Appendix 1 - Internal Audit Mandate & Charter
Perth and Kinross Council · 29 June 2026
Back to Audit and Risk Committee — 29 June 2026 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
1 Appendix 1 Internal Audit Mandate & Charter 2026-27
Page 2
2 Contents: 1. Executive Summary…………………………………………………………3 2. Purpose of Internal Audit…………………………………………………..3 3. Internal Audit Mandate……………………………………………………...4 4. Definitions……………………………………………………………………..5 5. Independence, Organisational Position and Reporting Relationships…………………………………………………………………….5 6. IA Authority and Audit & Risk Committee Oversight………………….6 7. CAE Roles and Responsibilities…………………………………………..7 8. Management Responsibilities……………………………………………10 9. Scope and Types of Internal Audit Services ………………………….10 10. Topical Requirements……………………………………………………11 11. Annual Reporting and Overall Conclusion………………………..…11
Page 3
3 Internal Audit Mandate & Charter for Perth & Kinross Council 1. Executive Summary In line with section 7(1) of The Local Authority Accounts (Scotland) Regulations 2014, local authorities must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing. The Global Internal Audit Standards (GIAS) came into effect in January 2025 and guide the worldwide professional practice of internal auditing and serve as a basis for evaluating and elevating the quality of the Internal Audit function. The Application Note: GIAS in the UK Public Sector effective from 1 April 2025, provides a framework for the practice of IA in the UK Public Sector when taken together with the GIAS. The GIAS (UK Public Sector) (GIAS (UKPS) sets out interpretations and requirements which need to be applied to the GIAS, to form a suitable basis for IA practice in the UK Public Sector. In addition, CIPFA have released a new Code of Practice for the Governance of IA in Local Government to support compliance with the principles and standards in Domain III (Governing the IA Function) of the GIAS (UK Public Sector). Compliance with the Code must be included in the IA annual internal quality assessment with outcomes reported to committee from 2025/26 onwards and the external quality assessment, due every five years. Standard 6.2 in Domain III of the GIAS (Governing the IA Function) requires the Chief Audit Executive (CAE) to implement and maintain an Internal Audit Charter with sets out the purpose of Internal Audit, the Internal Audit mandate, organisational position, essential conditions, reporting relationships, scope of work, types of services, and other specifications in accordance with the GIAS. The Internal Audit Charter for Perth & Kinross Council sets out these requirements and is based on the Institute of Internal Auditor’s 2024 Model Charter. 2. Purpose of Internal Audit In line with the GIAS, the purpose of the Internal Audit (IA) function is to strengthen the Council’s ability to create, protect, and sustain value by providing the Audit & Risk Committee and management with independent, risk-based, and objective assurance, advice, insight, and foresight. The IA function enhances the Council’s: • successful achievement of its objectives • governance, risk management, and control processes • decision-making and oversight • reputation and credibility with its stakeholders • ability to serve the public interest. The Council’s IA function is most effective when: • internal auditing is performed by competent professionals in conformance with the GIAS (UK Public Sector), which are set in the public interest
Page 4
4 • the IA function is independently positioned with direct accountability to the Audit & Risk Committee • internal auditors are free from undue influence and committed to making objective assessments. IA assurance is provided by delivering an annual programme of audit work that independently and objectively assesses the design and effectiveness of the controls established to manage the Council’s most significant risks. The IA scope covers all Council activities. Commitment to Adhering to the Global Internal Audit Standards The Council’s internal audit function will adhere to the mandatory elements of The Institute of Internal Auditors' International Professional Practices Framework, which are the GIAS and Topical Requirements as well as the Application Note: Global Internal Audit Standards in the UK Public Sector. When expressing conformance with standards, the Council’s IA function will be clear that they are conforming with Global Internal Audit Standards in the UK Public Sector. The CAE will report annually to the Audit & Risk Committee and senior management regarding the internal audit function’s conformance with the Standards, which will be assessed through a quality assurance and improvement program. In addition to their primary role, the CAE will also: • support the Strategic Leadership Team in discharging their duties • advise on the internal control implications of system or process changes within the Council • assist management in their duties to prevent and detect fraud and corruption • aim to add value to the Council in all its undertakings. 3. Internal Audit Mandate In line with the GIAS, the Council’s IA function receives its mandate from the Audit & Risk Committee. The mandate sets out the authority, roles and responsibilities, and empowers the IA function to provide the Audit & Risk Committee and senior management with independent, risk- based, and objective assurance, advice, insight, and foresight. The IA function’s authority is created by its direct reporting relationship to the Audit & Risk Committee. Such authority allows for unrestricted access to the Audit & Risk Committee. The Audit & Risk Committee authorises the IA function to: • have full and unrestricted access to all functions, data, records, information, physical property, and personnel pertinent to carrying out IA audit responsibilities. Internal auditors are accountable for confidentiality and safeguarding records and information • allocate resources, set frequencies, select subjects, determine scopes of work, apply techniques, and issue communications to accomplish the function’s objectives
Page 5
5 • obtain assistance from the necessary personnel of the Council to complete internal audit services. 4. Definitions The Council has adopted the following definitions set out in the GIAS 2024 Glossary: Internal Audit An independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation establish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Assurance Services Services through which internal auditors perform objective assessments to provide assurance. The nature and scope of assurance services are determined by Internal Audit. Advisory Services Services through which internal auditors provide advice to an organisation’s stakeholders without providing assurance or taking on management responsibilities. The nature and scope of advisory services are subject to agreement with relevant stakeholders. Independence Freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit responsibilities in an unbiased manner. 5. Independence, Organisational Position, and Reporting Relationships The CAE will be positioned at a level in the organisation that enables internal audit services and responsibilities to be performed without interference from management, thereby establishing the independence of the internal audit function. (See “Mandate” section.) The CAE report functionally to the Audit & Risk Committee and administratively (for example, day-to-day operations) to the Strategic Lead, Legal & Governance. This positioning provides the organisational authority and status to bring matters directly to senior management and escalate matters to the Audit & Risk Committee, when necessary, without interference and supports the internal auditors’ ability to maintain objectivity. The CAE will confirm to the Audit & Risk Committee, at least annually, the organisational independence of the internal audit function. If the governance structure does not support organisational independence, the CAE will document the characteristics of the governance structure limiting independence and any safeguards employed to achieve the principle of independence. The CAE will disclose to the Audit & Risk Committee any interference internal auditors encounter related to the scope, performance, or communication of internal audit work and results. The disclosure will include communicating the implications of such interference on the internal audit function’s effectiveness and ability to fulfill its mandate. To ensure that IA independence and objectivity is maintained for assurance services, IA will remain free from interference from anyone within the Council in relation to audit selection, scope, procedures, frequency, timing, and report content.
Page 6
6 Where IA also has responsibility for non-audit activities, the GIAS require that appropriate arrangements are established to avoid conflicts of interest. Additionally, IA will not be permitted to audit any activities for which they have previously been responsible within a period of one year and will not engage in any other activity that may impair judgment or independence. For advisory services, the IA role will be specifically restricted to providing guidance, views, and opinions. To comply with independence requirements, IA will not be involved in any aspects of operational decisions subsequently taken by management. Changes to the Mandate and Charter Circumstances may justify a follow-up discussion between the CAE, the Audit & Risk Committee, and senior management on the internal audit mandate or other aspects of the internal audit charter. Such circumstances may include but are not limited to: • A significant change in the Global Internal Audit Standards. • A significant reorganisation within the organisation. • Significant changes in the CAE, Audit & Risk Committee, and/or senior management. • Significant changes to the organisation’s strategies, objectives, risk profile, or the environment in which the organisation operates. • New laws or regulations that may affect the nature and/or scope of internal audit services. 6. IA Authority and Audit & Risk Committee Oversight To establish, maintain, and ensure that the Council’s internal audit function has sufficient authority to fulfill its duties, the Audit & Risk Committee will: • Discuss with the CAE and senior management the appropriate authority, role, responsibilities, scope, and services (assurance and/or advisory) of the internal audit function. • Ensure the CAE has unrestricted access to and communicates and interacts directly with the Audit & Risk Committee, including in private meetings without senior management present. • Discuss with the CAE and senior management other topics that should be included in the internal audit charter. • Participate in discussions with the CAE and senior management about the “essential conditions,” described in the GIAS, which establish the foundation that enables an effective internal audit function. • Approve the internal audit function’s charter, which includes the internal audit mandate and the scope and types of internal audit services. • Review the internal audit charter annually with the CAE to consider changes affecting the organisation, such as the employment of a new CAE or changes in the type, severity, and interdependencies of risks to the organisation; and approve the internal audit charter annually. • Approve the risk-based internal audit plan.
Page 7
7 • Provide input to the internal audit function’s human resources. • Provide input to senior management on the appointment and removal of the CAE, ensuring adequate competencies and qualifications and conformance with the GIAS (UKPS). • Review and provide input to senior management on the CAE’s performance. • Receive communications from the CAE about the internal audit function including its performance relative to its plan. • Ensure a quality assurance and improvement program has been established and review the results annually. • Make appropriate inquiries of senior management and the CAE to determine whether scope or resource limitations are inappropriate. 7. CAE Roles and Responsibilities Ethics and Professionalism The CAE will ensure that internal auditors: • Conform with the Global Internal Audit Standards, including the principles of Ethics and Professionalism: integrity, objectivity, competency, due professional care, and confidentiality. • Understand, respect, meet, and contribute to the legitimate and ethical expectations of the organisation and be able to recognise conduct that is contrary to those expectations. • Encourage and promote an ethics-based culture in the organisation. •Report organisational behavior that is inconsistent with the organisation’s ethical expectations, as described in applicable policies and procedures. Objectivity The CAE will ensure that the internal audit function remains free from all conditions that threaten the ability of internal auditors to carry out their responsibilities in an unbiased manner, including matters of engagement selection, scope, procedures, frequency, timing, and communication. If the CAE determines that objectivity may be impaired in fact or appearance, the details of the impairment will be disclosed to appropriate parties. Internal auditors will maintain an unbiased mental attitude that allows them to perform engagements objectively such that they believe in their work product, do not compromise quality, and do not subordinate their judgment on audit matters to others, either in fact or appearance. Internal auditors will have no direct operational responsibility or authority over any of the activities they review. Accordingly, internal auditors will not implement internal controls, develop procedures, install systems, or engage in other activities that may impair their judgment, including: • Assessing specific operations for which they had responsibility within the previous year. • Performing operational duties for the Council or its affiliates.
Page 8
8 • Initiating or approving transactions external to the internal audit function. • Directing the activities of any Council employee that is not employed by the internal audit function, except to the extent that such employees have been appropriately assigned to internal audit teams or to assist internal auditors. Internal auditors will: • Disclose impairments of independence or objectivity, in fact or appearance, to appropriate parties and at least annually, such as the CAE, The Audit & Risk Committee, management, or others. • Exhibit professional objectivity in gathering, evaluating, and communicating information. • Make balanced assessments of all available and relevant facts and circumstances. • Take necessary precautions to avoid conflicts of interest, bias, and undue influence. Managing the Internal Audit Function The CAE has the responsibility to: • At least annually, develop a risk-based internal audit plan that considers the input of the Audit & Risk Committee and senior management. Discuss the plan with the Audit & Risk Committee and senior management and submit the plan to the Audit & Risk Committee for review and approval. • Communicate the impact of resource limitations on the internal audit plan to the Audit & Risk and senior management. • Review and adjust the internal audit plan, as necessary, in response to changes in the Council’s business, risks, operations, programs, systems, and controls. • Communicate with the Audit & Risk Committee and senior management if there are significant interim changes to the internal audit plan. • Ensure internal audit engagements are performed, documented, and communicated in accordance with the GIAS (UKPS). • Follow up on engagement findings and confirm the implementation of recommendations or action plans and communicate the results of internal audit services to the Audit & Risk Committee and senior management for each engagement as appropriate. • Ensure the internal audit function collectively possesses or obtains the knowledge, skills, and other competencies and qualifications needed to meet the requirements of the GIAS (UKPS) and fulfill the internal audit mandate. • Identify and consider trends and emerging issues that could impact the Council and communicate to the Audit & Risk Committee and senior management as appropriate. • Consider emerging trends and successful practices in internal auditing. • Establish and ensure adherence to methodologies designed to guide the internal audit function.
Page 9
9 • Ensure adherence to the Council’s relevant policies and procedures unless such policies and procedures conflict with the internal audit charter or the GIAS (UKPS). Any such conflicts will be resolved or documented and communicated to the Audit & Risk Committee and senior management. • Coordinate activities and consider relying upon the work of other internal and external providers of assurance and advisory services. If the CAE cannot achieve an appropriate level of coordination, the issue must be communicated to senior management and if necessary escalated to the Audit & Risk Committee. Communication with the Audit & Risk Committee and Senior Management The CAE will report to the Audit & Risk Committee and senior management regarding: • The internal audit function’s mandate. • The internal audit plan and performance relative to its plan. • Significant revisions to the internal audit plan and budget. • Potential impairments to independence, including relevant disclosures as applicable. • Results from the quality assurance and improvement program, which include the internal audit function’s conformance with GIAS (UKPS) and action plans to address the internal audit function’s deficiencies and opportunities for improvement. • Significant risk exposures and control issues, including fraud risks, governance issues, and other areas of focus for the Audit & Risk Committee that could interfere with the achievement of Council’s strategic objectives. • Outcomes from assurance and advisory services. • Resource requirements. • Management’s responses to risk that the internal audit function determines may be unacceptable or acceptance of a risk that is beyond the Council’s risk appetite. Quality Assurance and Improvement Program The CAE will develop, implement, and maintain a quality assurance and improvement program that covers all aspects of the internal audit function. The program will include external and internal assessments of the internal audit function’s conformance with the GIAS (UKPS), as well as performance measurement to assess the internal audit function’s progress toward the achievement of its objectives and promotion of continuous improvement. The program also will assess, if applicable, compliance with laws and/or regulations relevant to internal auditing. Also, if applicable, the assessment will include plans to address the internal audit function’s deficiencies and opportunities for improvement. Annually, the CAE will communicate with the Audit & Risk Committee and senior management about the internal audit function’s quality assurance and improvement program, including the results of internal assessments (ongoing monitoring and periodic self-assessments) and external assessments. External assessments will be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the Council.
Page 10
10 8. Management Responsibilities Management will cooperate with IA on audits and provide access to records, systems and personnel as required within a reasonable timeframe following the request. Assurance engagements will be subject to a written terms of reference (Audit Brief) and report. Advisory engagements will be agreed in writing (for example via email or written terms of reference) and a relevant output agreed (for example full report/summary findings, focused feedback or an action plan). Draft reports will be shared with management for agreement as to the factual accuracy of draft findings raised. Management are to consider appropriate actions to mitigate the risks arising from the control weaknesses identified. It is management’s responsibility to agree to either: • accept and fully implement actions at address the weaknesses identified or • accept the risk associated with not implementing improvements with supporting rationale. When a draft audit report is delivered, management are required to provide agreed management actions to all IA findings raised, including specifying responsibility and anticipated dates for the implementation of these actions. Management is also responsible for ensuring that agreed management actions are implemented and effectively sustained. The GIAS also require the CAE to report to both senior management and the Audit & Risk Committee, details of management’s response to risk that (based on the CAE’s judgement) may be unacceptable to the Council. Consequently, any IA findings where management has accepted the risk will be highlighted in IA reports. 9. Scope and Types of Internal Audit Services The scope of internal audit services covers the entire breadth of the organisation, including all of the Council’s activities, assets, and personnel. The scope of internal audit activities also encompasses but is not limited to objective examinations of evidence to provide independent assurance and advisory services to the Audit & Risk Committee and management on the adequacy and effectiveness of governance, risk management, and control processes for the Council. The nature and scope of advisory services may be agreed with the party requesting the service, provided the internal audit function does not assume management responsibility. Opportunities for improving the efficiency of governance, risk management, and control processes may be identified during advisory engagements. These opportunities will be communicated to the appropriate level of management. Internal audit engagements may include evaluating whether: Risks relating to the achievement of the Council’s strategic objectives are appropriately identified and managed.
Page 11
11 • The actions of the Council’s officers, management, employees, and contractors or other relevant parties comply with the Council’s policies, procedures, and applicable laws, regulations, and governance standards. • The results of operations and programs are consistent with established goals and objectives. • Operations and programs are being carried out effectively, efficiently, ethically, and equitably. • Established processes and systems enable compliance with the policies, procedures, laws, and regulations that could significantly impact the Council. • The integrity of information and the means used to identify, measure, analyse, classify, and report such information is reliable. • Resources and assets are acquired economically, used efficiently and sustainably, and protected adequately. 10. Topical Requirements Topical Requirements are a mandatory component of the International Professional Practices Framework and GlAS. Topical Requirements enhance the consistency and quality of Internal Audit services related to specific audit subjects. Each Topical Requirement supports internal auditors performing engagements in a specific risk area. All Internal Audit functions must apply the relevant Topical Requirement in conformance with the GlAS (UKPS) when providing assurance services on that topic. A checklist for assessing applicability of the Topical Requirements will be used by the Internal Audit team. Internal Audit Assignment Briefs will advise management where a Topical Requirement may apply, and further information will be obtained via scoping and fieldwork meetings. 11. Annual Reporting and Overall Conclusion In line with the GIAS (UK Public Sector) the CAE must, at least annually: • conclude on the overall adequacy and effectiveness of the Council’s framework of governance, risk management and control (annual conclusion) • include a statement on conformance with the GIAS (UKPS) and the results of the Quality Assurance Improvement Plan. The annual conclusion for the Council is based on the outcomes of the audits included in the IA work programme, progress with implementation of agreed management actions, the result of any other IA activities that have identified control gaps that are exposing the Council to risk, and the professional judgement of the CAE. The Council has adopted the standard CIPFA standard engagement definitions for all engagement conclusions and the overall annual audit conclusion..