Internal Audit Annual Report and Internal Audit Opinion 2025-26
Perth and Kinross Council · 29 June 2026
Back to Audit and Risk Committee — 29 June 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Our vision is a Perth and Kinross where everyone can live life well, free from poverty and inequality ___________________________________________________________________ Committee or Board: Audit & Risk Committee Date of Meeting: 29 June 2026 Report Title: Internal Audit Annual Report & Internal Audit Opinion 2025/26 Report Number: 26/197 Report Author: Jackie Clark, Chief Internal Auditor Organisational Lead: strategic Lead – Legal and Governance ___________________________________________________________________ 1. Purpose 1.1 The purpose of this Report is to present the year-end report and audit opinion of the Chief Internal Auditor for 2025/26, as set out in Section 11. 1.2 Sections 1. Purpose 2. Recommendations 3. Background/Context 4. Internal Control Framework 5. Internal Audit Planning 6. Internal Audit Outcomes 2025/26 7. Follow Up Arrangements 8. Audit & Risk Committee 9. Compliance with Internal Audit Standards 10. Counter-Fraud & Corruption Activity 11. Audit Opinion 2025/26 12. Impact Value Assessment 2. Recommendation It is recommended that the Committee: 2.1 notes the content of this report and specifically the conclusion of the Chief Internal Auditor, at Section 11, which states that reasonable reliance can be placed on the Council’s risk management and governance arrangements, and systems of internal control for 2025/26.
Page 2
3. Background/Context 3.1 The Global Internal Audit Standards in the UK Public Sector (GIAS (UKPS)) became effective from 1 April 2026 and are the professional standards for Internal Audit in the UK Public Sector. GIAS (UKPS) requires that the Chief Audit Executive must prepare an overall conclusion at least annually, which encompasses governance, risk management and control. This report fulfils that requirement. 3.2 Internal Audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. In accordance with the GIAS (UKPS), it helps the IJB accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control and governance processes. 4. Internal Control Framework 4.1 Perth & Kinross Council’s internal controls include the full range of policies, procedures and practices intended to ensure the proper conduct of its operations and the achievement of its objectives. They include processes and procedures, organisational structures, job descriptions, authorisation limits, management supervision, risk management processes, reports and decisions. 4.2 It is the responsibility of management to devise, implement and maintain appropriate controls over the activities for which they are responsible. The role of Internal Audit is to provide an opinion to the Council as to the effectiveness of the controls that have been put in place by management in order to ensure that the organisation achieves its objectives. Internal Audit is thus a key part of the process by which the Council ensures the management of the risks that threaten the achievement of its objectives. 4.3 Internal Audit’s work is planned in such a way as to take account of these risks. Prioritising work towards the areas of highest assessed risk enables the Council to identify and remedy the most material weaknesses in its framework of internal controls. 5. Internal Audit Planning 5.1 In line with the GIAS (UKPS), Internal Audit undertakes a process of planning resulting in an annual plan. This plan was presented partly in themes, with many themes cutting across Services. This approach targeted the key risks identified as part of the Council’s Risk Management processes. In this respect, the Internal Audit Plan for 2025/26 was able to closely align with the Council’s risk management arrangements. 5.2 For 2025/26, the report containing Internal Audit’s Strategy & Plan was considered and approved in June 2025 (report 25/169). All Perth & Kinross Council’s activities are reviewed as part of the planning process.
Page 3
The plan for 25/26 aimed to cover the most significant areas of risk within the anticipated resources available whilst ensuring that there was a balance of coverage for all Service areas during the year. 5.3 In order to comply with GIAS (UKPS), there was a need identified for further assessment by Internal Audit of the assurances provided by internal and external sources, and the degree that reliance can be placed on these activities. This formed part of the Internal Audit Plan for 2025/26. 6. Internal Audit Outcome 2025/26 6.1 Of the 12 planned Internal Audit assignments for 2025/26, one was removed from the Internal Audit Plan to ensure audit effort was not duplicated with our External Audit colleagues, two are being carried forward into 2026/27, with the remaining assignments being complete or substantially complete and the outcomes have been taken into consideration in arriving at the conclusion. 6.2 Of those reports provided to Audit & Risk Committee within the year 2025/26, Internal Audit was able to provide substantial assurance for one area over the risk management, governance and internal controls in their areas, reasonable assurance for 3 areas and limited assurance for 4 areas. 6.3 Of the 113 individual actions included within reports considered by the Audit & Risk Committee in 2025/26, 30 were rated of critical importance to the business area, 25 were rated as of high-importance, 41 as medium- importance, 10 as low-importance, with a further 7 identified as minor actions for completion. Of the 30 critical actions, 24 were completed by the service prior to the report being finalised. 7. Follow Up Arrangements 7.1 The responsibility for considering (and accepting or rejecting) Internal Audit’s findings rests with management. Final audit reports record the agreed plan of action, including the individual(s) responsible; the planned timescales for completion; and the evidence required by Internal Audit to verify completion of the action. The audit process is of little value unless action is taken to remedy deficiencies in internal control where these are identified. Hence, a significant part of Internal Audit’s role is the following-up of progress with these action plans in line with the requirements of the Public Sector Internal Audit Standards. 7.2 A database for recording agreed actions is maintained for this purpose. Services are routinely requested to provide the agreed evidence of completion for actions which are due to have been completed. Where actions have not been completed, an update on progress is requested along with the reason for non-completion and a revised date for completion. The Audit & Risk Committee is informed of all actions which have not been completed, along with an Internal Audit opinion on the acceptability or otherwise of the response received from management.
Page 4
7.3 The support of the Chief Executive, Depute Chief Executive and the Strategic Leadership Team in ensuring that agreed actions are completed continued during the year. 7.4 In the Chief Internal Auditor’s opinion, the procedures in place provide a sound basis for ensuring that progress against the agreed plans is exposed to the proper level of scrutiny. 8. The Audit & Risk Committee 8.1 The Audit & Risk Committee operates within an approved ‘Role and Remit’ and as a formally constituted Committee of the Council. The Committee has conducted its meetings as hybrid, with all meetings routinely recorded and available to view via a link from the Committee’s webpage, thus ensuring a high degree of accountability for its activities. 9. Compliance with Internal Audit Standards 9.1 The GIAS (UKPS) have been adopted by Perth & Kinross Council as the relevant professional standards for 2025/26. 9.2 The GIAS (UKPS) came into effect in April 2025. Preparations, in terms of reporting their requirements to the Audit & Risk Committee and the Strategic Leadership of the Council, were undertaken before and during the year, with development sessions being help within the Internal Audit team. 9.3 There is a requirement under these Standards for an external review of compliance (External Quality Assessment – EQA) to be undertaken every 5 years. The EQA for Parth & Kinross Council was undertaken as a validated self assessment in 2024/25 (report 25/60), therefore the next EQA will be required in 2029/30. This report verified that Perth & Kinross Council’s Internal Audit function fully conformed with the Public Sector Internal Audit Standards (PSIAS), which were the relevant standards at that time. 9.4 The GIAS (UKPS) requires that internal auditors must be independent, namely free from conditions that threaten the ability to carry out their responsibilities in an unbiased manner. The Chief Internal Auditor has additional duties within Legal & Governance, specifically functional responsibility for Information Governance, which may be perceived to compromise this organisational independence. In order to manage these risks, any internal audit activity in these areas are undertaken by, and reported in the name of, the Senior Internal Auditor. 9.5 The Chief Internal Auditor has undertaken a self-assessment of compliance with the GIAS (UKPS) for 2025/26 and has concluded that the function generally conforms, with some areas identified for further development in terms of evidencing conformance. A Quality Assurance & Improvement programme is being developed arising from this and reflects the transition between PSIAS and GIAS (UKPS).
Page 5
9.6 A quality assurance system was in place in Internal Audit throughout 2025/26 which ensured the quality of Internal Audit work was of a consistent and professional standard. 9.7 Internal Auditors must conform to the Code of Ethics included within the Standards. This Code incorporates the principles and rules of conduct for Internal Auditors’ integrity, objectivity, confidentiality and competency. 10. Counter-Fraud & Corruption Activity 10.1 The responsibility for preventing and detecting fraud and corruption rests with management; it is the responsibility of management to take into account the risks arising from fraud and corruption and to devise and maintain the appropriate internal controls to provide a reasonable level of assurance that the Council’s resources are being protected from loss and misappropriation. 10.2 Nevertheless, Internal Audit has a number of responsibilities regarding the Council’s anti-fraud and anti-corruption arrangements, including whistleblowing. The year 2025/26 saw an steady level of audit activity in this area as described below compared with previous years. 10.3 The National Fraud Initiative (NFI) is a large-scale ‘data-matching’ exercise that takes place every two years and takes place over two financial years. Perth & Kinross Council has participated in the 2024/25 exercise. The NFI involves the comparison of personal data held by public authorities in order to identify anomalies that may indicate fraud or error. This output then forms the basis for a process of investigation within each authority, to ensure that errors are recognised and corrected and that, where cases of possible fraud are identified, they are pursued appropriately. 10.4 This investigative process, which is driven by Audit Scotland, is co-ordinated by Internal Audit and includes overseeing Services’ arrangements for uploading the data securely and the checking of a sample of identified anomalies within the period of the exercise, on the basis of an assessment of risk. Internal Audit facilitates the reporting of progress to our External Auditors, Audit Scotland. 10.5 In order to ensure that the Council meets the standards set out in its counter- fraud and corruption arrangements, some aspects of the Council’s ‘whistle- blowing’ arrangements are managed by Internal Audit. This includes the maintenance of a dedicated e-mail address and telephone line for employees with concerns at work, which is routed to Internal Audit. The Council also supports the national charity Protect that upholds the rights of those who raise concerns about wrongdoing at their place of work and which operates a free legal advice ‘hotline’. Whistleblowing arrangements have been in place throughout 2025/26 and are supported by a Whistle-blowing Policy, which is included within the Counter- Fraud and Corruption Strategy.
Page 6
10.6 Where control risks are highlighted as a result of these disclosures, these will be reported to the Audit & Risk Committee. Where no control issues are identified, detailed reports are not provided. The outcomes from all whistleblowing disclosures feed into the planning exercise for the future Internal Audit Plans. 10.7 The Chief Internal Auditor is the Council’s nominated Money Laundering Reporting Officer. There has been no activity in this area during the year. 11. Audit Opinion 2025/26 11.1 The Chief Internal Auditor concludes that reasonable reliance can be placed on the Council’s risk management and governance arrangements, and systems of internal control for 2025/26, subject to management implementation of the agreed actions detailed in Internal Audit reports. 12. Impact and Value Assessment 12.1 This report has been classified as being an operational report and as such does not require a full Impact and Value Assessment. 13. Appendices 13.1 Not applicable.