessary escalated to the Performance, Finance and Audit Committee. 4.5 Communication with the Performance, Finance and Audit Committee and Senior Management The CIAs will report annually to the Performance, Finance and Audit Committee and senior management regarding: • The internal audit function’s mandate. • The internal audit plan and performance relative to its plan. • Significant revisions to the internal audit plan. • Potential impairments to independence, including relevant disclosures as applicable. • Results from the quality assurance and improvement program, which include the internal audit function’s conformance with the IIA’s Global Internal Audit Standards and action plans to address the internal audit function’s deficiencies and opportunities for improvement. • Significant risk exposures and control issues, including fraud risks, governance issues, and other areas of focus for the Performance, Finance and Audit Committee that could interfere with the achievement of North Lanarkshire IJB’s strategic objectives.
Page 15
Appendix 1 Page 15 of 18 • Results of assurance and advisory services. • Human resource requirements. • Management’s responses to risk that the internal audit function determines may be unacceptable or acceptance of a risk that is beyond North Lanarkshire IJB’s risk appetite. 4.6 Quality Assurance and Improvement Programme The CIAs will develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function. The program will include external and internal assessments of the internal audit function’s conformance with the Global Internal Audit Standards, as well as performance measurement to assess the internal audit function’s progress toward the achievement of its objectives and promotion of continuous improvement. The program also will assess, if applicable, compliance with laws and/or regulations relevant to internal auditing. Also, if applicable, the assessment will include plans to address the internal audit function’s deficiencies and opportunities for improvement. The CIAs will regularly communicate with the Performance, Finance and Audit Committee and senior management about the internal audit function’s quality assurance and improvement program, including the results of internal assessments (ongoing monitoring and periodic self-assessments) and external assessments. The North Lanarkshire Council and NHS Lanarkshire audit teams are subject to external assessment at least once every five years by a qualified, independent assessor or assessment team; qualifications must include at least one assessor holding a CCAB Institute, or equivalent or CMIIA qualification, and Public Sector competencies and knowledge. 5. Scope and Types of Internal Audit Services 5.1 The scope of internal audit services covers the entire breadth of the organisation as set out in the audit universe, including all North Lanarkshire IJB’s activities, assets, and personnel. The scope of internal audit activities also encompasses, but is not limited to, objective examinations of evidence to provide independent assurance and advisory services to the Performance, Finance and Audit Committee and management on the adequacy and effectiveness of governance, risk management, and control processes for North Lanarkshire IJB. 5.2 Annual Report The principal report to be produced by Internal Audit will be the Annual Audit Report for each audit year. This requires to be prepared in time for submission to the Performance, Finance and Audit Committee no later than the agreed target date, in order to provide the assurance required in considering the Board’s Annual Accounts.
Page 16
Appendix 1 Page 16 of 18 The Annual Audit Report should contain: • An opinion on whether: Based on the work undertaken, there were adequate and effective internal control, risk management and governance arrangements in place throughout the year. The Accountable Officer has implemented a governance framework in line with required guidance sufficient to discharge the responsibilities of this role. • analysis of any changes in control requirements during the year. • comment on the key elements of the control environment. • summary of Internal Audit performance. • progress in delivering the Quality Assurance Improvement Programme. 5.3 Risk Management Through specific, periodic audits, internal audit will review the risk management systems, associated controls, assurance processes and functions, and test the operation of controls. Appropriate communication with the risk management function will be maintained, including provision of all audit reports and regular meetings with risk managers. 5.4 Advisory Services Internal Audit may be called upon to provide advice on controls and related matters, subject to the need to maintain objectivity. Normally Internal Audit will have no executive role, nor will it have any responsibility for the development, implementation or operation of systems. The nature and scope of advisory services will be agreed and set out in an assignment plan. Opportunities for improving the efficiency of governance, risk management, and control processes may be identified during advisory engagements. These opportunities will be communicated to the appropriate level of management. Internal audit engagements may include evaluating whether: • Risks relating to the achievement of North Lanarkshire IJB’s corporate objectives are appropriately identified and managed. • The actions of North Lanarkshire IJB’s officers, directors, management, employees, and contractors or other relevant parties comply with North Lanarkshire IJB’s policies, procedures, and applicable laws, regulations, and governance standards. • The results of operations and programs are consistent with established goals and objectives.
Page 17
Appendix 1 Page 17 of 18 • Operations and programs are being carried out effectively, efficiently, ethically, and equitably. • Established processes and systems enable compliance with the policies, procedures, laws, and regulations that could significantly impact North Lanarkshire IJB. • The integrity of information and the means used to identify, measure, analyse, classify, and report such information is reliable. • Resources and assets are acquired economically, used efficiently and sustainably, and protected adequately. Advisory engagements may include: • Attendance at governance forums in an independent capacity • Provision of controls and assurance expertise • Review of draft strategic and corporate documentation • Input into Board and Senior Management team development events • Independent validation of self-assessments The Performance, Finance and Audit Committee is the final reporting line for all audit reports and where it is appropriate for a report to be shared with another Committee, this will be included in the audit final audit report.
Page 18
Appendix 1 Page 18 of 18 Approved by the Performance, Finance and Audit Committee at its meeting on [date]. Acknowledgments/Signatures _________________________________ _________________ CIAs Date _________________________________ _________________ Performance, Finance and Audit Committee Chair Date _________________________________ _________________ Chief Officer Date _________________________________ _________________ Chief Finance Officer Date